Unifi Small Business setup
Vložit
- čas přidán 6. 07. 2024
- In this video we do a full Unifi small business setup. We are using Unifi network controller 6.2.25. I start with the basic setup of the Unifi dream machine pro, Getting it connected to the internet, Creating networks and vlans, Creating WIFI networks, We create firewall rules to help us secure our networks. I show you how to configure mac authentication as well as RADIUS authentication for wireless networks.
The equipment used in this video is the Unifi UDM Pro, Unifi switch pro 24 poe, Unifi flexHD, Unifi InWallHd and the Unifi NanoHD.
Unifi site to site video :
• Unifi Site To Site VPN...
Unifi remote user VPN:
• Unifi 6.1.71 Remote Us...
------------------------------------------------------------------------------------
◼️Hire us on our website
mactelecomnetworks.com/
◼️Join our discord server:
/ discord
◼️Contact me on email:
cody@mactelecomnetworks.com
------------------------------------------------------------------------------------
◼️Find us on social media:
◾Instagram:
/ mactelecomnetworks
◾Facebook:
/ mactelecomnetworks
◾Twitter:
/ mactelecomn
◾TikTok:
/ mactelecomnetworks
Linkedin:
/ cody-maccallum-29311b6b
------------------------------------------------------------------------------------
◼️If you would like to support the channel I have an Amazon storefront below:
◾Canadian Amazon Store front:
www.amazon.ca/shop/mactelecom...
◾USA Amazon store front:
www.amazon.com/shop/macteleco...
------------------------------------------------------------------------------------
Timestamps
Intro 0:00
Overview of equipment and topology 0:35
Connecting Unifi equipment together 2:48
UDM pro Initial config 3:35
Enabling two factor authentication 5:38
Updating UDM pro firmware and Unifi network controller firmware 6:18
Looking at the new Unifi UI 7:55
Adopting Unifi access points and switches into the network controller 9:24
Changing LAN subnet 10:27
Creating network in UDM Pro 11:37
Creating WIFI Networks in UDM pro 13:57
Creating bandwidth limit for WIFI network 17:00
MAC Address authorization on WIFI networks 18:10
Creating RADIUS server authentication for WIFI Networks 18:21
Creating Firewall rules to secure your Unifi network 19:50
Unifi Internet threat management 26:53
Enabling MDNS for casting to different VLANS 28:35
Setting physical port to a vlan 29:43
Creating switch port profiles 30:23 - Věda a technologie
It’s a first detailed quality video about all aspects of UDMP and USW-24 PoE management. Highly appreciated.
OMG! This video is a blasts. I love unifi. I've learned sooooo much from this video. Please keep up the amazing work.
Excellent tutorial Cody. I’m ready for more advances firewall settings in the future. I am new to ubiquiti unifi and your info is very helpful
So funny, i looked for this some hours before you posted this. Great work
Cody I appreciate you continuing to make these videos. I have learned so much about Unifi from you. I will be putting in a whole Unifi network at my gym according to the process you laid out here. Next will be my church. Keep up the great work and I hope you make it to 1 million subs soon enough. Your channel is gold my man!!
Glad I could help
Thanks for the great video. I was able to learn a lot about ubiquiti by watching your videos. Keep up your good work.
Wow, this guide has everything I need to make the switch to a UDM
Thank you for this video - a fantastic presentation. It was concise and informative without being hard to follow.
Highly appreciated video. Wish I could double like. Great content man!
Now I want a full ubiquiti network. Good vid!
A huge thanks for all this detailed description, there's a lot of useful information.
Thanks for watching :)
Perfect timing for this👌 thanks
Cody, your videos have motivated me to quit my job and start my own business. Great videos. Greetings from Mexico
Wow all the best on the new business :)
Thanks, Cody great video as always...
Thank you so much, great work, I learned and setup of my company network
Hi Cody, thanks for the great content as always. If I am not mistaken you can select Device Isolation in the Guest Network and it will behave like in the old controller version and create the firewall rules for you.
Best regards.
Outstanding video! Thank you so much!
Excellent, thanks much 😊👍
Excellent tutorial Cody.
Wow , Excellent video, setting up a UDM Pro for a client and after watching this gonna do it completely different.
Have fun doing the customer build! Glad you found the video useful :)
Thanks for your effort on this.
Very useful.
Great video and super informative! Ubiquiti's support isn't great, however your level of detail is most appreciated.
