6. Wireless Network Configuration

6.1 Overview

Wireless connectivity is provided by an UniFi U6+ access point running eight WiFi networks. Each SSID is mapped to a corresponding VLAN and carried through a 802.1Q trunk line to the router to provide isolation between wireless networks.

6.2 SSID to VLAN Mapping

6.3 Security Configuration

Wireless networks use the strongest security protocol available based on the types of devices connecting. For IoT and print networks, only WPA2-Personal is possible due to the capabilities of those devices. Home, mobile and guest networks use WPA3 transition mode (WPA2/WPA3) to ensure legacy devices are able to connect. The remaining work networks use strict WPA3. Each SSID is bound to its VLAN and carried to the router via a tagged trunk to the LAN port.

6.4 Isolation and Access Control

Client isolation is enabled on all SSIDs, except Home, to prevent peer-to-peer communication.

6.5 Management Access

The UniFi Controller resides on the Management VLAN (192.168.99.0/24). Home devices running the controller software can reach the AP based on firewall configuration allowing communication between Home and Management VLANs on ports 443, 8080, and 8443. Access through the UI is HTTPS-only and restricted to the admin account, the credentials for which are stored in Bitwarden.

6.6 Optimization and Maintenance

Wireless channels are statically assigned to minimize overlap, and transmit power is tuned for even coverage. Band steering is enabled to prefer 5 GHz clients. AP firmware updates are applied quarterly through the UniFi Controller.