UniFi Network Setup & Configuration Guide | 2023

hey what's up guys welcome back to another unified it video and today we're going to be talking about how to set up your guys's UniFi Network um a little bit of context as to what I do a lot of the times I deal with a lot of bigger networks a lot of Cisco mainly extreme too but it's always good to come back to ubiquity and kind of show you guys and apply some of those more larger broad scale topics to kind of configure and max out your UniFi setup we're going to talk about a lot of things brush through a lot of settings today but uh before that if you guys need help setting up any of your own networks any of your own ubiquity gear we're a full full stack I.T company we'll help you guys do anything you need just go ahead and visit our website down below we actually do a lot of managed it as well so just starting at 25 a seat we can go ahead and help you guys out with whatever you need so visit our website link will be down in the description but let's go ahead and get into the video so first thing we're going to go ahead and do is power on the udm pro as you can see we have it in our rack over here and we have two things plugged in right now we have our Wan Port which is going out to our ISP that'll be all the way on the far right side and then on the far left side you see that we have our computer plugged in we have it plugged in via our ethernet cable in the back so now that the console is actually powered on let's go ahead and get into our settings here and let's check our IP address so this will kind of tell us what the udm is configured with by default so we're going to need to grab this address to actually set the device up so if we go to our settings our Network we'll see that we have the router's IP and we've you know grabbed our own IP so it's giving us this default right here so we're just going to copy that into a web browser go ahead and paste that right into Safari up here and we can see that we're in the router now so it's going to ask us for some configuration startup information we'll go ahead and first off have to give the device a name we'll go ahead and name ours contoso Florida branch and of course we have to agree to the terms and services go ahead and hit next so now it'll ask us for our ui.com credentials so you can either use your existing one or create a new account down below this is just your cloud account it'll help you manage a lot of your devices inside of their Cloud so go ahead and sign up with an email and a password and just input them here so now that we've gone ahead and put our credentials in it'll actually show you if you've had a UniFi account before this is your second time setting anything up if you would like to restore from a backup but we're just going to go ahead and continue without One update schedule now for our purposes if you're actually running a real production Network we're actually going to disable the updates because we want to manually push those out when they come out on our schedule that works best for our Network so we usually always leave those disabled by default because the last thing you want is someone working on something in your udm restarting it's never a good thing this will also ask you if you want to enable the basic configuration for your console so sending any Diagnostics and performance information we'll just go ahead and leave that unchecked for now and now it'll start to do speed tests check our internet speed it'll usually ask you what your service provider is giving you so you can kind of input that into the portal as we can see it's running our test right now we'll wait for this to finish and as we can see com cable is calm crap in our area so we've just finished the test it'll automatically import the highest results in the lowest results inside of our download and upload I'll actually just go ahead and put 100 in there since that's actually what we get for most of our stuff for download about 20 for uploads so we'll leave that there and then once we head next it'll continue the rest of the setup this is the final step and that should allow us to see the home page in just a second now that our udm Pro is finally done doing its updates we're brought to the main home screen so before we go and touch anything with the network or any of that stuff let's just go to our settings and check our applications so usually within the system we would see if we had any updates that are pending looks like that took care of it as well as the network seems up to date there are some additional updates as well for things like protect access but we're not going to focus too much on those today if really at all this is purely just more the network portion of it so I'm actually going to stop all the other services because we are not enabling any of those for today and then we can go ahead and actually I'm going to uninstall most of them because we don't need any of these so it looks like everything is up to date we're good to go if we go back to the dashboard we'll just head right into our Network portion of it now for our configuration today we have one switch and one access point that we're going to plug in here so if we head on over to our unified devices this is kind of where we'll see everything pop up that is a unified device so we'll go ahead and plug the switch in for now and we should see that pop up in just a second and we will click to adopt we will adopt device and it looks like the device is attempting to adopt and it looks like it's given an IP address getting everything ready and then finally we will also plug our access point in as well at the top to adopt that as well awesome and then finally we will see our access point as well so we'll just click to adopt that we'll adopt that as well we'll close out of some of these notifications awesome so this is the very basic setup if you were to just plug everything in have it get an IP address from the router adopt it this is pretty much