I've been banging my head on this for a while and I have no clue what's going on. I'm trying to assign a handful of static IP addresses on a network and this ERPoE-5 running 1.9.1 refuses to hand out the IPs that I'm telling it to.
A third party contractor who wasn't familiar with EdgeMax installed a few systems on the network that require static IPs, so they went ahead and just set the static IPs on the devices (and didn't leave me a list of devices with static IPs). I'm going through and transferring the static assignments to the Edgerouter so that I can actually track what each device's IP address is. At the same time, I'm trying to assign some other network hardware to static IPs outside the DHCP range, namely a CloudKey and two UAP-AC-LRs. Here's a rough list of what has happened:
-UAPs had DHCP-assigned IP addresses of 192.168.1.103 and .108, I assigned static IPs of 192.168.1.3 and .4. I rebooted the UAPs and they pulled the correct addresses.
-UCK had a DHCP-assigned IP address of 192.168.1.102, I assigned a static IP of 192.168.1.2 and rebooted the UCK. It completely dropped off the UniFi system and showed as being offline (I assumed it had crashed - more on this later).
-A security camera DVR was set up with a (device-specified) static IP of 192.168.1.50, I assigned a static IP through the Edgerouter DHCP server of 192.168.1.50 (the same IP), and turned DHCP on the device. The connection to the device dropped.
-Thinking that it was highly unlikely that two completely different devices dropped off the network under similar circumstances, I downloaded NMAP and pinged the entire subnet. Turns out that the UCK's IP was actually192.168.1.30 (and internet access apparently wasn't working, hence the offline cloud controller issue), and the DVR's IP was 192.168.1.120. After signing into the UCK locally, both UAPs' addresses were showing at 192.168.1.20.
-I deleted all static mappings and the UCK, UAPs, and DVR came back up correctly with DHCP addresses. I then re-set a static IP for DVR to the IP that it seemed to prefer (192.168.1.120) and it seems to have stuck for now.
I have no clue what would cause the DHCP server to freak out like that. Authoritative was originally set to disabled, I then enabled it to troubleshoot (it didn't help). I seem to recall fome funkiness with static IPs when I originally set this thign up for my parents, but I can't recall the specifics of that at this point. I gave up and just went with DHCP addresses at the time.
Config is below. Any help would be greatly appreciated.
firewall {
all-ping enable
broadcast-ping disable
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name Guest_IN {
default-action accept
description ""
rule 1 {
action drop
description "Block LAN Access"
destination {
address 192.168.1.0/24
}
log disable
protocol all
}
rule 2 {
action drop
description "Block IOT LAN Access"
destination {
address 192.168.2.0/24
}
log disable
protocol all
}
}
name Guest_LOCAL {
default-action drop
description ""
rule 1 {
action accept
description "Allow DNS"
destination {
port 53
}
log disable
protocol tcp_udp
}
rule 2 {
action accept
description "Allow DHCP"
destination {
port 67
}
log disable
protocol udp
}
}
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 21 {
action accept
description "Allow IKE for VPN"
destination {
port 500
}
log disable
protocol udp
}
rule 22 {
action accept
description "Allow L2TP for VPN"
destination {
port 1701
}
log disable
protocol udp
}
rule 23 {
action accept
description "Allow ESP for VPN"
log disable
protocol 50
}
rule 24 {
action accept
description "Allow NAT-T for VPN"
destination {
port 4500
}
log disable
protocol udp
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address dhcp
description Internet
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
poe {
output off
}
speed auto
}
ethernet eth1 {
address 192.168.2.1/24
description “IOT LAN”
duplex auto
poe {
output off
}
speed auto
}
ethernet eth2 {
description Switch
duplex auto
poe {
output off
}
speed auto
}
ethernet eth3 {
description WIFI-1
duplex auto
poe {
output 24v
}
speed auto
}
ethernet eth4 {
description WIFI-2
duplex auto
poe {
output 24v
}
speed auto
}
loopback lo {
}
switch switch0 {
address 192.168.1.1/24
description LAN
mtu 1500
switch-port {
interface eth2 {
}
interface eth3 {
}
interface eth4 {
}
vlan-aware disable
}
vif 10 {
address 192.168.3.1/24
description "Guest VLAN"
firewall {
in {
name Guest_IN
}
local {
name Guest_LOCAL
}
}
mtu 1500
}
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface eth1
lan-interface switch0
lan-interface switch0.10
rule 1 {
description Leviton
forward-to {
address 192.168.1.80
port 4369
}
original-port 4369
protocol tcp
}
rule 2 {
description Alibi
forward-to {
address 192.168.1.120
port 8000
}
original-port 8000
protocol tcp_udp
}
wan-interface eth0
}
service {
dhcp-server {
disabled false
hostfile-update disable
shared-network-name Guest_VLAN {
authoritative enable
subnet 192.168.3.0/24 {
default-router 192.168.3.1
dns-server 192.168.3.1
lease 86400
start 192.168.3.101 {
stop 192.168.3.250
}
}
}
shared-network-name IOT_LAN {
authoritative enable
subnet 192.168.2.0/24 {
default-router 192.168.2.1
dns-server 192.168.2.1
lease 86400
start 192.168.2.101 {
stop 192.168.2.250
}
}
}
shared-network-name LAN {
authoritative enable
subnet 192.168.1.0/24 {
default-router 192.168.1.1
dns-server 192.168.1.1
lease 86400
start 192.168.1.101 {
stop 192.168.1.250
}
static-mapping Alibi {
ip-address 192.168.1.120
mac-address bc:ad:28:xx:xx:xx
}
static-mapping WIFI-1 {
ip-address 192.168.1.3
mac-address 44:d9:e7:xx:xx:xx
}
static-mapping WIFI-2 {
ip-address 192.168.1.4
mac-address 44:d9:e7:xx:xx:xx
}
}
}
use-dnsmasq disable
}
dns {
dynamic {
interface eth0 {
service dyndns {
host-name xxx.xxx.xxx
login xxx
password xxx
server dynupdate.no-ip.com
}
web dyndns
}
}
forwarding {
cache-size 200
listen-on eth1
listen-on switch0
listen-on switch0.10
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
outbound-interface eth0
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
}
system {
domain-name xxx
host-name ERPoE-5
login {
user xxx {
authentication {
encrypted-password xxx
}
level admin
}
user xxx {
authentication {
encrypted-password xxx
}
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
offload {
hwnat disable
ipsec enable
ipv4 {
vlan enable
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone America/Chicago
}
vpn {
ipsec {
auto-firewall-nat-exclude disable
ipsec-interfaces {
interface eth0
}
nat-networks {
allowed-network 192.168.1.0/24 {
}
}
nat-traversal enable
}
l2tp {
remote-access {
authentication {
local-users {
username xxx {
password xxx
}
username xxx {
password xxx
}
}
mode local
}
client-ip-pool {
start 192.168.1.21
stop 192.168.1.40
}
dhcp-interface eth0
dns-servers {
server-1 8.8.4.4
}
ipsec-settings {
authentication {
mode pre-shared-secret
pre-shared-secret xxx
}
ike-lifetime 3600
}
}
}
}
/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v1.9.1.4939093.161214.0705 */