Will quick tip to pass along on doing more advance VLAN assignments. Under the switch level / configure network and VLAN. you'll see that create icon. That will allow you to create a group rule for defining tagged and untagged ports it will also allow you to assign more than one VLAN. Once the rule is created when you go to the port level that port group will show up. Quick steps 1. Create VLANs as shown here 2. Create port group 3. Select port 4. Select the port group rule Wopper from the forums typed this up and I thank him for that great tip.
More trunking option videos, please! I'm in a house with different people, device types and security concerns... I'd like if any physical port could route a designated device to the appropriate VLAN.
Thanks for the videos, do you have an end to end video that shows how to create a standard Lan, an IoT Lan and how I can access the IoT Lan using firewall rules? There are several videos but I am finding it difficult to join them up to create a whole picture, especially whether I need to trunk my 5 APs. Cheers
Thank you for this excellent video. I was wondering if you would ever consider doing a video that focuses on separating iOT devices using a vLan that still allows the main or corporate LAN to connect to the iOT vlan devices but not vice versa. Been struggling to figure this unique situation out.
Check crosstalsolutions channel. Chris has just released a video of exactly what you asked. Both Willie and Chris are great and probably the best in UniFi videos in TH-cam and have even shared the screen in a video before. Hope helps @willie great stuff...
If I have a string of unifi switches connected via trunk ports and I setup a new vlan that is only assigned on a port on the first switch and the second switch, will broadcast traffic still flow to all the other switches through the trunk port even though they don't need it?
Hello... I have an edgerouter and cisco switch all managing the vlan. Currently have an Asus router acting as an AP only and I am able to print from the ASUS SSID to the vlan containing the printers. However I put in a Unifi Cloud Controller and AP on a seperate VLAN so that the controller can see the AP and when I set the SSID on the UNIFI AP with a new VLAN for each SSID assigned, I cannot print anymore across VLANS. Any suggestions
If you have a vlan setup and you are using ports only on a switch "down stream", will broadcasted data end up going up the trunk port to other switches even if those switches don't have that vlan on any port?
i have a USG to an HP switch and while i have tagged all the vlans on the hp's port, i cannot get the USG to connect the other networks and vlans to the DAM HP switch! we know that the switch is passing trunks, becuase we tested it against a cisco switch and the port config works, but the controller says USW required, i need to create sub interfaces in LAN1 to pass vlans 1,2,3 for each SSIF to the uniquity AP's, any help can and will be greatly appreciated.
Hi I was wandering if you could do a video on setting up a management VLAN with a local controller or cloud key. Most of the videos and tutorials are using amazon or some off site controller or they stop after configuring the switch and AP.
Sorry to necro, but im setting up a Mitel VOIP system and I want to set the phones to a different IP range than my data network (essentially a VLAN). Do I setup a corporate network or do I setup a VLAN only and make my DHCP server provide the different IP addresses to the phones?
Please do a video explaining vlan only configurations. Example on my network I have 200 devices, all on the same corporate network, however within that network I want to assign different vlan ID to each instead of creating a new network for each. #1 Is that possible? #2 If this is not, then what is the vlan only network intended for? (very noob here)
I know this video is a bit older, but I wanted to throw this out. Should I leave my APs tagged to “all” VLANs? Currently I have 4 SSIDs and just created a switch port profile and made LAN the native feed and tagged the other WiFi vlans. Is this the wrong approach?
So, Willie, have you noticed that if your local computer needs to be on let's say VLAN2 and your USG/Switch and such are on VLAN1 you can't manage the devices anymore? Meaning inter-vlan routing seems to not work.
