truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md

# UniFi Read-Only Recon Notes

Historical snapshot note:
- this file records the 2026-05-22 read-only discovery pass
- preserve it as evidence, but do not use it as the current next-step checklist without checking later outcome docs
- later results and reversals are documented in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`

Date: 2026-05-22
Mode: read-only only
Auth status: verified working with upgraded Doris admin login

## Scope completed
- authenticated login verified
- network object inventory read
- SSID inventory read
- port profile inventory read
- client inventory read
- AP/client mapping read
- wired switch-port/client mapping read
- firewall/policy endpoint probes read

## High-value findings

### 1. Firewall model / current policy state
- `firewallrule`: 200, count 0
- `firewallgroup`: 200, count 0
- `firewallzone`: 400
- `trafficrule`: 400
- `routing`: 200, count 0

Interpretation:
- there are currently no custom classic firewall rules in the Network app dataset returned by the API
- no custom firewall groups are defined there either
- zone/traffic-rule endpoints are not active in the way this API helper expected
- practical implication: tomorrow’s segmentation policy work is largely greenfield, not cleanup of a big custom ruleset

### 2. Current network objects
- Management -> corporate -> untagged -> `10.5.0.1/24`
- Trusted -> corporate -> VLAN 51 -> `10.5.1.1/24`
- Old IoT -> corporate -> VLAN 2 -> `192.168.1.1/24`
- IoT -> corporate -> VLAN 510 -> `10.5.10.1/24`
- Camera -> corporate -> VLAN 520 -> `10.5.20.1/24`
- Guest -> guest -> VLAN 590 -> `10.5.90.1/24`

### 3. Current SSIDs
- `CIA Via` -> Old IoT
- `UNEF's Playhouse` -> Camera
- `Whiskey Neat Fuck Ice` -> Trusted
- `Yer a Wifi Harry` -> Trusted

### 4. Management offenders
Both Management-lane clients are Wi‑Fi clients on the U7 Pro and both are unnamed `espressif` devices on the default `UniFi Wireless` SSID.

- `espressif` -> `10.5.0.123` -> U7 Pro -> SSID `UniFi Wireless`
- `espressif` -> `10.5.0.189` -> U7 Pro -> SSID `UniFi Wireless`

Interpretation:
- these are almost certainly stray ESP-class smart devices and exactly the kind of junk that should not live on Management
- tomorrow we should either identify and move them, or quarantine them if they are brittle

### 5. Old IoT live inventory
All are currently on SSID `CIA Via` via the U7 Pro.

Likely migrate-first / easy-value:
- `MyQ-29B` -> `192.168.1.130`
- `Main-Floor` ecobee -> `192.168.1.102`
- `Upstairs` ecobee -> `192.168.1.131`
- `LG_Smart_Dryer2_open` -> `192.168.1.186`
- `Samsung-FamilyHub` -> `192.168.1.149`

Likely migrate-later / discovery pain:
- `Google-Home-Mini` -> `192.168.1.185`
- `3c:8d:20:f3:92:36` -> Google -> `192.168.1.192`
- `90:ca:fa:b6:7f:6e` -> Google -> `192.168.1.129`

Likely quarantine until identified better:
- `5c:61:99:41:73:40` -> Cloud Network Technology Singapore -> `192.168.1.172`
- `60:74:f4:54:fd:ec` -> Private -> `192.168.1.136`
- `60:74:f4:7b:6a:11` -> Private -> `192.168.1.117`
- `c0:f5:35:20:5d:94` -> AMPAK -> `192.168.1.183`
- `d4:ad:fc:60:90:6a` -> Shenzhen Intellirocks -> `192.168.1.100`
- `d4:ad:fc:ea:7f:65` -> Shenzhen Intellirocks -> `192.168.1.101`

### 6. Camera lane live state
- `front-doorbell` is already on Camera network at `10.5.20.217`

Interpretation at the time:
- the doorbell was already in the expected camera lane during this snapshot
- later follow-up changed the chime guidance, so do not treat this paragraph as the final remaining-work instruction set

### 7. Trusted lane still carrying infrastructure-class hosts
Trusted currently includes:
- `PlausibleDeniability` -> `10.5.1.6`
- `Serenity` -> `10.5.1.5`
- `Nomad` -> `10.5.1.16`
- `Rocinante` -> `10.5.1.112`
- `FlyingDutchman` -> `10.5.1.111`

Interpretation:
- tomorrow’s server-lane work is real and necessary
- these should not stay blended into the human client lane long-term

### 8. AP/client mapping
- `U7 Pro`: 26 clients
- `wired/unknown`: 5 clients

Interpretation:
- almost all current active wireless load is concentrated on the U7 Pro
- the U6 LR is presently not carrying client load

### 9. Wired client to switch-port mapping
On `USW Pro HD 24`:
- port 2 -> `Rocinante`
- port 3 -> `FlyingDutchman`
- port 22 -> `Nomad`
- port 23 -> `PlausibleDeniability`
- port 24 -> `Serenity`

### 10. Important switch-port assignments
On `USW Pro HD 24`:
- port 1 -> profile `Management` -> `U7 Pro (Upstairs)`
- port 22 -> profile `Trusted` -> `Nomad`
- port 23 -> profile `Trusted` -> `Docker Server` / PD
- port 24 -> profile `Trusted` -> `Serenity 10G (1)`
- port 27 -> profile `Management` -> up at 10G
- port 3 -> profile `Trusted` -> `FlyingDutchman`
- port 2 -> up at 2.5G with no explicit profile shown -> `Rocinante`

On `USW-24-PoE`:
- port 24 -> profile `Management` -> up at 1G
- many inactive preassigned ports exist for `IoT`, `Old IoT`, and `Management`

Interpretation:
- the core server moves tomorrow are mechanically straightforward because their live ports are visible
- PD / Serenity / Nomad / FlyingDutchman are explicitly sitting on Trusted access profiles today
- Rocinante needs a quick extra look because the client is live on port 2 but that port did not show an explicit profile name in the returned record

## Recommended next actions for tomorrow
1. historical note: the two Management `espressif` devices were later identified as Protect WiFi chimes; do not treat this as an open rediscovery task
2. move/changeprofile for server ports on the USW Pro HD 24 one at a time
3. treat Google devices as late-batch or defer
4. treat unknown Old IoT clients as quarantine by default, not migration by default
5. keep Camera cleanup focused on validated policy and documented exceptions; the doorbell was already in the correct lane during this snapshot, but later chime guidance changed