UniFi Network - Creating Virtual Networks (VLANs)
UniFi makes it easy to create and implement virtual networks (VLANs).
If you are looking to troubleshoot your VLAN, visit this article.
Creating a VLAN
UniFi Gateway or Cloud Gateway
Third-Party Gateway
- Navigate to Settings > Networks to create a new virtual network.
- Name the network.
- (OPTIONAL) Advanced users can configure their preferred VLAN ID, subnet range, DNS, DHCP server, and DHCP options.
- By default, UniFi Gateways allow communication between different VLANs. See Traffic Rules to learn about implementing restrictions.
Although a UniFi Gateway or UniFi Cloud Gateway is recommended for the most integrated experience, it is possible to bridge networks/VLANs from a third-party gateway so that they can be assigned to UniFi Access Points (APs) and switch ports.
- Configure your network’s subnet, VLAN ID, DNS, and DHCP server on your third-party gateway.
- In UniFi, navigate to Settings > Networks to create a new virtual network.
- Although not required, we recommend giving it the same name used in your third-party gateway, for consistency.
- Enter the same VLAN ID that is configured on your third-party gateway.
- By default, most third-party gateways block routing between separate VLANs. Make any desired changes on the gateway, not within UniFi.
Applying a VLAN to a WiFi Instance
Client devices that join a particular WiFi will be assigned to the corresponding VLAN associated with that WiFi instance. To configure this VLAN:
- Navigate to Settings > WiFi to create a new WiFi.
- When creating or modifying a WiFi, click the Network dropdown.
- Select the desired network.
- Ensure all ports between your AP and gateway are configured to allow the specified network’s VLAN ID. Failure to do so will result in clients being unable to join the WiFi.
- UniFi Switches enable all traffic by default, but any third-party switch will need to be manually configured. See VLAN Connectivity to learn more.
Applying a VLAN to a Switch Port
Primary Network
The Primary Network (also known as the “Native” network) is the network that devices will join when physically connected to that switch port. It is also referred to as the "Untagged VLAN" because traffic without a VLAN tag (e.g., the VLAN ID is set to 1) is assumed to be a member of this network.
Tagged Networks and Trunk Ports
Ports can be configured to allow traffic from other networks. Allowing specific networks/VLANs is referred to as “tagging” them on the switch port.
Ports that have been tagged to allow traffic from multiple VLANs are referred to as “trunk” ports. By default, all ports on UniFi Switches are trunked to allow all VLANs.
Configuring UniFi Switch Ports
To configure the VLANs associated with a switch port:
- Navigate to the UniFi Devices tab.
- Select a switch and click the Port Manager button.
- Select the desired port.
- Set a Primary Network, if desired.
Note: If an AP is connected to a switch port, the Primary Network should never be the same as the network being broadcast by that AP (except when VLAN 1 is used). This will break connectivity and clients will not be able to join. - By default, UniFi Switches tag all VLANs. To modify this, enable Traffic Restriction. The port will be tagged with all “Allowed” networks, or all networks that are not explicitly “Blocked.”
- If you set any restrictions, ensure that they will not break connectivity for devices elsewhere. See here to learn more.
- Apply the changes.
Your UniFi Device’s Management Network
The Management Network is the network that your UniFi device uses to communicate with your Network Application (i.e., to download an update). By default, a UniFi device’s Management Network will be assigned according to the Primary (Native) Network configured on the switch port it is connected to. To change a device's Management Network, follow these steps:
- Determine what network (VLAN) you would like to assign as the device's Management Network.
- Ensure that the desired VLAN is tagged on all relevant switch ports between the UniFi device and your network’s gateway.
- Note: Do not assign this VLAN as the Primary Network for the switch port the UniFi device is directly connected to. This will break connectivity.
- Navigate to the UniFi Devices tab and select the target UniFi device.
- Enable Network Override in its settings.
- Select the desired network/VLAN.
- Apply the changes.
- Confirm that the changes take effect.
- If your device went "Offline," then you likely made a mistake during step (2). See here to learn more.