Designing a UniFi Network: Gateway, Switch, AP, VLAN
A UniFi network is built from four decisions — gateway/controller, switching, wireless and VLAN segmentation — not from any single box. Here's how we scope each layer before we spec hardware.
How we scope a UniFi design
Gateway & controller
Start with the UDM or UDR as your combined router/firewall and built-in UniFi Network controller — or run the controller separately if the site needs it. Model, throughput and port count always depend on the specific unit; check the current Ubiquiti datasheet.
Switching & PoE
Size the USW layer next: how many ports, how many need PoE for APs, cameras or phones, and what switching capacity the site needs. PoE budget and port count vary by USW model — confirm on the datasheet before you order.
Wireless coverage
Place U6 (Wi-Fi 6/6E) or U7 (Wi-Fi 7) access points per room and form factor — Lite, Pro, LR, In-Wall and others cover different footprints. Real-world coverage and throughput depend on the exact model.
VLAN segmentation
Separate IoT, guest Wi-Fi, CCTV and admin traffic into their own VLANs on the same physical cabling, then set inter-VLAN firewall rules once devices are adopted into the controller.
What actually matters when specifying UniFi
Hardware cost once, controller included
UDM/UDR ship with the UniFi Network controller built in, and self-hosted or cloud-hosted management doesn't carry a mandatory per-device subscription — the main honest difference versus Cisco Meraki's licensing model.
Combined gateway + controller
UDM/UDR fold the router/firewall and the UniFi Network controller into one box, which simplifies deployment versus running a separate controller server — though a standalone controller is still an option for larger sites.
PoE switching, model-dependent
USW switches are managed and many models support PoE to power APs, cameras and VoIP phones over the same cable. Port count, PoE budget and throughput vary by model — always check the datasheet.
Wi-Fi 6/6E and Wi-Fi 7 APs
U6 and U7 access points come in multiple form factors — Lite, Pro, LR, In-Wall and more — so you match the AP to the room instead of over- or under-specifying coverage.
VLAN segmentation by design
Keep IoT, guest, CCTV and admin traffic logically separated on shared physical infrastructure — the core of a defensible network design, not an afterthought.
Protect and Access in one app
UniFi Protect (video/NVR) and UniFi Access (door control) run in the same ecosystem dashboard as the network, so one login gives a unified view of network, cameras and access control.
What's in a UniFi design package
A structured scope before hardware gets ordered — so the gateway, switches and APs are sized to the site, not guessed at.
- {'t': 'Site & requirements survey', 'd': 'Coverage areas, device counts, PoE loads and traffic types the network needs to carry.'}
- {'t': 'Gateway & controller sizing', 'd': 'UDM/UDR selection or standalone controller decision, matched to throughput and site scale.'}
- {'t': 'Switch & PoE budget plan', 'd': 'USW port count and PoE allocation across APs, cameras and other powered devices.'}
- {'t': 'AP placement plan', 'd': 'U6/U7 model and form-factor selection per room, based on coverage need rather than a flat default.'}
- {'t': 'VLAN & firewall policy', 'd': 'Segmentation for IoT, guest, CCTV and admin traffic, with inter-VLAN rules defined before go-live.'}
Frequently asked questions
Do I need a separate controller server if I have a UDM or UDR?
No — UDM and UDR have the UniFi Network controller built in, which is the main point of those devices. A separate controller (self-hosted or cloud) is still an option for larger multi-site deployments, but it isn't required.
Is there a mandatory subscription to keep UniFi hardware working?
No per-device licence fee is required to keep adopted hardware running and manageable, whether you self-host the controller or use Ubiquiti's cloud hosting. That's the main honest contrast with Cisco Meraki's subscription model.
Should I choose U6 or U7 access points?
It depends on the site's client devices and coverage needs — Wi-Fi 6/6E (U6) versus Wi-Fi 7 (U7), and which form factor (Lite, Pro, LR, In-Wall) fits the room. We size this per site rather than defaulting to one model; check the current datasheet for exact throughput and range.
Can one USW switch power APs, cameras and phones at the same time?
Many USW models support PoE across multiple ports, but total PoE budget and port count vary by model. We calculate the combined power draw of your APs, cameras and phones against the specific switch's datasheet before specifying it.
How does UniFi compare to MikroTik RouterOS or Reyee?
UniFi trades CLI-level flexibility for a notably polished, unified app — closer to Reyee's cloud-managed simplicity than to MikroTik's RouterOS, which is more CLI-first and configurable. All three avoid Meraki-style mandatory subscriptions; the right pick depends on how much manual tuning your integrators want versus how important a single clean interface is. See our managed-switch VLAN guide for the segmentation logic that applies across all three.
Planning a UniFi rollout?
Send us your site size, device count and coverage areas — we'll help you size the gateway, switching and AP layer before you order hardware.