Can eap_proxy work with a switch between the ONT and the router?

[abulgatz]

I have had eap_proxy working for a while on my ER-4, with eth0 going to the AT&T ONT and eth1 going to the AT&T gateway.

I've recently re-arranged my rack, and it would be nice if I could go from ER-4 eth0 -> Unifi switch -> AT&T ONT.

On my US-48-500W Unifi switch I created a new VLAN 4000 (att_ont) and assigned it as the native untagged VLAN to ports 47 and 48. My wiring is then:

• ER-4 eth0 -> Unifi Switch Port 47
• Unifi Switch Port 48 -> AT&T ONT

However, this doesn't work. Any ideas why, or how to make it work?

[dever23b]

I just checked this repo to see if anyone had found a supported solution for this, because I'm trying to take another stab at it. I haven't figured out a permanent solution yet, but you're not alone. What I've figured out so far is that Unifi switches, by default, block the EAPOL packets, so this script isn't able to do its magic. The only supported (something in the Unifi controller that will survive reboots) configurations I've found assume that you're setting up EAP on your own network, with an authentication server you control.

The workaround I've come up with so far is to access the administration console directly on the switch and manually tweak things. Unfortunately, this type of tweaking will not survive a reboot: upon reboot, the switch will re-provision and lose the changes, so this isn't nearly suitable for a permanent fix.

That being said, hopefully this helps or helps someone else get started with a better solution. I've found that if you enable "EAPOL Flood Mode" in the switch, the switch will stop filtering EAP packets and allow this script to do its magic. I've brought this issue up with Ubiquity and their helpful response was to confirm what I already knew: "it's not possible in the GUI at this time." So, basically, "kick rocks."

To enable EAPOL Flood Mode: 1) SSH into the switch directly 2) telnet localhost 3) enable 4) configure 5) dot1x eapolflood

Command 5 is a toggle between "enable" and "disable".

[abulgatz]

Thanks @dever23b ! Good to know what the problem is and that using another switch may work. There are so many Unifi switch features that I wish Ubiquiti would expose in the GUI or through the equivalent of a config.gateway or config.properties file.

[dever23b]

It's unfortunate. The issue is trivial to resolve on their EdgeSwitch products. I understand the logic behind blocking the traffic by default and, admittedly, what we do with eap_proxy is certainly not "standard behavior" in networking. But this issue is frustratingly silly to me because you have a case where the hardware is more than capable of accomplishing the goal and the software, which is their big selling point with the Unifi line, messes everything up. My support ticket with them is 2 years old, so clearly they're not in a rush to provide us with a solution.

[jaysoffian]

Closing as this isn't an issue with eap_proxy.