as basic As It Gets You could also go into your settings Wi-Fi added Network and then just add it to the APS and let it run this is the setup that we're not trying to go for today we're actually trying to take a little bit of time to craft out the network our different vlans different segments how we actually want to make this work most efficiently for our business school whatever application you're actually trying to put this into a production level environment for so while the access point is getting ready in doing its adoption we're going to go and head over to the backbone of our udm the settings we're going to start off with our networks tab as we see the default Network for you know us is the 192.16810 with a slash 24 subnet very basic if you want to keep it and use the same scheme feel free you can use 192.1682-345 whatever you want for your vlans but we're going to go ahead and modify the existing one because we have a scheme that we like to use so first thing we're going to do is unclick auto scale Network and we're going to go ahead and actually manage these things the way that we want to do as well as we're also going to go ahead and click manual down here it'll give us a little bit more options to play with so our host address we're going to go ahead and change this we're going to do 10 Dot 69.1.0 and we're going to go ahead and select the slash 24 we actually have to do the host addresses.1 because it's asking for what we want to make the host so the way we'll do this is use 1069 as the first two octets that are fixed then the last two will actually be the ones that will see any change or variation so it'll be 1069.1 1069.2 1069. three so on and so forth and then the final octet over here will actually be used for our devices that will connect you know one through 253 whatever we want to have there is our our range I usually leave our DHCP range down here I don't do the first six I actually usually reserve the first 10 or 15 so I started off at dot 115 and then leave it through 254 that's usually fine but again the scheme we're going for is 10.69 dot you know and then our VLAN name and then the last octet will be for the hosts so this will be our first Network this network will be the backbone of the entire network this is what we call our netman Network or our net management this will be for switches access points anything that's actually critical to the network itself to operate so we have 106911 which will be the router's address and we left our net mask AS Slash 24 which gives us this range right here we see we have all the way from 15 to 254. that's fine network type is going to be standard we don't really want to play with the guests for this one content filtering that's kind of up to you I've noticed that some of this stuff is a little bit aggressive some of it works really well but again since this is the backbone of our Network we'll just leave that as none and then we'll kind of scroll down make sure if you guys have your own DHCP server you can put all of your information in there if you want a different server but we're all going to be containerizing it on the actual udm Pro itself so we'll leave all that is the same you also see that we get a little bit more options in here the least time I actually put this down in half I usually go to about 4 000 or um 46 000 seconds which usually the default is eight days I usually split it in half to four because on our guest networks typically we'll have a lot of people join and leave so you can even do as low as two days or even hours if you want but I don't like taxing the udm pro that much with all of its tables and stuff like that so I'll usually leave it to four days as a good middle ground and then there's your domain name if you're using active directory I highly recommend that you put your domain name in here it's kind of cool when your clients connect they see oh this is part of the you know unified it networker you know in this case contoso Network so we'll just leave this as contoso and then we'll do contoso.local for our Network we'll leave the rest of this pretty much the same we don't need to mess with a lot of the other stuff and then IPv6 we just won't have anything so we will go ahead and apply this and this will take place immediately so you'll notice if you try and refresh your browser page obviously we change the IP address and our subnet so it's not going to work anymore so we actually have to go to that new address which is going to be 10.69.1 and then our router is dot one and we'll go ahead and visit that page it might take a second to actually propagate and do all of that in fact you might actually have to unplug your laptop and plug it back in just to get a new IP address within that range so we'll go ahead and apply that we'll also go ahead and unplug our switch and our access point as well to all propagate that stuff awesome so now we got that again we'll go ahead and log back in now that we've logged back in we see that we're under our new address our 1069 Network we'll go ahead and go back into our network settings and get ready to set everything else back up so now that we're in our settings we're back to where we were so we have our default Network which again is that Network management network if we go into here it has all of the things that we just set it saved all of our options so we'll go ahead and split the network out into a couple other segments or vlans of course most of you guys know what vlans are but these are just other virtualized networks that we can go ahead and containerize what happens on some of those networks so usually now that we have the backbone of our Network we'll actually make the corporate Network where most of the posts themselves will live on people's laptops people's desktops the regular corporate devices that we actually own is the organization we'll go ahead and put this on so we'll name this Maine staff for this one router again is the router that we're on we'll go ahead