sync: auto-sync from ACG-TECH03L at 2026-07-14 14:43:38

Author: Howard Enos
Machine: ACG-TECH03L
Timestamp: 2026-07-14 14:43:38
This commit is contained in:
2026-07-14 14:46:01 -07:00
parent 548ebb8a20
commit 088ffb7645
10 changed files with 530 additions and 0 deletions

View File

@@ -0,0 +1,2 @@
ALIS ID,First Name,Last Name,Security Roles,Staff Status,Hire Date,Login Enabled,Email,Job Role
450823,Jeanbaptiste,Munezero,Caregiver (Cascades),Hired,06/09/2026,Yes,j.munezero@cascadestucson.com,Caregiver
1 ALIS ID First Name Last Name Security Roles Staff Status Hire Date Login Enabled Email Job Role
2 450823 Jeanbaptiste Munezero Caregiver (Cascades) Hired 06/09/2026 Yes j.munezero@cascadestucson.com Caregiver

View File

@@ -0,0 +1,156 @@
## User
- **User:** Howard Enos (howard)
- **Machine:** ACG-TECH03L
- **Role:** tech
# The Prairie Schooner — SonicWall + USG -> UniFi UDM Pro swap (prep + discovery)
> Onsite session, Howard. Goal: replace the SonicWall (and a USG) with the UDM Pro to regain
> DHCP/DNS control and unblock the PAUSED TPS-SERVER -> TPS-SVR server migration. Session moved
> to Howard's desktop mid-way — this log is the resume point. **No operational changes were
> made; all work was read-only discovery.**
## Session Summary
Resumed the Prairie Schooner engagement to finish the server move by first swapping the edge
gateway. Loaded prior context (wiki `the-prairie-schooner.md`, the 2026-07-10 server-migration
log): the migration is paused because the SonicWall (192.168.1.1) owns DHCP and hands clients
DNS = 192.168.1.125 (old DC), which must change before the old DC can be retired. Howard is
onsite with a UDM Pro and a USG, neither previously adopted to our accounts.
Confirmed the live network read-only via GuruRMM against TPS-SVR (agent
`799675cf-5c94-465a-b653-63e08d016526`): flat LAN 192.168.1.0/24, gateway .1 (SonicWall),
domain TPS.local, servers static at .125/.135, building has internet. A ping sweep mapped the
active hosts for a keep-the-IPs reservation plan. Determined the UDM Pro already has a public
WAN via the Cox modem (dynamic public DHCP) and that, because there are no inbound services,
the public-IP change at cutover is irrelevant.
Howard adopted the UDM Pro to the ui.com account and transferred ownership to
mike@azcomputerguru.com. Established that it is a standalone UniFi console (its own Network
app), correctly grouped in Site Manager with ~37 other ACG client consoles, and does NOT need
to be nested in the self-hosted UOS Server. Confirmed there is no remote API path to configure
it (Site Manager cloud API is read-only and its key currently 401), so its LAN/DHCP config must
be entered in the UniFi app.
This session included operator-corrected mistakes (below). The SonicWall admin password
provided is wrong (login page reachable, password rejected) — but SonicWall access is not
actually required since there are no inbound rules/VPN/port-forwards to preserve. Session was
saved here to continue on Howard's desktop; the authoritative device+IP inventory is to be
pulled from ScreenConnect next.
## Key Decisions
- **UDM Pro is the single replacement for BOTH the SonicWall and the USG.** One edge device,
flat 192.168.1.0/24. USG set aside.
- **Standalone console under Mike's ui.com account is the correct home** — not the self-hosted
UOS Server (172.16.3.29). Most ACG client sites run exactly this way; the UOS Server is only
