Switching & Cabling

Site A Port Map

Bootstrap handoffs and final assignments for all 36 ports on Site A's three UniFi Switch Pro XG 10 PoE switches.

The XG6 remains the separate UCG-side bootstrap/recovery switch. All three XG10s use only final VLAN-10 management behind OPNsense and never connect to UCG Max or XG6. Every XG10 port has a final role or an explicit disabled state; PoE stays off except on commissioned AP ports.

XG10 Never Connects to UCG/XG6

XG6 p4 serves one host/BMC at a time; p5/p6 stay disconnected. Every XG10 is commissioned and adopted only on the isolated OPNsense-backed target plane.

Physical Picture

SITE A · PHYSICAL CUTOVER MAP

Two isolated paths, one controlled handoff.

Select or focus a device. Only its physical cables brighten; the inspector resolves the exact port and phase.

A8 moves WAN only
LIVE / RECOVERYBootstrap island

UCG Max + XG 6 PoE

NO SHARED L2XG10 never connects to UCG Max or XG6
FINAL ADDRESSESTarget fabric

OPNsense + 3× XG10 RSTP

Wire language

  • WAN handoff
  • Bootstrap-only lead
  • OPNsense LAN trunk
  • 10G SFP+ DAC
  • AP PoE link
RECOVERY SWITCH

XG 6 PoE

4 physical links

The XG 6 PoE stays on the bootstrap network. Ports 5 and 6 remain disconnected; no XG10 ever attaches to this switch.

  • p2 → AP until A7
  • p3 → OPNsense WAN until A8
  • p4 → one endpoint · p5/p6 disconnected
Follow cable
  1. A3
    Build + adoptedge nic2 → sw1; add sw2/sw3 through the target-only VLAN-10 tree.
  2. A4
    Commission LANProve the final VLANs, DHCP, DNS, NAT, and policy on the A3 tree.
  3. A6
    Close trianglesa-sw-02 p12 ↔ sa-sw-03 p11 after RSTP validation.
  4. A7
    Move APXG6 p2 → sa-sw-03 p6; validate every SSID and policy.
  5. A8
    Move WANONT leaves UCG Max and lands on sa-edge-01 nic3.
XG6 p5/p6 remain disconnected; every XG10 is adopted only on the OPNsense-backed target plane.

No cable ever joins UCG Max or XG6 to an XG10, including during adoption.

UCG Max and XG6 Ports

PortEndpointPhase role
UCG WANFios ONTlive ISP termination through A7
UCG LAN 1XG6 p1bootstrap LAN uplink
XG6 p2sa-ap-01bootstrap Wi-Fi through A6; AP moves in A7
XG6 p3sa-edge-01 nic3 / vmbr1staged OPNsense WAN through A7
XG6 p4one endpoint at a time; sa-edge-01 nic0 during A2-A4service/recovery lead
XG6 p5nonedisconnected; never attach an XG10
XG6 p6nonedisconnected; never attach an XG10

Cabling Order

  1. A3: bring up OPNsense VLAN 10 and UOS's target interface, connect edge nic2 to sw1 p1, then add sw2 through sw1 p11 and sw3 through sw1 p12. Adopt each at its final address using a temporary target-only native-VLAN-10 commissioning profile. If discovery requires DHCP, remove the short-lived VLAN-10 scope after adoption.
  2. A4: commission and prove the remaining VLANs and policy on the A3 tree.
  3. A5: move every host and BMC directly to its final port and address.
  4. A6: add sw2 p12 to sw3 p11 as the third DAC, then failure-test RSTP.
  5. A7/A8: move the AP to sw3 p6, then move only the ONT feed to edge nic3.

