Public Guide · UniFi · Configuration tutorial

UniFi VLAN and Network Segmentation Fundamentals

Jump to verification

What you will learn

  • Create purpose-based networks and VLANs
  • Define traffic policy between zones
  • Verify isolation without breaking required discovery

When this procedure applies

Use when separating trusted users, guests, cameras, IoT, voice, management, or servers.

Prerequisites and required tools

  • Approved IP addressing plan
  • List of required cross-network services
  • Maintenance window and rollback plan
Safety and access warning: Confirm authorization, service impact, electrical and optical hazards, required PPE, and rollback procedures before touching production infrastructure. Stop when conditions exceed your training or test equipment.

Concept explanation

A VLAN separates broadcast domains; it does not create security by itself. Security comes from routing and firewall policy between networks. Start with business purposes and permitted flows, then configure IDs and addresses.

DIAGRAM: Example trusted, guest, IoT, camera, and management VLANs — 1600×1000Replace this placeholder with original, cleared FryAVSI media.

Step-by-step procedure

  1. Define zones and name each by purpose.
  2. Assign nonoverlapping subnets and DHCP scopes.
  3. Create networks and map switch ports or SSIDs.
  4. Apply default-deny policy between sensitive zones.
  5. Add only documented required flows such as DNS, printing, or controller discovery.
  6. Test from representative wired and wireless clients.

How to verify the result

  • Guest clients cannot reach trusted networks
  • Cameras reach required recorder services only
  • Management interfaces are reachable only from approved administrators

Common mistakes

  • Creating VLANs without firewall policy
  • Using VLAN 1 for everything
  • Allowing broad any-to-any rules to solve discovery problems
Troubleshooting and escalation

Return to the last known-good state. Separate physical, addressing, configuration, application, and documentation issues. Capture evidence before resetting or replacing equipment. Escalate when safety, life-safety service, regulated systems, unsupported hardware, or an unknown production dependency is involved.

SCREENSHOT: UniFi network and traffic-rule mapping — 1600×900, redact identifiersUse an annotated photo, diagram, or short demonstration with identifying information removed.

Field notes from FryAVSI

Record what was found, what changed, the exact test method, test limits, results, exceptions, and the person responsible for follow-up. A technically correct repair without usable documentation creates the next avoidable outage.

Short knowledge check

Can you explain what the selected test proves, what it does not prove, and what evidence must be retained before the system is returned to service?

Related lessons

Browse the Learning Center for prerequisite concepts, adjacent procedures, and advanced troubleshooting.

Revision: July 2026 · Review before use against current manufacturer documentation, standards, software versions, project specifications, and site policy.