Enable edge services
Turn on DHCP, captive access, firewall, bandwidth control, metrics, or EAP-TLS for one gateway.
An installed agent does not automatically run every edge service. The Agents page is where an operator enables only the services required at that site. Physical LAN, WAN, port mode, and allowed VLANs remain read-only because they are local safety controls.
Before you begin
Confirm that:
- the agent is Online and authenticated;
- LAN interface (clients) and WAN interface (internet) are correct;
- the WAN has internet access and a default route;
- the required native address or VLAN permissions were saved by the local setup wizard;
- no competing DHCP server is connected to a segment URUFI will serve.
If LAN or WAN is wrong, run sudo urufi-agent initial on the gateway, correct the local
configuration, and restart the service. NOC intentionally cannot replace those values.
1. Open the service controls
In NOC, open Agents, select the target gateway, then find Agent services.
2. Choose the services
| Service | Enable it when | Dependency behavior |
|---|---|---|
| DHCP | URUFI assigns client addresses on configured networks | Required by HotSpot because the agent maps client IPs to locally leased MACs |
| HotSpot | A network uses the captive portal | Enabling it also enables DHCP and Firewall |
| Firewall | The gateway enforces access, NAT, walled garden, or tenant policy | Required by HotSpot and Bandwidth control |
| Bandwidth control | Service classes apply download or upload limits | Enabling it also enables Firewall because firewall marks identify class membership |
| Metrics | Operators need gateway health and interface telemetry | Independent; a metrics failure does not stop packet services |
| EAP-TLS | The site provides WPA2/WPA3-Enterprise authentication | Enables its RADIUS foundation automatically |
The dependency switches are deliberate. For example, disabling Firewall also disables HotSpot and Bandwidth control because neither can enforce policy without it.
3. Save in a safe order
For a captive-access gateway, use this sequence:
- Enable Metrics and save so the gateway is observable.
- Create and activate the logical networks.
- Configure the tenant captive destination and firewall policy.
- Enable HotSpot. DHCP and Firewall are selected automatically.
- Enable Bandwidth control after at least one service class references a bandwidth profile.
For an open routed network, enable DHCP and Firewall, but leave HotSpot off. For a pure EAP-TLS site, enable EAP-TLS and the packet services required by that network design.
4. Verify the agent
On the gateway, check the service and recent logs:
sudo systemctl is-active urufi-agent
sudo journalctl -u urufi-agent -n 100 --no-pagerExpected log messages identify each enabled supervisor, such as DHCP enabled,
firewall active, hotspot enabled, or shaper active. A saved NOC switch expresses
desired state; the runtime log and the Networks convergence panel confirm local effect.
Do not enable DHCP before the segment is ready
Two DHCP servers on the same broadcast domain can give clients conflicting gateways. Disconnect or disable the old DHCP server before attaching production clients.
Next step
Create the site's logical networks, then confirm the desired revision reaches Converged before adding clients.