Wi-Fi and PPSK

A UniFi controller in a district rarely has "four SSIDs." It has four SSIDs provisioned across nine AP groups, which produces 26 WLAN records that look like duplication and are not.

Understanding that structure — plus private pre-shared keys — is what makes the wireless side maintainable instead of a list of near-identical entries.

WLANs are per AP group

A WLAN record binds an SSID to a network, a security mode, and a set of APs. When a district wants MarionStaff in every building but different VLANs per site, the result is one record per building.

SSID	Security	Network	Notes
MarionStaff	WPA2/WPA3 PSK	10.X.60.0/22	Per-building record
MarionStudent	WPA2 PSK	10.X.40.0/21	Pushed by Google Admin
MarionDevices	WPA2 + PPSK	per key	Printers, IoT, enrollment
MW	WPA2 PSK	10.30.50.0/24	Temporary event SSID

That structure is normal. The risk is drift: one building's record gets a different minimum rate or a different VLAN, and nobody notices until a device behaves differently in one wing.

Private pre-shared keys

PPSK (sometimes called PPSK or per-client PSK) lets one SSID carry multiple passwords, each mapped to its own network and optionally its own bandwidth limit.

The district uses it for MarionDevices:

Key	Network	Devices
Love2Print	<site>-Printers	Printers, copiers
Iaminsecure	<site>-IoT	HVAC, cameras, displays
powerwash	should be quarantine	ChromeOS enrollment

That is a good design and it is also where the current defects live: powerwash points at six different student VLANs across nine AP groups, two buildings have no key at all, and one has a duplicate key with different capitalization.

Radio settings: global versus per-AP

Setting	Scope	Advice
Channel and width	Per AP	Set explicitly; never auto
Transmit power	Per AP	Fixed, matched to cell size
Minimum data rate	Per WLAN	12–24 Mbps, tested against old devices
Band steering	Per WLAN	On for dual-band clients; test legacy
Client isolation	Per WLAN	On for guest/student
Multicast-to-unicast	Per WLAN	On for AV and mDNS-heavy networks
Schedule	Per WLAN	Useful for event SSIDs

Per-AP overrides are how a design drifts. If an AP needs different settings, write down why in the device's notes; otherwise the next person will "fix" it back.

Worked example: standardizing the powerwash key

Goal: every powerwash key points at one quarantine network.

1. Create District-Quarantine (VLAN 90, 10.0.90.0/24).
2. Zone: Quarantine; policy: allow enrollment domains, deny the rest.
3. For each of the nine MarionDevices records, edit the powerwash key's network.
4. Add the missing keys at CO and TRANS; remove the duplicate IamInsecure at CO.
5. Test: factory-reset one Chromebook, confirm 10.0.90.x, enrollment succeeds, nothing internal is reachable.

Nine records, one key each. The work is clerical; the payoff is that "powerwash" means one thing everywhere.

What breaks in production

• Key sprawl. Dozens of PPSKs with no owner, some for devices that no longer exist.
• A key on the wrong VLAN, so a printer lands on the student network and cannot be found.
• WPA3 enabled globally while old devices still connect; some fail silently.
• Band steering on a fleet that only supports 2.4 GHz, producing connection failures.
• Per-building WLAN drift: different rates, different VLANs, different security.
• Too many SSIDs, costing airtime in every dense wing.

Checklist

1. Every SSID's purpose and network are documented.
2. Per-building records are compared for drift quarterly.
3. Each PPSK key has an owner, a network, and a lifecycle.
4. Minimum data rate has been tested against the oldest device fleet.
5. Radio settings are explicit per AP, not inherited by accident.
6. Temporary SSIDs have an expiry date.

Next

Wireless is configured. Continue with Switching, Ports, and PoE for the wired side of the same closet.