Guide: How to run UniFi Controller on the Firewalla Gold or Purple

Follow

Comments

51 comments

  • Avatar
    Michael Bierman

    @Chris, I am not sure how you have configured your guest network. If it is a different VLAN then you can make a rule on Firewalla preventing the guest VLAN from reaching the LAN. 

     

    0
    Comment actions Permalink
  • Avatar
    Blake

    Ran into an issue that I think is related to the controller setup and the googles has let me down.

    I created a separate network from my LAN for my WFH computers. When I try to assign the “Work” port profile to the switch uplink in my office the switch disconnects from the controller. I suspect that the controller can’t reach it on that network? Any ideas?

    0
    Comment actions Permalink
  • Avatar
    Blake

    So if I wanted to change my controller to a different subnet for the purposes of using a management vlan different than my main lan, would it be faster to just start from scratch or should I update my Config with the new subnet?
    Specifically I set this up on 192.168.30.1 and now would like to move my controller over to 192.168.20.1 so I can have my Unifi gear on a different network than my main lan.

    1
    Comment actions Permalink
  • Avatar
    Michael Bierman

    Thanks for asking this @Blake. I was thinking about moving the management to another vlan but hadn’t taken the time to sort out the steps involved.

    0
    Comment actions Permalink
  • Avatar
    Blake

    So here is what I was thinking (and apparently this isn't an easy thing to do based on my research).  I want to create a separate network for my Unifi network equipment.  This involves 2 switchs, the controller and the APs when I get them.  Currently my controller is in docker and it has an IP of 172.16.1.2.  I can also access it from 192.168.30.1, but I'm not sure why.  I've created a MGMT VLAN in the FWG (192.168.20.1/24).  I also made this a corporate network in the controller.

    I first set the Management Network on the Flex Mini switch to MGMT VLAN and it disconnected from the controller.  After fiddling a bit I discovered and checked the box in the controller settings for "make controller discoverable on L2 network" and after a few minutes the switch changed from Disconnected to Adding.  It was stuck in Adding for a while and then surprisingly it finished provisioning and showed as connected in the controller.  It has an IP address in my MGMT VLAN, and the connected devices still have IPs in their correct subnets.  Sometime this weekend I'm going to attempt to move my main switch over as well.  But I still don't know how to move my controller to that network yet.  I also would love to know why I can access my controller from both the 172 and the 192 networks.

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    If anyone is interested, I wrote a script that I run on my firewalla (via cron) to turn on/off the LEDs of my Unifi APs every day. (One of the APs is in a bedroom.) 

     
    0
    Comment actions Permalink
  • Avatar
    Josh Hunsaker

    During step 1, when I try 

    sudo systemctl start docker-compose@unifi

    I get the following error:

    Error response from daemon: No such container: docker-compose@unifi
    Error: failed to start containers: docker-compose@unifi

    I have the file created, but it almost seems like Docker is not installed. Is it not installed on the Gold out of the box? I created the directories and saved the .yaml file, but I am wondering if I needed to install docker before starting this. Any help is appreciated, I'm pretty new to this.

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    To see if Docker is installed , you can check

    which docker 

    or see what containers are running!

    sudo docker ps

    You could also have a look at https://github.com/oznu/docker-homebridge/wiki/Running-Homebridge-on-Firewalla-Gold although it is for a different Docker container.

    0
    Comment actions Permalink
  • Avatar
    Josh Hunsaker

    Thank you for your help on this, I got through step 3 and everything appears to be working correctly, but when I try to access the controller through a browser I can't reach anything. So, a couple of questions here:

    1. I set up a Lan network on port 1 of the Firewalla Gold specifically for this, at the beginning of the guide when it says "a static IP for your unifi controller instance, we use 172.16.1.2 in this tutorial" are you doing anything other than the steps in this guide to assign that static ip to the controller? I just selected an ip in that range to use in the instructions, is there anything else I should have done there?
    2. In my app, the network I created for this is 192.168.215.1/24, in step 2 I get an error when I use that number, but the error goes away when I swap it with 192.168.215.0/24. Could that be preventing me from accessing the controller?
    0
    Comment actions Permalink
  • Avatar
    Abbas Jaffar Ali

    Step 2 says to Create the following file

    /home/pi/.firewalla/run/docker/unifi/docker-compose.yaml

    If I try to type "nano /home/pi/.firewalla/run/docker/unifi/docker-compose.yaml" and then pste the contents in it, then when I try to save, it says the file doesnt exists.

    If I manually mkdir the unif folder in /home/pi/.firewalla/run/docker/ and then try to "nano docker-compose.yaml" , I get a permissions dnied error

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    @Abbas, if you are using nano you have to use the, “write out” command before exiting. 

