Switching, Ports, and PoE

A UniFi switch has almost no per-port configuration of its own. Almost everything lives in a port profile — a reusable bundle of VLAN, PoE, and link settings — applied to a port. Get the profiles right and every closet is configured the same way; get them wrong and you debug the same three mistakes in nine buildings.

What a port profile contains

Setting	Options	Notes
Native VLAN	One network	Untagged traffic
Tagged VLANs	Many networks	Trunk only
PoE	Auto, passive 24V, off	Passive 24V is not 802.3af
Port isolation	On/off	Blocks client-to-client on that port
STP	Edge/PortFast, BPDU guard	Edge ports must not accept BPDUs
LLDP-MED	On/off	Voice VLAN advertisement
Link speed	Auto or fixed	Fix only when negotiating wrong

The two profiles every deployment needs: access (one native VLAN, no tagged, PoE auto) and trunk (native VLAN for management, tagged list for everything else).

Tagging: the mistake that looks like a dead network

A trunk carries tagged frames. If a VLAN is not in the tagged list on both ends, that VLAN does not cross the link — even though the controller shows it on both switches.

The symptom is specific: devices on the far switch get no DHCP (their VLAN is not there), or the management interface is unreachable while data works.

Verify at both ends: the uplink port on the access switch and the corresponding port on the core.

PoE: mode matters more than budget

Mode	Use	Danger
Auto (802.3af/at/bt)	APs, phones, cameras	None, if the device is standards-based
Passive 24V	Older Ubiquiti gear	Destroys non-passive devices
Off	Desktops, uplinks	Devices that need power will not boot

Passive 24V is always on, unnegotiated, and applied to the wrong device it can damage the NIC. If a port is set to passive for a legacy radio, label it physically and document it.

Budget is the other half: a 48-port switch with 740 W cannot power 48 ports at 30 W. See the PoE article in the switching series for the arithmetic; here, the operational point is that the switch shows a power budget and a per-port allocation, and it will refuse ports when the total is exhausted.

RSTP and priorities

UniFi switches run RSTP. Priorities are set per switch, and the default is 32768 — which means the root is chosen by MAC address.

Set the core to a low priority (4096), distribution to 8192, and leave access at the default. Then verify the root is where you intended; a replaced switch with default priority can silently become root and move half the campus's traffic through a closet.

Worked example: a standard 48-port closet

Ports	Profile	VLAN	PoE
1–40	access-student	104	Off
41–44	access-staff	106	Off
45–46	access-iot	108	Auto (cameras)
47–48	trunk-uplink	native 100, tagged 104/106/108/110	Off

Name the ports ("Classroom 112 — student") so the next person does not have to trace a cable. The controller's port name appears in alerts, which makes them readable.

What breaks in production

• Missing tagged VLAN on a trunk, producing a network that exists in the controller and nowhere on the wire.
• Passive 24V on a standard device, which damages hardware.
• A 100 Mbps uplink on an AP that needs 600 Mbps of airtime — the district has one of these today, with millions of dropped frames.
• PoE budget exhaustion, which reboots the lowest-priority device on a schedule.
• RSTP root on an access switch, which routes campus traffic through a closet.
• Port isolation enabled on a staff port, breaking printing from that desk.

Checklist

1. Every port has a named profile, and profiles are few.
2. Trunks list their tagged VLANs explicitly on both ends.
3. Passive PoE ports are labeled physically and in the controller.
4. PoE budgets are under 75% committed per switch.
5. RSTP priorities are set deliberately, and the root is verified.
6. Uplinks negotiate at the expected speed, and drops are monitored.

Next

The hardware is configured. Continue with Firmware, Updates, and Rollback to keep it that way without an outage.