## User
- **User:** Howard Enos (howard)
- **Machine:** ACG-TECH03L
- **Role:** tech

# The Prairie Schooner — SonicWall + USG -> UniFi UDM Pro swap (prep + discovery)

> Onsite session, Howard. Goal: replace the SonicWall (and a USG) with the UDM Pro to regain
> DHCP/DNS control and unblock the PAUSED TPS-SERVER -> TPS-SVR server migration. Session moved
> to Howard's desktop mid-way — this log is the resume point. **No operational changes were
> made; all work was read-only discovery.**

## Session Summary

Resumed the Prairie Schooner engagement to finish the server move by first swapping the edge
gateway. Loaded prior context (wiki `the-prairie-schooner.md`, the 2026-07-10 server-migration
log): the migration is paused because the SonicWall (192.168.1.1) owns DHCP and hands clients
DNS = 192.168.1.125 (old DC), which must change before the old DC can be retired. Howard is
onsite with a UDM Pro and a USG, neither previously adopted to our accounts.

Confirmed the live network read-only via GuruRMM against TPS-SVR (agent
`799675cf-5c94-465a-b653-63e08d016526`): flat LAN 192.168.1.0/24, gateway .1 (SonicWall),
domain TPS.local, servers static at .125/.135, building has internet. A ping sweep mapped the
active hosts for a keep-the-IPs reservation plan. Determined the UDM Pro already has a public
WAN via the Cox modem (dynamic public DHCP) and that, because there are no inbound services,
the public-IP change at cutover is irrelevant.

Howard adopted the UDM Pro to the ui.com account and transferred ownership to
mike@azcomputerguru.com. Established that it is a standalone UniFi console (its own Network
app), correctly grouped in Site Manager with ~37 other ACG client consoles, and does NOT need
to be nested in the self-hosted UOS Server. Confirmed there is no remote API path to configure
it (Site Manager cloud API is read-only and its key currently 401), so its LAN/DHCP config must
be entered in the UniFi app.

This session included operator-corrected mistakes (below). The SonicWall admin password
provided is wrong (login page reachable, password rejected) — but SonicWall access is not
actually required since there are no inbound rules/VPN/port-forwards to preserve. Session was
saved here to continue on Howard's desktop; the authoritative device+IP inventory is to be
pulled from ScreenConnect next.

## Key Decisions

- **UDM Pro is the single replacement for BOTH the SonicWall and the USG.** One edge device,
  flat 192.168.1.0/24. USG set aside.
- **Standalone console under Mike's ui.com account is the correct home** — not the self-hosted
  UOS Server (172.16.3.29). Most ACG client sites run exactly this way; the UOS Server is only
  for console-less AP/switch sites. No re-adoption to the UOS Server needed.
- **Public-IP change at cutover is acceptable** — no RDP/VPN/cameras/on-prem mail, so nothing
  inbound depends on the old address.
- **Keep every device on its current IP** via a Pro DHCP scope that is a superset of today's plus
  fixed-IP reservations by MAC; static servers (.125/.135) unchanged and reserved out of the pool.
- **Client DHCP DNS handed by the Pro = 192.168.1.135 then .125** (new DC first) — the migration
  objective; both DCs are up so it is transparent at flip.
- **Do NOT need the SonicWall config** — no inbound services to extract; rebuild DHCP/reservations
  from the ScreenConnect inventory instead of the (inaccessible) SonicWall lease table.

## Problems Encountered

- **Off the internal network at first** — this machine had no route to 172.16.3.x (RMM/coord
  HTTP 000). Resolved when Howard started Tailscale; coord 200, RMM reachable.
- **RMM auth vars lost to a subshell** — `eval "$(rmm-auth.sh)" | tail` ran eval in a pipe
  subshell so `$TOKEN`/`$RMM` never persisted -> 401s. Fixed by sourcing without a pipe.
- **Operator corrections (mistracking — do not repeat):**
  - The SonicWall password `T116623!` is **WRONG**. Howard reached the login page; the password
    is rejected. This was mishandled as a wrong-subnet/wrong-device problem and the bad password
    was re-offered repeatedly. Vault entry now marked REJECTED/INVALID. Logged to errorlog
    (`--correction`).
  - **No UniFi APs onsite.** Ubiquiti-OUI LAN devices were wrongly called "APs". WiFi is personal
    phones only; all machines hardwired.
- **Site Manager cloud API key 401** (`infrastructure/unifi-site-manager-api`, len 32) — cannot
  read inventory or configure devices via it. Logged to errorlog.

## Configuration Changes

- **No operational/network/server changes.** RMM commands were read-only (`ipconfig /all`,
  `route print`, `arp -a`, ping sweep).
- Vault: created `clients/prairie-schooner/sonicwall-admin`, then updated it to mark the password
  `REJECTED-2026-07-14-INVALID` with an explanatory note.
- errorlog.md: two entries — Site Manager API 401 (functional), and the correction (assumed the
  SonicWall password valid / mislabeled Ubiquiti devices as APs).

