Orbi and CUJO working together

[Ablac]

So I have an Orbi system (2 Sat) and I have a CUJO firewall. I wanted to share with everyone a way to get this working!!! It's quite a pain, but after spending 5 hours on the phone with CUJO support we figures out an amazing work around!

CUJO requires itself to be the DHCP server, so your suppose to disable the DHCP server of Orbi, instead limit orbi to broadcast only 10.0.0.3 - 10.0.0.x (Where X is the number of satellites you have + 2 so if you have 3 you would open 10.0.0.3 - 10.0.0.5). CUJO uses 10.0.0.2. Now get the mac addresses of your satellites and set them to static IP within Orbi to one of the 10.0.0.x you opened earlier. DO NOT OPEN MORE IPS THEN YOU NEED FOR THE SATELLITES!! Once that's done reboot CUJO, and all of your Orbi's. The last step is to go into CUJO and disable internet access to the Satellites. (This stops CUJO from trying to force an IP onto them, but it also blocks the web server for the satellites)

Now when you log into Orbi you will notice that both Satellites are working properly! You will also notice that even when your connected to one of the Satellites your still protected by CUJO as well.

[TheEther]

This is kinda clever but can you explain why simply disabling the DHCP server on the Orbi doesn't work?

[Ablac]

So with the DHCP disabled, Orbi doesn't see the Satellites, because orbi is running on 10.0.0.1 and the satellites are running on 192.168.0.X so when you open Orbi login the satellites do not usually show up, occasionally they will. But you will not be able to update them and have to manually do every update. Also due to the way CUJO works having the satellites running on CUJO DHCP creates a network loop that eventually slows the network down alittle. Let's say you have a device on Sat One with Orbi DHCP disabled and that device tries to connect to the web. Network traffic goes like this, Device Sat Orbi CUJO. Now that same data also goes Sat Orbi Cujo, and then Orbi Cujo a third time so CUJO is filtering the same data multiple times each way. The above way it's only running through once. Because the Satellites are not protected by CUJO, but the data going through them is scanned when it reaches Orbi. Kinda hard to explain, but my network speed increased to 300MBPs in the above method, where it was only 150-200 MBPS in the standard method.

[TheEther]

Thanks for replying.  I'm not quite seeing how the double/triple looping through the CUJO is happening.  I'm assuming that you have your CUJO set up in Direct mode, not Bridge mode.

The following is my understanding of how CUJO works in Direct mode.  Normally, the router has its DHCP server disabled and is configured with IP address 10.0.0.1/24.  CUJO functions as a DHCP server and hands out addresses in the 192.168.0.X/24 subnet to end devices.  End devices see the CUJO as the default gateway with address 192.168.0.1.  Therefore, outgoing traffic from devices will be sent to the CUJO as the default gateway. The traffic may even go through the router on its way to the CUJO.  The router won't do anything the first time except forward it to the CUJO.  The CUJO will NAT the traffic's source address to a 10.0.0.X address and then send the traffic back to the router.  This time the router will NAT the traffic a second time before sending it out to the Internet.

Now, let's consider what happens when the router is an Orbi.  It's true that the satellites will receive 192.168.0.X addresses, so auto update won't work.  Other than that, the satellite's IP address has no bearing on traffic forwarding.  That's because devices don't send traffic to the satellite's IP address; the destination IP address on outgoing traffic will be a public IP address.  When a device connected to the satellite wants to send traffic to the Internet, it should logically follow the path described above, namely Device->Satellite->Orbi->CUJO->Orbi->Internet.  The Orbi router will see the traffic twice, but the CUJO only sees it once, not multiple times.

Obviously the results speak for themselves, but I don't understand how traffic is looping multiple times through the CUJO, nor how the hack stops it.

[Ablac]

i don't know then, but from my tests my wifi is much more stable, with my Satellites staying online, and Orbi is able to see them for auto updates, as well as all my devices are still protected by CUJO. It might have been a fluke thing with my Orbi's and my CUJO (Which GetCujo support named it "The Rebel CUJO" for many reasons as my CUJO is extremelt defiant.

But for anyone having problems with the Satelittes connecting through CUJO, or other connectivity issues while using CUJO and Orbi (Or other mesh network devices) this seems to solve nearly every problem, as Orbi is acting much closer to how it was intended, And CUJO still sees all the devices connected.

[TheEther]

I'm glad it's working for you.  Honestly, I think it would be easier to use the CUJO in bridge mode.  That is, connect the CUJO between the modem and the Orbi.  This way, you can avoid all this nonsense with DHCP, double subnets, double NAT and looping through the router.  What a mess.

[Ablac]

Ya but bridge mode requires a Modem Router combo, or a Modem that has its own DHCP server

[ryanovelo]

I tried this last night. It doesn't work. A few questions to clarify: 

1. When you say "Satellite" are you referring to the satellite only (and not the main router)? I have 1 main router and 1 satellite - 2 units total. 
2. So if x is the number of satellites + 2, I would be 10.0.0.3? If so, that would be 10.0.0.3 to 10.0.0.3. 
3. Did you assign the main router the ip of 10.0.0.1?
4. I tried all combinations of above and the satellite will not connect. If I remove Cujo, the satellite works perfectly. 

