UniFi Switch Port Profiles and 802.1X: Locking Down Wired Ports Without Breaking Your Devices

Have you ever counted how many live Ethernet jacks sit in places you don't watch? A conference room, a garage, a porch camera mount, a guest bedroom — each one is a patch cable away from your switch, and by default most of them will hand out an address on whatever network the port happens to carry.

Our guide to UniFi VLANs explained covers how to carve a network into segments. This post covers the layer underneath that, which is deciding which segment each physical port may reach and what happens when someone plugs in a device you didn't expect.

The tools are already in the UniFi Network application: Ethernet port profiles, 802.1X port control, a RADIUS profile, and MAC-based authentication for devices that can't authenticate on their own. Used together, they keep an open wall jack from becoming a way into the network — without bricking the printer, the thermostat, or the PoE camera on the eave.

A port profile is a reusable bundle of switch-port settings that you can apply to one port or fifty. You define the behavior once and assign it, which also means a change to the profile updates every port that uses it.

In recent versions of the Network application, a profile (or the per-port settings in a switch's Port Manager) covers the following:

• Native VLAN. This is the untagged network a device lands on when it plugs in without VLAN awareness. For nearly every end device, including laptops, printers and cameras, this is the only setting that decides where it lives.
• Tagged VLANs. These are the additional networks the port carries with 802.1Q tags. Access points and downstream switches need them, but a desk jack almost never does, so the safest default on access ports is to block all tagged traffic.
• Port isolation. Isolation prevents the port from talking to other isolated ports on the same switch. It suits guest jacks and camera runs, where devices have no reason to see each other.
• 802.1X control. This decides whether a device must authenticate before the port forwards its traffic. We cover the modes in detail below.
• Storm control and loop protection. Storm control rate-limits broadcast, multicast and unknown-unicast floods, while spanning tree shuts down a loop before it melts the segment. Both matter on ports facing rooms where someone might plug a cable back into the wall.
• PoE mode, speed and LLDP-MED. These are the physical-layer settings. LLDP-MED lets VoIP phones learn their voice VLAN automatically, and PoE can be switched off on any port that should never power a device.

Keep in mind that profiles reference networks you have already built under Settings > Networks. Create the VLANs first, then point the profiles at them.

It also helps to separate two jobs that are easy to blur. The port profile decides which network a device lands on, and your zone-based firewall decides what that network is allowed to reach — you need both for an open jack to be harmless.

Most networks need only five or six profiles. The discipline lies in naming them for the role a port plays rather than the device currently plugged into it, because devices move and roles mostly don't.

Here's a starter set that covers a typical home lab or small office:

• Trunk – Uplink. Set the native VLAN to your management network and allow all tagged VLANs for switch-to-switch links, the gateway port and any link aggregation groups. 802.1X stays at Force Authorized.
• AP – Tagged. Keep the native VLAN on management so the access point can be adopted, and limit tagged VLANs to the SSIDs it actually broadcasts. Scoping the tagged list keeps an AP jack from leaking every network in the building.
• Workstation. Put the native VLAN on your trusted LAN, block tagged VLANs and set 802.1X to Auto. This is where authentication earns its keep.
• IoT – Wired. Point the native VLAN at your IoT network, block tagged traffic and consider port isolation. If you've built an IoT VLAN for Home Assistant, this profile is how wired smart-home devices join it.
• Camera – PoE. Use a dedicated camera network, block tagged VLANs, enable isolation and leave PoE on. Exterior camera runs are the jacks most exposed to tampering, since the cable often ends on the outside of the building.
• Disabled – Dead End. Disable the port outright or, if you want to see link events, set the native VLAN to an isolated network with no route anywhere. Block all tagged traffic either way.

That last profile is one of the highest-value changes most networks can make. An administratively disabled port can't be abused, and it takes seconds to re-enable when you genuinely need it.

Remember that the native VLAN on a trunk port is a quiet risk. Anyone who reaches a trunk drops untagged traffic straight onto its native network, so some operators move trunk natives to an unused VLAN and carry management tagged instead.

That approach requires every switch and access point in the chain to support tagged management, which UniFi devices do through their management VLAN setting. Test it on a single device first, because a mismatch strands that device until you reset it or fix the profile.

Access point ports deserve particular care. An AP that hands out four SSIDs only needs those four VLANs tagged, and trimming the rest means a laptop unplugged from an AP's jack and plugged in by someone else sees the management network and nothing more.

802.1X adds an authentication step between plugging in and getting connected. Until a device proves who it is, the port forwards only EAPOL authentication frames, so DHCP, ARP and everything else stays blocked.

Three parties take part in every exchange:

• Supplicant. This is the device asking for access, such as a laptop with 802.1X configured in its wired network settings. Windows, macOS, Linux, iOS and Android all ship with a supplicant built in.
• Authenticator. The UniFi switch relays the conversation between device and server. It enforces the outcome but never decides it.
• Authentication server. A RADIUS server checks the credentials and returns an accept or reject. The reply can also carry a VLAN assignment.

On the UniFi side, the setup has three pieces. First, you create a RADIUS profile under Settings > Profiles that points at a server — either the built-in RADIUS server on a UniFi gateway such as a Dream Machine or Cloud Gateway, or an external server like FreeRADIUS or Windows NPS.

Next, you enable 802.1X control on the switch itself, choosing that RADIUS profile and a fallback VLAN. Finally, you set the 802.1X mode on each port profile, which is where most of the nuance lives.

