71 lines
4.1 KiB
Markdown
71 lines
4.1 KiB
Markdown
# The Prairie Schooner — UDM Pro LAN/DHCP Plan (SonicWall+USG replacement)
|
||
|
||
Built 2026-07-14 from ScreenConnect inventory (authoritative, per Howard) cross-checked
|
||
against the 2026-07-14 onsite ping sweep. Goal: every device keeps its current IP.
|
||
|
||
## LAN settings (UDM Pro Network app)
|
||
|
||
- Network: 192.168.1.0/24, gateway **192.168.1.1** (Pro takes the SonicWall's IP)
|
||
- Domain name: `tps.local`
|
||
- DHCP pool (superset of today's clients): **192.168.1.100 – 192.168.1.199**
|
||
- Statics .125 and .135 are OUTSIDE reservations but INSIDE this range — see exclusions below.
|
||
- DHCP DNS handed to clients: **192.168.1.125, 192.168.1.135** for the swap (SAME primary as
|
||
the SonicWall hands today — the gateway swap must change nothing observable). AFTER the
|
||
network is proven, flip the order to .135 first on the Pro (the migration unblock — now a
|
||
10-second change we control).
|
||
- Disable content filtering / DNS Shield / ad-block (DCs do DNS)
|
||
|
||
## Fixed-IP reservations (MAC -> IP)
|
||
|
||
| IP | MAC | Device | Source |
|
||
|---|---|---|---|
|
||
| 192.168.1.130 | C0:25:A5:D5:2D:17 | TPS-JAYMI (Win11, OptiPlex 5090, SN 4FMLGR3) | SC + sweep |
|
||
| 192.168.1.139 | C0:25:A5:D5:2D:8B | TPS-TINA (Win11, OptiPlex 5090, SN HBMLGR3) | SC + sweep |
|
||
| 192.168.1.149 | 00:BE:43:D3:72:BD | MEL-PC (Win10, OptiPlex 5090, SN 5DMLGR3, user erin) | SC + sweep |
|
||
| 192.168.1.141 | 80:5E:C0:1A:19:3D | Yealink desk phone | sweep + TLS/HTTP probe 2026-07-14 |
|
||
| 192.168.1.142 | 80:5E:C0:49:AA:06 | Yealink desk phone (cert CN 805ec049aa06) | sweep + TLS/HTTP probe |
|
||
| 192.168.1.145 | E4:24:6C:2C:07:98 | Dahua NVR (camera recorder) | sweep + TLS/HTTP probe |
|
||
| 192.168.1.146 | 80:5E:C0:1A:14:ED | Yealink desk phone | sweep + TLS/HTTP probe |
|
||
|
||
## Static hosts (no reservation — configured on the host; keep OUT of active leases)
|
||
|
||
| IP | MAC | Device |
|
||
|---|---|---|
|
||
| 192.168.1.125 + .120 | 6C:0B:84:A5:D7:57 | TPS-SERVER (old DC, Server 2016, TS140). SC reports .120 as the NIC primary; .120 and .125 both bound to this NIC. |
|
||
| 192.168.1.135 | 5C:ED:8C:EB:26:A6 | TPS-SVR (new DC, Server 2019, MicroServer Gen10+ v2) |
|
||
|
||
UniFi note: if the app complains about statics inside the pool, either create dummy fixed-IP
|
||
entries for .125/.135 with their MACs, or shrink the pool to .100–.119 + .126–.134 equivalent —
|
||
simplest is pool .140–.199 plus the reservations above; any layout is fine as long as .120,
|
||
.125, .135 can never be leased to another MAC.
|
||
|
||
## Cutover sequence
|
||
|
||
1. Enter LAN config on the Pro with its LAN port ISOLATED (nothing but a laptop).
|
||
2. Verify reservations + DNS order in the running config.
|
||
3. Pull SonicWall (.1) and USG; patch the office switch into the Pro's LAN.
|
||
4. `ipconfig /renew` on a workstation -> expect same IP, DNS = .135, .125, internet up.
|
||
5. Public egress changes from 184.176.147.183 to the Cox-dynamic WAN (184.191.143.52 at
|
||
adoption) — acceptable, no inbound services.
|
||
6. Then resume the paused AD migration (FSMO, CA, QB DBSM, demote old DC).
|
||
|
||
## As-built 2026-07-15
|
||
|
||
- Swap completed and verified onsite (see cutover-runbook.md AS-BUILT section).
|
||
- The device previously listed as the "USG" (.136) is actually a **UniFi USW-Lite-16-PoE**
|
||
switch — no separate USG ever existed. Kept in service: adopted into the Pro's console,
|
||
uplinked to the Pro's LAN port; PoE-powers the 3x Yealink phones. Give it a fixed IP
|
||
(Devices -> switch -> Settings -> Network) once its DHCP address is noted.
|
||
- Workstation fixed IPs set in UniFi 2026-07-15; security toggles confirmed OFF.
|
||
|
||
## Open items
|
||
|
||
- ~~Identify the 4 unknown LAN devices~~ DONE 2026-07-14: 3x Yealink desk phones
|
||
(.141/.142/.146 — the "Ubiquiti OUI" read was wrong, 80:5E:C0 is Yealink) + 1x Dahua NVR
|
||
(.145). Both are outbound-only (hosted SIP / Dahua P2P) — no inbound rules needed; the
|
||
public-IP change at cutover stays a non-issue. Post-flip check: phones re-register, NVR
|
||
remote view works.
|
||
- USG's real role/wiring still unconfirmed (previously seen at .136 — not answering the sweep).
|
||
Physically trace it at flip time; it is being removed either way.
|
||
- SonicWall DHCP scope unknown (admin password invalid) — superset pool above covers it.
|