6. Wireless Network Configuration

6.1 Overview
Wireless connectivity is provided by an UniFi U6+ access point running eight WiFi networks. Each SSID is mapped to a corresponding VLAN and carried through a 802.1Q trunk line to the router to provide isolation between wireless networks.
6.2 SSID to VLAN Mapping




SSID


Network Protocol


Mapped VLAN


Purpose




thedenhome


WPA2/WPA3-Personal


VLAN10


Trusted household devices




thedenmobile


WPA2/WPA3-Personal


VLAN20


Family phones and tablets




thedeniot


WPA2-Personal


VLAN30


Untrusted smart devices




thedenguest


WPA2/WPA3-Personal


VLAN40


Guest network




thedenprinter


WPA2-Personal


VLAN50


Printer network




thedenwork1


WPA3-Personal


VLAN60


Primary work devices




thedenwork2


WPA3-Personal


VLAN70


Secondary work devices




thedenwork3


WPA3-Personal


VLAN80


Tertiary work devices




6.3 Security Configuration
Wireless networks use the strongest security protocol available based on the types of devices connecting. For IoT and print networks, only WPA2-Personal is possible due to the capabilities of those devices. Home, mobile and guest networks use WPA3 transition mode (WPA2/WPA3) to ensure legacy devices are able to connect. The remaining work networks use strict WPA3. Each SSID is bound to its VLAN and carried to the router via a tagged trunk to the LAN port.
6.4 Isolation and Access Control
Client isolation is enabled on all SSIDs, except Home, to prevent peer-to-peer communication.
6.5 Management Access
The UniFi Controller resides on the Management VLAN (192.168.99.0/24). Home devices running the controller software can reach the AP based on firewall configuration allowing communication between Home and Management VLANs on ports 443, 8080, and 8443. Access through the UI is HTTPS-only and restricted to the admin account, the credentials for which are stored in Bitwarden.
6.6 Optimization and Maintenance
Wireless channels are statically assigned to minimize overlap, and transmit power is tuned for even coverage. Band steering is enabled to prefer 5 GHz clients. AP firmware updates are applied quarterly through the UniFi Controller.