How do I put cameras and IoT devices on their own VLAN in UniFi

Updated Source: 9761080275607 Rev
Quick answer

Create a separate virtual network (VLAN) for the cameras and another for IoT devices, then assign devices to it. In UniFi Network you create it under Settings > Networks, give it a name and optionally a VLAN ID, subnet range and DHCP, then click Apply Changes. A new VLAN does not move any devices by itself.

Steps

From: Creating Virtual Networks (VLANs) manual, p. 1

  1. Create the network
    In UniFi Network, go to Settings > Networks and create a new virtual network. Name it, for example Cameras, and optionally set the VLAN ID, subnet range, DHCP, isolation, content filtering and DNS. Click Apply Changes.
  2. Repeat for IoT
    Make a second virtual network for smart TVs, thermostats and other IoT devices so they stay separate from both the cameras and your trusted devices.
  3. Assign the camera ports
    Set the VLAN on each switch port that feeds a camera or the recorder. Any device plugged into that port lands on the camera network.
  4. Map an SSID for wireless IoT
    Each SSID maps to a single VLAN. PPSK lets one SSID hand out different VLANs by password, but it is unavailable on 6 GHz networks.
  5. Use MAC-based assignment for devices that move
    With a UniFi Gateway, RADIUS MAC-based assignment or Virtual Network Override keeps a camera or IoT device on the same VLAN wherever it connects.
  6. Lock it down
    Enable network isolation or restrict access between VLANs. On a third-party gateway, create the VLANs there first with the same VLAN ID, select Third-party Gateway under Router, and set the routing and firewall rules on that gateway.

Specs & limits

From: Creating Virtual Networks (VLANs) manual, p. 1

CreateSettings > Networks, then Apply Changes
Wired assignmentVLAN per switch port
Wireless assignmentOne VLAN per SSID, or PPSK
MAC-basedRADIUS or Virtual Network Override (UniFi Gateway)
VLAN Magic not supported downstream ofUSW Flex, Flex Mini, Ultra, Flex 2.5G, ECS Aggregation

Common mistakes

From: Creating Virtual Networks (VLANs) manual, p. 1

  • Devices still on the default network: VLANs created on a UniFi Gateway don't assign devices automatically. Set the port or SSID.
  • VLAN Magic missing devices: it isn't supported downstream of USW Flex, USW Flex Mini, USW Ultra, USW Flex 2.5G series or ECS Aggregation switches.
  • No traffic between VLANs on a third-party gateway: most block inter-VLAN traffic by default, so add routing and firewall rules there.

Applies to

UniFi Network · UniFi Network application

Sources

  1. Creating Virtual Networks (VLANs), p. 1 (9761080275607 Rev )
Was this right?