GT-AXE1600 Firewalla Gold

[woodgray]

Hi everyone,

I’m in the planning stages of integrating a Firewalla Gold Pro with a GT-AXE16000 configured in Access Point (AP) mode, and I’m looking for advice on potential pitfalls and tips to make the transition as seamless as possible.

Background:​

• The GT-AXE16000 firmware version 3004 I’ve tested doesn’t support VLANs as promised.
• There was an older beta firmware (version 9000) that was supposed to be a precursor to a VLAN-capable 3006 firmware, but no updates have come in over 18 months.
• Since VLAN support isn’t available, I’m planning to rely on the Firewalla Gold Pro for all VLAN tagging and management. The GT-AXE16000 will be placed in AP mode to focus solely on providing WiFi access and bridging some wired devices.

Current Plan:​

1. Firewalla Gold Pro:
   • Will act as the primary router and manage all VLAN tagging and routing for both wired and wireless traffic.
   • Connected directly to the ISP modem.
2. GT-AXE16000:
   • Will be configured in AP mode.
   • Used to provide WiFi (including a guest network) and as a bridge for wired devices connected to its Ethernet ports.
3. Ethernet Devices:
   • Some of the GT-AXE16000’s Ethernet ports are used to connect devices that need to remain in separate VLANs.
4. Wired Network:
   • VLAN tagging is already functional and managed downstream by the Firewalla.

Questions & Concerns:​

1. WiFi & VLANs:
   • How do I ensure that both primary and guest WiFi traffic is correctly tagged and routed through the VLANs on the Firewalla Gold Pro?
   • Does the GT-AXE16000 in AP mode support VLAN tagging for wireless traffic? If not, what are the most efficient workarounds?
2. Guest Network Isolation:
   • I want a completely isolated guest WiFi network. Does the GT-AXE16000 in AP mode provide native isolation for guest traffic, or does this need to be entirely managed on the Firewalla?
   • Are there any specific settings on the Firewalla I should configure to ensure full isolation while maintaining ease of access for guests?
3. Ethernet Ports on GT-AXE16000:
   • Given that I’ll use its Ethernet ports for VLAN-segmented devices, how does VLAN tagging work in AP mode for these ports when routed through the Firewalla?
   • Are there any potential conflicts or limitations I should anticipate when using these ports?
4. Potential Pitfalls:
   • What common challenges or unexpected issues should I watch out for when integrating the GT-AXE16000 with the Firewalla Gold Pro in this setup?
   • Are there known stability or compatibility issues between these devices in similar configurations?
5. Best Practices:
   • What are the best practices for managing VLANs in a dual-device setup like this?
   • Are there particular settings or configurations on either the Firewalla or GT-AXE16000 that can streamline the setup and minimize latency or connectivity issues?
6. General Tips:
   • For those who’ve implemented a similar setup, do you have any tips for ensuring a seamless integration?
   • Are there particular tools or diagnostic steps you’d recommend to troubleshoot potential issues as I configure and test this setup?

Goal:​

I’d like to ensure this transition is as seamless as possible while maintaining optimal network performance and stability. I’d especially value insights from anyone with experience managing VLANs or working with Firewalla and ASUS networking devices.

Thanks in advance for your help and advice!

 

[Tech9]

What are the best practices for managing VLANs in a dual-device setup like this?

Getting a proper VLAN capable AP is the best practice. Your plan won't work with GT-AXE16000 as AP on 3004 firmware.

 

[woodgray]

What about using the Beta 9000? It has VLAN. So its not a hardware issue. Not sure about the CVEs? I think that Firewalla should handle that. Assuming its not a proximity issue.

 

[Tech9]

You can try, but as I remember early 3006 beta versions didn't have VLAN options in AP Mode. Another possibility is to script yourself all the VLANs to interfaces in 3004 Asuswrt-Merlin firmware, but it needs some research and won't be easy on 4-radio router. You can see examples for other models here on SNB Forums, search around. You have to start with identifying the interfaces correctly on your model.

 

[woodgray]

Yes, 6/6e never really worked on this model. So it would be only 5 and below. Not sure about the complexity given how ASUS implemented it. As for the AP mode have not tested its VLAN, the network is active. Support documentation is non existent. 11000 pro should have VLAN support in AP. Porting that might be easier. I am not Merlin though or even close.

 

[Tech9]

If replacing it - get a business class AP with native VLAN support and stand-alone configuration. It will make your life easier. Low cost options for home use are TP-Link Omada and Ubiquiti UniFi series products. They both offer up to Wi-Fi 7 products with different specs.

 

[woodgray]

Yes, Firewalla is coming out with one in the next couple of months. All the way to 7. Problem is its a new product. No reviews etc. Would be the best most seamless integration, assuming. I may just break off the the Ethernet nodes for the time being.

 

[Tech9]

I'm after reliability over speed. The APs I have purchased recently are about 2 years on the market, Wi-Fi 6 class. Currently running single dual-band SSID carrying 4x different networks with private keys. Started as an experiment to see what the system is capable of, no issues observed to mixed Wi-Fi 4/5/6 clients, it was left this way and I like it. AX clients get >800Mbps over Wi-Fi on non-DFS 80MHz wide channels.

Not interested in Wi-Fi 7 at the moment or speeds over Gigabit for my home network.

 

[woodgray]

Yes, I have a Channel (channels themselves) problem with some of my IOT devices. Think its a Broadcom issue.