UniFi network design patterns that scale

UniFi scales further than its reputation suggests, but only if the first site is structured as though there will be a tenth. Retrofitting structure onto an organically grown UniFi estate is painful.

Where the controller lives

Three models, in increasing order of scale:

On the gateway. A Cloud Gateway or Dream Machine runs the controller itself. Simplest, and correct for a single site. The limitation is that the controller shares a fate with the gateway — losing the box loses the management plane until it is restored from backup.

A dedicated console. A Cloud Key or similar separates the controller from the gateway. Worth it once you have more than one gateway, or where the gateway is in a location you cannot easily reach.

Self-hosted. UniFi Network runs on a Linux VM or container you control. This is the right answer for multi-site: one controller, many sites, one set of credentials, and backups that follow your normal VM backup policy. It also means you decide the upgrade schedule.

Whichever you pick, the controller is not in the data path. Access points keep serving clients when it is unreachable — you lose management and statistics, not the network.

A VLAN scheme that ages well

Decide this before the first switch is configured, and use the same numbering at every site:

The specific numbers matter less than using the same ones everywhere. An engineer who knows VLAN 30 is always IoT can work on any of your sites without a document.

Switch topology

Keep it a star. A single core switch with access switches hanging off it, each uplinked once (or twice, aggregated). UniFi handles spanning tree correctly, but a flat mesh of interconnected switches is harder to reason about than it is worth.

Uplink sizing. Access points on a switch with a 1 GbE uplink to the core will bottleneck as soon as you have more than a couple of Wi-Fi 6E APs on it. Aggregate two links, or use an SFP+ uplink.

PoE budget per switch. Count every device at its full-functionality draw. A 24-port switch with a 400 W budget does not run 24 Wi-Fi 7 access points, and the failure mode is silent degradation rather than an error.

Name and profile every port. UniFi port profiles let you define a VLAN and PoE mode once and apply it to many ports. Use them; per-port manual configuration does not survive staff turnover.

The multi-site model

• One self-hosted controller, one site per physical location.
• Identical VLAN numbering and identical SSID names across sites, so a laptop roams between buildings without reconfiguration.
• Site-specific settings — channel plans, transmit power — set per site, never globally.
• A naming convention for devices that encodes site, floor and position: LDN-03-NE-AP01 tells you where to find it. UAP-AC-Pro does not.
• Adoption over a site-to-site VPN or via the inform host setting, documented, so the next person can adopt a replacement access point without a support ticket.

What to do before the estate grows

Write down the channel plan, the VLAN scheme, the naming convention and the firmware policy in one short document, and put it somewhere the next engineer will find it. UniFi makes it very easy to add a site. It does nothing to make ten sites consistent — that part is yours.