UniFi has become the default for residential networks above a certain size, for good reasons: the hardware is well made, the management interface is genuinely usable, and it costs a fraction of the enterprise gear it resembles.
It is also easy to deploy badly, because the defaults are tuned for a small office and a large house is a different problem.
Start with the cabling
Nothing in the configuration compensates for insufficient cable. The decisions that matter are made before anyone chooses a controller.
- Two runs to every access point location, not one. The second costs a few pounds now and saves a chase later.
- Cat6A to APs and anything fixed. Multi-gigabit uplinks are already the norm on high-end APs.
- Fibre between floors or outbuildings, particularly anywhere the run approaches a hundred metres or crosses a separate electrical supply.
- Every TV, every AV position, every desk hard-wired. The best thing you can do for the Wi-Fi is take devices off it.
Coverage comes from AP placement, and AP placement is decided by where the cables go. Get this wrong and no amount of transmit power fixes it.
Access points
Ceiling-mounted, centrally, one per two or three rooms. Not one per floor. Not in the corner of the hall.
Turn the power down. The most common fault we inherit is every AP at maximum, all shouting over each other. A client device picks an AP by signal strength and then clings to it long after it should have moved. Lower power means smaller cells, cleaner handoff, and better throughput everywhere.
Be careful with 2.4GHz. It reaches further and performs worse, and half the IoT devices in the house only speak it. Keep it enabled, keep it on a small number of channels, and do not let it become the default path for anything that could use 5 or 6GHz.
6GHz is for the devices that can use it, which after several years is still not most of them. Specify it, expect it to carry the laptops and little else for now.
VLANs
This is where a residential UniFi deployment earns its cost. A sensible layout:
- Trusted — family devices
- Home systems — control, lighting, the rack
- IoT — cheap, cloud-dependent things
- Cameras — isolated, no internet
- Guest — internet only, client isolation on
Then firewall between them and default-deny. UniFi makes this genuinely straightforward; the reason it gets skipped is that it is invisible, not that it is hard.
One practical note: mDNS does not cross VLANs on its own. The moment you segment, AirPlay and Chromecast stop discovering devices in other VLANs. UniFi's mDNS reflector handles it, but you have to enable it and be deliberate about which VLANs it bridges, or you have just rebuilt the flat network you set out to avoid.
Things that will bite you
PoE budget. Add it up before you buy the switch: APs, cameras, doorbell, access control, and the cameras' infrared draw at night, which is when the budget is tightest. Then leave 30% headroom.
One controller, on real hardware. A UniFi gateway or a Cloud Key in the rack, on the UPS. Not a controller on somebody's laptop.
Firmware. Updates fix real bugs and occasionally introduce new ones. Update on a schedule, one device class at a time, never everything at once, and never the gateway on a Friday.
The upstream line is the ceiling. A beautifully engineered LAN behind a poor broadband connection is a beautifully engineered LAN behind a poor broadband connection. If the house depends on connectivity, put a second line in and configure failover.
The bit worth paying for
Documentation. A rack diagram, an IP plan, a VLAN table, port assignments, and the credentials somewhere sensible.
Every network is easy to understand on the day it is built. The question is whether an engineer who has never seen it can work out what is going on in three years. That is entirely down to whether somebody wrote it down.