6248 Switch Unifi AP Guest VLAN WLAN not getting DHCP

Not from the VLANS to the WAN or the LAN

Is the AP the only direct connected device with the VLANs or are there other devices on those VLANs that don't work either?

So I managed to get the AP and WLAN-VLAN working and giving out DHCP and Internet Access etc.

On port g2 which is attached to the internal NIC of the Firewall/DHCP/Router and provides multiple VLAN network ranges.

I tried an awful lot of different permutations, got it working and removed extraneous settings.

This is what did it:

interface ethernet 1/g2
mode dvlan-tunnel

Full config for completeness:

configure
vlan database
vlan 50,51
vlan routing 50 1
vlan routing 51 2
exit
ip address dhcp
ip http server
ip routing
!
interface vlan 50
name "Guest-WLAN-VLAN"
routing
ip address 10.0.0.2 255.255.255.0
exit
!
interface vlan 51
name "IoT-WLAN-VLAN"
routing
ip address 10.0.1.2 255.255.255.0
exit
!
interface ethernet 1/g2
mode dvlan-tunnel
exit
exit

So that's great, however I'm unable to assign a port on the switch to either VLAN and get DHCP or internet, I've literally tried every permutation I've been able to find. Trunk/General/Access VLAN tagged/untagged pvid etc etc.. 

The settings from the old Unifi Switch seem to include ip dhcp snooping which I've also tried to no avail:

ip dhcp snooping
ip dhcp snooping vlan 1,50,51

On the port assigned to VLAN 50 (unifi):

interface 0/3
description 'Port 3'
vlan pvid 50
vlan ingressfilter
vlan participation exclude 1,51
vlan participation include 50
port-security max-dynamic 0
lldp transmit
lldp receive
lldp transmit-tlv port-desc
lldp transmit-tlv sys-name
lldp transmit-tlv sys-desc
lldp transmit-tlv sys-cap
lldp med
exit

But I can't seem to translate that into a working version on the Dell switch.

OK so after playing a bit more I've discovered that for the Unifi AP Mesh to pick up the VLAN configuration over the switch from the opnsense router/firewall all you need is this in your config:

configure
vlan routing 1 1
exit
!
interface ethernet 1/g1
mode dvlan-tunnel
exit

Assuming port 1 on the switch is connected to your opensense internal NIC.

Could anyone please help me configure physical ports to pick up the VLAN DHCP from port 1 which will be pushing out 2 VLAN IP ranges so that they can be segregated with internet access.

One callout - what firmware revision is your switch on? I ask because there was a DHCP bugfix pertaining to VLANs on 3.3.14.2 that might be worth looking into.

Thanks Dylan

!System Description "PowerConnect 6248, 3.3.18.1, VxWorks 6.5"
!System Software Version 3.3.18.1

Just been continuing looking at things not yet touched on in the thread - it looks like OpenSense needs to see all of the VLANs. Adding the VLANs to port g8 should help with that (make sure to verify in the firewall). You might also take port g1, put it in general mode, untag VLAN 1, and tag the other VLANs.

I think I confused things a bit by moving the router/firewall to port g1 just as it’s a bit easier logically.

The AP’s are on g4,g5,g6,g7 but all work with the very minimal config setup I posted in the latter part of the thread. This includes getting DHCP for their specific VLANS from the router which is fantastic.

I’m now segregating the physical ports into the VLANS but with no success at getting DHCP from port g1.

The opnsense router has all the VLAN configuration on and the required IP ranges.

is the port to opnsense a trunk or general port still?

It's access, I reset everything to default except for what is in the config:

I literally just need to set up VLAN up like the following:

g13-g24 VLAN 100 Isolated except to g1 for outbound Internet and inbound DHCP

g25-g36 VLAN 200 Isolated except to g1 for outbound Internet and inbound DHCP

If it is an access port it is only going to pass the default vlan traffic, most of the ports only need access port to vlan 100 or 200, but the AP might need access to all of them.