Exclude U5G Max / cellular modems from "Excessive Tagged VLANs" port audit

[RichardD012]

Summary

The Security Audit flags the U5G Max with Port Issue: Excessive Tagged VLANs ("Access port for single device has all VLANs tagged") on its uplink switch port. This is not remediable — the U5G Max requires the port to be Native VLAN 1 + all VLANs tagged (Allow All) to function, so the flagged condition is the required configuration, not a misconfiguration.

Same class as #842 (UniFi power-device internal ports excluded from this audit).

Why the flagged port config is required

The U5G Max carries its management on a tagged 802.1Q VLAN subinterface while its provisioning/WAN-control plane uses the untagged native VLAN. Changing the port away from Native VLAN 1 + Allow All (e.g. to a restricted trunk) breaks the modem's WAN/failover path.

Confirmed via SSH on the device (firmware 7.5.3):

# ip -d link show
  vlan protocol 802.1Q id 10        # tagged VLAN 10 management subinterface
16: br-trunk: <...UP,LOWER_UP>      # trunk bridge

# ip -4 addr
  inet 48.233.10.7/28   wwan0       # cellular WAN uplink
  inet 100.127.125.128  gre1        # GRE tunnel to gateway
  inet 192.168.10.109   br0         # management (VLAN 10)

# ip route
default via 192.168.10.1 dev br0
48.233.10.0/28 dev wwan0
100.127.125.128/31 dev gre1

Request

Exclude cellular modem model codes from the "Excessive Tagged VLANs" / access-port VLAN audit. The U5G models are already recognized in UniFiProductDatabase.cs (CellularModemModelCodes: UMBBE630, UMBBE633, U5GMAX, etc.) for Cellular Modem Settings, but not excluded in AccessPortVlanRule the way #842's power devices are.

Maybe I'm doing this wrong but I've t tried every combination I can and the only way the 5G Backup works is keeping the port its on Default/1 Allow All, regardless of the management interface (and keeping it on the Default/1 flags other issues).

[jimstrang]

Interesting- for the U5G Backup I have, I was able to get it to work with just setting the Native VLAN to my management VLAN (which isn't VLAN 1 in my case), all others blocked.

[tvancott42]

Interesting- for the U5G Backup I have, I was able to get it to work with just setting the Native VLAN to my management VLAN (which isn't VLAN 1 in my case), all others blocked.

Same for me here on the U5G-Max

Curious what's different here... I've had my port configured this way since I did a write up on the modem when it launched.

[jimstrang]

I compared this against my U5G Backup (UMBBE633) over SSH. It has the same basic cellular-plus-GRE architecture, but its LAN-side configuration differs from the U5G Max shown here.

My working setup is a switch port with Management as the native VLAN and all tagged VLANs blocked. The modem is adopted at 10.0.3.158 and has successfully carried a recent WAN3 failover.

br0:          10.0.3.158/24
default:      via 10.0.3.1 dev br0
gre1:         100.127.125.128/31
GRE endpoints local 10.0.3.158, peer 10.0.3.1
rmnet_data0:  72.108.182.73/30

eth0 is directly bridged into br0; br0 reports vlan_filtering 0, and there is no tagged 802.1Q management subinterface visible on the device.

So the GRE tunnel address is even the same as yours (100.127.125.128/31), but the management/LAN attachment is different: mine works with untagged native Management VLAN only, rather than native VLAN 1 plus an allow-all trunk. That suggests the U5G Max requirement may be topology-, firmware-, or device-configuration-specific?

[tvancott42]

I should clarify, my U5G-Max is working with native VLAN 1 (not management) + VLAN 99 (my management VLAN) tagged.

[RichardD012]

I feel really dumb but that was exactly what I needed to do with tvancott42 - I think got so deep into the port profiles I didn't take a step back and do the simple thing - Default (Not managed) and Custom Tagged.

Sorry for the noise.

[tvancott42]

No prob at all! I wonder if I should somehow surface this under Security Audit for this particular device class. If it would have been helpful and would have saved you time, LMK, and re-open this so I can enhance that.

[RichardD012]

Actually yeah - I think for these devices if the tool tips for Open VLAN would notify set it as the Default Not managed with a custom tag for your management interface.