![](\"https:\/\/help-center-assets.ubnt.com\/book.svg\")
<\/td>\n\n
Table of Contents<\/h2>\n
\n\n- Introduction<\/a><\/li>\n
- Why a Guest Network?<\/a><\/li>\n
- How to Create a Guest Network in UniFi Controller<\/a><\/li>\n
- How to Configure Guest Control<\/a><\/li>\n
- How to Limit Guest Bandwidth<\/a><\/li>\n
- How to Manage Guest Networks<\/a><\/li>\n
- LAN-wide Client Isolation<\/a><\/li>\n
- Related Articles<\/a><\/li>\n<\/ol>\n
\n<\/a><\/h1>\nIntroduction<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nIn many networks public access has become a necessary and valuable feature. From hotels, to airports, to coffee shops, guest networks are fulfilling these needs while minimizing security risks and ensuring quality wireless for permanent users. UniFi empowers administrators with the tools to do everything from monetizing guest WiFi to advanced guest management. This article will explain how to configure a guest network and offer some best practices for managing these networks with UniFi.<\/p>\n
\n<\/a><\/p>\nWhy a Guest Network?<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nAlmost every wireless network will need to provide access to both permanent and temporary users. In order to ensure the security and success of the permanent local wireless network, it has become increasingly necessary to separate temporary users in their own network. This offers obvious benefits like not having to remember your network WPA key or having to find a creative way to say no to your neighbor, but also ensures that internal operations and resources are protected from guests who could otherwise exploit your network.<\/p>\n
Guest networks offer a number of other advantages:<\/p>\n
\n- Additional options for authorization like social logins<\/li>\n
- Ability to present terms and conditions for network access<\/li>\n
- Monetization capabilities<\/li>\n
- Branding<\/li>\n
- Ability to limit bandwidth to guests<\/li>\n
- Client isolation at AP level: use\u00a0Port Isolation<\/a>\u00a0for network isolation<\/li>\n
- Shorter terms of access to wireless<\/li>\n
- And much more\u2026<\/li>\n<\/ul>\n
To help you capitalize on the benefits of this feature, the remainder of this article will explain how to set up a Guest Network and how to configure related settings.<\/p>\n
\n<\/a><\/p>\nHow to Create a Guest Network in UniFi Controller<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\n1.<\/strong>\u00a0Open up your UniFi Controller and go to\u00a0Settings<\/strong>\u00a0>\u00a0Wireless Networks<\/strong>.<\/p>\n2.<\/strong>\u00a0To create a new guest network, select\u00a0Create New Wireless Network<\/strong>, otherwise edit an existing network.<\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000062348\/image03.png\")
<\/p>\n
3.\u00a0P<\/strong>rovide a name\u00a0<\/strong>to designate this network as a guest network.<\/p>\n4.<\/strong>\u00a0Select the\u00a0method to be\u00a0used to\u00a0authenticate<\/strong>\u00a0the guest network. A\u00a0security key may be used, while also leveraging the Guest Portal.<\/p>\n5.<\/strong>\u00a0To make this new network a Guest Network, check the box\u00a0“Apply guest policies\u2026”<\/strong><\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000062488\/image07.png\")
<\/strong><\/p>\nNext, this article will explain what makes up the Guest Policy associated with this setting, and how to configure these features.<\/p>\n
\n<\/a><\/p>\nHow to Configure Guest Control<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nIn the UniFi Controller, the Guest Control section is where administrators configure the custom Guest Portal and define what subnets they should and should not be able to access before and after authorization.<\/p>\n
To do this:<\/p>\n
1.\u00a0<\/strong>Open the UniFi Controller.<\/p>\n2.\u00a0<\/strong>Go to Settings > Guest Control.<\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000062628\/image05.png\")
<\/p>\n
