azcomputerguru/claudetools
1
0
Fork 0
Code Issues 58 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5aeabbcfb60ff12ec485f502a5c362bc28f4e1d9
claudetools/clients/prairie-schooner/session-logs/2026-07/2026-07-14-howard-sonicwall-usg-to-udmpro-swap-prep.md
Howard Enos 088ffb7645 sync: auto-sync from ACG-TECH03L at 2026-07-14 14:43:38 
Author: Howard Enos
Machine: ACG-TECH03L
Timestamp: 2026-07-14 14:43:38
2026-07-14 14:47:06 -07:00

9.4 KiB
Raw Blame History

User

  • User: Howard Enos (howard)
  • Machine: ACG-TECH03L
  • Role: tech

The Prairie Schooner — SonicWall + USG -> UniFi UDM Pro swap (prep + discovery)

Onsite session, Howard. Goal: replace the SonicWall (and a USG) with the UDM Pro to regain DHCP/DNS control and unblock the PAUSED TPS-SERVER -> TPS-SVR server migration. Session moved to Howard's desktop mid-way — this log is the resume point. No operational changes were made; all work was read-only discovery.

Session Summary

Resumed the Prairie Schooner engagement to finish the server move by first swapping the edge gateway. Loaded prior context (wiki the-prairie-schooner.md, the 2026-07-10 server-migration log): the migration is paused because the SonicWall (192.168.1.1) owns DHCP and hands clients DNS = 192.168.1.125 (old DC), which must change before the old DC can be retired. Howard is onsite with a UDM Pro and a USG, neither previously adopted to our accounts.

Confirmed the live network read-only via GuruRMM against TPS-SVR (agent 799675cf-5c94-465a-b653-63e08d016526): flat LAN 192.168.1.0/24, gateway .1 (SonicWall), domain TPS.local, servers static at .125/.135, building has internet. A ping sweep mapped the active hosts for a keep-the-IPs reservation plan. Determined the UDM Pro already has a public WAN via the Cox modem (dynamic public DHCP) and that, because there are no inbound services, the public-IP change at cutover is irrelevant.

Howard adopted the UDM Pro to the ui.com account and transferred ownership to mike@azcomputerguru.com. Established that it is a standalone UniFi console (its own Network app), correctly grouped in Site Manager with ~37 other ACG client consoles, and does NOT need to be nested in the self-hosted UOS Server. Confirmed there is no remote API path to configure it (Site Manager cloud API is read-only and its key currently 401), so its LAN/DHCP config must be entered in the UniFi app.

This session included operator-corrected mistakes (below). The SonicWall admin password provided is wrong (login page reachable, password rejected) — but SonicWall access is not actually required since there are no inbound rules/VPN/port-forwards to preserve. Session was saved here to continue on Howard's desktop; the authoritative device+IP inventory is to be pulled from ScreenConnect next.

Key Decisions

  • UDM Pro is the single replacement for BOTH the SonicWall and the USG. One edge device, flat 192.168.1.0/24. USG set aside.
  • Standalone console under Mike's ui.com account is the correct home — not the self-hosted UOS Server (172.16.3.29). Most ACG client sites run exactly this way; the UOS Server is only for console-less AP/switch sites. No re-adoption to the UOS Server needed.
  • Public-IP change at cutover is acceptable — no RDP/VPN/cameras/on-prem mail, so nothing inbound depends on the old address.
  • Keep every device on its current IP via a Pro DHCP scope that is a superset of today's plus fixed-IP reservations by MAC; static servers (.125/.135) unchanged and reserved out of the pool.
  • Client DHCP DNS handed by the Pro = 192.168.1.135 then .125 (new DC first) — the migration objective; both DCs are up so it is transparent at flip.
  • Do NOT need the SonicWall config — no inbound services to extract; rebuild DHCP/reservations from the ScreenConnect inventory instead of the (inaccessible) SonicWall lease table.

Problems Encountered

  • Off the internal network at first — this machine had no route to 172.16.3.x (RMM/coord HTTP 000). Resolved when Howard started Tailscale; coord 200, RMM reachable.
  • RMM auth vars lost to a subshell — eval "$(rmm-auth.sh)" | tail ran eval in a pipe subshell so $TOKEN/$RMM never persisted -> 401s. Fixed by sourcing without a pipe.
  • Operator corrections (mistracking — do not repeat):
    • The SonicWall password T116623! is WRONG. Howard reached the login page; the password is rejected. This was mishandled as a wrong-subnet/wrong-device problem and the bad password was re-offered repeatedly. Vault entry now marked REJECTED/INVALID. Logged to errorlog (--correction).
    • No UniFi APs onsite. Ubiquiti-OUI LAN devices were wrongly called "APs". WiFi is personal phones only; all machines hardwired.
  • Site Manager cloud API key 401 (infrastructure/unifi-site-manager-api, len 32) — cannot read inventory or configure devices via it. Logged to errorlog.

Configuration Changes

  • No operational/network/server changes. RMM commands were read-only (ipconfig /all, route print, arp -a, ping sweep).
  • Vault: created clients/prairie-schooner/sonicwall-admin, then updated it to mark the password REJECTED-2026-07-14-INVALID with an explanatory note.
  • errorlog.md: two entries — Site Manager API 401 (functional), and the correction (assumed the SonicWall password valid / mislabeled Ubiquiti devices as APs).

