Connecting a Unifi AP into a Mikrotik router (VLAN)


This article describes the setup necessary for a Mikrotik router (hAP ac2) and a UniFi AP (UAP-AC-LITE) to operate correctly and allow clients to connect to the correct VLAN. Both the Mikrotik and the UniFi have their radios enabled, allowing clients to initiate a Wi-Fi connection with either device. Connected Wi-Fi clients can transit from one device to the other. Before the UniFi AP, a Cisco Aironet 1600e AP was plugged into ether2. The Cisco's firmware was Autonomous AP IOS Software- 15.3.3-JF14i(ED).

This article doesn't go into setting up the Mikrotik. If you would like an explanation, ask, and I will try to create it.

The following VLANS were defined:

  • VLAN10      | Internal traffic                | HOMENET-AP SSID
  • VLAN20      | Guest traffic                   | HOMENET-GUEST SSID

The Mikrotik ports were setup as below:

  • ether1              |      WAN (all traffic, tagged)
  • ether2              |      Unifi AP (all traffic, tagged)
  • ether3, 4, 5      |      VLAN10 traffic only 

Tagging, sometimes referred to as Frame Tagging, is a method used to identify packets travelling through the trunk links. In this setup, ether3, 4 and 5 are untagged since only VLAN10 traffic is passing on them. Since the other ports had to handle traffic from both VLANs the packets had to be "marked" with the VLAN they belonged to.

Before modifying configurations on any device, take a backup. If things start going wrong, restoring the backup will take you to a position as everything stood when you started making changes.

With the Mikrotik I found that changes would not always go into effect. Power cycling the device (and verifying that the changes were implemented) always did the trick.

The Solution

The Mikrotik VLAN was configured as shown in the figure above.

I used UniFi's controller software to configure the AP. UniFi APs can run without the controller unless features like guest portal is enabled (not my case). The controller also allows one to automate backups and firmware updates. There are IOS and Android apps from UniFi that perform most of the tasks of the controller software but, I haven't used either.

The Unifi controller was set up in a container running on the VLAN10 network.

On the UniFi, the Wi-Fi and Network settings were defined as shown below.

The UniFi configuration was changed so that the Primary (Native) VLAN was VLAN10. If this is not done, the native VLAN defaults to 1 and, as will be explained below, will not work since the Mikrotik is not tracking this VLAN. Unifi should place this option under the Network section of their controller software rather than at this difficult-to-find page. Alternatively there should place a link to the Network section to this obscure location.

If UniFi's IP Settings => Network Override is not set

When the above was unset, the UniFi Controller would discover the AP but would fail to adopt it.

I was experiencing problems when the UniFi Controller attempted to take associate with the AP. It was be discovered, but I was unable to adopt it. Adoption is the process of connecting a device to the Unifi application that will manage it.

I tried untagging ether2 from VLAN10 as shown below. This resolved the issue of the UniFi Controller adopting and connecting to the AP but clients connecting to the VLAN10 network weren't getting an IP address. If the device got an IP address from the Mikrotik it would work on the UniFi (until the lease expired).

Follow This, That and (Maybe), the Other:


Popular posts from this blog

20150628 Giarratana Circular

HOWTO setup OpenVPN server and client configuration files using EasyRSA

How To Reset the firmware, wifi on GoPro Hero 3, 3+ and sync it with latest version of GoPro Quik