3.\u00a0<\/strong>If you want to require guests to interact with the portal click\u00a0Enable Guest Portal<\/strong>. Doing so will open additional options including the authentication method associated with the Guest Portal, Expiration Term, etc.<\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000062347\/image06.png\")
<\/p>\n
4.\u00a0<\/strong>Under Portal Customization choose\u00a0between AngularJS and Legacy JSP. AngularJS allows you to tweak and preview Portal Customization options.\u00a0Legacy JSP provides you with our classic, simple landing page for guests.<\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000062407\/image01.png\")
<\/p>\n
5.\u00a0<\/strong>Access Control allows you to\u00a0define subnets<\/strong>\u00a0necessary for devices to be able to access before and after authorization. An example of a case in which Pre-Authorization Access can be useful is ensuring that devices can access the Guest Portal before being Authorized\u2014to do this, simply define the subnet that contains the Guest Portal IP address. Similarly, if there is a subnet on the internal network you do not wish to allow your guests access to after connecting, you can use the Post-Authorization Restrictions to define these.<\/p>\nIn many cases where the Portal is not accessible, not having the Access Control properly configured is often the cause.<\/p>\n
![\"\"](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000063148\/image00.png\")
<\/p>\n
\n<\/a><\/p>\nHow to Limit Guest Bandwidth<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nAnother useful feature in the UniFi Controller is the ability to limit bandwidth allocation to different user groups. This may be important to ensure guests do not limit the productivity and speed available to permanent users\/critical applications.\u00a0To limit guest bandwidth follow\u00a0the steps below:<\/p>\n
1.\u00a0<\/strong>Go to Settings > User Groups<\/p>\n2.\u00a0<\/strong>Create a new User Group.<\/p>\n3.\u00a0<\/strong>Define the desired bandwidth limit.<\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000063228\/image04.png\")
<\/p>\n
Next, to add this group to the Guest Network:<\/p>\n
4.\u00a0<\/strong>Go to Settings > Wireless Networks.<\/p>\n5.\u00a0<\/strong>Select the corresponding Guest Network and expand\u00a0Advanced Options<\/strong><\/p>\n6.\u00a0<\/strong>Click the dropdown box next to\u00a0User Group<\/strong>\u00a0and select the guest user group.<\/p>\n7.<\/strong>\u00a0Click\u00a0Save<\/strong>\u00a0to apply the changes.<\/p>\n![](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115000062687\/image02.png\")
<\/p>\n
\n<\/a><\/p>\nHow to Manage Guest Networks<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nOnce the Guest Network has been set up, it\u2019s a good idea to test and evaluate function and performance to ensure guests won\u2019t encounter difficulty and demand unnecessary assistance in connecting to WiFi. As you continue to operate your guest network, make sure that your guest network isn\u2019t bogging down your private network. Evaluate security and ensure that the guest network poses minimal security risk. If changes are needed, these settings can be reconfigured and applied at anytime.<\/p>\n
\n<\/a><\/p>\nLAN-wide Client Isolation<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nOnce you have your guest network set up on the WLAN (AP) side\u2014it is necessary to make sure the LAN has sufficient isolation, while also allowing common services which may be required\u00a0(printers, servers, etc.).<\/p>\n
In addition to providing the desired client isolation, LAN-side controls on client isolation reduce\/eliminate unnecessary broadcast\/multicast data, which if left unchecked will have an adverse impact on installation with around 10 or more WLAN APs (see\u00a0here<\/a>\u00a0for details).<\/p>\nThe diagram below shows a generalized layout for network-wide (WLAN and LAN) client isolation, while still allowing network-wide core services.<\/p>\n
![\"\"](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115002776948\/Broadcast_Multitask_Diagram-01.png\")
