DHCP Not working on Unifi Switch for MGMT VLAN

[meyergru]

AFAIK, you cannot set a tagged VLAN 1 at all with Unifi, I did not investigate if VLAN 1 would be passed on a trunk port, but guessing from what I see, this ain't possible, either:

You cannot view this attachment.

Note the "VLAN 1" default - I doubt that you can set both untagged and tagged VLAN 1 - although some of the more recent problems with Unifi switch firmware might indicate otherwise. At least you have to set a default (V)LAN that is untagged - and also, you cannot delete the default (1) VLAN (I just renamed it from "Default" to "Untagged" to make clear what it does.

Reportedly, there are many Unifi switch models that now expose a (security) flaw: During the first seconds after turning them on, they pass traffic on all VLANs at once, that is, it seems like they strip incoming VLAN tags on all ports and pass these on as untagged on all others.

This could indicate, that they aim to be able to adopt new devices on any VLAN... but this should never be done on an otherwise configured switch.

[Patrick M. Hausen]

OK, whatever 🤷�♂️

Thanks! At work I connected a dedicated interface to VLAN 1. And at home I run Mikrotik 😉

[OPNenthu]

It sounds like you both prefer VLAN 1 for management in UniFi, so I think I'll stick with the same since it just works and gives the possibility to recover easily.

@meyergru Are you able to expand the list marked "Native VLAN / Network"?  On mine there is a possibility to select "None" there (it's at the bottom).

Once that is done, I am able to select "Default (1)" to be tagged under "Tagged VLAN Management" using the "Custom" radio button.


@Patrick I am torn on whether or not to keep a native/untagged network in OPNsense at all, as a fallback.  Presently I have LAN dedicated for this purpose on igc0, so I can just put any unmanaged switch there and get access to the 192.168.1.0/24 (example) network regardless of my UniFi network being online or not.  If I instead remove this native network and carry VLAN 1 tagged on the trunk as before, what will happen in case I connect an unmanaged switch to that?  Will VLAN 1 act as native on the "dumb" switch and still give me access to 192.168.1.0/24 and the other tags will be dropped?

EDIT: asking also a different way: is the reason why you tag VLAN 1 in order to save an interface/port or is it because untagged presents a security risk?

[Patrick M. Hausen]

The reason is that mixing tagged and untagged on a single interface can lead to unpredictable results in FreeBSD like e.g. DHCP leaking. Then there's the issue of accounting. And netflow.