Unable to ping across different ports on same switch with same VLAN tagging in Home Assistant

Configuration
1

Hi,

This week I started with Home Assistant, and yes, there’s a steep learning curve. So far, I have been able to resolve all issues, but with the latest issue, I’m stuck.

What I try to do:
I have set-up an SLZB-06 in my garage at the back of the garden. Got all set-up and at 1 automation running (just started 4-5 days ago with Home Assistant…). I then tried to add a second SLZB-06, since the distance between home and garage is too big. I got a second Zigbee2MQTT (Z2M) instance running (all on Raspberry Pi 5 with HAOS), but I got error:

zh:zstack:znp: Socket error Error: connect EHOSTUNREACH 192.168.10.13:6638

Then I started to test things, and down below you’ll see what’s happening. No idea what’s wrong.

Side note: if you have one Z2M, its config is in config/zigbee2mqtt. If you install a second instance, they cannot be configured in the same folder, I found out the hard way… Now I have two folders: config/zigbee2mqtt_garage and config/zigbee2mqtt_home.

Networks:
1=DEFAULT
10=VLAN_IOT
Some more VLANS not interesting for this issue.

DEFAULT can access VLAN_IOT, but the other way around doesn’t work.

My setup:
Internet-> UDM Pro → USW Pro HD 24 POE → USW Pro Max 16 Poe

USW Pro HD 24 POE has connected to it:
Port 1 + POE + VLAN_IOT → Raspberry Pi with Home Assitant (192.168.10.15)
Port 17 + POE + VLAN_IOT → Zigbee Coordinator (192.168.10.13)
Port 18 + VLAN_IOT → HUE Bridge (192.168.10.14)
Port 22 + POE + all networks → USW Flex 2.5 → Unifi Access Point “AP1” + all networks (including SSID specific for VLAN_IOT)
Port 24 + all networks → USW Pro Max 16 POE

USW Pro Max 16 POE has connected to it:
Port 1 + POE + VLAN_IOT → the first SLZB-06, working (192.168.10.12)

Other devices on VLAN_IOT have IP addresses like 192.168.10.12, 192.168.10.101, 192.168.10.102.

What I can do:
From my laptop, when connected to AP1, on network DEFAULT, I can ping Home Assistant (port 1), Zigbee Coordinator and Hue Bridge (and literally all devices connected to VLAN_IOT).

From a browser on my laptop I can connect to the Zigbee Coordinators webserver.

From my laptop, when connected to AP1, on network VLAN_IOT, I can ping Home Assistant (port 1), Zigbee Coordinator and Hue Bridge (and literally all devices connected to VLAN_IOT). (Unfortunately I can only add 1 image, see below.)

What I cannot do:

When I open a terminal in Home Assistant, I can ping all devices on VLAN_IOT except the two devices on ports 17 and 18, the Zigbee Coordinator and the Hue Bridge. All addresses are in the same range 192.168.10.xxx. Please see a screenshot of the terminal inside Home Assistant:

Screenshot 2026-07-21 at 22.26.40
Screenshot 2026-07-21 at 22.26.40982×1586 171 KB

What I’ve done:

Rebooted entire network multiple times.
Rebooted all clients several times.
Assigned different addresses to the Zigbee coordinator and Hue Bridge.

My Question:
What on earth may explain what I see?
I have no clue.
Is this an issue with my network?
An issue with Home Assistant?
I’m open to all suggestions.
Any help is greatly appreciated.

With kind regards,

Sjoerd

2

HA is designed to work on a flat subnet.
If you want to use vLans and other networking schemes you might have problems without the knowledge.

Consider this… The enterprise smart home syndrome

3

Hi Sir_Goodenough,

Thank you for the linked article. Good read, and also partly describing my setup.
Yes, I may have too good equipment for a home network, but all (upto the problem I ran into) was/is working perfectly. No issues ever.

Home Assistant may work best in a “flat” environment, but that doesn’t mean it has to be flat. Hackers love a flat network too. Using VLAN’s isn’t rocket science, just a virtual different set of cables. And VLAN’s make it possible to make it fractionally more annoying for hackers to browse around in your network.

Having said all that: I still am puzzled why from the Home Assistant terminal I can ping all but two devices that live on the same (virtual) network. And the odd thing: nowhere I the log-files of my Unify router can I find what’s going on: unable to trace successful and unsuccessfull pings. I have described this same issue at the forum of Ubiquity, hopefully someone recognises my issue.

With kind regards,

Sjoerd

4

Ubiquity is a problem IMO.
Aside from that, you need to determine what protocol is not being provided and provide it.
I didn’t say you can’t do it. I said it’s not designed to do so, meaning you have to figure it out or search to find an answer. I’m not withholding anything if that’s what you are thinking, I don’t know the answer. It would have to be you to determine what it needs because none of us have access to your flavor of network. If you can find the error message, then maybe others can help.
Tips on Searching for Answers & Duplicate Topics in the Forum.

Hackers that want something from you are not going to be bothered by any networking set-up you or Ubiquity can come up with.

My philosophy…
Make sure your firewall works.
Deny access to anything you don’t want talking to the world or other parts of the network because it’s not updated or it’s weird iron.
Check your firewall again.
Test your firewall like you are a hacker.
Get on with life.

5

Hi Sir_Goodenough,

If you have felt offended by me, or I have been not so polite to you, then I’d like to offer you my sincere apologies. That was never my intention, and never will. I try my best to be as decent as possible on any forum. I’m an active contributor to some as well, and I always hope to be treated equally by others. Sorry if I gave you that feeling or impression.

Regarding the issue:
I remember that some time ago (measured in years) I had an IOT device that was misbehaving on the port that now has Home Assistant connected to it. I enabled port isolation on that port, and only that port. Since I was solely focused on ports 17 and 18, I didn’t think about checking port 1. I turned port isolation off for port 1, and it works!

So this was a clear example of user error, years in the making.

Thank you for your time spend on my issue.

With kind regards,

Sjoerd

6

I use Unifi - ensure your PORT settings for 17 and 18 are correct. That’s likely your issue.

7

It is not the VLANs that are rocket science for most people. It is the routing that requires a deep understanding of the protocols needed to be routed.
Most lack knowledge about how discovery protocols work any why you can not use IP routing and firewalls to solve the issues.

8

Now that I fixed the problem: thank you all who have donated some of their time to my issue, either by just reading it, or by providing feedback. This is much appreciated.

9

Yes.

Coming in at the end of this thread, marked ‘solved’, I cannot quite fathom out what specific steps, having clearly outlined what didn’t work, were actually taken to make it functional again, and provide guidance to other network warroirs attempting bold network segmentation exercises with the corresponding challenges?

Was it a router change, a software change, a network philosophy rearrangement, a reboot, or what, that fixed it? Detail would help others that have backed themselves into the same corner.

General comment: segmenting your LAN to prevent hackers moving around inside it is probably entirely unnecessary - you are too late - they are already inside it. Solve that problem - robustly.

10

It’s clearly explained in the solution post. TLDR - past him screwed over present him. He knew exactly which steps to take to undo the config because he’s the one who set them up in the first place.