About this video

• Video Title: Ubiquiti Setup Guide - Best Practice
• Channel: Leader Academy
• Speakers: Alex
• Duration: 01:12:54

Overview

This video provides a comprehensive guide to setting up Ubiquiti networking products, focusing on best practices for initial configuration, device adoption, network setup, Wi-Fi configuration, security settings, and VPN access. The presenter, Alex, shares his personal deployment strategies, offering insights for both beginners and experienced users.

Key takeaways

• Initial Controller Setup: The video demonstrates two primary methods for setting up the UniFi controller or cloud gateway: using the UniFi mobile app via Bluetooth for remote handoff, or direct local access for environments prioritizing data privacy.
• Device Adoption Challenges: Common issues with adopting UniFi devices, such as incorrect IP addressing or pre-existing adoptions, are addressed with practical solutions, including SSH and factory resets.
• Network Configuration: Best practices for setting up internal, guest, and IoT networks are detailed, including VLAN assignment, DHCP guarding, and content filtering.
• Wi-Fi and AP Setup: The guide covers configuring Wi-Fi SSIDs, security protocols (WPA2/WPA3), channel optimization, and advanced settings like minimum data rates and band steering.
• Switch and Security Best Practices: Key switch configurations like RSTP priority, LAG groups, and port isolation are explained, alongside crucial security measures like firewall rules, intrusion prevention, and VPN setup.
• User Onboarding and Management: Methods for onboarding users, including Radius authentication, private pre-shared keys, and Ubiquiti Identity, are presented for streamlined access and management.
• Firmware and Backup Management: Recommendations are given for managing firmware updates, utilizing the Site Manager for bulk updates, and configuring system backups.

The video discusses VLAN assignments in the context of network setup. Best practices include:

• Creating Separate Networks: It's recommended to create distinct networks for different purposes, such as corporate, guest, and IoT devices. This allows for granular control.
• VLAN Assignment per Port: Specific VLANs can be assigned to individual switch ports. Any device plugged into that port will then be on the assigned VLAN.
• Wi-Fi VLAN Assignment: For Wi-Fi, it's often desirable to assign different SSIDs to different VLANs, allowing devices connecting to a specific Wi-Fi network to be placed on the corresponding VLAN. However, the video notes that assigning a VLAN directly to an AP's network port might not be the desired outcome if you want devices connecting wirelessly to be on different VLANs.
• Network Isolation: When setting up networks like guest networks, isolation is enabled by default to prevent them from accessing other parts of the network. This can be overridden if necessary.
• Content Filtering: Applying content filtering to specific networks is recommended to block certain types of content.
• DHCP Guarding: To prevent conflicts, DHCP guarding can be enabled to ensure only the specified DHCP server is active on a network.

For firewall and routing:

• Security Settings: The video emphasizes reviewing security settings. Recommended practices include:
  • Honeypot: Setting up a honeypot to detect potential hacking attempts.
  • Country Restrictions: Blocking traffic from specific regions can enhance security.
  • Ad Blocking: Enabling ad blocking can be beneficial, though it should be used with caution.
  • DNS Shield: Using a trusted DNS provider is advised.
  • Intrusion Protection and Prevention: Configuring these features based on the capabilities of the cloud gateway.
• Firewall Rules: The video mentions the ability to create custom traffic and firewall rules. A separate video is recommended for advanced firewall rule setup, particularly for inter-VLAN blocking.
• Policy-Based Routing: This is a common practice where specific traffic (e.g., VoIP, or traffic from certain devices or regions) can be directed through a particular WAN port. This allows for better management of different internet connections.
• Static Routes and OSPF: Static routes can be configured, and OSPF is available for more complex routing scenarios, though it cannot be used simultaneously with Site Magic.
• Advanced Firewall Rules: The video points to a dedicated resource for setting up advanced firewall rules, emphasizing inter-VLAN blocking as a key application.

Users can be effectively onboarded and managed within a Ubiquiti network environment through several methods, as detailed in the video:

• For Smaller Environments:

  • Users can connect directly using a pre-shared key for Wi-Fi.
  • Devices can be connected to switch ports that have been configured with the appropriate VLAN assignments.

• For Larger Businesses and Enhanced Control:

  • Radius Authentication:
    • The UniFi controller or cloud gateway can function as a Radius server.
    • Users can be managed via username and password or by using their MAC address as credentials.
    • This allows for dynamic VLAN assignment based on user or device identity, ensuring they are placed on the correct network segment (e.g., IT administrators on an IT network, corporate users on a corporate network).
    • This method requires WPA2 Enterprise or WPA3 Enterprise security.
  • Private Pre-Shared Keys (PSK):
    • This is a newer feature that allows for unique passwords per VLAN.
    • You can create multiple passwords that map to the same VLAN or different VLANs.
    • This is particularly useful in environments like hotels, where each guest room might get a unique password that places their devices on the same VLAN as the in-room TV for casting.
    • When a user leaves, their specific password can be revoked, revoking their access.
  • Ubiquiti Identity:
    • This platform allows for the creation and management of user accounts.
    • Users are sent email invitations with credentials to install the Identity application on their devices.
    • This application simplifies connection to Wi-Fi and VPNs by eliminating the need for users to know specific credentials; they simply tap to connect.
    • It can create a new Wi-Fi SSID for these users and automatically send out invites.
    • User accounts can be activated or deactivated as needed.
    • Ubiquiti Identity provides easy access to other Ubiquiti applications like Protect and Access.
  • User Groups:
    • Users can be organized into groups (e.g., Sales Team, Product Management).
    • Rules and access permissions can then be applied to these groups in bulk, simplifying management.
  • Admin Accounts:
    • Multiple administrator accounts can be created for local management.
    • Predefined roles like "Site Admin" can be assigned, granting core functionality without allowing full control or the ability to remove the primary administrator.
    • Access can be restricted to local access only if required.