If I apply quotas to a VLAN, are the restrictions given at the WAN or LAN level? I just want to restrict Internet to a vlan but not affect LAN-level speed between users of the same vlan
How about a video with Untangle UTM passing VLans to Unifi switches? I currently use Untangle UTM running on a Dell pc without VLans, plan upgrading to Unifi 24-250w, 8-60w, and 8-150w switches
This is kinda a long read but... Untangle, Unifi equipment and VLANs have been a saving grace. I run (IT Mgr for a company) a large multi-site retail network w/an Unifi backbone and Untangle as our UTM Gateway. Typical hub/spoke network design using a 200x 200 Mbit fiber circuit for primary / critical internet traffic / SIP Trunks for our on-site 3CX PBX system, 100ish Yealink T52 / T58 desktop phones and 50ish sales person's BYOD iphone / Android devices for 3CX mobile client HD Voice G722 from end to end and the Sales Ups / CTM mobile clients. Comcast cable for failover and people who watch youtube play on facebook all day long internet needs lol. MPLS is a diversified entry 100 x100 mbit to each remote store and warehouse location. ISP managed Adtran's for the failover/failback to LTE data service for the Mpls failover setup. A single Paid Service Untangle Appliance is our UTM/Gateway for all sites. The network core is 2*16 port SFP+ 4 * 10gig copper Unifi XG's for Server / Network ( 20gig lacp trunks using SFP+ DAC cables to each of the RDS-FARM / vdi servers and StorageCraft back up links using MPIO ISCSI connections to our NAS. Both of the server room and skybox client 48 port POE Unifi switch location are using SFP+ GBIC to LC MM OM3 fiber LACP trunks. We use the UNIFI XG Server as the multi-site controller Wireless is around 30 Unifi AP-HD's w/ 2Gig lacp trunks to each installed across our 4 locations. They handle about 150,000sq of combined retail/warehouse space (min RSSI is no higher than -70dbi w/ 80mhz channels on the 5Gig and -60dbi 20mhz 2.4 Gig. This is even in the 4 levels isles of 200 ft deep steel racking full of high-end furniture. Great coverage and zero drop hand off's. Pretty consistent w/ over 100 static wireless devices like the ELO 42in Product KIOSK and other product displays. We have around 70-100 constantly moving wireless devices like sales reps BYOD's, customers using the in-store guest wifi and forklift-mounted RF Guns We use Multi-Monitor 1080P Lenovo 24in AIO thin clients at every desk using either HTML5 RDP + RDS APP-V for sales and the built-in Full RDP ver. 10 clients for the admin, support and exec users w/ RDP quality settings on max. Using Powershell you can for Server 2019 to support RemoteFX. Worth every minute of the hours we spent making it work. Nighy and day difference to the end users. Our Servers have multiple NVIDIA TESLA M10's in each doing the vgpu / vworkstation graphics workloads.(I only had a 500k budget for all locations and $100k of it was Microsoft Licensing lol.) So as much as I wanted either to get all sweet VMWare Horizon 7 VDI goodness across the board. I couldn't find the other $150k to do SAN-based storage and additional licenses needed. Having 40 core 's per server was already painful. (Currently, have my 10 Power & Autocad / Photoshop users using Microsoft VDI the rest are running off of RDSH (50 users per server each balancing with 80gig personal storage drives ) A long story and lots of hard work later right after being hired last year I was able to do a complete technology change out. IE I chunked everything and just started completely over at every location. Was roughly a 2.5-month process. It handles about 1.5 to 2 TB worth of traffic per hour with absolutely no issues. total cost was roughly $545,000. Makes for a huge topology map that the Unifi Ctrl creates
Thanks for all the knowledge. I setup a wifi network that caters for hundreds of people weekly by following your videos. You came as ananswer for a me when I could not afford pricey consultants. Thanks again. My question though is I have 4 UAP AC M's managed over L3 network which no longer assign IP addresses to clients. How do I get this VLAN setup to work over Layer 3 network.
That was my thought as well, but every time I set the network up, I do everything required, setting up the vlan, setting up the DHCP server, setting up the firewalls, programming the guest network to use VLAN10 in my case, and even set up the DNS server to listen on that interface. But I can never get an internet connection on the guest network when I try this. This could simply be because I am trying to put the VLAN onto the switch0 interface, but that just doesn't seem likely. Anyway.... I appreciate the response and your videos are awesome. Especially since I can listen to them now!
I have a few of the AP-AC-Lite AP's set up this way. Cloud Key, USG are managing the Routing and Networks, and I have an HP PoE switch for the AP's. Just make sure your switch VLANs are set up properly and it works great.
