Skip to main content

Search

Cloudi-Fi Knowledge Base

How to enable Cloudi-Fi DHCP with an Ubiquiti Cloud-Gateway UniFi Device

Simon Mesnage
  • Updated

Use case

This article will guide you through enabling DHCP relay over IPsec using a Cloud-Gateway device from Ubiquiti UniFi Network.

 

Prerequisites

Before you begin, ensure you have the following prerequisites in place:

  1. Access to Cloudi-Fi Admin Console: You must have access to the Cloudi-Fi admin console to obtain DHCP and IPsec-related information.
  2. Create Cloudi-Fi Locations and Subnets: Within the Cloudi-Fi admin console, create the necessary locations and subnets corresponding to your network setup.
  3. Understanding of Your Network, Subnets, and Firewall Configuration: Clearly understand your network topology, subnets, and configuration.
  4. Access to Ubiquiti Cloud Gateway: Access to your UniFi dashboard.

 

1. Get DHCP and IPsec info from Cloudi-DHCP admin console

  • Log in to your Cloudi-Fi dashboard
  • Navigate to Networks > DHCP
  • Select your desired location, which should correspond to the network you want to enable DHCP relay over IPsec.
  • IPsec tunnel information
    • FQDN, IPv4 or user FQDN
    • Pre-shared key
Cloudi-Fi_Admin_Network_DHCP_VPN_IPSEC_configuration.png
  • Under Cloudi-Fi, find and note down the following information:
    • Service Subnet
    • Service Address
  • Additionally, locate the IPsec endpoint within Cloudi-Fi

 

2. VPN IPSec profile configuration

Add a new VPN Profile named "Cloudi-Fi DHCP" : Settings > VPN > Site-to-Site VPN > Create New

Configure the following criteria:

  • VPN Type: IPSEC
  • Name: Cloudi-Fi DHCP
  • Pre-Shared Key: Please use the one you have set in 1. Get DHCP and IPsec info from Cloudi-DHCP admin console.
  • Local IP: Select the IP used to go to Internet
  • Remote IP: Please use the IPSEC endpoint identified in Cloudi-Fi Dashboard.
  • Network Configuration
    • VPN Method: Route Based
    • Remote Networks: Add the two "Service Subnets" from the Cloudi-Fi Dashboard
  • Advanced
    • Key Exchange Version: IKEv2
    • IKE Encryption: AES-256
    • IKE Hash: SHA256
    • IKE DH Group: 14
    • IKE Lifetime: 86400
    • ESP Encryption: AES-256
    • ESP Hash: SHA256
    • ESP DH Group: 14
    • ESP Lifetime: 43200
    • PFS: Checked
    • Local Authentication ID: Your Public IP - Should be the same configured in 1. Get DHCP and IPsec info from Cloudi-DHCP admin console
    • Remote Authentication ID: 0.0.0.0
    • Route Distance: 30

 

3. Interface configuration

Add a new network for the Guest management: Settings > Networks > Create New

Configure the following criteria:

  • Name: eg. <Vlan-ID>-Cloudi-Fi
  • Router: Select your device with the role of Router in your infrastructure
  • Zone: Internal
  • IPv4: Configure the same subnet as the one you have configured in the Prerequisites
  • Vlan ID: Configure based on your infrastructure
  • Select Manual
  • Isolate Network: Checked
  • Allow Internet Access: Checked
  • DHCP Mode: Relay
  • DHCP Servers: Add the Service Address seen in 1. Get DHCP and IPsec info from Cloudi-DHCP admin console

4. Verification

After completing the above steps, you can verify if the tunnel is UP on the UniFi Dashboard: Settings > VPN > Site-to-Site VPN > Column Uptime

Another way to verify the tunnel establishment is to verify the communication between your router and the Cloudi-Fi DHCP servers: Insights > Flows.
From this menu, filter with the source (your router) and the destination which are the IPSEC endpoint or with the DHCP servers.