My new Omada Network and Wifi System - Just a presentation

Off-Topic
1

Hello everyone,

I eventually got tired of the limited visibility and configuration options offered by the Fritz!Box installed by my provider, as well as the limitations of my much-loved ASUS setup consisting of one XT12 as the main access point and three XT8 mesh nodes.

So I decided to move to something a little more professional.

I looked at both Ubiquiti UniFi and TP-Link Omada. Both seemed suitable, but in the end I chose Omada. To me, Omada is a little less stylish, but more affordable, and the interface feels less consumer-oriented and a bit more like a traditional professional network-management system. Of course, others may come to a completely different conclusion. :wink:

So, here are just a few pictures of the current installation:

The EAP720 is a PoE+ dual-band Wi-Fi 7 access point and supports up to 16 SSIDs.
The 3D printed supports are my own Design in Fusion.

Current setup

For the moment, I am still using one main VLAN that largely reproduces the functionality of the old Fritz!Box network.

However, I have already started to make use of some of the additional possibilities:

  • separate Wi-Fi channels;
  • AP/client bindings for selected devices;
  • a dedicated guest network;
  • centralised management through the OC300.

Next steps

The next stage will probably include:

  • a separate IoT VLAN;
  • possibly a dedicated management VLAN;
  • mDNS routing between selected VLANs;
  • proper IPv6 configuration to improve Matter compatibility;
  • stateful ACLs;
  • and whatever else I discover along the way. :wink:

It is definitely a learning project, but that is also part of the fun.

2

Looks great!

I myself use a Zyxel Nebula NWA110BE (with the Nebula Pro Pack subscription for the advanced features and longer data retention). I have also set up an IoT network, I would highly recommend creating one. My IoT network is set up with Nebula Cloud Authentication, currently MAC-based (so each device gets authenticated based on its MAC address, which means that unauthorized MACs can’t get access to the network). This is a bit more effort, since you need to disable it every time you add a new device, authorize its MAC and then enable it again, which is why I’m moving to DPPSK soon. My main network uses WPA3-Enterprise (overkill for a home network, but I set it up for fun) where you log in with an identity (username) and password, so each device has its own login. Optionally 2FA via Authenticator can be setup as well.

I would recommend to create an open guest network that’s protected using a captive portal with voucher code login. Then, the guests don’t know your password and you can make the voucher valid for f.e. only 1 hour, after which it expires and disconnects the client. This makes sure guests don’t have any shared password.

3

Thanks for sharing your setup.

For my use case, I would not go that far. My “guests” are mostly family members, friends, and sometimes friends of the kids. If I really need to remove someone, I can block the device by MAC address or simply change the Wi-Fi password and redistribute it.

The most important features of the guest network for me are:

  • Bandwidth limit: all guest devices together are limited to 150 Mbit/s, so they cannot consume too much of the available Internet bandwidth.
  • 5 GHz only: this keeps guest traffic away from the 2.4 GHz band used by many of my IoT devices.
  • Connection sharing disabled: guests cannot share their connection with other devices. They could still share the Wi-Fi password, of course, but in that case I would see the additional device appear in the client list, unlike when someone simply shares the connection through a personal hotspot.
  • Strict network isolation: the guest network is completely separated from my other networks.

For my environment, this gives me the level of control and separation I want without making access unnecessarily complicated for family and friends.