Credentials & Secrets

  • clients/prairie-schooner/sonicwall-admin — user admin, password field now REJECTED-2026-07-14-INVALID. The provided value T116623! was rejected at the SonicWall login page. Real admin password unknown. SonicWall being decommissioned; access not needed.
  • infrastructure/unifi-site-manager-api — X-API-Key returns 401 (needs rotation/regeneration).
  • infrastructure/uos-server-network-api-rw — RW admin claudetools @ https://172.16.3.29:11443 (UOS Server). Not applicable to this standalone-console Pro.
  • Domain creds (unchanged, from prior log): clients/prairie-schooner/tps-domain-admin (guru), .../tps-administrator (built-in, disabled), .../tps-svr-dsrm.

Infrastructure & Servers

  • Domain TPS.local. Flat LAN 192.168.1.0/24, gateway 192.168.1.1 = SonicWall (MAC c0-ea-e4-33-cd-c8, being removed).
  • TPS-SERVER (OLD DC): 192.168.1.125 (+ .120 alias), MAC 6c-0b-84-a5-d7-57, static, Server 2016, all 5 FSMO, Enterprise Root CA TPS-TPS-SERVER-CA, DNS, file server, QuickBooks host. RMM 4f8dff0c-b033-4f66-9101-9350e32e0a81.
  • TPS-SVR (NEW DC): 192.168.1.135/24, MAC 5c-ed-8c-eb-26-a6, static, Server 2019, 2nd DC GC+DNS, 0-error replication. RMM 799675cf-5c94-465a-b653-63e08d016526.
  • UDM Pro: WAN public 184.191.143.52 (Cox dynamic DHCP), LAN isolated. Adopted to ui.com, owner mike@azcomputerguru.com. Standalone console in Site Manager.
  • SonicWall public IP (current office egress): 184.176.147.183 (goes away at cutover).
  • USG onsite, had 192.168.1.136. Role/wiring UNCONFIRMED.
  • Ping-sweep map, 192.168.1.0/24 (active hosts; ping-blocking hosts may be missed):
    • .1 c0-ea-e4-33-cd-c8 SonicWall (removing)
    • .120 + .125 6c-0b-84-a5-d7-57 TPS-SERVER (old DC, static; .120 = alias cruft)
    • .130 c0-25-a5-d5-2d-17 workstation
    • .135 5c-ed-8c-eb-26-a6 TPS-SVR (new DC, static)
    • .139 c0-25-a5-d5-2d-8b Tina's PC (hardwired)
    • .141 80-5e-c0-1a-19-3d Ubiquiti device (unidentified — NOT an AP)
    • .142 80-5e-c0-49-aa-06 Ubiquiti device (unidentified)
    • .145 e4-24-6c-2c-07-98 Ubiquiti device (unidentified)
    • .146 80-5e-c0-1a-14-ed Ubiquiti device (unidentified)
    • .149 00-be-43-d3-72-bd Mel-PC

Commands & Outputs

  • RMM auth (correct form, no pipe): eval "$(bash .claude/scripts/rmm-auth.sh 2>/dev/null)" then use $TOKEN/$RMM. Piping eval into tail drops the vars (subshell) -> 401.
  • Discovery cmd on TPS-SVR: ipconfig /all; route print -4; arp -a; nslookup myip.opendns.com resolver1.opendns.com; ping -n 2 1.1.1.1 -> confirmed .135/gw .1/DNS .125, egress 184.176.147.183, internet up.
  • Sweep: PowerShell async Ping.SendPingAsync 1..254 then arp -a | Select-String 192.168.1. -> the map above.
  • Tailscale had to be started by Howard to reach 172.16.3.x (coord/RMM).

Pending / Incomplete Tasks

Resume on Howard's desktop:

  1. ScreenConnect inventory (per Howard — authoritative device+IP source): use /screenconnect to list this client's devices with IPs/MACs -> build the exact UniFi DHCP reservation list (MAC -> current IP) so every device keeps its IP.
  2. Identify the 4 Ubiquiti-OUI LAN devices (.141/.142/.145/.146) and the USG's real role and wiring (switch vs router). Not APs per Howard.
  3. Confirm the SonicWall DHCP scope range if obtainable (password unknown) — else use the inventory + a superset scope with reservations.
  4. Finalize the Pro config (LAN 192.168.1.1/24 gw .1, domain tps.local, DHCP scope superset, reservations, client DNS = .135 then .125, disable content filtering/DNS shield), enter it in the UniFi app with the Pro LAN isolated, then flip: pull the SonicWall + USG, patch the machine switch into the Pro.
  5. After the swap, resume the paused AD migration: FSMO transfer, CA migration (Backup-CARoleService key-export test first), QB Database Server Manager config, cutover, demote + power off old DC, stand up a real backup.

Operator note: keep tight, track stated facts, verify before acting — no assumptions.

Reference Information

  • Wiki: wiki/clients/the-prairie-schooner.md (migration status + resume checklist).
  • Prior log: clients/prairie-schooner/session-logs/2026-07/2026-07-10-howard-server-migration.md.
  • Syncro cid 3664974. Contact Tina Coalter, Tucson. Domain TPS.local.
  • RMM http://172.16.3.30:3001 (vault infrastructure/gururmm-server.sops.yaml).
  • UniFi Site Manager unifi.ui.com (owner mike@azcomputerguru.com); UOS Server https://172.16.3.29:11443 / unifi.azcomputerguru.com (not used for this Pro).
Reference in New Issue View Git Blame Copy Permalink