Use Case — US Office Network on a UniFi UDM Pro Max

1. The gateway

The UDM Pro Max is a 1U gateway that combines a router, zone-based firewall, the built-in UniFi Network controller, VPN concentrator, and an NVR in one device. Relevant capabilities for this design:

• Ports: 8× 1G RJ45 LAN, 1× 2.5GbE RJ45 (default WAN), 2× 10G SFP+.
• Capacity: 5 Gbps IDS/IPS, 200+ UniFi devices, 2,000+ clients.
• Segmentation: VLAN/subnet-based, with a zone-based firewall and Layer-7 (application-aware) rules.
• VPN / SD-WAN: WireGuard, L2TP, and OpenVPN servers; OpenVPN and IPsec site-to-site; Teleport remote VPN; license-free Site Magic SD-WAN.
• Routing: static, plus BGP and OSPF for dynamic routing over the cloud tunnels.

All configuration below is done in the UniFi Network application that runs on the device (Settings → Networks, WiFi, Routing, Policy Engine/Firewall, VPN).

2. Where it fits in the plan

US subsidiary      10.0.0.0/12
  On-prem          10.12.0.0/14
    US HQ office   10.12.0.0/16   <-- this use case
      VLANs        one /24 per segment (3rd octet = VLAN ID)

The office takes 10.12.0.0/16, leaving 10.13/10.14/10.15 for additional on-prem sites or a datacenter. Every VLAN is a /24 whose third octet equals its VLAN ID, so the subnet is readable straight from the tag.

3. VLAN / subnet plan

Leave the default VLAN 1 / "Default" network unused (or disable it) and put infrastructure on the dedicated Management VLAN — never manage the gear from VLAN 1.

4. WiFi → VLAN mapping

SSIDs are created under Settings → WiFi and each is bound to one of the VLAN networks above.

Management, Application, Data, and most Printers are wired.

5. Physical / port layout

ISP ──▶ [2.5GbE RJ45 WAN]  UDM Pro Max  [10G SFP+ LAN] ──▶ Core/Aggregation switch (VLAN trunk, all tagged)
                                                              │
                                   ┌──────────────────────────┼───────────────────────────┐
                              PoE switch                  PoE switch                   servers
                              (APs, printers,             (workstations,               (App VLAN 30,
                               cameras: VLANs              phones: VLAN 20)              Data VLAN 40 —
                               50, 20, 10)                                              access ports)
                                   │
                              UniFi APs (U7) broadcast Corp/Guest/IoT SSIDs → tagged to VLANs 20/60/50

• WAN: 2.5GbE RJ45 to the ISP handoff (or a 10G SFP+ port if the ISP delivers fiber). A second WAN / UniFi LTE backup can be added for failover (Shadow Mode / multi-WAN).
• LAN uplink: a 10G SFP+ port trunks all VLANs to the core/aggregation switch; access switches and APs carry the tagged VLANs downstream.
• The eight 1G RJ45 ports handle direct device or secondary connections.

6. Zone-based firewall (segmentation)

Assign each network to a firewall zone in the Policy Engine, then govern traffic between zones. The matrix below shows session initiation (source → destination); the stateful firewall auto-allows return traffic for permitted sessions. ✓ = allow, ✗ = deny, → = allow only specific ports/hosts.

Key intent:

• Guest reaches the internet and nothing else — fully isolated from every internal VLAN, including Management.
• Printers/IoT can be reached for printing from Corporate but cannot initiate to any internal VLAN, and has no internet egress (block or tightly allow specific update domains).
• Data is the crown jewel: reachable only from Application on database ports, no internet, no lateral initiation. Backups/replication to cloud go through the Cloud Transit path.
• Corporate reaches apps and the internet; it does not touch Data directly (only through the Application tier) or Management.
• Management is the only zone that can administer everything; inbound to it is restricted to admins arriving via Corporate or the VPN (ideally through a jump host).
• VPN users are treated like on-site employees, with admin access to Management gated separately.

