Kernaali ToolsMake the packet path explicit
A VLAN ID identifies a Layer 2 segment. A UniFi virtual network describes that segment and, with a UniFi gateway, can also configure its IP subnet, DHCP and policy. An SSID maps joining wireless clients into the selected network. Creating a network does not move existing devices into it automatically.
| Network | VLAN ID | Example subnet | Assignment |
|---|---|---|---|
| Trusted | 10 | 10.42.10.0/24 | Trusted SSID / office access ports |
| IoT | 30 | 10.42.30.0/24 | IoT SSID / device ports |
| Guest | 40 | 10.42.40.0/24 | Guest SSID |
| Management | 99 | 10.42.99.0/24 | Deliberately planned AP/switch management |
These IDs and addresses are a planning example, not UniFi defaults. Check VPN and existing LAN routes for overlap before adopting them.
Gateway first, then the full uplink path
On a UniFi gateway, define the network’s VLAN ID, subnet, gateway and DHCP behavior. With a third-party gateway, create those Layer 3 services there and use the same VLAN ID in UniFi’s Third-party Gateway network definition. UniFi APs cannot supply a missing upstream DHCP server simply because an SSID exists.
Allow the required tagged VLAN on every switch-to-switch and switch-to-AP uplink along the path. An access port gives an untagged wired client the chosen native VLAN. A trunk can carry several tagged VLANs plus a deliberately selected native network. Both ends must agree on untagged/native behavior.
Map the SSID and preserve AP management
Assign the Wi-Fi SSID to the intended virtual network. A client on the IoT SSID should receive an address in 10.42.30.0/24 in this example. AP management is a separate path from the VLAN tags applied to its wireless clients.
Keep the AP port’s native network distinct from the tagged SSID networks. Ubiquiti warns that using the same non-default VLAN as both the AP port’s native network and a broadcast SSID network breaks client connectivity. A device Network Override also requires that VLAN to arrive tagged, not as the directly connected port’s native VLAN.
Do not change the AP’s management VLAN and remove its old uplink network in one remote step. First make the new network reachable end to end, including DHCP, DNS and controller access. Test with one AP and retain a recovery port or local access. If an AP falls offline but clients still pass traffic, investigate management reachability before resetting it.
Diagnose by the observed address
| Symptom | First check | Next evidence |
|---|---|---|
| No DHCP address | SSID mapping and allowed tags on uplinks | Gateway DHCP scope / leases |
| Address from the wrong subnet | Native VLAN or SSID network mismatch | Port profile at both ends |
| Correct address, no Internet | Gateway/default route and DNS | Firewall policy and upstream service |
| Internet works, local discovery fails | Inter-VLAN policy and mDNS design | Required discovery and service ports |
| AP offline after change | Management network transport | Controller reachability from that VLAN |
Verify isolation separately. Distinct VLANs create boundaries, but routed access between them still depends on the gateway policy. Test both IPv4 and IPv6 if enabled.
Check a subnet · VLAN frame overhead · Guest and IoT policy · RouterOS bridge trunk example
These guides use the current UniFi Network concepts. Menu wording and location vary by release; check the policy’s actual scope and result. Kernaali Tools is not affiliated with Ubiquiti.
Technical references
- UniFi virtual networks
- UniFi network and client isolation
- UniFi zone-based firewall
- UniFi trunk and access ports
- UniFi VLAN troubleshooting
Found an issue? Send a correction with a reproducible example.