R1D2 wrote

@CoKro,

  

Port 1 of the lower TL-SG1016DE switch must be a tagged member of VLAN 1, too.

 

For the EAP, assign IoT SSID to VLAN 20 and another SSID to VLAN 1.

 

As for management traffic of the EAP itself, you have two choices:

1. either set the PVID of the switch port 9 to VID 1 – mgmt traffic from the EAP gets tagged by the switch with VID 1,
2. or explicitly set the EAP's »Management VLAN« setting to VID 1 – mgmt traffic from the EAP gets tagged by the EAP with VID 1.

 Second solution requires to set tagged port 9 to untagged temporarily when adopting a new EAP, then set it back to tagged again to complete configuration after adoption.

 

First solution does not need this trick.

@R1D2

I can't edit VLAN1 on the bottom SG1016DE. It is locked. The WebUI won't let me enter "1" as a value when picking which VLAN to edit, and the Easy Smart Config Utility will let me make the change, but not accep the change when I hit "Apply." 

I'm using Firmware v: 1.0.1 Build 20131023 Rel.33236. Would that matter? 

On the upper switch, the Easy Config shows that 1, 9 & 15 are tagged, not untagged. (something funky going on here?)

Should I change everything that was VLAN1 and create a VLAN10 to replace it across the board? 

Re: The EAP settings...Does that not default to VLAN1 if not specified? Or do I now live in a world where everything is assigned a vlan? 

 

CoKro wrote

1. I'm using Firmware v: 1.0.1 Build 20131023 Rel.33236. Would that matter? 

 

2. Should I change everything that was VLAN1 and create a VLAN10 to replace it across the board? 

 

3. Re: The EAP settings...Does that not default to VLAN1 if not specified? Or do I now live in a world where everything is assigned a vlan? 

1. Yes, it matters. In old firmwares TP-Link did force a port membership to VLAN 1 for Easy Smart switches. If you want to know why this is a bad idea, see this thread. You can even find many more threads about the famous VLAN 1 bug. Long story short: TP-Link finally changed this in TL-SG108E/PE and TL-SG105E, but it lastet nearly a year to convince R&D let users remove ports from the Default VLAN 1.
    
2. Yes. I suggest to not use the Default VLAN 1 at all (except for assigning it unused ports) if one of your switches don't let you remove ports from VLAN 1. Otherwise you have to deal with leakage from VLAN 1 into other VLANs caused by non-IP frames. There are more protocols than only IP.
   
   Just use VLAN 2 or 10 or any other VLAN except VLAN 1 for your LAN.
    
3. No, traffic from an EAP does not default to any VLAN. An EAP with no VLAN settings always sends untagged traffic. So, if you just use a single SSID, assign switch port 9 to VLAN 20 and set its PVID to 20. You want EAP's traffic to use VLAN 20 rather than VLAN 1, won't you? Make sure that port 9 is in VLAN 20 only.
   
   From your setup (port 9 member of VLANs 1 and 20) I got the impression that you want to use the Multi-SSID feature of the EAP which requires VLANs in order to isolate the wireless networks. If you only want to isolate the IoT network inside your wired network (from switches to ER-X) and use only one SSID on the EAP, you can tag frames arriving from EAP on the switch's port 9.

R1D2 wrote

 

CoKro wrote

1. I'm using Firmware v: 1.0.1 Build 20131023 Rel.33236. Would that matter? 

2. Should I change everything that was VLAN1 and create a VLAN10 to replace it across the board? 

3. Re: The EAP settings...Does that not default to VLAN1 if not specified? Or do I now live in a world where everything is assigned a vlan? 

 

1. Yes, it matters. In old firmwares TP-Link did force a port membership to VLAN 1 for Easy Smart switches. If you want to know why this is a bad idea, see this thread. You can even find many more threads about the famous VLAN 1 bug. Long story short: TP-Link finally changed this in TL-SG108E/PE and TL-SG105E, but it lastet nearly a year to convince R&D let users remove ports from the Default VLAN 1.
    
2. Yes. I suggest to not use the Default VLAN 1 at all (except for assigning it unused ports) if one of your switches don't let you remove ports from VLAN 1. Otherwise you have to deal with leakage from VLAN 1 into other VLANs caused by non-IP frames. There are more protocols than only IP.
   
   Just use VLAN 2 or 10 or any other VLAN except VLAN 1 for your LAN.
    
3. No, traffic from an EAP does not default to any VLAN. An EAP with no VLAN settings always sends untagged traffic. So, if you just use a single SSID, assign switch port 9 to VLAN 20 and set its PVID to 20. You want EAP's traffic to use VLAN 20 rather than VLAN 1, won't you? Make sure that port 9 is in VLAN 20 only.
   
   From your setup (port 9 member of VLANs 1 and 20) I got the impression that you want to use the Multi-SSID feature of the EAP which requires VLANs in order to isolate the wireless networks. If you only want to isolate the IoT network inside your wired network (from switches to ER-X) and use only one SSID on the EAP, you can tag frames arriving from EAP on the switch's port 9.

@R1D2 Thank you for your detailed response.

1&2) Did some more reading and I see that I am stuck with the static VLAN1 without upgrading the switch, so for now, I'm going to copy / recreate everything with a 1 as VLAN10. PVIDs too, I presume? (Guess I'll find out as soon as I hit "apply")

3) Yes, I want to use multi-ssid. My end-goal is to have a VLAN for IoTwifi, a VLAN for my cameras (PoE, not wifi), VLAN for a Guest Wifi (which I could just use the guest mode of the EAP for, since I know the people that come to my house. I'm protecting against an accident, not a hack), an SSID and wired VLAN for my family's wifi, and possibly a VLAN for my streaming devices, but I'd need that VLAN to be able to talk to some of my other devices. I don't know enough to know if it makes sense to isolate a Google Mini, a Roku, an Amazon FireTV, etc, or if it causes more problems than its worth.

But before I get to 5 VLANs, I need to get the first one working and understanding how and why it works.

 

@R1D2 

Thank you, again, for such a thorough explanation that a noob can understand. 

The ubiquiti forums were helpful in navigating their products and unique terminology, but less helpful in understanding the basics. 

Your time and effort is tremendously appreciated. THANK YOU.

@CoKro, you're welcome. Glad that my answer was helpful for you.