<\/p>\n
Here\u2019s how to set this up as shown in the above example in the UniFi controller:<\/p>\n
\n- First, open the\u00a0UniFi Controller that manages your network.<\/li>\n
- Click the\u00a0Devices<\/strong>\u00a0tab on the left to see your devices.<\/li>\n
- Click on the switch you want to enable port isolation on, and go to the\u00a0Ports<\/strong>\u00a0tab.<\/li>\n
- Either select the ports individually you want to enable port isolation on, or click box to select all.<\/li>\n
- Click\u00a0Edit Selected<\/strong>\u00a0at the bottom.<\/li>\n
- Go to\u00a0Advanced.<\/strong><\/li>\n
- Expand\u00a0Advanced Options.<\/strong><\/li>\n
- Under\u00a0Isolation<\/strong>, select\u00a0Enable port isolation<\/strong>.<\/li>\n
- Click\u00a0Apply<\/strong>\u00a0to finalize changes.<\/li>\n<\/ol>\n
![\"\"](\"https:\/\/help.ubnt.com\/hc\/en-us\/article_attachments\/115002739847\/image00.gif\")
<\/p>\n
For more advanced configurations related to your guest network see the\u00a0Related Articles<\/a>\u00a0below.<\/p>\n
\n<\/a><\/p>\nRelated Articles<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nUniFi – Hotspot Portal Customization<\/a><\/p>\nUniFi – Managing Broadcast Traffic<\/a><\/p>\n
\n
<\/a><\/h1>\nIntroduction<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nIn many networks public access has become a necessary and valuable feature. From hotels, to airports, to coffee shops, guest networks are fulfilling these needs while minimizing security risks and ensuring quality wireless for permanent users. UniFi empowers administrators with the tools to do everything from monetizing guest WiFi to advanced guest management. This article will explain how to configure a guest network and offer some best practices for managing these networks with UniFi.<\/p>\n
\n<\/a><\/p>\nWhy a Guest Network?<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nAlmost every wireless network will need to provide access to both permanent and temporary users. In order to ensure the security and success of the permanent local wireless network, it has become increasingly necessary to separate temporary users in their own network. This offers obvious benefits like not having to remember your network WPA key or having to find a creative way to say no to your neighbor, but also ensures that internal operations and resources are protected from guests who could otherwise exploit your network.<\/p>\n
Guest networks offer a number of other advantages:<\/p>\n
\n- Additional options for authorization like social logins<\/li>\n
- Ability to present terms and conditions for network access<\/li>\n
- Monetization capabilities<\/li>\n
- Branding<\/li>\n
- Ability to limit bandwidth to guests<\/li>\n
- Client isolation at AP level: use\u00a0Port Isolation<\/a>\u00a0for network isolation<\/li>\n
- Shorter terms of access to wireless<\/li>\n
- And much more\u2026<\/li>\n<\/ul>\n
To help you capitalize on the benefits of this feature, the remainder of this article will explain how to set up a Guest Network and how to configure related settings.<\/p>\n
\n<\/a><\/p>\nHow to Create a Guest Network in UniFi Controller<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\n1.<\/strong>\u00a0Open up your UniFi Controller and go to\u00a0Settings<\/strong>\u00a0>\u00a0Wireless Networks<\/strong>.<\/p>\n2.<\/strong>\u00a0To create a new guest network, select\u00a0Create New Wireless Network<\/strong>, otherwise edit an existing network.<\/p>\n<\/p>\n
3.\u00a0P<\/strong>rovide a name\u00a0<\/strong>to designate this network as a guest network.<\/p>\n4.<\/strong>\u00a0Select the\u00a0method to be\u00a0used to\u00a0authenticate<\/strong>\u00a0the guest network. A\u00a0security key may be used, while also leveraging the Guest Portal.<\/p>\n5.<\/strong>\u00a0To make this new network a Guest Network, check the box\u00a0“Apply guest policies\u2026”<\/strong><\/p>\n<\/strong><\/p>\nNext, this article will explain what makes up the Guest Policy associated with this setting, and how to configure these features.<\/p>\n