and unselect the auto scale feature we'll do our 10 69. this one's going to be dot 2.1 so this will be the second Network that we're creating of course we have to go to manual we'll actually give this a VLAN ID this will actually allow the network to operate as a second layer 2 Network by giving it this ID or this tag and again since this is the main corporate Network we'll just leave this standard we'll actually do filtering we'll actually put this on work mode this will block some explicit content you know and stuff like that search engines will be set to safe mode some other cool stuff it does you know we'll just do that again we'll reserve the first 15 in our DHCP range to save that in case we need to put anything that low for services and everything else looks good so we'll go ahead and add this network that'll be our main staffing network and then we'll go ahead and add our server Network so this network is very pertinent if you're running a lot of on-premise applications or kind of want to carve out a segment for your day-to-day operations or workstations that act as servers so we'll just go ahead and make this the server VLAN and we'll make sure again we'll change that off we'll do 10.69.3.1 this will be the third network we'll make sure that that VLAN ID again is set to 3 it is again a work one standard Network everything looks good there this one will actually I usually Reserve in the server Network at least the first 25 because usually all of our servers are statically set for the most part so I don't like anything taking the first chunk of the network but other than that we add it and it's another standard Network as one of the most contentious networks Will Be Our Guest Network now this is optional but you don't have to provide this to people but you know most places do so we'll just make this Our Guest Network now typically I kind of hide this one away so this one will be 10.69 and let's say we're a little bit of a a bigger company I'll actually kind of shove this up in like the 80 range um and in fact we can actually take this to a whole different level I actually will probably do [Music] 10.68.0.1 and we'll actually do this as a slash once bring that down to a 16. so that actually gives you a lot more possibilities with this network since usually we'll have you know usually we'll see you know anywhere from four to five hundred guests on a network at any point in time so we'll kind of open this one up a little bit so we'll bring this down to the 68 and we'll leave this as slash 16 so our new Range becomes a lot wider again we'll give this a different VLAN ID I'll actually give this like a I'll give this a VLAN ID of 68 to match the 68 in front and for network type we will hit guest Network so your guest hotspot profile will automatically be applied to this guest Network connected clients will be isolated from all other internal networks very important that our guests cannot access any other networks and we'll actually show you later within the access point we can separate the guests from talking to any of the other guests which is a really nice feature so we'll just make sure that this one is selected for guests we'll also make sure that this one is uh family rated this one actually will block vpns which is extremely important if you guys are trying to firewall certain content a lot of people will attempt to use a VPN to try and get out of that but that content filtering will actually block most of the vpns that you try and use again DHCP server for this one's not as pertinent because we have so wide of a range that we're dealing with here and we'll never really throw anything statically into the guest Network so we'll just add this one for now now we see we have our default Our Guest our main Staffing one and our servers now the last Network that we usually like to add is the iot and security network it's very contested of whether these should be together or not we always separate them no matter what we we don't think that you should just have an extra Network for all your miscellaneous devices because if you have your nest thermostat on the same network that your door access control is on that could be a very big problem a lot of people just like to make a an iot Network and just launch sum everything onto that network but we actually differentiate those two and we'll actually make an iot Network separately again we'll uncheck the auto scale Network option and we will do our 10.69 now this is iot so I kind of also throw this one up there as well I'll probably put this in like the 20s just to give us room on the lower side of it so we'll do 20.1 we'll also make this again a slash 24 we'll go ahead and change that ID up to 20 to match that octet up there we can also make this a guest Network to isolate this internally from any of the other networks it'll be nice because that way that iot Network can't talk to our server Network it should never have access to do that content filtering isn't super pertinent to this network since nothing should really be browsing the internet like a traditional guest client would be so that's kind of up to you your own and again DHCP range doesn't really matter because I'm not planning on setting anything up statically for iot and then we'll just go ahead and add that Network and then the last but not least will create a security VLAN now this will be where a lot of our door access control is maybe one or two cameras an NVR something like that now something to keep in mind if you do plan to use ubiquity cameras is to always keep the cameras on the same VLAN as the actual NVR it can use up a lot of east to west traffic for the router's sake of trying to push you know 1080p you know seven streams of 1080p over the network having to Route cross those vlans you know it could just be unnecessary traffic so we usually just leave the nvrs on the same network as the actual cameras so again we'll unselect Auto scale Network we'll do our 10.69 and this one will be