OPNsense / UniFi Handoff

Site A

Final Site A data path

One routed boundary, one Layer 2 fabric

Inspect each handoff from the provider edge to the target switches.

A8 target state

Final handoff

WAN to Site A Target Fabric

The production path after the A8 ONT move.

Provider edgeFios ONTProduction WAN feed

Physical handoffnic3 / vmbr1sa-edge-01 WAN bridge

Stateful boundarysa-fw-01OPNsense VM

LAN trunknic2 / vmbr2Final VLAN trunk

Fabric rootsa-sw-01 port 1OPNsense trunk ingress

Layer 2 domainSite A fabricsa-sw-01 / 02 / 03

WAN pathLAN trunk and L2 fabric

During bootstrap, the UCG can feed the OPNsense WAN. It never joins the target LAN fabric.

sa-sw-01 port 1 uses A-EDGE-ROUTER: native VLAN 999 and tagged VLANs 10,20,30,40,50,70,80,90,100,110,120. OPNsense owns .1 on each routed subnet. The switches do not route.

VLANs 25 and 60 are not on the router trunk because they have no gateway. VLAN 65 is reserved and not carried. VLANs 253 and 4040 are absent at Site A.

Site B

Site B remains unchanged: OPNsense feeds the Netgear L2 core, and the USG Pro WAN remains downstream on VLAN 253 at 10.20.253.2, with OPNsense at 10.20.253.1.

Site A Validation

• every routed .1 appears only on OPNsense;
• VLAN 25/60/65/999 have no gateway;
• no Site A VLAN 253/4040 exists;
• DHCP, DNS, and NAT pass on trusted/IoT/guest test clients;
• permitted flows pass and neighboring prohibited flows fail;
• the UCG Max is not on the infrastructure path.

See Migration Phases and Site A Port Map.