\n<\/a><\/p>\nHow to Configure Guest Control<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nIn the UniFi Controller, the Guest Control section is where administrators configure the custom Guest Portal and define what subnets they should and should not be able to access before and after authorization.<\/p>\n
To do this:<\/p>\n
1.\u00a0<\/strong>Open the UniFi Controller.<\/p>\n2.\u00a0<\/strong>Go to Settings > Guest Control.<\/p>\n<\/p>\n
3.\u00a0<\/strong>If you want to require guests to interact with the portal click\u00a0Enable Guest Portal<\/strong>. Doing so will open additional options including the authentication method associated with the Guest Portal, Expiration Term, etc.<\/p>\n<\/p>\n
4.\u00a0<\/strong>Under Portal Customization choose\u00a0between AngularJS and Legacy JSP. AngularJS allows you to tweak and preview Portal Customization options.\u00a0Legacy JSP provides you with our classic, simple landing page for guests.<\/p>\n<\/p>\n
5.\u00a0<\/strong>Access Control allows you to\u00a0define subnets<\/strong>\u00a0necessary for devices to be able to access before and after authorization. An example of a case in which Pre-Authorization Access can be useful is ensuring that devices can access the Guest Portal before being Authorized\u2014to do this, simply define the subnet that contains the Guest Portal IP address. Similarly, if there is a subnet on the internal network you do not wish to allow your guests access to after connecting, you can use the Post-Authorization Restrictions to define these.<\/p>\nIn many cases where the Portal is not accessible, not having the Access Control properly configured is often the cause.<\/p>\n
<\/p>\n
\n<\/a><\/p>\nHow to Limit Guest Bandwidth<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nAnother useful feature in the UniFi Controller is the ability to limit bandwidth allocation to different user groups. This may be important to ensure guests do not limit the productivity and speed available to permanent users\/critical applications.\u00a0To limit guest bandwidth follow\u00a0the steps below:<\/p>\n
1.\u00a0<\/strong>Go to Settings > User Groups<\/p>\n2.\u00a0<\/strong>Create a new User Group.<\/p>\n3.\u00a0<\/strong>Define the desired bandwidth limit.<\/p>\n<\/p>\n
Next, to add this group to the Guest Network:<\/p>\n
4.\u00a0<\/strong>Go to Settings > Wireless Networks.<\/p>\n5.\u00a0<\/strong>Select the corresponding Guest Network and expand\u00a0Advanced Options<\/strong><\/p>\n6.\u00a0<\/strong>Click the dropdown box next to\u00a0User Group<\/strong>\u00a0and select the guest user group.<\/p>\n7.<\/strong>\u00a0Click\u00a0Save<\/strong>\u00a0to apply the changes.<\/p>\n<\/p>\n
\n<\/a><\/p>\nHow to Manage Guest Networks<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nOnce the Guest Network has been set up, it\u2019s a good idea to test and evaluate function and performance to ensure guests won\u2019t encounter difficulty and demand unnecessary assistance in connecting to WiFi. As you continue to operate your guest network, make sure that your guest network isn\u2019t bogging down your private network. Evaluate security and ensure that the guest network poses minimal security risk. If changes are needed, these settings can be reconfigured and applied at anytime.<\/p>\n
\n<\/a><\/p>\nLAN-wide Client Isolation<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nOnce you have your guest network set up on the WLAN (AP) side\u2014it is necessary to make sure the LAN has sufficient isolation, while also allowing common services which may be required\u00a0(printers, servers, etc.).<\/p>\n
In addition to providing the desired client isolation, LAN-side controls on client isolation reduce\/eliminate unnecessary broadcast\/multicast data, which if left unchecked will have an adverse impact on installation with around 10 or more WLAN APs (see\u00a0here<\/a>\u00a0for details).<\/p>\nThe diagram below shows a generalized layout for network-wide (WLAN and LAN) client isolation, while still allowing network-wide core services.<\/p>\n
