Understanding Native VLAN while setting up Ubiquiti AP-AC-Pro with Cisco 2960-S


While “the thing” has been ongoing, I’ve been learning about 802.1Q. I have a couple HP switches and one Cisco 2960-S and I’ve been able to trunk/tag ports to allow communication between VLANs using pfSense as a router.

My question is specifically about integrating the popular Ubiquiti UAC-AP-Pro. I have a Unifi controller installed to a local computer on a VLAN 10. I configured the AP with an address (statically) like 192.168.10.x/24. I’ve configured three SSIDs and tagged three separate VLANs depending on which SSID is used (VLAN 20,30,40).

With the AP connected to a trunk on the Cisco switch, this works as expected. Devices connecting via SSID 20 get assigned addresses on VLAN 20, etc. My problem is that the controller on VLAN 10 cannot communicate with the AP once it’s connected to the trunk. I’ve setup the trunk to allow VLANs 10,20,30 and 40.

One thing I notice about Ubiquiti is that I need a companion UniFi switch to enable some of the more advanced AP features, like assigning a management VLAN. I assume that without a UniFi switch, the NIC of the AP is not tagging wired traffic.

I read a bit about native VLANs. My understanding is that this is a feature for “dumb” devices that do not adhere to the 802.1Q protocol. If my assumption is correct, the 2960-S should tag frames from the AP-AC-Pro with the native VLAN.

Can anyone help me understand how to communicate with my AP via the trunk? If my native VLAN is VLAN 5, for example, do I need that same VLAN defined in my router to properly establish communication? My feeling is that this is going to be specific to Ubiquiti and that if I used a more standalone AP, I wouldn’t be having this issue.

You’ll want to untag the AP port on your switch with the management vlan where the controller is and tag the other vlans on that port.

Unintuitively, untag means default, tagged is configurable but not default.

Considering the switch is a Cisco, is tagged equivalent to trunked? Is untagged equivalent to access? Can a Cisco trunk have untagged VLANs or is it tagged with every VLAN by design?

If you connect your APs to Cisco Switch and use different VLANs for each SSID, you want your Ports configured as trunk AND for your case: switchport trunk native vlan 10. So that your SSID Traffic is tagged for their own VLAN and the untagged managment traffic between the controller and the APs ist using VLAN 10. Without a Unifi Switch your APs wont put a tag on the managment traffic. With that command your untagged traffic will be put into VLAN10 where you want it. I also use that setup and it works great.