Connect UniFi Device to Cloud Controller via Sophos Firewall

UniFi Access Points and Switches do not automatically discover a controller across site boundaries. When a device is located in a local network but the UniFi Controller is operated externally or as a Cloud Controller, a proper L3 adoption is required: DNS, outbound firewall rules, and if necessary, the set-inform command.

This guide demonstrates the practical procedure when a Sophos Firewall is involved as a gateway or DNS server. For the fundamental decision on how to operate a UniFi Controller, first refer to UniFi Controller - Managing Access Points & Switches. If UniFi Switches are used with Sophos Firewall VLANs, the additional guide Configure VLAN on Sophos Firewall and UniFi Switch is helpful.

Customers with a Sophos Firewall subscription can use the Avanet Cloud Controller free of charge for up to five UniFi devices.

Prerequisites

Before adoption, ensure the following:

• The UniFi device obtains an IP address via DHCP.
• DNS works correctly from the device VLAN.
• The device is allowed to reach the controller outbound.
• The Controller FQDN or Controller IP is known.
• SSH access to the UniFi device is possible if DNS adoption does not work.
• Appropriate firewall rules for the device network exist on the Sophos Firewall.

For outbound communication to the UniFi Cloud Controller, these ports are typically relevant:

• TCP Port 8080: For management tasks and adoption (setting the controller parameter via the set-inform command).
• UDP Port 3478: For the STUN protocol, used for data collection and determining the public IP address.
• TCP Port 8443: For access to the controller’s web interface and remote management. This port is not always critical for device adoption alone but is relevant for admin access to the controller.

On the Sophos Firewall, this allowance should be as restrictive as possible: the source is the UniFi management or device network, the destination is the Cloud Controller or its FQDN, and services are limited to the required ports only. For general rule verification, see Testing Sophos Firewall Rules with Log Viewer and Packet Capture.

L3 Adoption via DNS

UniFi devices by default try to resolve the name unifi and connect to that controller. If this DNS name points to the Cloud Controller, new devices can automatically appear at the correct controller.

This only works if the Sophos Firewall in the affected network is also used as the DNS server or the responsible DNS server correctly resolves the name unifi. In Sophos Firewall environments, you should first check which DNS servers are distributed to the UniFi devices via DHCP.

On a Sophos Firewall, the setting might look like this:

After the DNS entry, test from the same VLAN:

1. Restart the UniFi device or renew the DHCP lease.
2. Check if the name unifi resolves to the expected controller.
3. Verify in the UniFi Controller whether the device appears as adoptable.
4. Check in the Sophos Firewall Log Viewer if traffic from the device network to the controller is allowed.

L3 Adoption via CLI

If DNS adoption does not work or a single device should be assigned to a controller deliberately, the controller can be set via SSH. First, the UniFi Switch or Access Point must be powered on in the network and have obtained an IP address.

1. Establish SSH Connection to the Device

Connect from the admin client via SSH:

ssh ubnt@<device-ip>

The default password in factory state is often ubnt. If the device was already adopted, a different password may be set. After successful adoption with the controller, the device password is automatically changed.

2. Define the UniFi Controller

After successful login, set the controller with set-inform:

set-inform http://<controller-hostname>:8080/inform

Alternatively, the controller IP can be used instead of the hostname if the operating model requires it. An FQDN is usually more maintainable because the target address can change later without having to touch each device again.

Afterwards, the device normally connects to the UniFi Controller within a few seconds without rebooting. It must then be adopted in the controller. If the device shows Disconnected again after adoption, run the set-inform command a second time. This is a common procedure with UniFi devices because the controller writes new credentials to the device after adoption.

Checking on the Sophos Firewall

If a UniFi device cannot reach the controller, do not reset the device immediately. Usually, one of these points is involved:

• DHCP distributes incorrect DNS servers.
• The name unifi does not resolve to the desired controller.
• A firewall rule does not allow TCP 8080 or UDP 3478.
• The device VLAN has no internet access or no allowed path to the controller.
• NAT or policy routing sends the traffic over the wrong WAN path.
• The controller is reachable, but the device has not yet been adopted in the controller.

On the Sophos Firewall, Log Viewer, Policy Test, and Packet Capture help. It is especially important whether the traffic comes from the correct source network and whether the expected firewall rule applies. If VLANs are involved, also check whether the UniFi device is really in the planned management or device VLAN.

Useful SSH Commands

When connecting to the UniFi Switch or Access Point via SSH, these commands are helpful for initial analysis.

Display device information:

info

Reset controller to the default name unifi:

set-inform http://unifi:8080/inform

Reset device to factory defaults:

set-default

set-default removes the existing device configuration. This step should only be performed after IP address, DNS, firewall rule, and controller reachability have been verified.

UniFi Device Reset

Sometimes a reset is useful, for example if a device is still linked to an old controller and no credentials are known.

• Restart: Briefly press and release the Reset button on the device.
• Restore factory settings: Hold the Reset button for more than five seconds until the LED goes off.

After a factory reset, the device must obtain an IP address again and reach the controller anew. Therefore, check DHCP, DNS, and firewall rules before resetting. If the device ends up in the wrong VLAN or cannot resolve the controller afterwards, troubleshooting starts again with the network configuration, not the controller.

Troubleshooting

Device does not appear in UniFi Controller

First, check if the device has obtained an IP address and can resolve the controller name. Then use Sophos Firewall Log Viewer or Packet Capture for TCP 8080 and UDP 3478.

DNS adoption does not work

Check which DNS server is distributed via DHCP. If an internal DNS server is responsible instead of the Sophos Firewall, the name unifi must be configured there. With multiple VLANs, there may be different DHCP and DNS configurations.

set-inform works but adoption hangs

After the first set-inform, adopt the device in the controller and then run the command again. Also check whether the controller remains reachable from the device network over TCP 8080.

Device was previously adopted by another controller

Local credentials often no longer match ubnt. If no device password is known, usually only a factory reset remains. Beforehand, ensure the device will reconnect cleanly to the correct network afterwards.

Operational Checklist

• UniFi devices are located in a deliberately planned management or device network.
• DHCP distributes gateway and DNS correctly.
• The DNS name unifi points to the desired controller if DNS adoption is used.
• Sophos Firewall allows only the necessary outbound ports to the controller.
• Log Viewer shows the expected firewall rule.
• Controller access credentials and device passwords are documented.
• Factory reset is only performed after DNS, port, and rule verification.

FAQ