<\/p>\n
Here\u2019s how to set this up as shown in the above example in the UniFi controller:<\/p>\n
\n- First, open the\u00a0UniFi Controller that manages your network.<\/li>\n
- Click the\u00a0Devices<\/strong>\u00a0tab on the left to see your devices.<\/li>\n
- Click on the switch you want to enable port isolation on, and go to the\u00a0Ports<\/strong>\u00a0tab.<\/li>\n
- Either select the ports individually you want to enable port isolation on, or click box to select all.<\/li>\n
- Click\u00a0Edit Selected<\/strong>\u00a0at the bottom.<\/li>\n
- Go to\u00a0Advanced.<\/strong><\/li>\n
- Expand\u00a0Advanced Options.<\/strong><\/li>\n
- Under\u00a0Isolation<\/strong>, select\u00a0Enable port isolation<\/strong>.<\/li>\n
- Click\u00a0Apply<\/strong>\u00a0to finalize changes.<\/li>\n<\/ol>\n
<\/p>\n
For more advanced configurations related to your guest network see the\u00a0Related Articles<\/a>\u00a0below.<\/p>\n
\n<\/a><\/p>\nRelated Articles<\/h1>\n
\n
Back to Top<\/a><\/span><\/p>\nUniFi – Hotspot Portal Customization<\/a><\/p>\nUniFi – Managing Broadcast Traffic<\/a><\/p>\n
\n
In many networks public access has become a necessary and valuable feature. From hotels, to airports, to coffee shops, guest networks are fulfilling these needs while minimizing security risks and ensuring quality wireless for permanent users. UniFi empowers administrators with the tools to do everything from monetizing guest WiFi to advanced guest management. This article will explain how to configure a guest network and offer some best practices for managing these networks with UniFi.<\/p>\n
\n
<\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n Almost every wireless network will need to provide access to both permanent and temporary users. In order to ensure the security and success of the permanent local wireless network, it has become increasingly necessary to separate temporary users in their own network. This offers obvious benefits like not having to remember your network WPA key or having to find a creative way to say no to your neighbor, but also ensures that internal operations and resources are protected from guests who could otherwise exploit your network.<\/p>\n Guest networks offer a number of other advantages:<\/p>\n To help you capitalize on the benefits of this feature, the remainder of this article will explain how to set up a Guest Network and how to configure related settings.<\/p>\n <\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n 1.<\/strong>\u00a0Open up your UniFi Controller and go to\u00a0Settings<\/strong>\u00a0>\u00a0Wireless Networks<\/strong>.<\/p>\n 2.<\/strong>\u00a0To create a new guest network, select\u00a0Create New Wireless Network<\/strong>, otherwise edit an existing network.<\/p>\n 3.\u00a0P<\/strong>rovide a name\u00a0<\/strong>to designate this network as a guest network.<\/p>\n 4.<\/strong>\u00a0Select the\u00a0method to be\u00a0used to\u00a0authenticate<\/strong>\u00a0the guest network. A\u00a0security key may be used, while also leveraging the Guest Portal.<\/p>\n 5.<\/strong>\u00a0To make this new network a Guest Network, check the box\u00a0“Apply guest policies\u2026”<\/strong><\/p>\n Next, this article will explain what makes up the Guest Policy associated with this setting, and how to configure these features.<\/p>\n <\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n In the UniFi Controller, the Guest Control section is where administrators configure the custom Guest Portal and define what subnets they should and should not be able to access before and after authorization.<\/p>\n To do this:<\/p>\n 1.\u00a0<\/strong>Open the UniFi Controller.<\/p>\n 2.\u00a0<\/strong>Go to Settings > Guest Control.<\/p>\n 3.\u00a0<\/strong>If you want to require guests to interact with the portal click\u00a0Enable Guest Portal<\/strong>. Doing so will open additional options including the authentication method associated with the Guest Portal, Expiration Term, etc.