Any pointers would help tremendously. 

Thanks, 

[Ablac]

Yes 10.0.0.3 would be the correct DHCP, make sure the DHCP server is enabled on orbi.
And that the IP address of Orbi is set to 10.0.0.1

Here's what your trying to accomplish.
Orbi (Main) on 10.0.0.1 (As per CUJO setup)
CUJO defaults to 10.0.0.2
The satellite is on 10.0.0.3

So part one of setting this up is to re-Enable DHCP for Orbi and set it to broadcast 10.0.0.3 and then set the Satellite IP to be statically set to the 10.0.0.3. Also
While in Orbi settings make sure it's default IP is 10.0.0.1

At this point you can pair the Satellites (And make sure the satellites are set to the correct IP.

Once there paired, the satellite will appear in the CUJO app you have to disable Internet to the Satellite within the CUJO App. And it will stay paired within Orbi.

If your still confused PM me, or if you contact GetCujo phone support ask for Brandon, and tell him your having problems getting Orbi and CUJO to work together. As he knows how to set this up, and currently CUJO is accepting this as a valid solution to he Orbi CUJO connection problems.

[CR-sound]

The statement that Cujo is required to be the DHCP server quite complete since Cujo does not default to this in the recommended configuration, bridge mode.  I have a unit in bridge mode, not DHCP mode.  To change to DHCP mode, I would have to tell Cujo to do that.  I do have an issue in bridge mode in that Cujo does not see all my devices...due to Orbi subneting...thinking about switching to AP mode with the Cujo sitting between the Orbi and the xfinity modem/router for this reason. Are you in bridge mode or direct mode?

[arcdancer]

I have a wireless connection to my ISP. It enters the house via a Cat 5 cable from the dish on the roof. It connects to a PoE devise and another cable goes to the Internet port on my Linksys EA 6350. This allows me to get Internet, wifi, and sharing on my home network. I recently purchased a CUJO firewall appliance and a Orbi with 1 satellite in order to improve my wifi coverage. I have spent hours trying to add the Orbi and the CUJO to my existing system but have gotten lost and frustrated to the point of putting back to the way it was setup prior to trying to add the Obri And CUJO. I have both cable and wifi  and would like to continue to use both platforms. I am new to doing all these connections and configuring of componets but would very much like some help with this matter.

Thanks

[Ablac]

I would highly recommend contacting Cujo Support! They are aware of comparability issues and are willing to.help everyone get there Orbi and Cujos working well! The above.method took us about 5 hours to come up with, and it worked great till somebody screwed with my network at my last house party, haha. People need to.not touch what they don't understand.

[arcdancer]

I think that is very sound advise. I just hope their support people are very patient.

Thanks

[CR-sound]

Their support people are great. Putting the Orbi in AP mode with the Cujo sitting between the Orbi and the Comcast cable modem/router does work. If you don't want to go AP mode for some reason, the Cujo still works.  It checks all traffic going through it from the Orbi.  It doesn't see the which item on your network is generating problematic traffic in router mode as it does in AP mode, but still performs its basic function.

[Texas22Step]

Hello -

I have the exact same ISP configuration that you describe -- a 'fixed wireless' ISP via a dish on the roof, entering the home via an ethernet cable with a PoE.  I installed an Orbi RBK50 router with a single RBS50 satellite with no problems, and it works as advertised in terms of WiFi coverage in the home.  So, I don't think your challenge is the installation of the Orbi system by just plugging it in to the ISP cable as your Internet source.

I have just run across the CUJO device in doing some reading on the web and am considering adding it to my network.  However, it seems to require a lot of 'work-arounds' with the Orbi system, which I really don't want to do for various reasons.  Did you proceed with your CUJO/Orbi installation?  If so, did you use a bridge configuration with the CUJO?  Or?

Thank you in advance for your reply.

[Ablac]

I did exactly what I stated above. It wasn’t that challenging, also the CUJO support team is extremely helpful, and as they update CUJO it’s becoming more and more compatible with Orbi, and eventually they will have a plug n play simple installation.

[Ablac]

When you disable thw DHCP on the Orbi, you lose the ability to update Orbi over the Orbi interface. As well as the main orbi hub is unable to see the satellite’s. When you set them up under DHCP there able to view the satellite’s receive updates, as well as being protected by CUJO.

[CR-sound]

Not sure that this is quite right...since my cable modem is a router and provides dhcp, I have the orbi in AP mode with the cujo inbetween.  If the orbi is not in AP mode, cujo can't see the individual devices, only the orbi main and the cable modem.  Cujo is still protecting all Orbi connected devices since it sees the traffic through the orbi main.  In terms of updating, Orbi does go out and check for updates and can see the satellites, so think that the AP mode is OK here.