Configure networks and VLANs

The Networks page owns logical client networks: attachment, subnet, gateway, DNS, MTU, DHCP pools, lease time, and access policy. It does not choose the physical LAN or WAN. Those values, the local port mode, and the VLAN allow-list are approved on the gateway during agent setup.

Understand the two layers

This separation prevents a remote form mistake from moving the gateway onto the wrong interface or creating an unapproved VLAN.

Choose the local port mode

An empty VLAN allow-list means no VLANs, not all VLANs. For example:

network:
  wan_interface: enp2s0
  lan:
    interface: enp26s0
    mode: hybrid
    native_address: 10.10.0.1/24
    manage_native_address: true
    allowed_vlan_ids:
      - "100,200-220"

Restart the agent after changing local topology. NOC will report the new port policy and allowed VLANs when the agent reconnects.

Create a native network

Use a native network for untagged clients directly connected to the LAN parent.

1. Open Networks and select the agent.
2. Choose Import native LAN.
3. Confirm the canonical network CIDR and gateway. For local address 10.10.0.1/24, the CIDR is 10.10.0.0/24 and the gateway is 10.10.0.1.
4. Set DNS, MTU, lease duration, DHCP, access policy, and an allocation pool.
5. Save, then activate network runtime.

When Manage LAN Address is off, cloud CIDR and gateway must exactly match the local address. When it is on, URUFI can safely reconcile the native address without rewriting config.yaml; unrelated interface addresses are preserved.

Create a VLAN network

Use VLAN networks when SSIDs or switch access ports must be isolated at layer 2.

1. Configure the gateway as trunk or hybrid and allow the VLAN ID locally.
2. Carry that VLAN tagged on the switch/AP uplink to the gateway.
3. In Networks, choose New network and select VLAN.
4. Enter the same VLAN ID used by the switch and AP.
5. Give it a unique, non-overlapping CIDR and gateway.
6. Set an MTU that the complete path supports. Use 1496 when a 1500-byte physical or virtual path cannot carry the additional VLAN tag; keep 1500 only when the full path supports the tagged frame size.

The agent creates a URUFI-owned interface such as ufv100. It will not adopt or delete an unrelated interface merely because the name or VLAN ID looks similar.

Configure addressing and DHCP

Use a bounded subnet for each broadcast domain. A /24 is usually easier to operate than one very large shared subnet.

Multiple pools create reserved gaps inside the same network. They do not represent packages, speeds, or customer tiers. A client's package changes entitlement and service class without moving its address.

Choose the access policy

• Captive portal gives an address but restricts the client until portal activation.
• Authorized devices only permits only devices with a current entitlement and does not redirect unauthenticated browsing.
• Open internet access permits every client on that network immediately. Use it only for intentionally open or otherwise trusted segments.

Activate and verify convergence

Saving changes creates desired state. Activate starts network runtime for that agent. The status is trustworthy only when it shows:

Converged
desired revision = applied revision

The agent acknowledges a revision only after it applies and verifies interface address, MTU, firewall, DHCP, captive, and traffic-control state. If Last apply failed appears, fix the structured error rather than repeatedly editing unrelated fields.

On a client, renew DHCP after an address, pool, DNS, or MTU change:

sudo nmcli connection down CONNECTION_NAME
sudo nmcli connection up CONNECTION_NAME
ip -4 address
ip route

Next step

Build the tenant firewall policy, then add bandwidth and service classes without changing network addressing.