The Networks page is where a UniFi deployment is actually designed. It is also where the terminology does the most damage, because "network" means a VLAN tag, an IP subnet, and a DHCP server in one object — and changing one field can change all three.
This is the field-by-field version, with the consequences.
What a network object contains
| Field | What it controls | Consequence of getting it wrong |
|---|---|---|
| Name | Label only | Cosmetic, but be consistent |
| Purpose | Corporate, Guest, VLAN-only | Determines which fields appear |
| VLAN ID | 802.1Q tag on the wire | Mismatch with the switch = no connectivity |
| Gateway IP / Subnet | Layer 3 interface and mask | Wrong mask breaks local/remote decisions |
| DHCP Mode | Server, relay, none | None means static-only clients |
| DHCP Range | Pool inside the subnet | Overlap with statics causes duplicates |
| DNS | Option 6 | Blank means the gateway answers |
| Lease Time | DHCP lease | Too short causes churn |
| Isolation | Blocks intra-network traffic | Breaks printers and casting |
| Zone | Firewall zone membership | The security boundary |
The Purpose field is the one people ignore. "VLAN-only" creates a network with no gateway and no DHCP — useful when the router lives elsewhere, and confusing when you expected clients to get addresses.
VLAN ID is not optional
Every network except the untagged default carries an 802.1Q tag. That tag must exist on every trunk between the gateway and the access ports, or the network exists in the controller and nowhere on the wire.
The most common failure: a network is created, a WLAN is assigned to it, clients associate, and nothing works — because the switch uplink's allowed-VLAN list does not include the new tag. The controller shows the network as healthy; the wire disagrees.
DHCP is local to the gateway
In a UniFi deployment the gateway is the DHCP server for each network. That is convenient — no relay, no external dependency — and it means:
- The gateway must be up for clients to get addresses.
- DHCP options are per network, which is exactly what you want for DNS.
- A second gateway (for failover) needs the same scopes configured, or clients get nothing when the primary fails.
Custom DHCP options exist for the cases that need them: option 43 for wireless APs, option 66/67 for phones, option 119 for domain search. Use them sparingly; each is a dependency on a string that a vendor can change.
Isolation: the checkbox that breaks printers
"Network Isolation" blocks clients from talking to each other within the same network. It is correct for guest and student networks and wrong for anything with a local service:
| Network | Isolation | Why |
|---|---|---|
| Guest | On | Guests should not see each other |
| Student | On | Limits lateral movement between devices |
| Staff | Off | Printing, casting, file sharing |
| IoT | Off | Controllers need to reach devices |
| Management | Off | Infrastructure must talk |
If isolation is on and users cannot print, check this before anything else.
Blank DNS is not "no DNS"
Leaving the DNS field empty makes the gateway the resolver for that network. That works until the gateway's forwarder is wrong or filtering depends on the client using the domain controllers. Set DNS explicitly on every network you care about.
Worked example: adding a quarantine network
Goal: a network that can enroll ChromeOS devices and reach nothing else.
- Create the network: name
District-Quarantine, purpose Corporate, VLAN 90, subnet10.0.90.1/24, DHCP range.10–.200. - DNS: the filtered resolver, explicitly.
- Isolation: on. Internet access: on.
- Zone: a dedicated Quarantine zone, not Internal.
- Policy: allow to the enrollment domain group, deny everything else.
- Verify: a test device gets
10.0.90.x, enrolls, and cannot reach10.0.0.3or a printer.
Six fields, and every one of them has a failure mode you will meet later if you skip it.
What breaks in production
- VLAN tag missing on a trunk, so the network exists only in the controller.
- DHCP range overlapping static addresses, producing duplicate-IP symptoms that look like a bad NIC.
- Isolation enabled on a staff network, breaking printing and casting.
- Blank DNS, so filtering silently depends on the gateway's forwarder.
- A VLAN-only network where clients were expected to get leases.
- Lease times of one hour on a 2,000-device campus, producing renewal storms.
Checklist
- Every network has an explicit VLAN, subnet, DHCP range, and DNS.
- Every VLAN on a network is allowed on every trunk in its path.
- Isolation matches the intent of the network, and printing has been tested.
- DHCP ranges exclude the static and infrastructure ranges.
- Every network belongs to a zone on purpose.
Next
Networks define the groups. Continue with Firewall Zones and Policies for what may cross between them.