dot 5.1 we'll leave this as manual we'll do five for this one and we'll take a look at our DHCP server again I usually reserve the first 15 for this in case you want to throw in anything like an NVR or a couple of Access Control cans anything like that so we'll go ahead and hit save to this one as well and I'll also remember don't select guest for this one because we would like to have that cross VLAN communication as well so and it looks like we have the backbone structure of our Network pretty much laid out I'll organize these so you guys can see that again we'll go across guest is completely different it's on the 68 octet on the first or the second octet and we're doing a slash 16 to give that plenty of addresses for any guests who could want to join the network or anything like that and then we you know go into our default again this is the network for switches access points stuff like that our main staff which will be our operating staff their production machines stuff like that and then our servers pretty obvious security which will be you know cameras access control and then iot which will be our chromecasts anything else like that you know Apple TVs conference room stuff now that we have those Network networks created let's actually create Wi-Fi networks to associate with those physical Networks so this one we will do contoso staff again this will be on that Staffing VLAN that we created and we can create a password for this we will just make this one two three four five six pretty good pretty secure password now never do this in production would never recommend it and the network we can actually then attach it to our main staff Network and then it will actually say that we have a couple of access points this is just the all APS group but you can actually change if you had different APS and different groups so you had a first second and third floor of a building and you didn't want to broadcast your SSID to all of them maybe only the first two need them and the third floor is just kind of like a guest lounge area we could make different groups and broadcast different ssids on that so um and then in manual here you can choose do you want to do both 2.4 and 5 Wi-Fi type will be standard or a guest hopped spot band steering bandwidth profiles we can do a whole bunch of stuff like that but again since this is the core production Network I want this one to have full bandwidth full priority don't want to limit any of that and what's cool here is you can actually change the security protocol I will change it to WPA2 and wpa3 since I know all of our devices will support that but you might just want to keep it WPA2 if you you know need need that what's also cool too is if you change this to WPA to Enterprise you can point that to a radius server so if you use active directory credentials you can have the Wi-Fi network not have a password at all up here and purely just use that radius server now that'll probably be a separate video you'll have to configure your devices to use certificates and it's a little bit more of a complex scenario but you do have that option if you want to enable that we'll just kick it back to WPA2 wpa3 that password of one two three four five six it's our main staff Network and everything else looks good so we'll go ahead you can also do the Wi-Fi schedule down here if you turn that on you can do certain days of the weeks it's broadcasted certain times it's not it's actually kind of cool for production if a lot of your staff isn't at the office all the time it might be a little bit more secure to not broadcast that again completely up to you guys you can also do a MAC address filter and radius Mac authentication so we'll go ahead and add that Wi-Fi network oh look it's even asking us to make that eight password characters so we'll just add through eight cool so our staff network has made the password is there and it's attached to the correct VLAN we see right here is our main staff Network so we'll go ahead and now make our guest Network now this one is the one that we have to be critical of this one we'll just leave this one open actually so we'll hit manual we'll make this one a guest hotspot and it says look we've applied your guest hotspot profile to this SSID by default clients connected will be isolated from all the other internal networks very good very good we also want to make sure that this goes to our guest Network as we see it's also showing that it's a guest labeled Network um so guests will go on to guest and the Wi-Fi type is also a guest hotspot so it not only is isolating them from the physical Network layer but also on the actual Wi-Fi access points themselves it is making sure that they're not touching any of the internal traffic as far as the password goes we can just make that whatever we want usually I leave it open we also could do a bandwidth profile but we'll go ahead and set that up in a little bit we won't do that just right now and we'll go ahead and add all that so now we have both our guest and our staff and then we will create one more this one will actually be a hidden network this one will be for iot devices so we'll do contoso Dash iot and we'll do a password for this one again we'll just make it whatever we want um the network we will go ahead and point this one down to our iot Network we'll go ahead and do our guest hotspot as well cool it took that automatically we'll leave that on 2.4 and 5. really important here client device isolation this prevents the clients on the same AP from talking to themselves this can be a problem in iot though if you have one Google home device trying to talk to a light switch or if you have a phone that's on that Network connected to a different network usually it can create some problems so this is up to you to leave enabled you can disable this if devices on the iot network need to talk to each other or a bridge on that Network um but again it's still a guest labeled Network so it won't talk to your production