Great video mate. Thank you!
Thanks for watching :)
Thank you so much my friend, your video is pure gold
Glad you liked it
Another excellent tutorial. One request, would like to see a video solely on creating vlans in unifi where you go through each step a little more slowly. We seasoned citizens take longer to absorb things 😊.
Hey this could be possible
Absolutely an helpful video and for setting up a home use do you need to follow everything on it’s just some of them.
Thankyou explained a lot great work
GREAT WORK. similar to pfsense Firewall.... I may add to change the ap's native vlan to vlan 10 also block any dns request and forward them only to local dns that way they can't bypass my filter . Just hint.... If the unit is after a isp provider modem that use 192.168.x. x. Then rfc 1918 must be modified and remove this ip range as it is considered as a wan... Thank you for your work.
Man our industry changes fast. At around 3:25 you mention the positions of the sfp ports. That’s not accurate anymore since we can not choose the top port to be a LAN port. Not complaining. Your videos are very good and explanatory but this is just one example of how fresh info has to be to still be relevant. A never ending work for you updating these tutorials or amending them with changes.
Great video, what a lot of ground covered really fast. When creating firewall rules, how do you know whether they should be Lan In, Lan Out, or Lan local?
Superb video as always Cody. Would you consider adding section on how a Guest is redirected to a login page and then to a specific web page or link. Thanks for your continued support.
CZcams know what I want :) good jobp
Hi Cody, I’m considering buying UDM Pro for our small office ever since my current firewall (Cyberoam) became redundant due to takeover by Sophos and this video has answered almost all my queries. I just have one question before I go ahead and buy it:
I have noticed in almost all UDM Pro videos that people have paired it up with a Unifi Switch. I was wondering, whether it will work with a normal gigabit switch (D’Link DGS-1210-52) as well? I have tried to find answers to this but have been unsuccessful so far.
Thanks for sharing
Hey Coday thanks for this video, quite useful. Being a newbie here, getting into this IT networking field, question: if I'll be using
Excellent
Thank you very much and how many VLANS range can you have
Awesome vid, in addition to the vlans that you created, you can create a separate vlan for credit card machines to be pci compliant?
Great video! How does dropping access to gateways not prevent devices from connecting to the internet? Or is that why you specify ports for own gateways?
Thank you for the very usefull information. I bought the UDM Pro as well and did the configuration almost the same as you did. After my CCNA i bought cisco but i changed it for unifi. I have a question i hope you can help me with.. I have different networks/vlans for Guest / IoT / camera's and management. It all works fine but i have one thing i dont understand, i have a cable connection with my tv and i want my tv in the IoT network. When i put the cable in the tv it connects to my management network authomatic. But on wifi it connects the right way to my IoT... How can i fix this?
Great tutorial. Thank You. question/request : can you do exactly same using IPv6?
great video.
Hi Cody, Great Video. I have a issue after falling your steps and it seems to be a common issue with other people with VLAN's. After you create a VLAN and tag it to a port for a Wired client. This is the issue: The native (untagged) VLAN in the 'CAMERAS' switch port profile. First of all, how to do change tag the native 'LAN' VLAN? It seems like I can't edit mine.
Really excellent explanation. Just discovered your channel.
Do you perhaps have a transcript of the video(s) around? It's much easier than rewinding the video every few seconds!
Great video!! Please make a video og how to log and examine (troubleshoot) the logs :)
Great video, really appreciate the effort you put in to all your videos. I wanted to know if they is a way of blocking stuff like FaceTime and WhatsApp from selected networks?
Aside from the POE capabilities of the switch could you accomplish everything you setup without the switch; using only the UDM Pro and POE injectors OR does the configuration require a layer 3 switch? Thanks
Great!
oof. that's deep. I use unifi in the home and it's great. I need to set up something like this in our little nonprofit (animal shelter). Wish they were more affordable though
Hello Cody, Thanks very much for your video. I have a quick question. My ISP is DHCP. Is there any issue if I setup VPN?
I added mine Guest network and Guest WiFi in the old interface. When I switched to the new interface, it put the Guest WiFi in the Guest Hotspot area of the WiFi section and then it added the RFC1918 information to the bottom of the Guest network in the Network isolation section.
