UniFi makes it easy to create and implement virtual networks (VLANs).
If you are looking to troubleshoot your VLAN, visit this article.
Creating a VLAN
UniFi Gateway or Cloud Gateway
- Navigate to Settings > Networks to create a new virtual network.
- Name the network.
- (OPTIONAL) Advanced users can configure their preferred VLAN ID, subnet range, DNS, DHCP server, and DHCP options.
- By default, UniFi Gateways allow communication between different VLANs. See Traffic Rules to learn about implementing restrictions.
Although a UniFi Gateway or UniFi Cloud Gateway is recommended for the most integrated experience, it is possible to bridge networks/VLANs from a third-party gateway so that they can be assigned to UniFi Access Points (APs) and switch ports.
- Configure your network’s subnet, VLAN ID, DNS, and DHCP server on your third-party gateway.
- In UniFi, navigate to Settings > Networks to create a new virtual network.
- Although not required, we recommend giving it the same name used in your third-party gateway, for consistency.
- Enter the same VLAN ID that is configured on your third-party gateway.
- By default, most third-party gateways block routing between separate VLANs. Make any desired changes on the gateway, not within UniFi.
Applying a VLAN to a WiFi Instance
Client devices that join a particular WiFi will be assigned to the corresponding VLAN associated with that WiFi instance. To configure this VLAN:
- Navigate to Settings > WiFi to create a new WiFi.
- When creating or modifying a WiFi, click the Network dropdown.
- Select the desired network.
- Ensure all ports between your AP and gateway are configured to allow the specified network’s VLAN ID. Failure to do so will result in clients being unable to join the WiFi.
- UniFi Switches enable all traffic by default, but any third-party switch will need to be manually configured. See VLAN Connectivity to learn more.
Applying a VLAN to a Switch Port
The Native VLAN is the VLAN assigned to "untagged" traffic passing through a switch port. Devices physically connected to a switch port will be placed on this Native VLAN.
Tagged Networks and Trunk Ports
Ports can be configured to allow traffic from other networks. Allowing specific networks/VLANs is referred to as “tagging” them on the switch port. You can see all ports’ VLAN tags in the VLAN Viewer, found in the Ports tab.
Ports that have been tagged to allow traffic from multiple VLANs are referred to as “trunk” ports. By default, all ports on UniFi Switches are trunked to allow all VLANs.
Configuring UniFi Switch Ports
To configure the VLANs associated with a switch port:
- Navigate to the Ports tab.
- Select the desired port.
- Set a Native VLAN, if desired.
Note: If an AP is connected to a switch port, the Native VLAN should never be the same as the network being broadcast by that AP (except when VLAN 1 is used). This will break connectivity and clients will not be able to join.
- By default, UniFi Switches tag all VLANs. To modify this, enable Tagged VLAN Management. The port will be tagged with all “Allowed” networks, or all networks that are not explicitly “Blocked.”
- If you set any restrictions, ensure that they will not break connectivity for devices elsewhere. See here to learn more.
- Apply the changes.
Your UniFi Device’s Management Network
The Management Network is the network that your UniFi device uses to communicate with your Network Application (i.e., to download an update). By default, a UniFi device’s Management Network will be assigned according to the Native VLAN configured on the switch port it is connected to. To change a device's Management Network, follow these steps:
- Determine what network (VLAN) you would like to assign as the device's Management Network.
- Ensure that the desired VLAN is tagged on all relevant switch ports between the UniFi device and your network’s gateway.
- Note: Do not assign this VLAN as the Native VLAN for the switch port the UniFi device is directly connected to. This will break connectivity.
- Navigate to the UniFi Devices tab and select the target UniFi device.
- Enable Network Override in its settings.
- Select the desired network/VLAN.
- Apply the changes.
- Confirm that the changes take effect.
- If your device went "Offline," then you likely made a mistake during step (2). See here to learn more.