your core or your servers so that one's kind of up to you to leave enabled you can keep that enabled or disabled at your will we'll leave that disabled for now and then hide Wi-Fi name we'll go ahead and hit enable we don't really need anyone seeing that popping up on their phone we'll just leave that one hidden everything else looks fine though we'll go ahead and hit add Wi-Fi network now we have our three networks our guest and our staff and then there's iot there as well you can also do some Global AP settings you can change where the Channel width is on the 2.4 or the five gigahertz change transmit power I usually leave a lot of these on auto ubiquity actually does a really good job at scanning its surroundings and adjusting accordingly so I actually use a lot of that in auto mode because it usually does a really good job of that you can do wireless meshing as well it allows APS to connect to other APS wirelessly to to kind of rebroadcast the network again this can be really good for places where you may not be able to run a cable to but still have a decent Wi-Fi connection you just want to rebroadcast it I usually leave it disabled because I don't like to have an AP that's not about wire and kind of confuse me when it's being set up that it's working but it's not I mean other than that now we have Wi-Fi we have our networks really everything is enabled under the networks if you're in a production Network we do need to look at a couple of the global switch settings so jumbo frames jumbo frames are for of course that says larger than 1500 bytes connectivity issues may not may occur if you don't have support for this feature or if they're improperly configured if you have applications that require jumbo frames enable it if you don't or don't even know what it is probably don't mess with it flow control you can also do stuff with packet latency by pausing traffic you can increase TC CPE throughput again if you don't know what it is probably don't touch it spanning tree is very important and can actually save you a lot of problems in your environment I always use rstp and it basically allows you to make loops in your network that way you can create rings and stuff like that and have redundancy at the switch level I usually just leave rstp enabled by default and then 802.1x control on the ports again if you don't have radius setup there's no need to touch any of this all of that looks good now let's go ahead and go to our firewall and security this is the fun part of the firewall that I really like to kind of get in and to touch on So Country restrictions pretty obvious if we want to restrict any countries from coming in or from us going out to them we always I always do both directions just to make sure that the country can't come and ping us and we can't ping them for example we could just put like China and add it as well as like if Afghan Afghanistan you can really go through and add as many countries as you want in services that you don't really have it's better to block as much as you don't need and then allow them through when you do need them so I usually just leave you know Canada Mexico and the United States unblocked as well as you know Europe we have some Services over there that we like to connect to but other than that usually we block a lot of other stuff threat management this is a very important part this will affect how your udm pro performs if you have a gigabit connection it may slow it down if you don't have a gigabit connection you can kind of mess with this and it won't really affect too much so you have two different modes you can do you can do detect only and detect and block I like to do detect and block um because I know how to set up a lot of that stuff to not be overly sensitive but you know choose whichever one that you would like to system sensitivity has identification in of things like viruses peer-to-peer you know stuff like that you can also choose your threat categories down below if you want to block certain things like SQL or you know DNS or web apps or stuff like that usually we just go ahead and we block things like all the stuff up top you know malware all that kind of stuff P2P I usually block a lot of P2P stuff because we don't have any vpns or stuff like that that would use that in our Network as well as tor um save that and that'll kind of create its own custom category you know depending on what we select in here or you can go with their settings of low medium and high but look into that there's also the dark web blocker this will prevent traffic encrypted from Tor moving through your networks we usually enable that malicious website blocker will also use unify's database that they have on their end to kind of update IP addresses that could be malicious and stuff like that I hit enable but sometimes it can cause problems because you don't have control over all those IP addresses so be conscious when you do that and then down below you'll actually see firewall rules that have been in place so you know there's internet rules there's rules within your land there's rules within your guest Network you know to make sure that all the restrictions happen a lot of those will get automatically filled in but if you need to add new rules this is where you'll do them you can also have different contract modules um for like things like Nat that may be a problem you can add things into here you can also change your logging actions in case you also want to send these over to like great log or Splunk or something like of that nature there's also port forwarding rules in case you need to open up a service to the internet and there's the threat management allow list you can create custom lists in here and allow certain IPS if you're having problems with them to make sure that they're always allowed in um but this is our basic setup this will get us to where we need to go we'll apply those changes um and then we should see them be reflected shortly uh traffic management we