UniFi VLAN segmentation is the answer, and it's far simpler than most people think.
In our Hyde Park workshop, we've helped dozens of Johannesburg businesses implement UniFi networks that actually work—networks that isolate guest traffic, protect sensitive systems, and make troubleshooting straightforward. This guide walks through what VLANs are, why they matter, and how to configure them properly.
What Is a VLAN and Why Does Your Johannesburg Business Need One?
A VLAN—Virtual Local Area Network—lets you split a single physical network into multiple logical networks. Think of it like this: you have one set of cables and switches, but you create separate "zones" so that a guest on your WiFi cannot accidentally (or intentionally) access your accounting system or file server.
We've seen the consequences of not doing this. A visitor's laptop gets infected. It sits on your main network. Within hours, it's scanning your printers, trying passwords on shared drives, and sometimes worse. Load shedding spikes cause restarts, and suddenly you're scrambling to reset access controls. With VLANs properly configured, that infected guest device is confined to a guest VLAN—it can reach the internet, but nothing on your internal network.
UniFi makes this achievable without expensive enterprise hardware. Ubiquiti's interface is designed for people who understand networking but aren't spending eight hours a day on Cisco commands.
How VLANs Work on UniFi Hardware in Your Johannesburg Network
Here's the practical reality: your UniFi Dream Machine or UDM Pro arrives at your Hyde Park office. You unbox it. You plug in your WAN connection. But if you want real segmentation, you need to do three things:
Create networks in the UniFi console. Each VLAN gets a name, a VLAN ID (usually 100, 200, 300, etc.), and a subnet. Your main network might be 192.168.1.0/24. Your guest network becomes 192.168.100.0/24. Your IoT network becomes 192.168.200.0/24. The system isolates traffic between these subnets.
Assign WiFi SSIDs to VLANs. You create three wireless networks: "YourBusiness" on VLAN 1, "YourBusiness-Guest" on VLAN 100, and "YourBusiness-IoT" on VLAN 200. Users connect to the SSID they're supposed to use. The access point knows which VLAN to place them on.
Configure firewall rules. This is where security happens. You write rules that say: "Traffic from VLAN 100 (guest) can reach WAN but cannot reach VLAN 1 (business)." Or: "VLAN 200 (IoT) can query NTP for time-sync but cannot initiate other connections." UniFi's firewall interface is cleaner than most—you're not staring at access-control-list syntax.
The key insight: VLANs don't magically happen. Your switch (the UDM Pro or a separate UniFi Switch) must support them. If you've got old dumb switches lying around from 2015, they won't work. A proper UniFi setup from our partners includes managed switches that respect VLAN tags.
Common VLAN Configuration Mistakes We See in Johannesburg Businesses
Over the years, we've debugged networks where VLANs *sort of* work but leak traffic. Here are the mistakes that cost people money and security:
Forgetting the firewall rules. You create VLANs and WiFi networks but leave inter-VLAN traffic open. Guests can still ping your server. The segmentation is useless. Check the firewall tab. Make sure deny-all rules are in place, then explicitly allow only the traffic you need.
Mixing tagged and untagged ports. Your switch has ports. Some are "tagged" (they carry multiple VLANs) and some are "untagged" (they belong to one VLAN only). If your printer is plugged into an untagged port on VLAN 1, it can't talk to your guest VLAN. You need an inter-VLAN route or a rule allowing specific guest-to-printer traffic. We recommend putting guest-accessible devices (printers, WiFi controllers) on their own VLAN and explicitly routing traffic to them.
Not documenting which devices are on which VLAN. You set up VLANs beautifully, then six months later your accountant can't print, you can't remember why, and you restart everything at 3pm on a Friday during load shedding. Write it down. Tape a label on your switch. Use the UniFi comment field.
Setting Up Guest and IoT VLANs: A Step-by-Step Workflow
Here's what we actually do in the workshop when a client books a R599 network assessment:
Once you've done it once, the second setup takes 20 minutes.
Why Local Johannesburg Businesses Are Implementing UniFi VLANs Now
Load shedding has changed how we think about network resilience. If your network goes down during Stage 6, you need fast recovery. UniFi's configuration is backed up to the cloud, so when power returns and your UDM reboots, your VLAN settings are already there. You don't reconfigure from scratch.
Additionally, POPIA compliance is now real. If you're storing client data, you're legally required to have reasonable security controls. Network segmentation—isolating client data from guest networks—is a control that auditors actually respect. It's documented, it's verifiable, and it shows intent.
We've also seen WiFi 6 adoption accelerate. New UniFi 6+ access points are rolling into Johannesburg businesses, and they support enterprise-grade features like per-VLAN QoS (quality of service). You can now guarantee that your VoIP calls on the business network don't stutter because someone on the guest network is streaming Netflix.
If you're considering liquid-damage repair or other emergency fixes to existing equipment, this is the moment to plan your network architecture. New equipment deserves a network that protects it.
Next Steps: Professional VLAN Setup in Hyde Park
If your Johannesburg business is running UniFi but VLANs are a mystery, or if you've configured them but suspect they're not working properly, book a consultation. Our R599 assessment includes network audit, VLAN configuration review, and a written plan for fixing any gaps. We can implement the changes same-day for most small to medium businesses.
We offer up to a 3-year warranty on UniFi network implementations, and we're based in Hyde Park—close to Johannesburg's business hubs.
Book online at zasupport.com/book or WhatsApp us on 064 529 5863 to get started. We'll also check any connected Apple hardware while you're here.
For deeper UniFi documentation, Ubiquiti's official learning centre covers advanced VLAN use cases.
---
Frequently Asked Questions
Q: Do I need managed switches for UniFi VLAN segmentation to work?
Yes. Unmanaged switches don't understand VLAN tags. If you have a UDM or UDM Pro, that device has built-in switching, so you can segment a small network without additional hardware. But as you grow, you need a UniFi Switch (Pro 24 PoE or similar) to carry VLAN traffic between access points and between zones. This is non-negotiable for proper segmentation.
Q: Can I use VLANs with my existing WiFi router, or do I need UniFi?
Most consumer routers cannot configure VLANs at all, or they can create a single guest network (which is a VLAN, technically, but you can't create others). If you want genuine multi-VLAN segmentation, you need enterprise-grade hardware like UniFi. UniFi is the sweet spot for Johannesburg businesses because it's affordable, powerful, and doesn't require on-site support staff.
Q: What's the difference between a VLAN and a subnet?
A subnet is an IP address range (192.168.1.0/24). A VLAN is a logical network segment at layer 2 (the switch layer). You can have multiple subnets on one VLAN (unusual but possible) or one subnet per VLAN (standard practice). For simplicity: one VLAN = one subnet.
Q: If I misconfigure a firewall rule, will my network go down?
Not immediately. If you block all traffic accidentally, yes, your network stops. But UniFi has a rollback feature—if you lose connection to the console, the system reverts changes after a timeout. Always test on a non-critical VLAN first. During load shedding, restarts can clear temporary misconfigurations, so don't assume your rule worked just because the network is up.
Q: Can I implement VLANs gradually, or does the whole network need to change at once?
Gradually is smarter. Start with a guest VLAN on your WiFi. Once that's stable, add an IoT VLAN. After a month, audit for issues. Most VLAN problems show up within days of deployment, not weeks later. We recommend rolling out one new VLAN per month and documenting as you go.
Q: Do VLANs slow down my network?
No. VLAN processing is hardware-based on managed switches. The slight overhead is unmeasurable on gigabit networks. If anything, segmenting IoT and guest traffic improves performance for your main business network because those devices aren't congesting shared bandwidth. Throughput stays the same; reliability improves.
