Securing your UniFi Network: a Step-By-Step Guide

So, you've set up your UniFi network, and now you're wondering, "How do I lock this thing down?" Whether you're running a small office, managing a large corporate network, or just setting things up at home, securing your UniFi environment is crucial.

But don't worry, we've got you covered. Here's a comprehensive guide on how to activate and manage security settings in UniFi.

Lets get to work !!!

Table of Contents

• Getting started with basic security
  • 1. Change the default admin credentials
  • 2. Enable two-factor authentication (2FA)
• Locking down Wi-Fi access
  • 1. Use strong encryption
  • 2. Hide your SSID (optional)
  • 3. Set up guest networks
• Advanced security settings
  • 1. Enable MAC address filtering
  • 2. Configure VLANs for network segmentation
  • 3. Set up Private Pre-Shared Keys (PPSK)
• Keeping your UniFi system updated
  • 1. Enable automatic updates
  • 2. Monitor the security advisories
• Monitoring and responding to threats
  • 1. Set up alerts
  • 2. Regularly check logs
• Final Thoughts

Getting started with basic security

Let's start with the basics. Even if you're not a networking expert, these steps are essential for ensuring your UniFi network is secure from day one.

1. Change the default admin credentials

The very first step you should take is changing the default admin username and password. UniFi devices come with a default set of credentials (username: "ubnt", password: "ubnt"). While this makes initial setup easy, it also leaves your network vulnerable if you don’t change it.

Here’s how you can change it:

1. Log into your UniFi Controller.

2. Navigate to Settings > System > Administrator.

3. Change the username and set a strong, unique password.
4. Save your settings.

Remember, strong passwords should be at least 12 characters long, including numbers, symbols, and a mix of upper and lower case letters.

2. Enable two-factor authentication (2FA)

2FA adds an extra layer of security by requiring a second form of identification when logging in. This could be a code sent to your phone or an authentication app.

To enable 2FA:

1. Go to Settings > User Management.

2. Select the user account you want to secure.
3. Toggle the 2FA option and follow the prompts to set it up.

Now, even if someone gets hold of your password, they won’t be able to access your network without your second factor.

Locking down Wi-Fi access

Next up is securing the Wi-Fi aspect of your network. This is where most people connect, so you want to make sure it’s as secure as possible.

1. Use strong encryption

Make sure your Wi-Fi is using WPA3 encryption. WPA3 is the latest standard and offers better security compared to its predecessors.

Here’s how to set it:

1. Navigate to Settings > Wi-Fi.

2. Select the Wi-Fi network you want to secure.
3. In the security settings, choose WPA3.
4. Save your changes.

If some of your devices don’t support WPA3, you can opt for WPA2/WPA3 mixed mode. This way, older devices can still connect while newer ones enjoy better security.

2. Hide your SSID (optional)

Hiding your SSID (the name of your Wi-Fi network) won’t stop determined attackers, but it can add a small layer of obscurity. Just remember that this might make it harder for legitimate users to connect.

To hide your SSID:

1. Go to Settings > Wi-Fi.

2. Edit the desired Wi-Fi network.

3. Toggle the Hide SSID option.

4. Save the changes.

3. Set up guest networks

If you frequently have guests connecting to your network, it’s a good idea to set up a separate guest network. This keeps your main network isolated and more secure.

To create a guest network:

1. Go to Settings > Wi-Fi.

2. Create a new network and label it as “Guest”.

3. Ensure Guest Policy is enabled.

4. Set a strong password and consider hiding the SSID.
5. Save your settings.

Guest networks can be configured with limited access, meaning guests can browse the internet but won’t have access to your internal network resources.

Advanced security settings

Once you’ve handled the basics, it’s time to dive into some of the more advanced security settings available in UniFi.

1. Enable MAC address filtering

MAC address filtering only allows devices with specified MAC addresses to connect to your network. It’s not foolproof, as MAC addresses can be spoofed, but it’s another layer of security.

To enable MAC address filtering:

1. Go to Settings > Wi-Fi > Advanced.

2. Enable MAC Filtering and add the MAC addresses of devices you want to allow.

3. Save your settings.

This is particularly useful for locking down critical devices like servers or IoT devices that should not be easily accessible.

2. Configure VLANs for network segmentation

Virtual LANs (VLANs) help segment your network, isolating different types of traffic and enhancing security. For example, you can create a VLAN for your IoT devices, keeping them separate from your main network.

To configure VLANs:

1. Navigate to Settings > Networks.

2. Create a new network and assign a VLAN ID.
3. Adjust the network settings according to your needs and save.

Devices on different VLANs can be kept isolated from each other, reducing the risk of cross-network attacks.

3. Set up Private Pre-Shared Keys (PPSK)

PPSK provides each device or user with a unique Wi-Fi password, making it harder for unauthorized users to access your network if a password is compromised.

To set up PPSK:

1. Go to Settings > Wi-Fi.

2. Edit the Wi-Fi network you want to secure.

3. Enable Private Pre-Shared Keys under the Advanced section.

4. Add unique keys for each device or user.

PPSK is particularly useful in environments where you have a lot of different users and devices, such as an office with frequent visitors.

Keeping your UniFi system updated

One of the simplest ways to keep your network secure is to ensure your UniFi system is always running the latest firmware. Updates often include security patches for known vulnerabilities.

1. Enable automatic updates

To enable automatic updates:

1. Go to Settings > System > Maintenance.

2. Toggle Automatic Firmware Update.

3. Set a preferred time for updates to occur, ideally during off-hours.

Keeping your system up-to-date ensures you have the latest security features and patches applied.

2. Monitor the security advisories

UniFi regularly releases security advisories and patches. Make it a habit to check for these updates or subscribe to notifications.

You can find the latest advisories on the Ubiquiti website.

Monitoring and responding to threats

Now that your network is locked down, you need to make sure you’re always aware of what’s happening on it.

1. Set up alerts

UniFi allows you to set up alerts for various events, such as unauthorized access attempts or unusual network activity.

To set up alerts:

1. Go to Settings > Alerts.

2. Customize the alerts you want to receive.
3. Ensure you have up-to-date contact information in the alert settings.

These alerts can be sent via email or SMS, ensuring you’re always in the loop.

2. Regularly check logs

Regularly checking your logs can help you spot any unusual activity. This can include attempts to access your network or unexpected changes in device behavior.

You can access logs via:

1. Settings > Logs

2. Review the logs periodically, or set up automated log analysis if possible.

Final Thoughts

Securing your UniFi network isn’t just a one-time task—it’s an ongoing process. By following the steps outlined here, you’ll set up a strong foundation of security. Remember to keep your software updated, monitor your network for unusual activity, and revisit your security settings regularly to ensure everything is in top shape.

For those looking to streamline and manage their UniFi network, we at UniHosted offer a hassle-free cloud-hosted UniFi Controller solution. It’s a great way to ensure your network is always up-to-date and secure, with automated updates and 24/7 monitoring.