Great tutorial, but I must have screwed something up when I followed it. After implementing the networks and firewall rules as specified, I assigned port 1 to the Trunk Links port profile and connected a PC to it. I then assigned port 3 to the management VLAN port profile, and port 5 to the IoT VLAN port profile. When I connect my laptop to ports 3 or 5 and try to ping back and forth I don't get any responses in either direction. IE, the PC connected to port 1 (operating with the Trunk Links port profile) cannot ping the laptop, even when it's connected to port 3 (running the management VLAN port profile) and both systems are pulling IP's from the exact same subnet.
Ideas on where I may have gone wrong here?
Do you have a guide for a home setup option?
This would be a great idea if you could actually get some Unifi equipment. . . . Great video, tho! Thanks!
Where do I plug in my second ISP in this set up (for failover, etc)?
Cody, I am looking at doing a similar setup but with the Dream Machine Pro Max.
In your opinion - am I okay using that, rather than say a NetGate firewall and CloudKey-G2 with Ubiquiti poe switch? There seems to be a group of people who believe the DM Pro Max will not offer good enough security?
I am using all Unifi network gear and cameras. Thank Do I need a dedicated PC if so what would you suggest I also am planning on Smarthings and Home Asst. TIA
Bedankt
Thank you so much for the super like :)
Great video I try to do my first set up today and I ran into an issue I do not see an adopt button. The lights are blue like yours. They are off or orange or red. is there something I did wrong
Is there any merit in setting up a VLAN/WLAN exclusively for your your connected smart-phones or do we put it in the IoT Lan. By the way video was bob on and just in process of setting up Unifi Eco-System from scratch. This will go along way to setting it up correctly.
Good job on this one, too, mate 👌🏻
Thanks Virgil :)
Great video...and it really helped me see the configuration pages of Unifi as I'm about to do an install for a small business using all Unifi hardware.
@@GSP-76 Glad to see that Cody's videos are bringing value into people's lives :)
@@VirgilNicolae Without a doubt...it's like when your considering a product but want to see it in action... awesome video that checked the boxes for me.
my latest console update looks quite different to this. Seems UI are making some changes. I found after changing the GatewayIP into the Management VLAN address, I lost connectivity with the access point. The IP address of the access point changed correctly however in the Devices view it showed up as Adoption Failed.
Ive seen in comments on another video that udm's arent made for the constant video and audio packs from zoom and teams? Anyone heard of this? And to adjust queues to 300m+??
Question, could i go from a UDM Pro SFP+ port into for example a XG24 switch on a 10Gbe port; SFP+ to RJ45, leaving the SFP28 (uplink) ports on the switch open to be used as LAN port for a file server? And would the 10Gbe port require special settings for it? Thanks.
Is there a way to test the transfer rate of APs to Switch?
Can i plug my ISP Cable directly into the UDM-Pro or is only the UDM-SE capable of that and the Pro does need a Modem ?
Quick question. How does your Network dashboard show a real time down and up usage? Mine just shows a traffic overview and client device types / active clients as default. I can't seem to find a way to customize it.
Can I still use my pfsense device if I already have the UDM Pro?
Does the UDMPRO also work with other brand routers/AP?
example:
UDM PRO
Linksys routers (already bought)
- Linksys - BHW03V2 mesh router
- Linksys Velop WHW0303B mesh router
or do I have to buy ubiquity AP's?
Does unifi has a selling module to issue and sell access code for a wifi?
Question...you have created your main networks....If I add a bunch of cable network sockets to my switch ----I can assign in the ports what network I want the cable networks should be connected to.... for example there are 20 sockets that allow guests to connect directly to their computers via cable.......I then add the specific ports to that network? .does that make sense....;)
Hello Cody!! I have 3 vlans, but all of them operating with native firewall rules. I still didn’t do any specific intervlan blocking, so all vlans communicate to each other. I use 2 pi-holes as recursive dns. My question is: even using pi-holes is it necessary/recommended to enable mDNS?
Hey you shouldn't have to but if you are having troubles casting across vlans I would turn mdns on
I have the UDM Pro SE and the UDM Pro. Is there any reason why I can't use both?
I would like a good 4 5G Unifi Cameras and a door bell i have too many homelessness camping around my house so what do i need to get those 5 things working? Is a residential single house any ideas of what i need?
Hi Cody, this was a terrific tutorial. When creating your vlans, is there a reason you didn't select your layer 3 switch instead of the UDM Pro for your router?
