Enhancing your Network

Starting with Unifi can be overwhelming and while I won’t cover all the advanced settings, I will cover the ones that I have found helpful for maintaining a robust stable network.

Networks

  • If you are changing the IP range of the Default network there is no need to change the name. New networks need a name.

  • The default Router should be sufficient. This gives you zone-based firewall policies instead of switch ACLs.

  • Uncheck Auto-Scale Network. I don’t like things automatically doing anything unless I defined the guardrails.

  • Default is really VLAN 1. Change it off 192.168.1.0/24. I use 10.0.0.0/8 and pick a /24 that will never collide with a VPN or the ISP router.

  • Click Manual. Auto does some best practices, but I want VLAN, spanning tree, and multicast under my control.

Typical routed network:

  • VLAN ID 2–4096

  • Isolate Network unchecked

  • Allow Internet Access checked unless it is storage

  • IGMP Snooping checked

  • Multicast DNS checked, unless it is a noisy IoT VLAN

  • DHCP Server, range .100–.199 unless it is wireless-only

  • DHCP Guardian set to the router address on that VLAN so a guest’s old Netgear cannot hand out leases

  • DNS: UDM primary, then Google or OpenDNS

  • Lease Time 86400

  • Ping Conflict Detection checked

  • Option 43 checked with the Default network UDM IP so Unifi devices find the controller faster

Creating Port Profiles

I love Port Profiles. They keep switches consistent.

Naming I use:

  • Uplink Port – DeviceType (Uplink Port – AP)

  • Access Port – VLANID (Purpose) (Access Port – VLAN2 (IOT))

  • Disabled

Uplink: Native VLAN of the network, Tagged VLAN Management Allow All, POE if the AP needs it, STP on, LLDP-MED on, loop protection off. Uplinks carry multiple VLANs. APs with several SSIDs belong here.

Access: Native VLAN, Tagged VLAN Management Block All, loop protection on, STP on. One VLAN, tagged as a single network.

Disabled: Port Disabled. Use it on empty jacks so someone plugging in does not get a surprise VLAN, and on backup uplinks you do not want forming a loop.

Assigning Port Profiles

Devices → switch → Port Manager. Select ports, pick the Ethernet Port Profile, Apply Changes. Edit the profile later and every assigned port follows.

Global Network Settings

  • mDNS checked, proxy All if you want Chromecast and AirPlay across VLANs

  • IGMP Snooping checked, Fast Leave checked

  • Spanning Tree Protocol: RSTP

  • Rogue DHCP Server Detection checked

  • L3 Network Isolation and Device Isolation ACLs unchecked unless you have a real reason. A firewall policy is usually the better tool.

Changing the Internet Port

If the ISP is faster than 1 Gig, move WAN to a 10GB SFP. Gear → Internet → WAN port → Port. Apply Changes only after it is cabled or you will take yourself offline. The UDM can fail over or load balance two WANs. You only get two 10GB ports, so pick what matters.