Ubiquiti USG Pro 4 & Firewalla Gold

Comments

5 comments

  • Avatar
    Firewalla

    Your devices are hidden by the USG, it is likely running NAT. Not sure if you can, but changing the USG into bridge mode will expose all the devices.

    0
    Comment actions Permalink
  • Avatar
    Gary Ownsby

    Thank you for your reply.

    I did some research on that before posting.  As far as I know, USGs don't have a bridge mode.  I think I remember a "workaround" but I don't recall the details.

    Gary

    0
    Comment actions Permalink
  • Avatar
    David Vaughan

    If you convert the USG to bridge mode or equivalent, you will have to re-do all of your IP assignments which you said you preferred not to do. You could also try restoring the USG to its formerly pre-eminent position of WAN connection then attaching your FWG to one of its LAN ports in Simple mode. If it works with the USG, then you will now see everything. There may be a speed hit which I cannot quantify for you. The FWG, no longer being the primary router, will lose some of its other features like LAN segmentation. Were you intending to use that? There are other (fast) Firewalla solutions, depending on your needs (and $). I suggest one of the above two first.

    0
    Comment actions Permalink
  • Avatar
    Gary Ownsby

    Thank you for your reply and suggestions.

    I tried using the FWG in various configurations while still maintaining the Pro 4 in its current position as the main entry point from the ISP but nothing worked as well as I had hoped.  In the end, I removed the USG Pro 4 from the network and placed the FWG as the main router/entry point from the ISP.  That worked with some minor adjustments.

    Here are adjustments I made to permit the FWG to match my existing network:

    • I changed the FWG's IP assignment range/subnet mask to match what the USG Pro 4 had been using (10.x.x.x) so that all devices on the network (static or DHCP-issued) would remain within that range.  That worked.

      I would also note that out-of-box, the FWG does not default to the 10.x.x.x range, so with the USG Pro 4 removed, any non-fixed IP address device initially were assigned a 192.x.x.x (or similar) IP address.  So when I changed the IP range on the FWG, I also changed the "lease time" from 24 hours to 1 hour so that those 192.x.x.x addressed would convert to the new 10.x.x.x addresses that I needed quickly.  That worked.  Now that those devices have changed to the 10.x.x.x range, I will readjust the IP lease time to 24 hours.

    • Since the IP range is matching, the Ubiquiti Cloud Key (CK) still is on-line and is accessible via the normal Ubiquiti remote access procedure.  Having the CK functional is very important as it is the main method of managing a Ubiquiti Network.

    • Since the Ubiquiti CK is still available, I reviewed the port forwardings that were previously place and adjusted the FWG (using the FWG app) to "match".  Port forwards on the FWG must still "match" those in place on the Ubiquiti CK though you can take a "generic" approach such as forwarding Port 80 to the Ubiquiti CK then let it route to the specific device based on previously defined forwarding in the CK.

      I have several servers on my network...one of which is a family-only WordPress website along with several Amateur Radio (ham radio) related servers so forwarding rules needed to remain intact.

    • I also reviewed the CK's list of fixed IP devices and used the FWG app to set those same IPs as "reserved".  That also worked.

    Once the IP range of the FWG matched that of the previously-assigned/used IPs by the Pro 4, the FWG began identifying every item on the network as it should.  Over the next couple of hours as various devices performed their functions, the FWG notified me of what they were doing.

    At the moment, 108 devices show up on our network.  So for now, all is well and the FWG is doing the things it should be doing.

    All in all, the transition was not as bad as some I have encountered and I'm very pleased with the results.

    Gary

    1
    Comment actions Permalink
  • Avatar
    David Vaughan

    Gary, thank you for coming back with your solution with details. It is informative.

    David

    0
    Comment actions Permalink

Please sign in to leave a comment.