It wasn't working properly before and there was no way to create firewall rules for the layer3 I believe that may have changed. I will probably do a full video on layer 3 switching in Unifi
@@MactelecomNetworks Thanks, looking forward to your videos.
Just a quick note to something I encountered recently. Have a client that was having connection problems with her laptop as she works from home so I installed a the old type cloud key on her network to monitor it running firmware 1.1.19 and version 7.1.66. Got home and logged on no problem. Tried again the next day and only getting the main screen so I tried another browser and it worked then stopped again like the other. another browser and again the same. Finally got it to work again in edge but I have to clear the cache everytime I try to log on. Have 2 other clients with the same cloud key but running firmware 1.1.13 and version 6.2.26 no problems there. Any thoughts?
Thank you for this video. Can DMPro use DCHP Replay and/or work with Windows Active Directory?
Yup it can there is a DHCP relay
Nice video! (If you can find the UDM Pro)
Ya everything is very hard to find right now
Awesome video, man you were like 2 weeks late for me! That said, it was super helpful to see I did everything right. I personally prefer the new UI minus a few minor items. One thing curious is it just OCD that you change the main lan to 192.168.10.1 ? That was really the only thing I didn't change, mainly just to keep it at the default for my admin network.
Hey I just like starting mine at 192.168.10.1 just my preference
It's also good security practice to not have your network be on a 192.168.0.x or 192.168.1.x subnet since many/most SoHo routers are on this network. Just another small step in network hardening.
@@JoeQuanne The step is so small and arguably non-existent to anyone worth worrying about. I mean 10 is pretty common that an attacker is likely to try that right after 1. Why not go 172 or 10 if that's the reason?
@@5280Burnside it is a small, nearly non existent step sure, but assume an attacker gets access to a physical switch port that hasn't been shut down, and assume you aren't running DHCP on your management network (not all that farfetched). First two statics I'm going to try are 192.168.1.x and 192.168.0.x.
Looking at it a different way, using those two common subnets can cause problems when using VPN's if you are establishing a connection to your network while connected to an external Soho router using the same subnet. Again, more common for non technical users to have the defaults set up.
I'm not claiming to be a security expert, I'm not, but this is something ive been told to avoid. Discussion welcome.
new to ubiquiti, my current toplogy is udmpro->edgeswitch5-> wireless (ptp)->toughswitch->edgerouter. After i put up firewall rules, I was not able to access management of my edgerouter anymore.
ip set up is (for discussion purposes, not my actual IP)
UDMP Pro 192.168.x.1
Edgeswitch 5 192.168.x.6
Toughswitch 192.168.x.7
Edgerouter 192.168.x.8
Any idea what went wrong? I am on management network but still can't get through to x.8 (edgerouter). Please bear with me, I am not a tech guy. doing this DIY set up for my own small business.
At 18:50 you show how to create a RADIUS user without showing that you apply the changes. When I do the same thing and apply changes I get an error, did you need to assign a VLAN ID or anything else in the create radius user area.
Thank you for making these Unifi videos. I especially appreciate this small business setup series. Cody, is it okay to leave the UDM Pro on the default network of 192.168.1.1? I had already setup my UDM Pro in my office and adopted all of the devices, so I'm not sure if I can go back and change the network to 192.168.10.1 can I? If I leave the default network of 192.168.1.1 can I still setup the other networks of 192.168.20.1/24, 192.168.30.1/24, 192.168.40/24 and 192.168.50.1/24?
Hey thanks for watching ya it is fine to leave it at that
Might be worth mentioning that after you update the subnet address to 192.168.10.1 you will need to reboot your computer to receive a new IP address in order to access UDM. At least I did! Timely video for me. Thanks
You needn't restart your computer, instead, open up command prompt and type the following command 'ipconfig /release && ipconfig /renew' and click enter. This will request a new lease from the DHCP server built into your UDM and in turn put you on the correct subnet, providing your PC is using DHCP and isn't using a static IP address. This will then return a list of network configuration details, wherein you will find your new IP address.
Exsample : How to Vlan 20 Staff connecto to file server on Vlan management?
Hello CODY!
Needed your help on layout of Unifi Access Points at a big office space
Hey,
If you need help with network consulting visit my website
www.mactelecomnetworks.com
HI Mac, I moved Unifi Controller from one location to another and tried to setup with static IP. I have connected with ISP modem and WAN port of Unifi controller. I have logged in Unifi controller with my existing login credendials where I can update with new IP? How can I connect my laptop with Unifi controller and change WAN IP? Please kindly advise.
