sync: auto-sync from ACG-TECH03L at 2026-07-14 14:43:38
Author: Howard Enos Machine: ACG-TECH03L Timestamp: 2026-07-14 14:43:38
This commit is contained in:
@@ -0,0 +1,2 @@
|
||||
ALIS ID,First Name,Last Name,Security Roles,Staff Status,Hire Date,Login Enabled,Email,Job Role
|
||||
450823,Jeanbaptiste,Munezero,Caregiver (Cascades),Hired,06/09/2026,Yes,j.munezero@cascadestucson.com,Caregiver
|
||||
|
BIN
clients/cascades-tucson/reports/alis-munezero-sso-update.xls
Normal file
BIN
clients/cascades-tucson/reports/alis-munezero-sso-update.xls
Normal file
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,156 @@
|
||||
## User
|
||||
- **User:** Howard Enos (howard)
|
||||
- **Machine:** ACG-TECH03L
|
||||
- **Role:** tech
|
||||
|
||||
# The Prairie Schooner — SonicWall + USG -> UniFi UDM Pro swap (prep + discovery)
|
||||
|
||||
> Onsite session, Howard. Goal: replace the SonicWall (and a USG) with the UDM Pro to regain
|
||||
> DHCP/DNS control and unblock the PAUSED TPS-SERVER -> TPS-SVR server migration. Session moved
|
||||
> to Howard's desktop mid-way — this log is the resume point. **No operational changes were
|
||||
> made; all work was read-only discovery.**
|
||||
|
||||
## Session Summary
|
||||
|
||||
Resumed the Prairie Schooner engagement to finish the server move by first swapping the edge
|
||||
gateway. Loaded prior context (wiki `the-prairie-schooner.md`, the 2026-07-10 server-migration
|
||||
log): the migration is paused because the SonicWall (192.168.1.1) owns DHCP and hands clients
|
||||
DNS = 192.168.1.125 (old DC), which must change before the old DC can be retired. Howard is
|
||||
onsite with a UDM Pro and a USG, neither previously adopted to our accounts.
|
||||
|
||||
Confirmed the live network read-only via GuruRMM against TPS-SVR (agent
|
||||
`799675cf-5c94-465a-b653-63e08d016526`): flat LAN 192.168.1.0/24, gateway .1 (SonicWall),
|
||||
domain TPS.local, servers static at .125/.135, building has internet. A ping sweep mapped the
|
||||
active hosts for a keep-the-IPs reservation plan. Determined the UDM Pro already has a public
|
||||
WAN via the Cox modem (dynamic public DHCP) and that, because there are no inbound services,
|
||||
the public-IP change at cutover is irrelevant.
|
||||
|
||||
Howard adopted the UDM Pro to the ui.com account and transferred ownership to
|
||||
mike@azcomputerguru.com. Established that it is a standalone UniFi console (its own Network
|
||||
app), correctly grouped in Site Manager with ~37 other ACG client consoles, and does NOT need
|
||||
to be nested in the self-hosted UOS Server. Confirmed there is no remote API path to configure
|
||||
it (Site Manager cloud API is read-only and its key currently 401), so its LAN/DHCP config must
|
||||
be entered in the UniFi app.
|
||||
|
||||
This session included operator-corrected mistakes (below). The SonicWall admin password
|
||||
provided is wrong (login page reachable, password rejected) — but SonicWall access is not
|
||||
actually required since there are no inbound rules/VPN/port-forwards to preserve. Session was
|
||||
saved here to continue on Howard's desktop; the authoritative device+IP inventory is to be
|
||||
pulled from ScreenConnect next.
|
||||
|
||||
## Key Decisions
|
||||
|
||||
- **UDM Pro is the single replacement for BOTH the SonicWall and the USG.** One edge device,
|
||||
flat 192.168.1.0/24. USG set aside.
|
||||
- **Standalone console under Mike's ui.com account is the correct home** — not the self-hosted
|
||||
UOS Server (172.16.3.29). Most ACG client sites run exactly this way; the UOS Server is only
|
||||
for console-less AP/switch sites. No re-adoption to the UOS Server needed.
|
||||
- **Public-IP change at cutover is acceptable** — no RDP/VPN/cameras/on-prem mail, so nothing
|
||||
inbound depends on the old address.
|
||||
- **Keep every device on its current IP** via a Pro DHCP scope that is a superset of today's plus
|
||||
fixed-IP reservations by MAC; static servers (.125/.135) unchanged and reserved out of the pool.
