Site A L2 Fabric
Clean-slate Site A target: three UniFi Switch Pro XG 10 PoE switches at Layer 2, OPNsense-owned routing, explicit trunks, RSTP, and failure domains.
Site A uses three USW-Pro-XG-10-PoE switches as one Layer-2 RSTP fabric.
sa-fw-01 on sa-edge-01 is the only router, DHCP server, stateful firewall,
NAT boundary, and future WireGuard endpoint.
XG10 Never Connects to UCG/XG6
The UCG Max, XG 6 PoE, and U7 Pro XGS are still the working bootstrap network.
During A3-A7, UCG feeds OPNsense WAN while every downstream endpoint moves to final
10.10.x. XG6 never joins the fabric: p4 keeps the edge bootstrap path only until
A5, and p5/p6 stay disconnected. Every XG10 is adopted only on final VLAN 10 on the
OPNsense-backed target plane. A8 changes only the WAN feed.
Ownership Model
| Layer | Owner | Responsibilities |
|---|---|---|
| Layer 3 | sa-fw-01 | routed .1 gateways, DHCP, DNS forwarding, stateful inter-VLAN policy, WAN NAT, DMZ, future WireGuard |
| Layer 2 | sa-sw-01/02/03 | explicit VLAN admission, access/trunk profiles, PoE, RSTP, switch management |
| Virtual switching | Proxmox bridges | connect VM vNICs to approved VLANs; never route on the host |
The switches have management IPs 10.10.10.2/.3/.4 on VLAN 10. They have no
SVIs, DHCP scopes, static routes, or gateway role. VLAN 4040 is absent. VLAN 253
is absent at Site A, and 10.10.253.0/24 is reserved.
Standard Profiles
| Profile | Native | Tagged VLANs | Use |
|---|---|---|---|
A-FABRIC | 999 | 10,20,25,30,40,50,60,70,80,90,100,110,120 | inter-switch DACs |
A-EDGE-ROUTER | 999 | 10,20,30,40,50,70,80,90,100,110,120 | OPNsense LAN trunk |
A-AP | 10 | 100,110,120 | U7 Pro XGS |
A-ACCESS-10 | 10 | none | switch and IPMI management |
A-ACCESS-20 | 20 | none | Proxmox management |
A-ACCESS-25 | 25 | none | Corosync; no gateway |
A-ACCESS-60 | 60 | none | storage; no gateway |
A-ACCESS-90 | 90 | none | backup |
A-QUARANTINE | 999 | none | unused; disabled |
VLAN 999 is an unrouted, DHCP-free native sink. Use explicit custom tag lists,
not Allow All. VLAN 65 remains reserved and is not carried.
Physical Fabric
| Link | End A | End B |
|---|---|---|
| A | sa-sw-01 SFP+ 11 | sa-sw-02 SFP+ 11 |
| B | sa-sw-02 SFP+ 12 | sa-sw-03 SFP+ 11 |
| C | sa-sw-03 SFP+ 12 | sa-sw-01 SFP+ 12 |
RSTP priorities are 4096, 8192, and 12288 in switch-number order. One
path should be alternate/blocking while healthy. MTU stays 1500. There is no
LACP, MLAG, stacking, or switch routing.
Router Attachment
sa-edge-01 nic2/vmbr2 connects to sa-sw-01 port 1 using
A-EDGE-ROUTER. The Proxmox host has no IP on that bridge. The OPNsense LAN
vNIC must explicitly allow trunks 10;20;30;40;50;70;80;90;100;110;120.
A VLAN-aware bridge alone does not make the VM vNIC a trunk.
DHCP and DNS
OPNsense serves client DHCP:
- VLAN 100:
10.10.100.50-10.10.103.199 - VLAN 110:
10.10.110.50-10.10.110.199 - VLAN 120:
10.10.120.50-10.10.120.199
During bootstrap it advertises its local interface as DNS. After Technitium is
proven, it advertises 10.10.30.10 and 10.10.30.11.
Failure Domains
| Failure | Expected impact |
|---|---|
| One DAC | RSTP reconverges over the other two links; the surviving switches and router remain connected |
| One switch | endpoints unique to that chassis fail; the other two switches retain a direct path |
sa-fw-01 / sa-edge-01 | L2 forwarding remains, but all gateways, DHCP, WAN, DNS forwarding, WireGuard, and inter-VLAN routing fail |
sa-uos-01 | existing forwarding remains; adoption, telemetry, and configuration stop |
| shared power | entire fabric fails; the triangle is not power redundancy |
See Site A Port Map for all 36 ports and Site A Fabric Explorer for the physical, routing, and failure views.