Hi Mate ,Thanks for the great tutorial . I have a stumbling block though. I have set up 3 vLANs on the UDM Pro and applied the ‘ Allow LAN to All vLANs ‘ ( Source = LAN , Destination RFC1918 ) firewall rule to the main LAN , I can access the other vLANs via ping etc from the main LAN , but when I try to access my Apple TV or wifi speakers ( which is on IoT vLAN ) , using iPhone apple remote or Roon remote , I don’t see those devices. Only when I’m on the IoT network , I'm able to see the other IoT devices . My desire is to control the devices in other other vLAN from my Main LAN devices. Any kind of help would be greatly appreciated . Cheers . Emmany .
Do you have MDNS enabled? If not and in the classic interface go to services > MDNS
If you’re in the new interface you can just search for it
@@MactelecomNetworks Splendid Mate :-) . Thanks a Ton . I'm learning so much about unifi OS and networking in general from your videos. I really appreciate it mate . Cheers from Australia .
Hi
Why do we need to block HTTP, HTTPS and SSH to block the network to hit his own GW? It seems that if we put all GW IPs in the Group, you can block all access to GW from any Network you want? Just asking, cause I tried that and it seems to be working.
BTW, thanks for your vids, they are very educating
Found the answer lol
Great video and super informative, Is it capable of acting as a camera NVR?
Yup the UDM pro has the Protect controller built into it. You need to use Unifi cameras with it though
@@MactelecomNetworks it capable only unifi camara?
@@sirajudheenmelepeediakkal9138 That's correct
Hi Cody,
Thank you again for a great video, nice to see you using of the new interface.
Keep up the good work, I can't use your Amazon Store front, any suggestions how the folks from "the old countries" can support you?
Dank je wel, (TY)
Martin
Great video, I've gone through all of these steps so many times already, but you've done a fantastic job of cleanly and precisely explaining steps and why.
The one thing killing me, is finding a way to limit wired clients to something similar to bandwidth profile like they work for WLANs. Let me know if you have a solution. Thanks Cody.
Check out this video
czcams.com/video/D8fDqO7HmJI/video.html
@@MactelecomNetworks thanks for the consideration. The egress setting is unfortunately a terrible way to do limits as it slows down LAN speeds. At the port level for larger networks too, this would be so very difficult to implement and track.
We really do need to send in a message signed by everyone possible for UBNT to bring bandwidth profiles to wired devices, exactly as they have working for WLAN.
Again, thanks for pointing me to something and trying.
@@HaemonAK ya unfortunately there is no other way to do it as of right now
The management network is where you would put your printers, laptops, and desktops?
I would put printer in IoT desktop and laptops in another vlan, staff , guest depending on the needs of the client
@@MactelecomNetworks I'm running a home/printing small business. Have 4 printers not understanding why you would put them into an Iot vlan when that is supposed to be blocked from your local lan. I've watched several of your awesome videos on Unifi networks, thanks for that, and you always create 4 networks, none of which says local. So I guess the better question is that that management network is you local lan?
Hello everyone, what is exactly RFC1918 purpose at 21:50?!
Thanking you in advance!
+1
The fact that I don't use Unifi or ubiquity gear does not mean that the content you are providing is not AWSOME !!!!
Ps. Most of the things you say, apply to any device or network.
What system schematic software are you using?
Do you mean for my topology? I use draw.io
I need ur help for tutorial setup uisp for cloud??
I just ran All eaithenet wire 5e in my house took all coax and phone wire out next Is saving money todo unifi with three access points two in house one outside on deck
In my USW-24-POE Controller 6.2.26 I don't have router available, anyone else experience this?
You look too much like "Caike Pro" :D
Adding the honeypot feature disconnected one of my APs set to the same IP. Manually changing the honeypot IP to a higher value isn't allowed either. Any tips please?
Also, how do I move my IoT devices to the IoT network? Thanks in advance
If one of your APs were on the .2 then it would have brought it down due to a conflict. You need to add your honey pot IP to one of the reserved addresses. by default it is between 192.168.1.6-192.168.1.254 So really the only IP you could use for honey pot would be 192.168.1.2 192.168.1.3 192.168.1.4 192.168.1.5
You can always change the DHCP server to have a bigger "Static range"
@@MactelecomNetworks thanks so much for your reply!