## Credentials & Secrets

- `clients/prairie-schooner/sonicwall-admin` — user `admin`, password field now
  `REJECTED-2026-07-14-INVALID`. The provided value `T116623!` was rejected at the SonicWall
  login page. **Real admin password unknown.** SonicWall being decommissioned; access not needed.
- `infrastructure/unifi-site-manager-api` — X-API-Key returns 401 (needs rotation/regeneration).
- `infrastructure/uos-server-network-api-rw` — RW admin `claudetools` @ https://172.16.3.29:11443
  (UOS Server). Not applicable to this standalone-console Pro.
- Domain creds (unchanged, from prior log): `clients/prairie-schooner/tps-domain-admin` (guru),
  `.../tps-administrator` (built-in, disabled), `.../tps-svr-dsrm`.

## Infrastructure & Servers

- Domain `TPS.local`. Flat LAN **192.168.1.0/24**, gateway **192.168.1.1** = SonicWall
  (MAC c0-ea-e4-33-cd-c8, being removed).
- **TPS-SERVER** (OLD DC): 192.168.1.125 (+ .120 alias), MAC 6c-0b-84-a5-d7-57, static, Server
  2016, all 5 FSMO, Enterprise Root CA `TPS-TPS-SERVER-CA`, DNS, file server, QuickBooks host.
  RMM `4f8dff0c-b033-4f66-9101-9350e32e0a81`.
- **TPS-SVR** (NEW DC): 192.168.1.135/24, MAC 5c-ed-8c-eb-26-a6, static, Server 2019, 2nd DC
  GC+DNS, 0-error replication. RMM `799675cf-5c94-465a-b653-63e08d016526`.
- **UDM Pro:** WAN public 184.191.143.52 (Cox dynamic DHCP), LAN isolated. Adopted to ui.com,
  owner mike@azcomputerguru.com. Standalone console in Site Manager.
- **SonicWall public IP** (current office egress): 184.176.147.183 (goes away at cutover).
- **USG** onsite, had 192.168.1.136. Role/wiring UNCONFIRMED.
- **Ping-sweep map, 192.168.1.0/24** (active hosts; ping-blocking hosts may be missed):
  - .1  c0-ea-e4-33-cd-c8  SonicWall (removing)
  - .120 + .125  6c-0b-84-a5-d7-57  TPS-SERVER (old DC, static; .120 = alias cruft)
  - .130  c0-25-a5-d5-2d-17  workstation
  - .135  5c-ed-8c-eb-26-a6  TPS-SVR (new DC, static)
  - .139  c0-25-a5-d5-2d-8b  **Tina's PC (hardwired)**
  - .141  80-5e-c0-1a-19-3d  Ubiquiti device (unidentified — NOT an AP)
  - .142  80-5e-c0-49-aa-06  Ubiquiti device (unidentified)
  - .145  e4-24-6c-2c-07-98  Ubiquiti device (unidentified)
  - .146  80-5e-c0-1a-14-ed  Ubiquiti device (unidentified)
  - .149  00-be-43-d3-72-bd  Mel-PC

## Commands & Outputs

- RMM auth (correct form, no pipe): `eval "$(bash .claude/scripts/rmm-auth.sh 2>/dev/null)"` then
  use `$TOKEN`/`$RMM`. Piping eval into `tail` drops the vars (subshell) -> 401.
- Discovery cmd on TPS-SVR: `ipconfig /all; route print -4; arp -a; nslookup myip.opendns.com
  resolver1.opendns.com; ping -n 2 1.1.1.1` -> confirmed .135/gw .1/DNS .125, egress
  184.176.147.183, internet up.
- Sweep: PowerShell async `Ping.SendPingAsync` 1..254 then `arp -a | Select-String 192.168.1.` ->
  the map above.
- Tailscale had to be started by Howard to reach 172.16.3.x (coord/RMM).

## Pending / Incomplete Tasks

Resume on Howard's desktop:
1. **ScreenConnect inventory** (per Howard — authoritative device+IP source): use `/screenconnect`
   to list this client's devices with IPs/MACs -> build the exact UniFi **DHCP reservation list**
   (MAC -> current IP) so every device keeps its IP.
2. **Identify** the 4 Ubiquiti-OUI LAN devices (.141/.142/.145/.146) and the **USG's** real role
   and wiring (switch vs router). Not APs per Howard.
3. Confirm the SonicWall DHCP scope range if obtainable (password unknown) — else use the
   inventory + a superset scope with reservations.
4. **Finalize the Pro config** (LAN 192.168.1.1/24 gw .1, domain tps.local, DHCP scope superset,
   reservations, client DNS = .135 then .125, disable content filtering/DNS shield), enter it in
   the UniFi app with the Pro LAN **isolated**, then **flip**: pull the SonicWall + USG, patch the
   machine switch into the Pro.
5. **After the swap, resume the paused AD migration:** FSMO transfer, CA migration
   (`Backup-CARoleService` key-export test first), QB Database Server Manager config, cutover,
   demote + power off old DC, stand up a real backup.

Operator note: keep tight, track stated facts, verify before acting — no assumptions.

## Reference Information

- Wiki: `wiki/clients/the-prairie-schooner.md` (migration status + resume checklist).
- Prior log: `clients/prairie-schooner/session-logs/2026-07/2026-07-10-howard-server-migration.md`.
- Syncro cid 3664974. Contact Tina Coalter, Tucson. Domain TPS.local.
- RMM `http://172.16.3.30:3001` (vault `infrastructure/gururmm-server.sops.yaml`).
- UniFi Site Manager unifi.ui.com (owner mike@azcomputerguru.com); UOS Server
  https://172.16.3.29:11443 / unifi.azcomputerguru.com (not used for this Pro).
