Switching & Cabling
Site A's three-switch UniFi L2 fabric and exact clean-slate port design, alongside Site B's unchanged switching boundary.
Site A is moving to three UniFi Switch Pro XG 10 PoE switches connected as an RSTP triangle. They remain Layer 2 only; OPNsense owns all routing and DHCP. Site B remains unchanged and must not inherit Site A profiles or migration mechanics.
Target Versus Current
The working Site A network is still UCG Max → XG 6 PoE → U7 Pro XGS. The new fabric is accepted only after phases A3-A8 pass. During A4-A7, UCG remains only the upstream WAN for the final-addressed OPNsense LAN; XG6 p4 remains a deliberate edge bootstrap/recovery path only until A5.
Site A
| Switch | Role | Management | RSTP |
|---|---|---|---|
sa-sw-01 | L2 root and OPNsense attachment | 10.10.10.2 | 4096 |
sa-sw-02 | L2 secondary and data attachment | 10.10.10.3 | 8192 |
sa-sw-03 | L2 tertiary and AP/client attachment | 10.10.10.4 | 12288 |
Fabric trunks use native VLAN 999 and explicit tagged lists. The switches have no SVIs, routes, or DHCP. Host links remain independent; there is no LACP, MLAG, or stacking.
Site B
sb-sw-01 remains the Netgear XS748T L2 core. sb-sw-02 remains the UniFi
USW 24 PoE access/IPMI/AP switch. OPNsense owns Site B routed VLANs, and the
USG Pro remains downstream on VLAN 253.