truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md

UniFi Read-Only Recon Notes

Historical snapshot note:

• this file records the 2026-05-22 read-only discovery pass
• preserve it as evidence, but do not use it as the current next-step checklist without checking later outcome docs
• later results and reversals are documented in network-migration-remaining-checklist-2026-05-22.md and unifi-protect-doorbell-chime-current-state-2026-05-26.md

Date: 2026-05-22 Mode: read-only only Auth status: verified working with upgraded Doris admin login

Scope completed

• authenticated login verified
• network object inventory read
• SSID inventory read
• port profile inventory read
• client inventory read
• AP/client mapping read
• wired switch-port/client mapping read
• firewall/policy endpoint probes read

High-value findings

1. Firewall model / current policy state

• firewallrule: 200, count 0
• firewallgroup: 200, count 0
• firewallzone: 400
• trafficrule: 400
• routing: 200, count 0

Interpretation:

• there are currently no custom classic firewall rules in the Network app dataset returned by the API
• no custom firewall groups are defined there either
• zone/traffic-rule endpoints are not active in the way this API helper expected
• practical implication: tomorrow’s segmentation policy work is largely greenfield, not cleanup of a big custom ruleset

2. Current network objects

• Management -> corporate -> untagged -> 10.5.0.1/24
• Trusted -> corporate -> VLAN 51 -> 10.5.1.1/24
• Old IoT -> corporate -> VLAN 2 -> 192.168.1.1/24
• IoT -> corporate -> VLAN 510 -> 10.5.10.1/24
• Camera -> corporate -> VLAN 520 -> 10.5.20.1/24
• Guest -> guest -> VLAN 590 -> 10.5.90.1/24

3. Current SSIDs

• CIA Via -> Old IoT
• UNEF's Playhouse -> Camera
• Whiskey Neat Fuck Ice -> Trusted
• Yer a Wifi Harry -> Trusted

4. Management offenders

Both Management-lane clients are Wi‑Fi clients on the U7 Pro and both are unnamed espressif devices on the default UniFi Wireless SSID.

• espressif -> 10.5.0.123 -> U7 Pro -> SSID UniFi Wireless
• espressif -> 10.5.0.189 -> U7 Pro -> SSID UniFi Wireless

Interpretation:

• these are almost certainly stray ESP-class smart devices and exactly the kind of junk that should not live on Management
• tomorrow we should either identify and move them, or quarantine them if they are brittle

5. Old IoT live inventory

All are currently on SSID CIA Via via the U7 Pro.

Likely migrate-first / easy-value:

• MyQ-29B -> 192.168.1.130
• Main-Floor ecobee -> 192.168.1.102
• Upstairs ecobee -> 192.168.1.131
• LG_Smart_Dryer2_open -> 192.168.1.186
• Samsung-FamilyHub -> 192.168.1.149

Likely migrate-later / discovery pain:

• Google-Home-Mini -> 192.168.1.185
• 3c:8d:20:f3:92:36 -> Google -> 192.168.1.192
• 90:ca:fa:b6:7f:6e -> Google -> 192.168.1.129

Likely quarantine until identified better:

• 5c:61:99:41:73:40 -> Cloud Network Technology Singapore -> 192.168.1.172
• 60:74:f4:54:fd:ec -> Private -> 192.168.1.136
• 60:74:f4:7b:6a:11 -> Private -> 192.168.1.117
• c0:f5:35:20:5d:94 -> AMPAK -> 192.168.1.183
• d4:ad:fc:60:90:6a -> Shenzhen Intellirocks -> 192.168.1.100
• d4:ad:fc:ea:7f:65 -> Shenzhen Intellirocks -> 192.168.1.101

6. Camera lane live state

• front-doorbell is already on Camera network at 10.5.20.217

Interpretation at the time:

• the doorbell was already in the expected camera lane during this snapshot
• later follow-up changed the chime guidance, so do not treat this paragraph as the final remaining-work instruction set

7. Trusted lane still carrying infrastructure-class hosts

Trusted currently includes:

• PlausibleDeniability -> 10.5.1.6
• Serenity -> 10.5.1.5
• Nomad -> 10.5.1.16
• Rocinante -> 10.5.1.112
• FlyingDutchman -> 10.5.1.111

Interpretation:

• tomorrow’s server-lane work is real and necessary
• these should not stay blended into the human client lane long-term

8. AP/client mapping

• U7 Pro: 26 clients
• wired/unknown: 5 clients

Interpretation:

• almost all current active wireless load is concentrated on the U7 Pro
• the U6 LR is presently not carrying client load

9. Wired client to switch-port mapping

On USW Pro HD 24:

• port 2 -> Rocinante
• port 3 -> FlyingDutchman
• port 22 -> Nomad
• port 23 -> PlausibleDeniability
• port 24 -> Serenity

10. Important switch-port assignments

On USW Pro HD 24:

• port 1 -> profile Management -> U7 Pro (Upstairs)
• port 22 -> profile Trusted -> Nomad
• port 23 -> profile Trusted -> Docker Server / PD
• port 24 -> profile Trusted -> Serenity 10G (1)
• port 27 -> profile Management -> up at 10G
• port 3 -> profile Trusted -> FlyingDutchman
• port 2 -> up at 2.5G with no explicit profile shown -> Rocinante

On USW-24-PoE:

• port 24 -> profile Management -> up at 1G
• many inactive preassigned ports exist for IoT, Old IoT, and Management

Interpretation:

• the core server moves tomorrow are mechanically straightforward because their live ports are visible
• PD / Serenity / Nomad / FlyingDutchman are explicitly sitting on Trusted access profiles today
• Rocinante needs a quick extra look because the client is live on port 2 but that port did not show an explicit profile name in the returned record

Recommended next actions for tomorrow

1. historical note: the two Management espressif devices were later identified as Protect WiFi chimes; do not treat this as an open rediscovery task
2. move/changeprofile for server ports on the USW Pro HD 24 one at a time
3. treat Google devices as late-batch or defer
4. treat unknown Old IoT clients as quarantine by default, not migration by default
5. keep Camera cleanup focused on validated policy and documented exceptions; the doorbell was already in the correct lane during this snapshot, but later chime guidance changed