Ubiquiti Guest VLAN routing to Meraki MX100 Guest VLAN

[CamS]

Hi Everyone,

I'm new to the board and searched for this question but didn't find anything. If this has been addressed already, please redirect me and forgive my repetition. 

A client recently built a large manufacturing and shipping plant next to their sales building. This group comprises two distinct companies that remain separated both as entities and on the network. We have connected the two buildings with 12-strand fibre, creating separate connections between the pertinent networks. 

This is where explaining gets a bit complicated. The network is configured on the Meraki MX100 Firewall to route all internet traffic through a port configured for their subnet. For example, their sub is 192.168.3.0/24, and the switches associated with this sub connect to Port 5 on the MX100. All of this works great. 

We then added the new plant to the network, and all the wired connections worked great. Once we got the wired connections online, we began rolling out the Ubiquiti APs. We configured the Private WIFI network on the default Ubiquiti VLAN1 to access the Private Meraki VLAN3, and because these two networks are physically connected, everything worked great. 

The problem arises when I try to set up a Guest WIFI network. We currently have a Guest VLAN on the MX100 using VLAN50. It is connected to a switch provided by the client's Internet Provider, which is then attached to 3 Meraki APs. These APs can handle private and guest WIFI networks just fine. However, when I attempt to create a Guest WIFI network using the Ubiquiti APs, I cannot get an IP address for the joining devices. I have made a guest network using VLAN50 and a distinct Guest WIFI network using VLAN31 on both the Ubiquiti controller and the MX Controller, but neither option works. 

I am guessing that Port 5, the physical port the switches and APs connect to on the MX, isn't handling Ubiquiti VLAN50 or VLAN31 requests to the appropriate MX VLAN for some reason. I'm at a loss as to how to make the two see one another. If someone has any ideas, I could use some advice to sort this out. Thanks. 

[alemabrahao]

Can you provide a simple topology?

This seems to be a configuration problem regarding VLAN tagging.

Do you know if the switch port where the APs are located is configured in trunk mode or access mode?

The same question applies to the MX port, is it in trunk or access mode?

Please provide a topology that would be very helpful to understand the scenario better.

[CamS]

Hi Alemabrahao,

I apologize for the delay in answering you. I am going to draw up a topology map for you and IvanJukic to help make sense of the confusion in my explanation. Thank you very much for stepping in to help though! I look forward to hearing what you have to say. 

[IvanJukic]

Hi @CamS 

Welcome to the Community.

Without a diagram showing the VLANs, DHCP etc. This is how I understand the situation.

Problem Statement:

"when I attempt to create a Guest WIFI network using the Ubiquiti APs, I cannot get an IP address for the joining devices"

"...Private WIFI network on the default Ubiquiti VLAN 1 to access the Private Meraki VLAN 3, and because these two networks are physically connected, everything worked great."

I'm working with the assumption that wireless clients on VLAN 1 can communicate with clients on VLAN 3. DHCP, DNS Etc works.

"The problem arises when I try to set up a Guest WIFI network... Guest VLAN on the MX100 using VLAN50...

However, when I attempt to create a Guest WIFI network using the Ubiquiti APs, I cannot get an IP address for the joining devices. I have made a guest network using VLAN50 and a distinct Guest WIFI network using VLAN31 on both the Ubiquiti controller and the MX Controller, but neither option works."

This is where I'm a little confused. If the MX is using VLAN 50 for the Guest Wifi, what is the need for VLAN 31 on the MX?

I would suggest making the configuration for the "Guest WIFI" a mirror of the "Private Network" on the MX and Ubiquiti APs. Only change the VLAN IDs. As long as all the ports connected from the APs, through the switch to MX have those VLAN IDs. You should be good.

Of course, please correct me if needed.

[CamS]

Hi Ivan,

Like with Alemabrahao, thank you for stepping up and opening yourself to helping me. I will get you the topology map you asked for as soon as I get a chance, and I will also answer your questions to the best of my abilities ASAP. I have been in the field all day and am just catching up, but will try to put something together over the next couple of days. Thanks again!