sync: auto-sync from HOWARD-HOME at 2026-07-14 17:02:24

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-14 17:02:24

clients/prairie-schooner/udm-dhcp-plan.md

@@ -0,0 +1,59 @@
+# The Prairie Schooner — UDM Pro LAN/DHCP Plan (SonicWall+USG replacement)
+
+Built 2026-07-14 from ScreenConnect inventory (authoritative, per Howard) cross-checked
+against the 2026-07-14 onsite ping sweep. Goal: every device keeps its current IP.
+
+## LAN settings (UDM Pro Network app)
+
+- Network: 192.168.1.0/24, gateway **192.168.1.1** (Pro takes the SonicWall's IP)
+- Domain name: `tps.local`
+- DHCP pool (superset of today's clients): **192.168.1.100 – 192.168.1.199**
+  - Statics .125 and .135 are OUTSIDE reservations but INSIDE this range — see exclusions below.
+- DHCP DNS handed to clients: **192.168.1.135, 192.168.1.125** (new DC first — this is the
+  migration unblock)
+- Disable content filtering / DNS Shield / ad-block (DCs do DNS)
+
+## Fixed-IP reservations (MAC -> IP)
+
+| IP | MAC | Device | Source |
+|---|---|---|---|
+| 192.168.1.130 | C0:25:A5:D5:2D:17 | TPS-JAYMI (Win11, OptiPlex 5090, SN 4FMLGR3) | SC + sweep |
+| 192.168.1.139 | C0:25:A5:D5:2D:8B | TPS-TINA (Win11, OptiPlex 5090, SN HBMLGR3) | SC + sweep |
+| 192.168.1.149 | 00:BE:43:D3:72:BD | MEL-PC (Win10, OptiPlex 5090, SN 5DMLGR3, user erin) | SC + sweep |
+| 192.168.1.141 | 80:5E:C0:1A:19:3D | Yealink desk phone | sweep + TLS/HTTP probe 2026-07-14 |
+| 192.168.1.142 | 80:5E:C0:49:AA:06 | Yealink desk phone (cert CN 805ec049aa06) | sweep + TLS/HTTP probe |
+| 192.168.1.145 | E4:24:6C:2C:07:98 | Dahua NVR (camera recorder) | sweep + TLS/HTTP probe |
+| 192.168.1.146 | 80:5E:C0:1A:14:ED | Yealink desk phone | sweep + TLS/HTTP probe |
+
+## Static hosts (no reservation — configured on the host; keep OUT of active leases)
+
+| IP | MAC | Device |
+|---|---|---|
+| 192.168.1.125 + .120 | 6C:0B:84:A5:D7:57 | TPS-SERVER (old DC, Server 2016, TS140). SC reports .120 as the NIC primary; .120 and .125 both bound to this NIC. |
+| 192.168.1.135 | 5C:ED:8C:EB:26:A6 | TPS-SVR (new DC, Server 2019, MicroServer Gen10+ v2) |
+
+UniFi note: if the app complains about statics inside the pool, either create dummy fixed-IP
+entries for .125/.135 with their MACs, or shrink the pool to .100–.119 + .126–.134 equivalent —
+simplest is pool .140–.199 plus the reservations above; any layout is fine as long as .120,
+.125, .135 can never be leased to another MAC.
+
+## Cutover sequence
+
+1. Enter LAN config on the Pro with its LAN port ISOLATED (nothing but a laptop).
+2. Verify reservations + DNS order in the running config.
+3. Pull SonicWall (.1) and USG; patch the office switch into the Pro's LAN.
+4. `ipconfig /renew` on a workstation -> expect same IP, DNS = .135, .125, internet up.
+5. Public egress changes from 184.176.147.183 to the Cox-dynamic WAN (184.191.143.52 at
+   adoption) — acceptable, no inbound services.
+6. Then resume the paused AD migration (FSMO, CA, QB DBSM, demote old DC).
+
+## Open items
+
+- ~~Identify the 4 unknown LAN devices~~ DONE 2026-07-14: 3x Yealink desk phones
+  (.141/.142/.146 — the "Ubiquiti OUI" read was wrong, 80:5E:C0 is Yealink) + 1x Dahua NVR
+  (.145). Both are outbound-only (hosted SIP / Dahua P2P) — no inbound rules needed; the
+  public-IP change at cutover stays a non-issue. Post-flip check: phones re-register, NVR
+  remote view works.
+- USG's real role/wiring still unconfirmed (previously seen at .136 — not answering the sweep).
+  Physically trace it at flip time; it is being removed either way.
+- SonicWall DHCP scope unknown (admin password invalid) — superset pool above covers it.