Installing an Omada business network: a field report
A field report on setting up an Omada network with VLANs, LAG, Wi-Fi, ACLs and separation of uses in a combined residential and professional environment.
Segmenting a network by use, isolating guests, preparing for video surveillance and keeping administration centralised: these are needs you find in a smaller company just as much as in an advanced residential installation. This field report describes the deployment of a TP-Link Omada network in a house that also serves as a professional office — with constraints close to those of a small business infrastructure.
Start from the uses, not from the hardware
The project started during construction, alongside the other technical trades (electrics, heating, ventilation). The first step was to inventory the requirements room by room:
- Number of RJ45 sockets per zone
- Expected uses: workstation, online gaming, television, audio, home automation, camera, guest
- Equipment better served by cable than by Wi-Fi
- Zones needing strong radio coverage, indoors and outdoors
- Access point locations (wall or ceiling)
- Headroom for future changes
The office was treated as a priority zone: AI work, large transfers, network stability and isolation of the administration equipment. Video surveillance was planned for at the cabling stage, even though the cameras and the NVR were not yet installed.
This phase avoids the classic mistake: deploying Wi-Fi everywhere and then discovering that the fixed uses (workstations, TV, cameras) lack stability.
Why Omada
Omada was not chosen by default, but as a compromise between centralised management, cost, hardware availability and manageable complexity.
The concrete requirement: a router, two managed switches, several access points, PoE, VLANs, ACLs, a LAG between switches and a single monitoring view — all of it usable day to day without stacking up several tools.
Solutions based on recurring cloud licences were ruled out on grounds of cost and proportion. The more flexible but slower-to-implement approaches were not suited to this project. Omada covers the whole scope in a single console, which suits a hybrid home / office installation well.
The hardware chosen
| Equipment | Role |
|---|---|
| Freebox Pro | Internet access from the carrier (Free, a French ISP) |
| ER8411 | Main Omada router |
| SG3428XMPP | Core switch, high-power PoE ports |
| SG3452P | Density switch |
| OC300 | Omada hardware controller |
| EAP772 / TL-EAP772-OUT | Indoor and outdoor access points |
| Cat6A cabling | Fixed links to rooms, APs, cameras |
| TL-SM5310-T modules | 10G SFP+ to RJ45 |
| NVR and IP cameras | Planned on a dedicated Surveillance network |
| Sonos Pro | Planned on an IoT-Audio network powered over PoE |
Watch out: the TL-SM5310-T 10G SFP+ modules are not compatible with the 1G SFP ports on the SG3452P. For the inter-switch links, Cat6A RJ45 connections were preferred.
The technical room as the point of convergence
All the cabling converges on a technical room: the internet feed, the router, the switches, the controller and the critical equipment (UPS). This choice simplifies maintenance, port patching and future changes.
The distribution was designed so as not to depend on Wi-Fi for the fixed uses. Each access point has its own network feed; the camera positions were planned in advance.
Physical layout
| Link | From | To | Role |
|---|---|---|---|
| Internet | Freebox Pro 10G | ER8411 SFP+ WAN1 | Carrier access |
| Network core | ER8411 SFP+ WAN/LAN2 | SW-CORE port 25 | Router → core switch uplink |
| LAG cable 1 | SW-CORE port 23 | SW-DENSITY port 47 | Inter-switch aggregation |
| LAG cable 2 | SW-CORE port 24 | SW-DENSITY port 48 | Inter-switch aggregation |
| Controller | OC300 | SW-DENSITY port 46 | Omada administration |
| Video surveillance | NVR | SW-DENSITY port 45 | Surveillance network |
The dual SW-CORE ↔ SW-DENSITY link forms a 2 Gbps LAG to absorb the combined traffic between the office, the bedrooms, Wi-Fi, audio, cameras and inter-zone flows.
VLAN plan
The first structural decision: move off the default VLAN 1. In Omada, the “Default” network always exists, but it can be reassigned.
| Network | VLAN | Use |
|---|---|---|
| Management | 10 | Router, switches, OC300, access points |
| Data | 20 | User workstations, office uses |
| Surveillance | 30 | Cameras and NVR |
| IoT-Audio | 40 | Sonos, connected audio, specialised devices |
| Guest | 60 | Guests |
Each VLAN has its own private subnet (/24). The Management plan was chosen after checking the ranges already used by the carrier’s box, in order to avoid any addressing conflict.
Management addressing
All the network equipment shares the same Management subnet, with static addresses reserved for the router, the controller, the switches and the access points.