|
||||
- **Client DHCP DNS handed by the Pro = 192.168.1.135 then .125** (new DC first) — the migration
|
||||
objective; both DCs are up so it is transparent at flip.
|
||||
- **Do NOT need the SonicWall config** — no inbound services to extract; rebuild DHCP/reservations
|
||||
from the ScreenConnect inventory instead of the (inaccessible) SonicWall lease table.
|
||||
|
||||
## Problems Encountered
|
||||
|
||||
- **Off the internal network at first** — this machine had no route to 172.16.3.x (RMM/coord
|
||||
HTTP 000). Resolved when Howard started Tailscale; coord 200, RMM reachable.
|
||||
- **RMM auth vars lost to a subshell** — `eval "$(rmm-auth.sh)" | tail` ran eval in a pipe
|
||||
subshell so `$TOKEN`/`$RMM` never persisted -> 401s. Fixed by sourcing without a pipe.
|
||||
- **Operator corrections (mistracking — do not repeat):**
|
||||
- The SonicWall password `T116623!` is **WRONG**. Howard reached the login page; the password
|
||||
is rejected. This was mishandled as a wrong-subnet/wrong-device problem and the bad password
|
||||
was re-offered repeatedly. Vault entry now marked REJECTED/INVALID. Logged to errorlog
|
||||
(`--correction`).
|
||||
- **No UniFi APs onsite.** Ubiquiti-OUI LAN devices were wrongly called "APs". WiFi is personal
|
||||
phones only; all machines hardwired.
|
||||
- **Site Manager cloud API key 401** (`infrastructure/unifi-site-manager-api`, len 32) — cannot
|
||||
read inventory or configure devices via it. Logged to errorlog.
|
||||
|
||||
## Configuration Changes
|
||||
|
||||
- **No operational/network/server changes.** RMM commands were read-only (`ipconfig /all`,
|
||||
`route print`, `arp -a`, ping sweep).
|
||||
- Vault: created `clients/prairie-schooner/sonicwall-admin`, then updated it to mark the password
|
||||
`REJECTED-2026-07-14-INVALID` with an explanatory note.
|
||||
- errorlog.md: two entries — Site Manager API 401 (functional), and the correction (assumed the
|
||||
SonicWall password valid / mislabeled Ubiquiti devices as APs).
|
||||
|
||||
## Credentials & Secrets
|
||||
|
||||
- `clients/prairie-schooner/sonicwall-admin` — user `admin`, password field now
|
||||
`REJECTED-2026-07-14-INVALID`. The provided value `T116623!` was rejected at the SonicWall
|
||||
login page. **Real admin password unknown.** SonicWall being decommissioned; access not needed.
|
||||
- `infrastructure/unifi-site-manager-api` — X-API-Key returns 401 (needs rotation/regeneration).
|
||||
- `infrastructure/uos-server-network-api-rw` — RW admin `claudetools` @ https://172.16.3.29:11443
|
||||
(UOS Server). Not applicable to this standalone-console Pro.
|
||||
- Domain creds (unchanged, from prior log): `clients/prairie-schooner/tps-domain-admin` (guru),
|
||||
`.../tps-administrator` (built-in, disabled), `.../tps-svr-dsrm`.
|
||||
|
||||
## Infrastructure & Servers
|
||||
|
||||
- Domain `TPS.local`. Flat LAN **192.168.1.0/24**, gateway **192.168.1.1** = SonicWall
|
||||
(MAC c0-ea-e4-33-cd-c8, being removed).
|
||||
- **TPS-SERVER** (OLD DC): 192.168.1.125 (+ .120 alias), MAC 6c-0b-84-a5-d7-57, static, Server
|
||||
2016, all 5 FSMO, Enterprise Root CA `TPS-TPS-SERVER-CA`, DNS, file server, QuickBooks host.
|
||||
RMM `4f8dff0c-b033-4f66-9101-9350e32e0a81`.
|
||||
- **TPS-SVR** (NEW DC): 192.168.1.135/24, MAC 5c-ed-8c-eb-26-a6, static, Server 2019, 2nd DC
|
||||
GC+DNS, 0-error replication. RMM `799675cf-5c94-465a-b653-63e08d016526`.
|
||||
- **UDM Pro:** WAN public 184.191.143.52 (Cox dynamic DHCP), LAN isolated. Adopted to ui.com,
|
||||
owner mike@azcomputerguru.com. Standalone console in Site Manager.
