To finish out my misadventures in home networking, I wanted to capture the process to add a second site and setup the site-to-site VPN. It was less than obvious.

Preparing Your First Site

The first thing one needs to do is prepare the first site. This involves enabling Multi-Site Management and then configure the USG to expose the needed ports for the controller.

Enabling Multi-Site management can be accomplished using the following steps:

1. Configure your controller to use the New User Interface.
2. Open Settings
3. Open System Settings
4. Expand Controller Configuration
5. Expand Site Configuration (within Controller Configuration)
6. Make sure your first site has a name
7. Check the Multi-Site Management dialogue to enable it
8. Apply these settings

Now, in the upper left under the Ubiquiti logo, you will see a circle with an abbreviation of your site name in it. This is how you switch sites. Click on that and you can add a second site.

Once you have added that, go into the second site, open Settings, and create your Network and WiFi networks. Note: You must configure a different subnet than your current site. (E.g. If your current site is the default 192.168.1.x, you should configure for example 192.168.3.x.).

Upon completion, it is time to configure the USG. See Ubiquiti’s knowledge base article and create port forwarding rules for everything in the “Ingress Ports required for L3 management over the Internet” to point to your controller.

To make things easier, it is probably easiest to setup a DDNS service to make it easy to find the controller from the second site.

At this point, it is time to move onto configuring the second site.

Configuring the Second Site

All Unifi security gateways by default are on the 192.168.1.x subnet. Because this is a second site, it will have to be configured differently. You will need a laptop connected via Ethernet to the LAN port of the gateway to do this. For the sake of this blog, we’ll assume the second site is 192.168.3.x. The steps required are as follows:

1. Connect the laptop into the USG LAN port.
2. Setup a static address on 192.168.1.x network – any address is fine other than the default of 192.168.1.1. Set 192.168.1.1 as the gateway and a public DNS server such as Google’s at 8.8.8.8/8.8.4.4.
3. Open in a browser https://192.168.1.1/.
4. Change the address to the new subnet (192.168.3.1) and apply these changes. Ensure that the WAN connection is active/valid.
5. Change your laptop’s IP to the new subnet.
6. SSH into the USG using the default credentials.
7. Enter set-inform https://yourddns:8080/inform/
8. Wait a few minutes and the device should show up in the Unifi portal at the first site. Adopt the device into the second site and this phase is complete.

Once the USG is adopted, other devices can be setup and adopted accordingly.

Configuring the Site to Site VPN

Once both networks are online, setting up a Site-to-Site VPN is very easy. In the Unifi portal, go to the Networks section in either site. Create a New Network. Pick Site to Site VPN and select the other site – and that’s literally it.

My own experience is that occassionally it will get disconnected and the easiest fix is to simply delete and re-create the VPN network.

******

Hope this has been helpful!