First i love the way you show howto, now the probem : i would like to install one computer of my network to do VPN (Private Internet Access) i have got the subscription for but i would like to config my ERLie-3 to achive the job by create tunel for vpn and place only one IP address to that VPN and all other PC go to the internet without VPN. My ERLite is a router behind my Bell Fiber router internet. If you like to receive my network topo for that, i can send you right away. I hope you understand my English. Sorry i am french canadian.
I got it working. It just natively works. I now have a few VLANS talking to one another. I'm guessing an SVI gets made when one creates a vlan with a dhcp scope.
Thanks for the Video. I want to Segment my Network and have 2 totally separated Data network using VLAN. All my Devices are UBNT i have some doubt about how it should be, can you help?
Will quick tip to pass along on doing more advance VLAN assignments. Under the switch level / configure network and VLAN. you'll see that create icon. That will allow you to create a group rule for defining tagged and untagged ports it will also allow you to assign more than one VLAN. Once the rule is created when you go to the port level that port group will show up.
Quick steps
1. Create VLANs as shown here
2. Create port group
3. Select port
4. Select the port group rule
Wopper from the forums typed this up and I thank him for that great tip.
I’d love more information on this, kinda a new subject for me
More trunking option videos, please! I'm in a house with different people, device types and security concerns... I'd like if any physical port could route a designated device to the appropriate VLAN.
Thanks Willie for digging into the per port VLAN question I had.
At the moment I have an SG300 28-P active and SG500x 52P on stand by. I now have a Unifi switch that came in yesterday.
I really appreciate the simple break down comparison across all router manufactures communicating on 802.1q. Great Vid!
Thank you for your videos. You have helped me understand how to use some of the more advanced features of Unifi.
Thanks for the videos, do you have an end to end video that shows how to create a standard Lan, an IoT Lan and how I can access the IoT Lan using firewall rules? There are several videos but I am finding it difficult to join them up to create a whole picture, especially whether I need to trunk my 5 APs. Cheers
Did you find any tutorials covering this? I need to do something similar.
I am new to the Ubiquiti switches. This video was a HUGE lifesaver on Saturday morning as I totally re-working the network.
You never mentioned how to change to trunk port
it is similar to how HP does things, you basically tag vlans onto an interface that makes it "a trunk port"
Thank you for this excellent video. I was wondering if you would ever consider doing a video that focuses on separating iOT devices using a vLan that still allows the main or corporate LAN to connect to the iOT vlan devices but not vice versa. Been struggling to figure this unique situation out.
Check crosstalsolutions channel. Chris has just released a video of exactly what you asked. Both Willie and Chris are great and probably the best in UniFi videos in TH-cam and have even shared the screen in a video before. Hope helps
@willie great stuff...
If I have a string of unifi switches connected via trunk ports and I setup a new vlan that is only assigned on a port on the first switch and the second switch, will broadcast traffic still flow to all the other switches through the trunk port even though they don't need it?
You can crate groups of VLANs in the Network supsection. That way you cann pass through more than one
So.... Do I need a different router to do vlans or no? I have a unifi wifi system but not a uniqity router
Hello... I have an edgerouter and cisco switch all managing the vlan. Currently have an Asus router acting as an AP only and I am able to print from the ASUS SSID to the vlan containing the printers. However I put in a Unifi Cloud Controller and AP on a seperate VLAN so that the controller can see the AP and when I set the SSID on the UNIFI AP with a new VLAN for each SSID assigned, I cannot print anymore across VLANS. Any suggestions
If you have a vlan setup and you are using ports only on a switch "down stream", will broadcasted data end up going up the trunk port to other switches even if those switches don't have that vlan on any port?
How do you setup this config when 1AP broadcast 2 ssid's? Different vlans on different subnets?
trunk port on teh switched interface as well as switch to USG or router
i have a USG to an HP switch and while i have tagged all the vlans on the hp's port, i cannot get the USG to connect the other networks and vlans to the DAM HP switch!
we know that the switch is passing trunks, becuase we tested it against a cisco switch and the port config works, but the controller says USW required,
i need to create sub interfaces in LAN1 to pass vlans 1,2,3 for each SSIF to the uniquity AP's, any help can and will be greatly appreciated.