7. Cloud Transit — connecting the office to the cloud

The Cloud Transit VLAN (10.12.80.0/24) is the local anchor for hybrid connectivity. The UDM establishes site-to-site VPN tunnels over its WAN to each cloud's VPN gateway, landing in the shared-services transit block (10.240.0.0/12) and the per-cloud transit hubs:

• The office advertises 10.12.0.0/16 (or the summarized 10.12.0.0/14 on-prem block) to the hubs; it receives the cloud /14s in return. Because everything sits under the US 10.0.0.0/12, route tables stay small.
• The UDM supports BGP, so the tunnels can exchange routes dynamically rather than via static routes — preferred for failover across multiple hubs.
• Site Magic SD-WAN can be used for office-to-office (UniFi-to-UniFi) tunnels; IPsec is used for the cloud gateways, which are not UniFi.
• Only the zones permitted in the matrix (Corporate, Application, Data-replication, Management) route across Cloud Transit; Guest and IoT never do.

8. Configuration approach

UniFi is controller-driven; the build order in the UniFi Network app:

1. Networks (Settings → Networks): create the eight VLANs above with their subnets, gateways, and DHCP scopes. Set DHCP reservations for infrastructure and servers.
2. WiFi (Settings → WiFi): create the SSIDs and bind each to its VLAN; enable Guest Policy on Guest-WiFi.
3. Policy Engine / Zone-Based Firewall: define the zones, map each network to a zone, and implement the matrix in §6.
4. VPN: configure the remote-access server (WireGuard or Teleport) into the VPN VLAN, and the IPsec site-to-site tunnels to each cloud gateway; enable BGP for the cloud routes.
5. Routing: confirm the learned cloud /14s and the advertised office prefix; add static routes only where BGP isn't used.

Infrastructure-as-code option. UniFi config is primarily GUI/controller-based, but it can be automated via the Ubiquiti Site Manager API or the community Terraform provider (paultyng/unifi), which exposes unifi_network, unifi_wlan, unifi_firewall_group, and related resources. A representative skeleton (verify attribute names against the current provider docs, as the community schema changes):

# Community provider — confirm current schema before use.
terraform {
  required_providers {
    unifi = {
      source  = "paultyng/unifi"
      version = "~> 0.41"
    }
  }
}

provider "unifi" {
  # api_url / username / password (or API key) for the UDM Pro Max controller
}

locals {
  vlans = {
    mgmt     = { id = 10, subnet = "10.12.10.0/24" }
    corp     = { id = 20, subnet = "10.12.20.0/24" }
    app      = { id = 30, subnet = "10.12.30.0/24" }
    data     = { id = 40, subnet = "10.12.40.0/24" }
    iot      = { id = 50, subnet = "10.12.50.0/24" }
    guest    = { id = 60, subnet = "10.12.60.0/24" }
    vpn      = { id = 70, subnet = "10.12.70.0/24" }
    transit  = { id = 80, subnet = "10.12.80.0/24" }
  }
}

resource "unifi_network" "vlan" {
  for_each      = local.vlans
  name          = "us-hq-${each.key}"
  purpose       = "corporate"
  vlan_id       = each.value.id
  subnet        = each.value.subnet
  dhcp_start    = cidrhost(each.value.subnet, 20)
  dhcp_stop     = cidrhost(each.value.subnet, 250)
  dhcp_enabled  = true
}

resource "unifi_wlan" "corp" {
  name       = "Corp-WiFi"
  network_id = unifi_network.vlan["corp"].id
  security   = "wpapsk"
  passphrase = var.corp_wifi_passphrase
  # ... ap_group_ids, etc.
}

9. Notes

• CyberSecure (subscription) adds 100,000+ IPS/IDS signatures, content/region filtering, and a honeypot — worth enabling for a corporate edge.
• Redundancy: the UDM Pro Max supports Shadow Mode (VRRP) gateway failover and multi-WAN/LTE backup; add these for an HQ that depends on cloud connectivity.
• RADIUS / 802.1X: the built-in RADIUS server lets you put Corporate WiFi (and wired ports) on WPA2/3-Enterprise with per-user identity instead of a shared PSK.
• Capacity headroom: at 5 Gbps IDS/IPS the Pro Max suits an HQ of a few hundred users; if you approach 7,500+ clients or need 25 Gbps inspection, the Dream Machine Beast is the next tier.
• IPAM source of truth: record all eight VLAN prefixes in NetBox under the US on-prem branch so the office space reconciles against the same plan as the clouds.