can have this section for some of the rules different routes that we want to make you can add static routes in here in case you have different subnets or networks that you're trying to get to through other routers that you want to make the udm pro aware of so we'll go ahead you know we can create rules in here we can block a specific app we can block um you know let's say that you want to block uh Instagram say you want to block Instagram on the phones Target would be all devices schedules always and then this actually does this on an application layer so this is really cool you can speed limit you can throttle this is a very very awesome feature to have in the udm Pro definitely take advantage of it look into what's offered in that traffic management section it's a great place to explore some cool options and then teleported VPN you can go ahead and create your VPN server here you can make a layer 2 VPN that your external Associates can VPN back into the network this is where it would be you'd see your IP address here there's a pre-shared key you would go ahead and actually put them on you know a network and give them a Gateway that they have that's kind of the VLAN for vpns you could even do like radius so that way when people want to authenticate to the VPN they actually have to use like their active directory credentials or their email login very cool stuff another great place to play around with and now that we got most of our stuff set up just a couple things to wrap up around we want to give our switch a static IP you know we started the router with DOT one usually we'll keep the switches in like the 10-ish area um we'll go ahead and make sure you can also see the the network that the switch is attached to make sure it's on our default Network that's our Network management Network we'll keep that in there we'll go ahead and set it to static we'll give it a um 10.69.1 and we'll give it something a little bit lower it's at 131 right now we'll give it a we'll give it a DOT 10 address and then it's preferred DNS you know you can set that up within the udm we usually just point it to one one one for now subnet mask will be 255-255-2550 alternate DNS we can do 8888 Gateway it will be 10 6 9. uh one one and all that looks good spanning tree spanning trees priorities right there as well you'll notice too if we go into the switch and take a look at the ports we see that we have some options if we go into our Port manager we'll actually see that the flex is connected up at the first port and our udm Pros connected to the last port we just want to make sure that whatever Port we're plugging into the udm pro into our first switch or whatever switches we're plugging into the udm pro the port profile is all that way we can pass all of the vlans through that and we make sure that they're all enabled as well as for APS the same will apply you want to make sure you're passing through all the vlans that you're going to actually be broadcasting but if you had like a staff computer on let's say Port 3 and Port 5. you would go ahead and choose the networks that would be enabled for that which would be like main staff you know because we don't need to have all the vlans passed through on three and five we would just go into here and select that we just want the port Pro profile to be just main staff and then you know you could see port isolation all the other cool things that you have to do at the bottom you can set it to poe poe plus link speed you can change all that um and then we'll go ahead and apply and confirm and you'll see that you know Port three and five now have their profile set to main staff and then we'll also change the ap's IP address as well we'll do uh 10.69.1. we'll give this one a and management Network again is that default Network we're leaving it on that netman Network another cool thing too is if you go to the settings and you want to go to the top you can also search settings too so like if I wanted to change the DNS that my network uses I could just go ahead and type in DNS and I would choose my DNS server I want to go into our primary win here and then we would just go ahead and hit manual you could choose your own DNS servers that your router uses in case you want to use like 111 or you want to use something else and of course the most important thing is setting the console to dark mode we will go ahead and apply that immediately um looks way better as well as you'll also see there's your updates you can choose your channels we do automatic device updates at 3am that's kind of out of the normal work window that's usually what it has there but you can add a schedule you can also change that to not do it at all um also super critical to make sure that you take backups you can do a manual backup through here you can also do Cloud backups that actually go to your UniFi account which is super awesome highly recommend you set that up that'll be right up in this tab as well that's really it for the base the backbone of our Network again your network May or will 100 look different than this but as long as we're applying that these concepts of making sure that devices have the least amount of access that they need making sure that their networks are set up as securely as we possibly can and going to a layered security approach is better than just plugging it in creating an SSID and letting it roll we really are trying to set you guys up for One Step Above um you know just a regular configuration we really want you to take advantage of some of the features that unify offers so let us know down in the comments if you guys would do anything differently or how you guys are using your UniFi networks we're super interested to hear things that you guys have done and how you guys have kind of tricked out your network so thanks again for watching see you guys in the next video

Channel: Unified IT

Views: 215,350

Keywords:

Id: q89MVy8iySs

Length: 38min 30sec (2310 seconds)

Published: Fri Apr 21 2023