Hi I was wandering if you could do a video on setting up a management VLAN with a local controller or cloud key. Most of the videos and tutorials are using amazon or some off site controller or they stop after configuring the switch and AP.
Hi, is it possible to make a vlan without a USG?
Is the UniFi security gateway required to set-up vlan's and push SSID's on the vlan's to AP's? Can't i just do that with a UniFi Switch alone?
Hi Willie, just to do a bit of a deeper dive, why would you want to put an SSID on a separate vlan?
Makes sense, thanks for the info and the video!
Sorry to necro, but im setting up a Mitel VOIP system and I want to set the phones to a different IP range than my data network (essentially a VLAN). Do I setup a corporate network or do I setup a VLAN only and make my DHCP server provide the different IP addresses to the phones?
Will thank you for sharing great video, may i ask if you a video setup multiple AP ?
Please do a video explaining vlan only configurations.
Example on my network I have 200 devices, all on the same corporate network, however within that network I want to assign different vlan ID to each instead of creating a new network for each.
#1 Is that possible?
#2 If this is not, then what is the vlan only network intended for?
(very noob here)
I know this video is a bit older, but I wanted to throw this out. Should I leave my APs tagged to “all” VLANs? Currently I have 4 SSIDs and just created a switch port profile and made LAN the native feed and tagged the other WiFi vlans. Is this the wrong approach?
Thanks, well explained (as usual)
So, Willie, have you noticed that if your local computer needs to be on let's say VLAN2 and your USG/Switch and such are on VLAN1 you can't manage the devices anymore? Meaning inter-vlan routing seems to not work.
Did you find a work around for this?
If I apply quotas to a VLAN, are the restrictions given at the WAN or LAN level?
I just want to restrict Internet to a vlan but not affect LAN-level speed between users of the same vlan
How about a video with Untangle UTM passing VLans to Unifi switches? I currently use Untangle UTM running on a Dell pc without VLans, plan upgrading to Unifi 24-250w, 8-60w, and 8-150w switches
This is kinda a long read but... Untangle, Unifi equipment and VLANs have been a saving grace. I run (IT Mgr for a company) a large multi-site retail network w/an Unifi backbone and Untangle as our UTM Gateway. Typical hub/spoke network design using a 200x 200 Mbit fiber circuit for primary / critical internet traffic / SIP Trunks for our on-site 3CX PBX system, 100ish Yealink T52 / T58 desktop phones and 50ish sales person's BYOD iphone / Android devices for 3CX mobile client HD Voice G722 from end to end and the Sales Ups / CTM mobile clients. Comcast cable for failover and people who watch youtube play on facebook all day long internet needs lol.
MPLS is a diversified entry 100 x100 mbit to each remote store and warehouse location. ISP managed Adtran's for the failover/failback to LTE data service for the Mpls failover setup. A single Paid Service Untangle Appliance is our UTM/Gateway for all sites. The network core is 2*16 port SFP+ 4 * 10gig copper Unifi XG's for Server / Network ( 20gig lacp trunks using SFP+ DAC cables to each of the RDS-FARM / vdi servers and StorageCraft back up links using MPIO ISCSI connections to our NAS. Both of the server room and skybox client 48 port POE Unifi switch location are using SFP+ GBIC to LC MM OM3 fiber LACP trunks.
We use the UNIFI XG Server as the multi-site controller Wireless is around 30 Unifi AP-HD's w/ 2Gig lacp trunks to each installed across our 4 locations. They handle about 150,000sq of combined retail/warehouse space (min RSSI is no higher than -70dbi w/ 80mhz channels on the 5Gig and -60dbi 20mhz 2.4 Gig. This is even in the 4 levels isles of 200 ft deep steel racking full of high-end furniture. Great coverage and zero drop hand off's. Pretty consistent w/ over 100 static wireless devices like the ELO 42in Product KIOSK and other product displays. We have around 70-100 constantly moving wireless devices like sales reps BYOD's, customers using the in-store guest wifi and forklift-mounted RF Guns
We use Multi-Monitor 1080P Lenovo 24in AIO thin clients at every desk using either HTML5 RDP + RDS APP-V for sales and the built-in Full RDP ver. 10 clients for the admin, support and exec users w/ RDP quality settings on max. Using Powershell you can for Server 2019 to support RemoteFX. Worth every minute of the hours we spent making it work. Nighy and day difference to the end users. Our Servers have multiple NVIDIA TESLA M10's in each doing the vgpu / vworkstation graphics workloads.(I only had a 500k budget for all locations and $100k of it was Microsoft Licensing lol.)
