UniFi: the settings worth changing from default

UniFi's defaults are chosen so that a first-time user with one access point gets a working network. That is the right default. It is also the wrong configuration for almost any multi-AP deployment, and nothing in the interface tells you so.

This is the pass to make after adoption and before you hand the network over.

Radio settings

Channel width. The default at 5 GHz is often 40 MHz (VHT40), which is reasonable — but check it, and drop to 20 MHz if you have more than six access points within earshot of each other. At 6 GHz, set 80 MHz rather than leaving it wide.

Transmit power. The default is High or Auto. In a multi-AP deployment set 2.4 GHz to Low and 5 GHz to Medium as a starting point, then measure. High power on every radio in a dense install is the single most common cause of sticky clients and co-channel contention in UniFi networks.

Disable 2.4 GHz radios selectively. UniFi will happily run 2.4 GHz on all twelve of your access points sharing three channels. Turn the radio off on at least half. There is no global switch — do it per device, and record which ones.

Channel assignment. Auto-optimise is fine, but constrain it. Under the site's RF settings, exclude DFS channels if you have decided against them, and exclude 120–128 regardless.

Wireless network settings

Minimum data rate control. Buried under advanced SSID settings, and one of the highest-value changes available. Setting the minimum rate to 12 Mbps or 24 Mbps shrinks cells, kills 802.11b compatibility overhead and pushes clients to roam properly. UniFi exposes this per band — set it on both.

Multicast enhancement / IGMP snooping. On for networks with Chromecasts, AirPlay or printers, off on guest networks. Left unmanaged, multicast at the lowest basic rate is a real capacity drain.

Band steering. Available per SSID. Enable it, but be aware that UniFi's implementation is blunt, and a few IoT clients handle it badly. If a device will not associate, this is an early suspect.

Fast Roaming (802.11r). Off by default, and that default is deliberate. Turn it on per SSID, test with your least fashionable devices first, and keep a non-FT SSID available while you do.

BSS Transition (802.11v) and RSSI-based disconnect. 802.11v on. Use the minimum RSSI setting sparingly — it disconnects clients below a threshold, which fixes sticky clients but breaks devices at the edge of coverage if set too aggressively. Start at -75 dBm if you use it at all.

Networks and VLANs

Put IoT on its own network. Create a VLAN, assign it an SSID, then use the firewall rules to block it reaching your LAN. UniFi's default inter-VLAN behaviour is to allow, which surprises people.

Private Pre-Shared Keys. UniFi supports multiple PSKs per SSID with VLAN assignment. This is the right way to handle a mixed IoT estate — a different key per device class, each landing on its own VLAN, without an SSID for each.

Guest network isolation. Use the built-in Guest network type rather than building it yourself; it applies client isolation and LAN blocking correctly by default.

System settings

Firmware. Turn off automatic updates on production sites. Update deliberately, one release behind the newest, after reading the release notes.

Backups. Set automatic backups and configure them to somewhere that is not the console itself. A UniFi controller backup is a small file and it is the whole configuration.

Remote access. If you enable it, put multi-factor authentication on the Ubiquiti account. That account can reconfigure your entire network from anywhere.

Switch ports. Name them. A UniFi switch with 24 ports named "Port 7" is a network nobody can troubleshoot at 2am.

The one-line summary

Set minimum data rates, reduce transmit power, turn off most of your 2.4 GHz radios, constrain automatic channel selection, and put IoT behind a firewall rule. Those five changes fix most UniFi networks that people describe as disappointing.