Firewall / OPNsense
Site A Migration Phases
Decision-gated A0-A8 migration from the UCG Max bootstrap island to OPNsense and the three-switch UniFi L2 fabric.
Site A builds the complete final-addressed LAN behind OPNsense while the UCG remains its temporary WAN upstream. The final cutover changes only the WAN feed.
Physical Presence Required
Do not apply a switch, Proxmox bridge, OPNsense, or WAN-path change without console access, exported backups, documented rollback cabling, and local hands.
| Phase | Outcome | Gate |
|---|---|---|
| A0 | current bootstrap exported, labeled, and recoverable | rollback can be executed from the written map |
| A1 | four hosts and two BMCs proven one at a time through XG6 p4 | every NIC identity is observed and recorded |
| A2 | OPNsense, UOS, and Bao staged behind UCG | all edge services healthy without moving the ONT |
| A3 | UOS dual-homed to final VLAN 10; all three XG10s adopted there in a final-addressed loop-free target tree | unique identities at .2/.3/.4; no UCG/XG6 connection |
| A4 | remaining target VLANs and policy commissioned on the A3 tree | DHCP/DNS/NAT and allowed/denied zone tests pass |
| A5 | UOS bootstrap vNIC retired; secrets, management, and IPMI migrated | UOS/Bao/management remain reachable after each move |
| A6 | third DAC added and RSTP triangle validated | every single-DAC pull passes |
| A7 | AP, SSIDs, and clients migrated | complete final LAN passes while UCG still feeds OPNsense WAN |
| A8 | ONT feed moved to OPNsense | public WAN and policy pass twice; no UCG/XG6 dependency remains |
Critical Order
- Add the final UOS tag-10 vNIC while retaining bootstrap; prove target VLAN 10 before cabling any XG10.
- Connect edge nic2→sw1, then add sw2 and sw3 through sw1. Adopt each at its final VLAN-10 address using target-only commissioning profiles. Never connect an XG10 to UCG Max or XG6.
- Prove UOS through the target tree, retire its bootstrap vNIC, then move Bao.
- Move each BMC and host-management cable directly to its final port and address.
- Connect
sw2 p12 -> sw3 p11as the third DAC and failure-test the triangle. - Move the AP to sw3 p6 and prove all SSIDs/clients while UCG still feeds WAN.
- Freeze every LAN setting.
- Move only the ONT feed to edge
nic3, then validate twice.
Rollback
If WAN service cannot be restored inside the maintenance window, reconnect
ONT -> UCG Max and edge nic3 -> XG6 p3. The same final LAN returns through
temporary double NAT; do not readdress hosts or move the AP.
Site B is outside this campaign and remains unchanged.