Unifi equipment testing with 3rd party gateways and Firewalls

Networking & Firewalls
1

Hi Tom & Lawrence System team,

I am new to this forum and appreciate you guys for providing me access to post and conversate here. I would also like to note I have been following your youtube channel for several years now. As a fellow IT person I really appreciate your efforts and time you guys take with posting your knowledge and experience up for others to learn from. It has been a great resource for a lot of the topics you speak on. I can personally attest to the countless hours I have saved from my own testing on my end. By just watching your videos. This is very much appreciated and thanks again for that.

So what has finally pushed me to request access to post here after so long. Is a situation I have been tracking for a couple months now. On the unifi forums along with the unifi support channel that I have engaged in. Have been fully exhausted currently on the subject from my end. I have figured since you guys seem to be heavily invested in pfsense and unifi stuff. This might have some interest for you as well. I guess I would like to possibly get input on how you guys may manage this issue or work around it. Cons and pluses per say. The link below is what was asked on the community forums of unifi and provide a background. I then attempted to open a ticket with support and have worked through that route. It ended where they would consider it a possible feature I think passing to the dev team in the future ( I have to look back at that dialogue again for accuracy), but only provided working solutions outside the scope of the original subject. Again, I would like to see if I can get some input from Tom or Lawrence team on this if possible. Because I do believe it has some importance for unifi equipment users and possible security issue implications as well.

https://community.ui.com/questions/Device-Isolation-MAC-ACL-Support-for-3rd-party-gateway-VLANs/fa77ac0a-0b31-46df-a856-213a2b91f698

Best Regards,

“PS” Thanks again for all you do for the community.

2

I looked at the thread you were linking and I was wondering what you are talking about until I saw the screenshots. In my version of the Unifi network app the is no such category of switch isolation settings. Curious.

3

Yeah from my understanding to have access to those areas under the unifi network area. I believe you need to either have one of there layer 3 compatible switches, a dream machine, or one of there gateway products. For those areas to be unlocked and available. I could be way off ,but that was what I gathered.

The first screenshot is located at the bottom of the network area.

Lawrence Network Area
Lawrence Network Area1913×929 119 KB

The second screen shot is in the security area under mac acl tabs.

Lawrence ACL Area
Lawrence ACL Area1919×925 123 KB

So if you don’t have them available its probably because what I mentioned above. Cause I think I recall I didn’t initially have them available when I had one layer 2 compatible switch from them during testing. Only till I added the layer 3 switch and adopted was when I started to see those features.

4

Only some switch models support layer three features and ACL rules. That is also when people asl for a setup that requires layer 3 routing I don’t always think UniFi will be their best choice.