Skip to content
Avanet
Sign in

Set up new WLAN (SSID) for guest network on UniFi Controller

UniFi

In many environments it makes sense to offer a separate guest network. This allows visitors or external service providers to access the internet safely without exposing the internal company network. This article shows how to create a new SSID on a UniFi Controller and assign it to an already configured VLAN, for example a guest VLAN.

Requirements

  • UniFi Controller with access to the web interface.
  • Already configured VLAN (configure VLAN on Sophos Firewall and UniFi Switch).
  • VLAN ID and the corresponding firewall rules are configured. The guest VLAN must be carried from the gateway through the switch uplinks to the access points.
  • DHCP and DNS are available for the guest network; the firewall allows the required internet access and blocks the intended internal destinations.

Create a new SSID for the guest network

Open UniFi Controller

  • Sign in to the UniFi Controller.
  • Open Settings in the left menu.

Open WiFi settings

  • Select WiFi in the left area.
  • Check the overview of existing wireless networks (SSIDs).

Create new SSID

  • Click Create New.
  • Enter a name for the network, for example GUEST.
  • Set a password that guests should use. Make sure it is sufficiently complex.
UniFi WiFi settings
UniFi WiFi settings

Assign VLAN

  • In the settings under Network, define the previously created VLAN.
  • Select the VLAN created for the guest network, for example WLAN Guest.
UniFi WiFi - create SSID
UniFi WiFi - create SSID

Advanced settings (optional)

  • Under Advanced, configure additional options such as Guest Portal, Hotspot 2.0, Captive Portal or Bandwidth Limits.
  • Options differ by UniFi Network version. For wireless client separation, check Client Device Isolation in the advanced SSID settings. This control concerns clients on the same access point and does not replace firewall rules between VLANs or additional isolation across switches and multiple access points.

Save and apply

  • Finally click Add WiFi Network to create the new SSID.
  • After a short time, the guest WLAN should be visible.

Check the configuration

  • Connection test: Connect to the new WLAN and check whether a correct IP address from the guest VLAN is assigned, provided DHCP is already configured.
  • Firewall rules: Check on the Sophos Firewall or gateway firewall whether the matching rules apply.
  • Network separation: Use a guest client to verify that the intended internal VLANs and management addresses are unreachable. Verify this through the gateway firewall, not through the SSID setting alone.
  • Client isolation: Use two test clients on the same access point and, if available, on different access points to verify that the expected mutual blocking takes effect. Successful internet access alone does not prove this isolation.

If DHCP, DNS, network separation or client isolation remain unclear, do not make the SSID available to guests yet. If unexpected access occurs, disable the new SSID until corrected; do not remove existing VLANs or firewall rules speculatively.