Build a small office UniFi network

Outcome and equipment

Build a small office with staff computers, guest WiFi, a shared printer and cameras. This example uses a UniFi gateway, a managed PoE switch with enough ports and power, two APs, a printer and a dedicated Protect recorder with cameras. Select hardware capacity from actual client, port, power and recording requirements. Keep an existing management LAN for infrastructure and an administrator port while the office networks are introduced.

Example design

Network Address range Intended devices and access
Main VLAN 10 192.168.10.0/24 Staff computers and authorised management users
IoT VLAN 20 192.168.20.0/24 Printer and other selected appliances
Guest VLAN 30 192.168.30.0/24 Visitor internet access with isolation
Cameras VLAN 40 192.168.40.0/24 Cameras and the dedicated recorder

Use .1 as each gateway and .100 to .199 as each DHCP pool. Reserve printer .120 on IoT and recorder .120 on Cameras. Choose different ranges if these overlap the office's existing routes. Application permissions remain necessary even when a network connection is allowed.

Procedure

  1. Inventory the office. Count wired computers, APs, printer, recorder, cameras and uplinks, then add planned expansion. Sum the actual maximum power requirements of PoE devices and compare both each port and the switch's total available budget. Record the required WAN throughput and which services must continue during an internet outage.
  2. Set up the gateway and verify internet access through a wired test computer. Adopt and label the switch and APs. Set the site location and timezone correctly. Keep infrastructure management on its current network while the client VLANs are built. Create a backup of this working foundation.
  3. Create the four networks with the address plan above. Configure infrastructure trunks and endpoint access ports using Access and trunk ports guide. The printer port uses IoT; cameras and the dedicated recorder use Cameras. A straightforward Protect installation keeps the recorder and cameras together, avoiding an unnecessary cross-VLAN adoption problem. [1]
  4. Create Office WiFi on Main and Office Guest on Guest. Add an IoT WiFi only if wireless appliances need it. Start with compatible security settings and a modest number of WiFi names. Select the APs serving the office and test both access points with a laptop before moving every user. Dedicated IoT WiFi can accommodate device requirements separately from the staff network. [2]
  5. Apply the access plan. Staff may reach the selected printer service. Authorised staff may access the recorder's application; ordinary staff need not reach individual camera administration. Guests receive internet access without access to private networks. IoT and cameras cannot start unrelated sessions into staff or management networks. Implement the specific exceptions and return traffic before broad denials, following Tutorials: Guest WiFi isolation, IoT VLAN with casting and Zone-based firewall.
  6. Configure printer discovery only between Main and IoT if required. Reserve the printer and recorder addresses, then test access by address before relying on names. Decide whether camera devices need internet connectivity for their particular functions and support workflow; do not copy a universal block without testing the selected installation.
  7. Create individual administrative accounts for people who manage the installation, using permissions appropriate to their responsibilities. In a non-Fabric deployment, Site Manager's People workflow lets you add an admin and assign application access. Use the Fabric role workflow instead where the organisation is already managed through a Fabric. [3]
  8. Keep ordinary staff service access separate from infrastructure administration. A user who needs to view permitted footage or unlock a door does not automatically need a Super Admin account. Verify application roles using the person's actual account or an equivalent test account. [4]
  9. Configure the chosen backup internet arrangement if required, then run the failover exercise in Backup internet failover guide. Schedule maintenance and updates for an appropriate business window. Save a new configuration backup and document the final port map, network ranges, administrative owner and recovery contact.

Acceptance tests

Test one device from every network. Staff must browse, print and use their business application. Guests must browse while private service tests fail. Cameras must record and replay a staged event through the recorder. Test the permitted staff viewer and a user without camera permission. Check wireless behaviour in meeting rooms and work areas, including a call while moving between AP coverage areas.

Repeat network isolation checks for IPv6 wherever it is enabled. Check that DHCP and DNS continue after the policies are applied. Measure performance during ordinary office activity rather than using a single idle speed test as the complete acceptance criterion.

Troubleshooting and handover

Treat faults by layer: power and link, VLAN and addressing, routing and firewall, then application permissions. If a newly moved printer fails, return just that port to its recorded previous network while investigating. Preserve the administrator connection and move users in small groups.

Give the office a concise operating record covering how to obtain guest access, report a fault, retrieve recordings and reach its administrator. Record completed tests and any remaining limitations. Do not label the installation compliant with a particular standard solely because VLANs have been configured.

Sources

Back to the series

Leave a comment

Please note, comments need to be approved before they are published.