<\/p>\n 4.\u00a0<\/strong>Under Portal Customization choose\u00a0between AngularJS and Legacy JSP. AngularJS allows you to tweak and preview Portal Customization options.\u00a0Legacy JSP provides you with our classic, simple landing page for guests.<\/p>\n 5.\u00a0<\/strong>Access Control allows you to\u00a0define subnets<\/strong>\u00a0necessary for devices to be able to access before and after authorization. An example of a case in which Pre-Authorization Access can be useful is ensuring that devices can access the Guest Portal before being Authorized\u2014to do this, simply define the subnet that contains the Guest Portal IP address. Similarly, if there is a subnet on the internal network you do not wish to allow your guests access to after connecting, you can use the Post-Authorization Restrictions to define these.<\/p>\n In many cases where the Portal is not accessible, not having the Access Control properly configured is often the cause.<\/p>\n <\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n Another useful feature in the UniFi Controller is the ability to limit bandwidth allocation to different user groups. This may be important to ensure guests do not limit the productivity and speed available to permanent users\/critical applications.\u00a0To limit guest bandwidth follow\u00a0the steps below:<\/p>\n 1.\u00a0<\/strong>Go to Settings > User Groups<\/p>\n 2.\u00a0<\/strong>Create a new User Group.<\/p>\n 3.\u00a0<\/strong>Define the desired bandwidth limit.<\/p>\n Next, to add this group to the Guest Network:<\/p>\n 4.\u00a0<\/strong>Go to Settings > Wireless Networks.<\/p>\n 5.\u00a0<\/strong>Select the corresponding Guest Network and expand\u00a0Advanced Options<\/strong><\/p>\n 6.\u00a0<\/strong>Click the dropdown box next to\u00a0User Group<\/strong>\u00a0and select the guest user group.<\/p>\n 7.<\/strong>\u00a0Click\u00a0Save<\/strong>\u00a0to apply the changes.<\/p>\n <\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n Once the Guest Network has been set up, it\u2019s a good idea to test and evaluate function and performance to ensure guests won\u2019t encounter difficulty and demand unnecessary assistance in connecting to WiFi. As you continue to operate your guest network, make sure that your guest network isn\u2019t bogging down your private network. Evaluate security and ensure that the guest network poses minimal security risk. If changes are needed, these settings can be reconfigured and applied at anytime.<\/p>\n <\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n Once you have your guest network set up on the WLAN (AP) side\u2014it is necessary to make sure the LAN has sufficient isolation, while also allowing common services which may be required\u00a0(printers, servers, etc.).<\/p>\n In addition to providing the desired client isolation, LAN-side controls on client isolation reduce\/eliminate unnecessary broadcast\/multicast data, which if left unchecked will have an adverse impact on installation with around 10 or more WLAN APs (see\u00a0here<\/a>\u00a0for details).<\/p>\n The diagram below shows a generalized layout for network-wide (WLAN and LAN) client isolation, while still allowing network-wide core services.<\/p>\n Here\u2019s how to set this up as shown in the above example in the UniFi controller:<\/p>\n For more advanced configurations related to your guest network see the\u00a0Related Articles<\/a>\u00a0below.<\/p>\n <\/a><\/p>\n Back to Top<\/a><\/span><\/p>\n UniFi – Hotspot Portal Customization<\/a><\/p>\n UniFi – Managing Broadcast Traffic<\/a><\/p>\nWhy a Guest Network?<\/h1>\n
\n\n
\nHow to Create a Guest Network in UniFi Controller<\/h1>\n
\n<\/p>\n<\/strong><\/p>\n
\nHow to Configure Guest Control<\/h1>\n
\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n
\nHow to Limit Guest Bandwidth<\/h1>\n
\n<\/p>\n<\/p>\n
\nHow to Manage Guest Networks<\/h1>\n
\n
\nLAN-wide Client Isolation<\/h1>\n
\n<\/p>\n\n
<\/p>\n
\nRelated Articles<\/h1>\n
\n