|
||||
- **SonicWall public IP** (current office egress): 184.176.147.183 (goes away at cutover).
|
||||
- **USG** onsite, had 192.168.1.136. Role/wiring UNCONFIRMED.
|
||||
- **Ping-sweep map, 192.168.1.0/24** (active hosts; ping-blocking hosts may be missed):
|
||||
- .1 c0-ea-e4-33-cd-c8 SonicWall (removing)
|
||||
- .120 + .125 6c-0b-84-a5-d7-57 TPS-SERVER (old DC, static; .120 = alias cruft)
|
||||
- .130 c0-25-a5-d5-2d-17 workstation
|
||||
- .135 5c-ed-8c-eb-26-a6 TPS-SVR (new DC, static)
|
||||
- .139 c0-25-a5-d5-2d-8b **Tina's PC (hardwired)**
|
||||
- .141 80-5e-c0-1a-19-3d Ubiquiti device (unidentified — NOT an AP)
|
||||
- .142 80-5e-c0-49-aa-06 Ubiquiti device (unidentified)
|
||||
- .145 e4-24-6c-2c-07-98 Ubiquiti device (unidentified)
|
||||
- .146 80-5e-c0-1a-14-ed Ubiquiti device (unidentified)
|
||||
- .149 00-be-43-d3-72-bd Mel-PC
|
||||
|
||||
## Commands & Outputs
|
||||
|
||||
- RMM auth (correct form, no pipe): `eval "$(bash .claude/scripts/rmm-auth.sh 2>/dev/null)"` then
|
||||
use `$TOKEN`/`$RMM`. Piping eval into `tail` drops the vars (subshell) -> 401.
|
||||
- Discovery cmd on TPS-SVR: `ipconfig /all; route print -4; arp -a; nslookup myip.opendns.com
|
||||
resolver1.opendns.com; ping -n 2 1.1.1.1` -> confirmed .135/gw .1/DNS .125, egress
|
||||
184.176.147.183, internet up.
|
||||
- Sweep: PowerShell async `Ping.SendPingAsync` 1..254 then `arp -a | Select-String 192.168.1.` ->
|
||||
the map above.
|
||||
- Tailscale had to be started by Howard to reach 172.16.3.x (coord/RMM).
|
||||
|
||||
## Pending / Incomplete Tasks
|
||||
|
||||
Resume on Howard's desktop:
|
||||
1. **ScreenConnect inventory** (per Howard — authoritative device+IP source): use `/screenconnect`
|
||||
to list this client's devices with IPs/MACs -> build the exact UniFi **DHCP reservation list**
|
||||
(MAC -> current IP) so every device keeps its IP.
|
||||
2. **Identify** the 4 Ubiquiti-OUI LAN devices (.141/.142/.145/.146) and the **USG's** real role
|
||||
and wiring (switch vs router). Not APs per Howard.
|
||||
3. Confirm the SonicWall DHCP scope range if obtainable (password unknown) — else use the
|
||||
inventory + a superset scope with reservations.
|
||||
4. **Finalize the Pro config** (LAN 192.168.1.1/24 gw .1, domain tps.local, DHCP scope superset,
|
||||
reservations, client DNS = .135 then .125, disable content filtering/DNS shield), enter it in
|
||||
the UniFi app with the Pro LAN **isolated**, then **flip**: pull the SonicWall + USG, patch the
|
||||
machine switch into the Pro.
|
||||
5. **After the swap, resume the paused AD migration:** FSMO transfer, CA migration
|
||||
(`Backup-CARoleService` key-export test first), QB Database Server Manager config, cutover,
|
||||
demote + power off old DC, stand up a real backup.
|
||||
|
||||
Operator note: keep tight, track stated facts, verify before acting — no assumptions.
|
||||
|
||||
## Reference Information
|
||||
|
||||
- Wiki: `wiki/clients/the-prairie-schooner.md` (migration status + resume checklist).
|
||||
- Prior log: `clients/prairie-schooner/session-logs/2026-07/2026-07-10-howard-server-migration.md`.
|
||||
- Syncro cid 3664974. Contact Tina Coalter, Tucson. Domain TPS.local.
|
||||
- RMM `http://172.16.3.30:3001` (vault `infrastructure/gururmm-server.sops.yaml`).
|
||||
- UniFi Site Manager unifi.ui.com (owner mike@azcomputerguru.com); UOS Server
|
||||
https://172.16.3.29:11443 / unifi.azcomputerguru.com (not used for this Pro).
|
||||
Reference in New Issue
Block a user