Configure UniFi access and trunk ports

Outcome and equipment

Configure ordinary endpoint ports for one network and infrastructure links for several networks. You need an adopted managed UniFi switch, a gateway with the example VLANs, an AP, an administrator computer and a spare test computer. Keep the management LAN unchanged and reserve one physically labelled recovery port on that network.

An access port carries its native network for a normal untagged endpoint. A trunk permits specified tagged networks in addition to its native network. In UniFi, inspect Native VLAN or Network and Tagged VLAN Management rather than looking only for a traditional access or trunk mode selector. [1]

Example port plan

Port purpose Native network Permitted tagged VLANs
Gateway uplink Existing management network 10 20 30 40
Downstream switch uplink Existing management network 10 20 30 40
AP uplink Existing management network 10 20 30
Main computer Main VLAN 10 None
IoT printer IoT VLAN 20 None
Camera Cameras VLAN 40 None
Recovery computer Existing management network None

This plan assumes the AP broadcasts Main, IoT and Guest, and its management remains on the original native network. Do not copy an example port number without tracing the real cable. A link between switches needs compatible treatment at both ends.

Procedure

  1. Back up the configuration and write a port inventory. Include port number, cable destination, negotiated speed, PoE requirement and current network settings. Label the recovery port. Confirm the administrator computer works through it before changing another port.
  2. Verify that Main VLAN 10, IoT VLAN 20, Guest VLAN 30 and Cameras VLAN 40 exist on the routing gateway. Each example subnet uses 192.168.VLAN.0/24, its .1 gateway and .100 to .199 DHCP pool. A switch VLAN assignment does not create an independent DHCP server or routing policy. [2]
  3. Open the switch's Ports or Port Manager view and select the gateway uplink. Preserve the existing native management network. Set tagged VLAN management to Custom and allow 10, 20, 30 and 40, or retain a working Allow All trunk while preparing a later restriction. Apply only this port change and confirm the switch remains online. [1]
  4. If there is a downstream switch, configure the upstream port feeding it, then the downstream switch's uplink, preserving management access throughout. Permit the VLANs that must reach its endpoints. Do not remove an existing production VLAN merely because it is absent from this example.
  5. Configure the AP port with its original native management network and tagged VLANs 10, 20 and 30. UniFi warns against making an AP port's native network the same non-default VLAN that the AP broadcasts as an explicitly tagged WiFi network. Keep the management and broadcast roles clear. Confirm the AP returns online before testing clients. [1]
  6. Select a spare endpoint port, set its native network to Main, and choose Block All for tagged VLANs. Connect the test computer using automatic addressing. Disconnect and reconnect its network adapter if it retains an old lease. Confirm a 192.168.10.x address and gateway .1.
  7. Repeat on the printer port using IoT and on the camera port using Cameras. These ordinary endpoints should transmit untagged traffic. Preserve the correct PoE setting for the connected hardware; changing a VLAN does not require changing PoE mode or forcing the Ethernet link speed. [3]
  8. Test the three AP WiFi networks and confirm that each yields the expected subnet. On a multi-switch path, run the same test using an AP on the farthest switch. Use UniFi's VLAN Viewer to trace where a required tag stops, if available in your installed interface. [4]

Verification

Create a record with endpoint, physical port or AP, WiFi name if applicable, assigned address and expected gateway. Test internet access and one intended private service, then one intentionally blocked service. Correct IP assignment proves the basic VLAN and DHCP path; it does not prove your firewall policy.

For a controlled fault exercise, use a spare test link to remove Guest VLAN 30 from a trunk. Observe the guest client's failure to obtain a correct address, then restore the tag. Do this only on the dedicated test path and keep the recovery connection unaffected. Record the symptom so a future fault can be recognised without resetting hardware.

Troubleshooting and recovery

If every downstream device disappears, restore the changed uplink's previous management and tagged VLAN settings. If only one WiFi network fails, trace that VLAN along the path. If a wired endpoint lands on the wrong network, check the native network and any manually configured client address. If two devices claim the same address, inspect DHCP reservations and static addresses separately.

To undo the exercise, restore each affected port from the inventory in reverse order, starting with endpoint ports. Preserve all needed tags until dependent devices have moved. Avoid applying a new profile to every port at once, because that can simultaneously remove both service and the path used to repair it.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.