A5 Control-Plane Cable Moves

OrderEndpointFromFinal portFinal address/state
1sa-uos-01 bootstrap vNICdual-homed in A3: bootstrap vmbr0 + PVE tag 10remove bootstrap vNIC after target proofretain 10.10.10.40 on tag 10
2sa-bao-01 vNICbootstrap vmbr0PVE tag 3010.10.30.40
3sa-edge-01 IPMIdisconnected after XG6 p4 first contactsw2 p510.10.10.10
4sa-edge-01 nic0XG6 p4sw3 p510.10.20.10
5sa-stor-01 IPMIdisconnected after XG6 p4 first contactsw3 p210.10.10.20
6sa-stor-01 i210disconnected after bootstrapsw2 p210.10.20.20
7sa-cmp-01 built-in NICdisconnected after bootstrapsw3 p310.10.20.11
8sa-cmp-02 built-in NICdisconnected after bootstrapsw1 p610.10.20.12
LinkEnd AEnd B
Asa-sw-01 p11sa-sw-02 p11
Bsa-sw-02 p12sa-sw-03 p11
Csa-sw-03 p12sa-sw-01 p12

All three use A-FABRIC: native VLAN 999; tagged 10,20,25,30,40,50,60,70,80,90,100,110,120.

sa-sw-01: L2 Root and Router Attachment

Management 10.10.10.2; RSTP priority 4096.

PortEndpointConfiguration
1sa-edge-01 nic2 / vmbr2A-EDGE-ROUTER: native 999; tagged 10,20,30,40,50,70,80,90,100,110,120
2sa-edge-01 nic1 / vmbr3access 25; Corosync
3sa-stor-01 XL710 p1native 999; tagged 25,30,70,80
4sa-stor-01 XL710 p4access 90
5sa-cmp-01 X550 p2native 999; tagged 60,90
6sa-cmp-02 built-in NICaccess 20
7-9unusedquarantine; disabled
10emergency adminaccess 10; normally disabled
11sa-sw-02 p11A-FABRIC
12sa-sw-03 p12A-FABRIC

sa-sw-02: L2 Secondary and Data Attachment

Management 10.10.10.3; RSTP priority 8192.

PortEndpointConfiguration
1sa-stor-01 XL710 p2native 999; tagged 40,50,100
2sa-stor-01 i210access 20
3sa-cmp-01 X550 p1native 999; tagged 25,30,40,50,70,80,100
4sa-cmp-02 X550 p2native 999; tagged 60,90
5sa-edge-01 IPMIaccess 10
6-9unusedquarantine; disabled
10emergency adminaccess 10; normally disabled
11sa-sw-01 p11A-FABRIC
12sa-sw-03 p11A-FABRIC

sa-sw-03: L2 Tertiary and Client/AP Attachment

Management 10.10.10.4; RSTP priority 12288.

PortEndpointConfiguration
1sa-stor-01 XL710 p3access 60
2sa-stor-01 IPMIaccess 10
3sa-cmp-01 built-in NICaccess 20
4sa-cmp-02 X550 p1native 999; tagged 25,30,40,50,70,80,100
5sa-edge-01 nic0 / vmbr0access 20
6sa-ap-01 U7 Pro XGSnative 10; tagged 100,110,120; PoE++
7future APquarantine; disabled
8unusedquarantine; disabled
9unusedquarantine; disabled
10emergency adminaccess 10; normally disabled
11sa-sw-02 p12A-FABRIC
12sa-sw-01 p12A-FABRIC

Endpoint Rules

  • Infrastructure trunks use native VLAN 999 plus explicit tagged allow-lists.
  • VLANs 25 and 60 have no gateway. VLAN 65 is reserved and not carried.
  • The switches have no SVIs, DHCP, or static routes.
  • sa-uos-01 ends on VLAN 10; sa-bao-01 ends on VLAN 30.
  • The OPNsense LAN vNIC is a real Proxmox trunk, not a single tagged vNIC.

See Site A L2 Fabric and Migration Phases.

Site A L2 Fabric

Clean-slate Site A target: three UniFi Switch Pro XG 10 PoE switches at Layer 2, OPNsense-owned routing, explicit trunks, RSTP, and failure domains.

Site B Port Map

Site B port assignments for sb-sw-01 and sb-sw-02, with NIC-to-VLAN wiring for the five compute nodes and the edge device.