for console-less AP/switch sites. No re-adoption to the UOS Server needed.
- **Public-IP change at cutover is acceptable** — no RDP/VPN/cameras/on-prem mail, so nothing
inbound depends on the old address.
- **Keep every device on its current IP** via a Pro DHCP scope that is a superset of today's plus
fixed-IP reservations by MAC; static servers (.125/.135) unchanged and reserved out of the pool.
- **Client DHCP DNS handed by the Pro = 192.168.1.135 then .125** (new DC first) — the migration
objective; both DCs are up so it is transparent at flip.
- **Do NOT need the SonicWall config** — no inbound services to extract; rebuild DHCP/reservations
from the ScreenConnect inventory instead of the (inaccessible) SonicWall lease table.
## Problems Encountered
- **Off the internal network at first** — this machine had no route to 172.16.3.x (RMM/coord
HTTP 000). Resolved when Howard started Tailscale; coord 200, RMM reachable.
- **RMM auth vars lost to a subshell** — `eval "$(rmm-auth.sh)" | tail` ran eval in a pipe
subshell so `$TOKEN`/`$RMM` never persisted -> 401s. Fixed by sourcing without a pipe.
- **Operator corrections (mistracking — do not repeat):**
- The SonicWall password `T116623!` is **WRONG**. Howard reached the login page; the password
is rejected. This was mishandled as a wrong-subnet/wrong-device problem and the bad password
was re-offered repeatedly. Vault entry now marked REJECTED/INVALID. Logged to errorlog
(`--correction`).
- **No UniFi APs onsite.** Ubiquiti-OUI LAN devices were wrongly called "APs". WiFi is personal
phones only; all machines hardwired.
- **Site Manager cloud API key 401** (`infrastructure/unifi-site-manager-api`, len 32) — cannot
read inventory or configure devices via it. Logged to errorlog.
## Configuration Changes
- **No operational/network/server changes.** RMM commands were read-only (`ipconfig /all`,
`route print`, `arp -a`, ping sweep).
- Vault: created `clients/prairie-schooner/sonicwall-admin`, then updated it to mark the password
`REJECTED-2026-07-14-INVALID` with an explanatory note.
- errorlog.md: two entries — Site Manager API 401 (functional), and the correction (assumed the
SonicWall password valid / mislabeled Ubiquiti devices as APs).
## Credentials & Secrets
- `clients/prairie-schooner/sonicwall-admin` — user `admin`, password field now
`REJECTED-2026-07-14-INVALID`. The provided value `T116623!` was rejected at the SonicWall
login page. **Real admin password unknown.** SonicWall being decommissioned; access not needed.
- `infrastructure/unifi-site-manager-api` — X-API-Key returns 401 (needs rotation/regeneration).
- `infrastructure/uos-server-network-api-rw` — RW admin `claudetools` @ https://172.16.3.29:11443
(UOS Server). Not applicable to this standalone-console Pro.
- Domain creds (unchanged, from prior log): `clients/prairie-schooner/tps-domain-admin` (guru),
`.../tps-administrator` (built-in, disabled), `.../tps-svr-dsrm`.
## Infrastructure & Servers
- Domain `TPS.local`. Flat LAN **192.168.1.0/24**, gateway **192.168.1.1** = SonicWall
(MAC c0-ea-e4-33-cd-c8, being removed).
- **TPS-SERVER** (OLD DC): 192.168.1.125 (+ .120 alias), MAC 6c-0b-84-a5-d7-57, static, Server
2016, all 5 FSMO, Enterprise Root CA `TPS-TPS-SERVER-CA`, DNS, file server, QuickBooks host.
RMM `4f8dff0c-b033-4f66-9101-9350e32e0a81`.
