This weekend I upgraded from a simple home mesh system to UniFi Express 7 mesh system. It was time but one of the reasons was I wanted to start using VLANs at home to isolate smart devices away from user devices.
I’ve used VLANs for wired equipment at work, but I have no experience with doing it over WiFi.
I haven’t tried yet, but saw this in their documentation.
Assign VLANs to WiFi SSIDs
Each SSID can be mapped to a single VLAN, ensuring that all connected devices remain within the designated VLAN. For more flexibility, PPSK (Per-Password VLAN) allows multiple VLANs on the same SSID, where the password used determines the VLAN assignment.
My question is, are there drawbacks to PPSK? That seems like the cleanest way to do it.
So I did some playing around with this last night and a little more research. It looks like there are a few limitations that I found.
It is not supported on WPA3, only WPA2. Which also then removes 6GHz as an option.
With what I was thinking I’d use this for, 6GHz wouldn’t be an issue.
My original thought was to isolate some of these devices that I don’t trust, like smart internet connected plugs, smart tvs, thermostats, etc.
While this network would not be sensitive in nature and I might make the WPA2/3 sacrifice, I’m still not sure if I want to do that
I think I have some answers to chew on but would be open to anyone else’s experience or thoughts. I won’t be able to get back to this for at least a few weeks, I’m about to be on vacation until the 18th.
I’ve set up a dedicated IoT SSID, but not a separate VLAN for it yet. I’ve seen many reports from people who did, though. It seems to be the best way to keep using devices that might have sketchy firmware with minimal risk. Isolation has always been a key factor in security. The “smart” TV needs access to the internet, but not to your work laptop. The WiFi camera in the backyard doesn’t even need internet access at all.
The PPSK concept is new to me, and I’d first implement a shared IoT VLAN to see how it goes.