Migrating the Management VLAN was the most delicate step: the controller, the switches and the access points all had to end up on the same subnet before the configuration could continue.
DHCP option 138
With an OC300 hardware controller, DHCP option 138 tells the equipment where to find the controller. It points to the controller’s IP address on the Management VLAN and was applied across the various networks to guarantee re-adoption after a restart.
LAG between switches
Two RJ45 cables in LACP aggregation:
| Cable | SW-CORE | SW-DENSITY |
|---|---|---|
| Cable 1 | Port 23 | Port 47 |
| Cable 2 | Port 24 | Port 48 |
Final configuration:
- SW-DENSITY: LAG1 in Active LACP, ports 47 and 48
- SW-CORE: LAG1 in Passive LACP, ports 23 and 24
- Native Network: Management(10)
- Network Tags Setting: Allow All
Pitfall encountered: enabling LACP on one side only caused a temporary loss of link. The configuration was finalised with SW-DENSITY as Active and SW-CORE as Passive.
Structuring ports
| Switch | Port | Name | Configuration |
|---|---|---|---|
| SW-CORE | 23-24 | LAG-SW-DENSITY | Trunk, LACP, native Management |
| SW-CORE | 25 | ER8411-Uplink | Trunk, native Management |
| SW-DENSITY | 45 | NVR-Surveillance | Access, Surveillance(30) |
| SW-DENSITY | 46 | OC300 | Access, Management(10) |
| SW-DENSITY | 47-48 | LAG-SW-CORE | Trunk, LACP, native Management |
PoE strategy
The SG3428XMPP offers two power profiles: ports 1-8 up to 90 W, ports 9-24 up to 30 W.
Allocation on SW-CORE:
| Ports | Use | VLAN | PoE |
|---|---|---|---|
| 1-5 | Omada access points | Management(10) | Enabled |
| 6-11 | Sonos / IoT audio | IoT-Audio(40) | Enabled |
| 12-15 | Outdoor cameras | Surveillance(30) | Enabled |
| 16-22 | Spare | — | Disabled |
| 23-24 | LAG to SW-DENSITY | Trunk | — |
On SW-DENSITY, PoE was disabled everywhere it was not needed. On the LAG ports, the Omada interface can show PoE as available without power actually being supplied: 802.3af/at only delivers current if the connected device presents a PoE signature.
Wi-Fi networks
Three SSIDs, each attached to a VLAN:
| SSID | Use | VLAN |
|---|---|---|
| Main network | Day-to-day uses | Data(20) |
| Guests | Visitors | Guest(60) |
| IoT | Audio and connected devices | IoT-Audio(40) |
6 GHz is reserved for the main network. For guests and IoT, 2.4 GHz and 5 GHz are enough. MLO (multi-link operation) was disabled: with several access points, roaming between units takes priority over the MLO gain on a single AP.
MAC filtering was not adopted: little real security, easy to bypass, and incompatible with the randomised MAC addresses of modern devices.
ACL rules
Three deny rules, with no general permit rule:
- Block Guest towards the internal networks
- Block Data, IoT-Audio and Surveillance towards Management
- Block Surveillance towards the other internal networks
This delivers the expected network segmentation: guests reach the internet only, clients cannot administer the network equipment, and the cameras stay confined.
Pitfalls encountered
- 10G SFP+ modules incompatible with the 1G SFP ports on the SG3452P
- LACP enabled on one side only: link outage
- Changing the Management VLAN without checking the controller’s IP: equipment cut off
- Subnet conflict with the carrier’s box
- Omada Default network reassigned in order to avoid VLAN 1
These incidents led to recreating a clean Omada site, with the Management VLAN stabilised before going back to the LAG, the access ports, the SSIDs and the ACLs.
Recommended configuration order
- Create the Omada site
- Define the VLAN plan and reassign Default off VLAN 1
- Configure Management and DHCP option 138
- Adopt the equipment
- Check that all the devices have a Management IP
- Configure the trunks and the LAG
- Configure the access ports
- Create the SSIDs
- Add the ACLs
- Disable unnecessary PoE
In short
This installation shows that business-grade segmentation — isolated management, separated uses, ACLs, a 2 Gbps LAG, one SSID per VLAN — can be achieved on an Omada infrastructure without becoming a carrier-scale project.
The lessons that transfer to a smaller company: start from the real uses, plan the cabling ahead, move off VLAN 1, stabilise management before the rest, and document the topology (a point often missing from IT audits). The result is a solid foundation, ready to take new access points, cameras and connected devices.