- **TPS-SVR** (NEW DC): 192.168.1.135/24, MAC 5c-ed-8c-eb-26-a6, static, Server 2019, 2nd DC
GC+DNS, 0-error replication. RMM `799675cf-5c94-465a-b653-63e08d016526`.
- **UDM Pro:** WAN public 184.191.143.52 (Cox dynamic DHCP), LAN isolated. Adopted to ui.com,
owner mike@azcomputerguru.com. Standalone console in Site Manager.
- **SonicWall public IP** (current office egress): 184.176.147.183 (goes away at cutover).
- **USG** onsite, had 192.168.1.136. Role/wiring UNCONFIRMED.
- **Ping-sweep map, 192.168.1.0/24** (active hosts; ping-blocking hosts may be missed):
- .1 c0-ea-e4-33-cd-c8 SonicWall (removing)
- .120 + .125 6c-0b-84-a5-d7-57 TPS-SERVER (old DC, static; .120 = alias cruft)
- .130 c0-25-a5-d5-2d-17 workstation
- .135 5c-ed-8c-eb-26-a6 TPS-SVR (new DC, static)
- .139 c0-25-a5-d5-2d-8b **Tina's PC (hardwired)**
- .141 80-5e-c0-1a-19-3d Ubiquiti device (unidentified — NOT an AP)
- .142 80-5e-c0-49-aa-06 Ubiquiti device (unidentified)
- .145 e4-24-6c-2c-07-98 Ubiquiti device (unidentified)
- .146 80-5e-c0-1a-14-ed Ubiquiti device (unidentified)
- .149 00-be-43-d3-72-bd Mel-PC
## Commands & Outputs
- RMM auth (correct form, no pipe): `eval "$(bash .claude/scripts/rmm-auth.sh 2>/dev/null)"` then
use `$TOKEN`/`$RMM`. Piping eval into `tail` drops the vars (subshell) -> 401.
- Discovery cmd on TPS-SVR: `ipconfig /all; route print -4; arp -a; nslookup myip.opendns.com
resolver1.opendns.com; ping -n 2 1.1.1.1` -> confirmed .135/gw .1/DNS .125, egress
184.176.147.183, internet up.
- Sweep: PowerShell async `Ping.SendPingAsync` 1..254 then `arp -a | Select-String 192.168.1.` ->
the map above.
- Tailscale had to be started by Howard to reach 172.16.3.x (coord/RMM).
## Pending / Incomplete Tasks
Resume on Howard's desktop:
1. **ScreenConnect inventory** (per Howard — authoritative device+IP source): use `/screenconnect`
to list this client's devices with IPs/MACs -> build the exact UniFi **DHCP reservation list**
(MAC -> current IP) so every device keeps its IP.
2. **Identify** the 4 Ubiquiti-OUI LAN devices (.141/.142/.145/.146) and the **USG's** real role
and wiring (switch vs router). Not APs per Howard.
3. Confirm the SonicWall DHCP scope range if obtainable (password unknown) — else use the
inventory + a superset scope with reservations.
4. **Finalize the Pro config** (LAN 192.168.1.1/24 gw .1, domain tps.local, DHCP scope superset,
reservations, client DNS = .135 then .125, disable content filtering/DNS shield), enter it in
the UniFi app with the Pro LAN **isolated**, then **flip**: pull the SonicWall + USG, patch the
machine switch into the Pro.
5. **After the swap, resume the paused AD migration:** FSMO transfer, CA migration
(`Backup-CARoleService` key-export test first), QB Database Server Manager config, cutover,
demote + power off old DC, stand up a real backup.
Operator note: keep tight, track stated facts, verify before acting — no assumptions.
## Reference Information
- Wiki: `wiki/clients/the-prairie-schooner.md` (migration status + resume checklist).
- Prior log: `clients/prairie-schooner/session-logs/2026-07/2026-07-10-howard-server-migration.md`.
- Syncro cid 3664974. Contact Tina Coalter, Tucson. Domain TPS.local.
- RMM `http://172.16.3.30:3001` (vault `infrastructure/gururmm-server.sops.yaml`).
- UniFi Site Manager unifi.ui.com (owner mike@azcomputerguru.com); UOS Server
https://172.16.3.29:11443 / unifi.azcomputerguru.com (not used for this Pro).