The per-port modes break down as follows:

• Force Authorized. No authentication happens, and the port behaves like an ordinary switch port. Uplinks, gateway ports and AP ports belong here.
• Force Unauthorized. The port never forwards client traffic at all. It's a blunt instrument, but it works as a hard lockout.
• Auto. The port requires a successful 802.1X exchange from a supplicant before it forwards anything. This is the right mode for workstation jacks.
• MAC-Based. The switch authenticates the device using its MAC address as the credential. No supplicant is needed on the device.
• Multi-Host. Once one device on the port authenticates, every device behind it is allowed through. It exists for phones and small passthrough setups.

Dynamic VLAN assignment is where 802.1X becomes more than a gate. When the RADIUS reply carries the standard tunnel attributes — Tunnel-Type set to VLAN (13), Tunnel-Medium-Type set to 802 (6) and Tunnel-Private-Group-ID set to the VLAN ID — the switch places the device on that network regardless of the port's native VLAN.

The built-in UniFi RADIUS server handles this through the VLAN field on each user account. As a result, a single Workstation profile can serve every desk: a staff laptop lands on the trusted LAN, a contractor's credentials land on a restricted network, and nobody re-patches anything.

The EAP method matters too. The built-in server works with username-and-password methods such as PEAP-MSCHAPv2, which is quick to roll out, while certificate-based EAP-TLS — stronger, since no reusable password ever crosses the wire — usually means pointing the RADIUS profile at an external server.

Note that 802.1X support varies across the switch lineup. Most managed Standard, Pro and Enterprise models support it, but the smallest models carry a reduced feature set, so confirm on the datasheet or in our UniFi switch buying guide before you plan a rollout around a specific unit.

Plenty of wired devices have no supplicant at all. Printers, smart TVs, most IoT hubs, many PoE cameras and nearly every thermostat or irrigation controller will sit silently on a port set to Auto, never authenticate, and never receive an address.

MAC-based authentication, often called MAC Authentication Bypass or MAB, solves this by letting the switch authenticate on the device's behalf. The switch sends the device's MAC address to the RADIUS server as the credential, and if a matching entry exists, the port opens and any VLAN in the reply is applied.

Here's how to make it work without surprises:

• Match the MAC format. RADIUS servers are strict about whether the address arrives in lowercase, uppercase, or with colons and dashes. Check what the switch actually sends in your server's logs before you create dozens of entries.
• Assign a restricted VLAN in the reply. A MAC-authenticated device should land on an IoT or camera network. It should never land on the trusted LAN.
• Document every entry. Label each RADIUS user with the device and its location. A list you can audit a year from now is worth the extra minute today.

Be aware that a MAC address is not a secret. It's printed on device labels, visible to anything on the same segment and trivial to spoof, so MAB works as an inventory control rather than strong authentication.

That is why the fallback VLAN matters so much. Anything that fails both 802.1X and MAC authentication should land on an isolated network with internet-only access at most, where firewall rules keep it away from anything you care about.

This follows the same logic as a well-built UniFi guest network. Unknown devices get somewhere to go, so failures show up in the client list instead of failing silently, and none of them can reach your NAS, your controller or your cameras.

Power and data also behave separately here. PoE is delivered at the physical layer, so a camera on a MAC-Based port still powers up and boots before it authenticates — plan the draw with our PoE budget planning guide as you normally would.

Multi-Host deserves a word of caution. It's the right mode for a VoIP phone with a PC daisy-chained behind it, since the phone authenticates and the PC rides along, but anything plugged into that phone's passthrough port rides along too.

Use Multi-Host only where a device genuinely sits between the wall and the endpoint. And of course, never use it as a shortcut to quiet a port that keeps rejecting a device you haven't identified.

The most common way to break a network with 802.1X is to require authentication on a port your own management traffic depends on. A downstream switch whose uplink suddenly demands authentication loses contact with the controller and the RADIUS server at the same moment, and it can't recover on its own.

Accordingly, a staged rollout pays for itself. Here's a sequence that keeps every step reversible:

1. Inventory every port. Use the switch's port view to record what is plugged in, its MAC address and the network it should be on. This list becomes your MAC entries later.
2. Apply profiles without authentication. Move ports onto role-based profiles with 802.1X at Force Authorized, and disable unused ports. Live with that for a few days and confirm nothing broke.
3. Stand up RADIUS and test one port. Create users and MAC entries, then set a single spare port to Auto. Test it with a laptop, a printer and a device the server has never seen.
4. Expand by role. Convert workstation ports first, then move IoT and camera ports to MAC-Based. Watch the RADIUS logs for rejects after each batch.
5. Keep an escape hatch. Leave one clearly labeled port near the rack on Force Authorized and your trusted LAN. If RADIUS goes down, you still have a way in.

That fifth step addresses the real dependency. If your RADIUS server lives on the gateway and the gateway reboots, new connections and re-authentications fail until it returns, so the fallback VLAN and the escape-hatch port are what keep a firmware update from turning into an outage.

After the rollout, make the client list part of your routine. Devices sitting on the fallback VLAN are either things you forgot to register or things that shouldn't be there, and both are worth knowing about.

All of this adds up to a wired network that behaves as deliberately as your wireless one. Every port has a role, every unknown device has a contained place to land, and an open jack in the garage is no longer an open door.

If you're planning a switch upgrade with port security in mind, start with our UniFi switch lineup and check 802.1X support model by model. Then pair it with the segmentation in our UniFi VLAN guide so each profile points at a network that's actually built to contain what lands on it.