So as much as I wanted either to get all sweet VMWare Horizon 7 VDI goodness across the board. I couldn't find the other $150k to do SAN-based storage and additional licenses needed. Having 40 core 's per server was already painful. (Currently, have my 10 Power & Autocad / Photoshop users using Microsoft VDI the rest are running off of RDSH (50 users per server each balancing with 80gig personal storage drives )
A long story and lots of hard work later right after being hired last year I was able to do a complete technology change out. IE I chunked everything and just started completely over at every location. Was roughly a 2.5-month process. It handles about 1.5 to 2 TB worth of traffic per hour with absolutely no issues. total cost was roughly $545,000. Makes for a huge topology map that the Unifi Ctrl creates
Do the UniFi APs work VLANs without UniFi Switch?
Thanks for all the knowledge. I setup a wifi network that caters for hundreds of people weekly by following your videos. You came as ananswer for a me when I could not afford pricey consultants. Thanks again. My question though is I have 4 UAP AC M's managed over L3 network which no longer assign IP addresses to clients. How do I get this VLAN setup to work over Layer 3 network.
How is it that you create a network for say, a guest network tagged with say VLAN 10, using a unifi switch and a UAP, but an ERPoe-5 as the router?
That was my thought as well, but every time I set the network up, I do everything required, setting up the vlan, setting up the DHCP server, setting up the firewalls, programming the guest network to use VLAN10 in my case, and even set up the DNS server to listen on that interface. But I can never get an internet connection on the guest network when I try this. This could simply be because I am trying to put the VLAN onto the switch0 interface, but that just doesn't seem likely. Anyway.... I appreciate the response and your videos are awesome. Especially since I can listen to them now!
Thanks Willie
I am using an AP-AC--LR, can I use a different type of switch device like cisco, or netgear with this setup? or Does it has to be Unifi switch?
I have a few of the AP-AC-Lite AP's set up this way. Cloud Key, USG are managing the Routing and Networks, and I have an HP PoE switch for the AP's. Just make sure your switch VLANs are set up properly and it works great.
First i love the way you show howto, now the probem : i would like to install one computer of my network to do VPN (Private Internet Access) i have got the subscription for but i would like to config my ERLie-3 to achive the job by create tunel for vpn and place only one IP address to that VPN and all other PC go to the internet without VPN. My ERLite is a router behind my Bell Fiber router internet. If you like to receive my network topo for that, i can send you right away.
I hope you understand my English. Sorry i am french canadian.
Willie thank for this video, one question i plan to purchase a router and a Switch. I'm wondering which is the good one.
Sir, what exactly the use of VLAN? and how important it is?
how to allow 2 vlan in 1 port but not all vlan
You can set up a port group with one (or none) native VLANs and as much as you want tagged VLANs (just tick the ones you want to use).
Great video once again!
Hasta el re-cu tu video, mucho floro man
I would like to get config to PIA VPN to specific ip address on ERLite comfig.
Can the unifi switch doe inter-vlan routing without the need for trunking via the gateway?
anon its later 2
I got it working. It just natively works. I now have a few VLANS talking to one another. I'm guessing an SVI gets made when one creates a vlan with a dhcp scope.
Anyone could help me out here. I have multiple subnets configure to different port. How do I create 1 port to manage all Of them?
Sir, Master Howe how come you have different IP address?
Please tell me boss.
Thanks for the Video. I want to Segment my Network and have 2 totally separated Data network using VLAN. All my Devices are UBNT i have some doubt about how it should be, can you help?
Could you PM me just have a few questions thanks!