    0
    Comment actions Permalink
  • Avatar
    StackIOI

    The controller runs fine but I see my devices as disconnected, do you have to set the controller ip under Settings > Controller > Controller Settings or leave it blank? and tick the "Override inform host with controller hostname/IP" box? 

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    @StackIOI do not tick the, "Override inform host" 

    The IP for Controller Hostname/IP will be the Firewalla.

    If you have never adopted the devices before you may need to the device where the controller is. 

    https://community.ui.com/questions/What-is-correct-command-to-set-inform-url-and-also-to-factory-reset-via-SSH/9d219587-76d5-4c8e-bc81-63a70a8bb212

    0
    Comment actions Permalink
  • Avatar
    StackIOI

    Thanks @Michael Bierman, for some reason it seems that the devices are not finding the controller... I double checked my UniFi dnsmasq_local entry and is correct, also reconfigured the controller from scratch, as the previous time I restored the configuration from a backup of the working controller (running in my computer) into this new one... Which is why I saw the devices as disconnected... now, with the new controller running (the one in my computer is off) I can't see any of the devices, so obviously, I can't adopt them into this new controller.

    Did reboot them manually hoping for a refresh, but still can't reach them. Any suggestions? I can reach them from the FWG, I can ping them just fine.

    0
    Comment actions Permalink
  • Avatar
    Blake

    Have you tried resetting them to factory?

    1
    Comment actions Permalink
  • Avatar
    StackIOI

    @Blake.. no, I have not.. Edit: I just did.. thought the issue laid else where... but that did it. Thanks for the help!

    1
    Comment actions Permalink
  • Avatar
    Blake

    Yep. I’ve had to factory my switches several times as they often can’t adopt once I’ve monkeyed with the controller. Glad that worked!

    0
    Comment actions Permalink
  • Avatar
    Ed

    Hello, excuse my ignorance and if this is more of a unifi question.

    Basically I have recently been given 2 unifi uap-ac-pro access points. I have connected those via a POE switch on the gold, and they connected fine. I initially installed the unifi controller on my local device to be able to configure the APs, they connected to the network fine, and have been allocated IPs by the FWG. I have connected a device to the AP's given  SSID and generated network traffic by going on youtube, etc, however when I connect to the controller page on my laptop, it does not show any traffic or any clients connected to either APs and they both show as Offiline?!?

    , nor does it show any traffic going through the APs in the FWG.

    My question are, is this standard behaviour from the way I have set it up? what is the unifi controller used for then? am I ok to carry on using as they are now they are connected? without running the controller on the FWG, or will the uap-ac-pros loose their config if the power goes out on either the fwg or the lot? and I will have no wireless connectivity in the future (post black out for instance) because of the lack of the unifi controller running on the FWG?

    Besides the above, is there anything else beneficial from running the controller on the FWG, any great functionalities I am missing out on?

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    Hi @Ed,

    I can share my experience with roughly the same setup. 

    I currently have the Unifi Controller running on a NAS instead of the Firewalla.

    1. It should not matter if you run the Controller on Firewalla, a NAS, or an RPI, in terms of the issues you have raised. There is no functionality you are missing either way. Some people just prefer to run the Controller on Firewalla. One less device to manage, etc. 
    2. If properly configured, you should see devices both on Firewalla and in the Unifi Controller. 

    If you aren't seeing devices on the Unifi side, here are a few things to check: 

    1. Go to Unifi Controller Settings > Networks > Choose the network and make sure Enable IGMP snooping is active. 
    2. Make sure that Firewalla is doing DHCP and that Unifi is not doing DHCP. 
    3. While you can get Wi-Fi without the Controller running, the Controller should always be running. It isn't meant to be just to configure and turn off. 

    Off the top of my head this should get things working unless I'm forgetting something. You didn't mention your network topology, but if you have VLANs set up (or a management VLAN for the APs things get a little more complicated. If the suggestions above don't resolve things, post back and we'll take it from there.

    0
    Comment actions Permalink
  • Avatar
    Ed

    Thanks Michael, I will have a go when I get back. In the meanwhile, are you able to elaborate the reasons why the controller should always be running? Can't the UAP-AC-PRO access points just be running as access points attached to the switch/lan under the FWG? Thanks

    0
    Comment actions Permalink
  • Avatar
    Michael Bierman

    Hi @Ed, 

    sorry for the delay. from Ubiquiti

    Does the UniFi Network application have to run at all times?

    Since UniFi devices retain their settings, internet connectivity will work even if the UniFi OS Console is offline.

    However, the features running directly on the UniFi OS Console will be lost. This includes statistics, reporting, manually applied user groups and the guest hotspot. If you did not set up a WPA security protocol under the guest hotspot's Advanced > Security, then if the Network application is down, users will be able to connect to that WiFi network without being prompted for a password.

    0
    Comment actions Permalink

Please sign in to leave a comment.