UniFi Home Network Setup: What to Buy First

Most first UniFi builds go wrong in the same two places: buying a switch by its port count instead of its power budget, and buying an access point before working out where it will physically go. Neither mistake is expensive to avoid on paper and both are expensive to fix once the cable is in the wall.

This is a buying order, not a shopping list. The point is to decide what constrains your build before you decide what brand-new model to put in the cart.

How a UniFi network fits together: four roles

A managed UniFi network separates four roles, although a cloud gateway can combine several in one purchase.

The controller is the UniFi Network application: it adopts devices, applies configuration and collects statistics.
The gateway routes, does NAT, provides DHCP and enforces firewall and inter-VLAN policy. A UniFi cloud gateway also hosts UniFi Network; a third-party router can provide routing separately.
The switch carries VLAN tags and, if it is a PoE model, delivers power to access points and cameras over the same cable as data.
The access point provides the Wi-Fi connection to the wired network.

A small deployment can use an existing router and power an AP with a compatible injector. For centralized management, UniFi Network can run on a CloudKey or a self-hosted system instead of a cloud gateway. You therefore do not need to replace a functioning router merely to manage UniFi APs.

The controller manages; the gateway forwards

Ubiquiti’s self-hosting documentation confirms that adopted APs and switches keep functioning if the Network application stops. The application is needed for configuration changes and complete statistics, so plan a host that remains available. A controller outage and a routing outage require different checks.

The gateway owns the subnet and firewall configuration in a basic cloud-gateway design. With a third-party gateway, configure the VLAN ID, subnet and DHCP there as well as declaring the matching network in UniFi. Creating a VLAN alone does not define which other networks it should reach: choose isolation and permitted services explicitly.

Buy the console first, and size it by device count

Console capacity is published as a device count and a client count, and those two numbers are what actually box you in later.

Console	Ports	Manages	Clients	Notable
UniFi Express	Gigabit RJ45 WAN and LAN	4 UniFi devices	50+	Built-in 2x2 Wi-Fi 6 radio, 10 W over USB-C
Cloud Gateway Ultra	1x 2.5 GbE, 4x GbE RJ45	30+ UniFi devices	300+	1 Gbps IDS/IPS, 6.2 W, no PoE output
Dream Machine Pro	9x GbE RJ45, 2x 10G SFP+	100+ UniFi devices	1,000+	3.5 Gbps IDS/IPS, 3.5-inch NVR bay, 1U rack, 33 W

Ubiquiti’s own datasheets carry those figures. Three things follow from them.

First, the original UniFi Express includes Wi-Fi 6, so a small deployment can start with one box. Its published management capacity is four UniFi devices. Its specifications also limit its continuing Network updates to the 9.0 line; check software requirements before adding newer devices. Protect camera management is a separate application requirement.

Second, the Cloud Gateway Ultra has no PoE output at all. If you buy it and then buy a PoE access point, you also need either a PoE switch or an injector. This surprises people who assume a “gateway” powers the things plugged into it.

Third, compare the published IDS/IPS rating with the intended inspected traffic load. The Ultra is rated at 1 Gbps and the Dream Machine Pro at 3.5 Gbps. These are vendor specifications, not a guarantee for every workload; Ethernet port speeds remain separate limits.

Buy the switch for its power budget, not its ports

This is the single most common sizing error, and the specifications make it obvious once you look at the right line.

The UniFi Lite 16 PoE has sixteen gigabit ports. Only eight of them are PoE+, and the total PoE budget across the whole switch is 45 W. Eight PoE+ ports each capable of 32 W do not add up to 256 W of usable power; they add up to 45 W, shared.

Compare that with the Pro 24 PoE: 24 gigabit ports, of which 16 are PoE+ at up to 30 W and 8 are PoE++ at up to 60 W, on a 400 W total budget, with two 10G SFP+ uplinks.

Now put real load against it. A U7 Pro access point draws up to 21 W. Three of them is 63 W, which already exceeds the Lite 16’s entire 45 W budget even though only three of its eight PoE ports are in use. A U7 Lite or U6 Pro at 13 W would total 39 W for three APs, leaving 6 W before delivery losses and expansion.

Two rules fall out of that:

Add up worst-case draw, not typical draw. Datasheet maximums are what the switch has to be able to satisfy simultaneously.
Leave headroom. Cameras, doorbells, and a second AP arrive later, and cable length and quality both eat into delivered power.

Use the PoE budget and switch planning worksheet to separate compatible powered ports from available watts. The UniFi sizing planner provides an initial estimate; substitute each chosen device’s published maximum when checking the final budget.

Access points: fewer and better, placed properly

Coverage figures on Ubiquiti datasheets are ideal-condition numbers: 140 m² (1,500 ft²) for the U7 Pro, U6 Pro, and U6+; 115 m² (1,250 ft²) for the U7 Lite. Real walls, especially anything with foil-backed insulation, brick, or a metal stud frame, take large bites out of that.

Access-point placement also needs a channel plan. Ubiquiti’s optimization guide distinguishes low-density homes from environments with overlapping APs: channel width and transmit power should follow the environment rather than a single maximum-performance preset. An added AP can create more interference if its configuration overlaps poorly with existing radios.

Practical starting points for a house:

Start with the rooms that need coverage and suitable mounting positions. A central ceiling location is a planning candidate, not a guarantee that one AP will cover an entire floor.
Skip the AP entirely in the first pass if you bought a console with a built-in radio and you are testing whether coverage is even a problem.
Match the uplink. The U7 Pro and U7 Lite both present a 2.5 GbE port. Plugged into a gigabit switch port, that 2.5 GbE is capped at 1 Gbps, which is fine for most homes but is a spec you paid for and are not using.

How many of those access points the switch can actually power, and whether the faster uplink port earns its price, is worked through in UniFi access point PoE budget and switch planning.

Ubiquiti recommends 20 MHz on 2.4 GHz, with 5 GHz width depending on density: its examples use 80 MHz for low-density homes and 40 MHz for denser deployments. Supported 6 GHz operation adds another band, but clients still need suitable signal strength and compatible radios. Wider channels do not remove the need to review placement and airtime use.

A sane buying order

Console. It determines your device ceiling and whether you have PoE at all.
One access point, if the console has no radio, or if it has one and coverage is clearly short.
PoE switch, sized from the actual draw of the devices you now own plus the ones you have already decided to buy.
Everything else — cameras, more APs, a second switch for a distant room.

Buying in that order means each purchase is made with a real constraint in hand rather than a guess. It also means the network is functional after step one or two, so you learn what your coverage problem actually is before spending money on it.

What to plan now even if you build it later

Two decisions are cheap to make on day one and irritating to retrofit.

A management network. Decide early which VLAN your UniFi devices themselves live on. Moving adopted devices to a different management VLAN later can strand them mid-transition, and untangling that is the most common cause of a device that will not come back. If it does happen, UniFi adoption failures walks the diagnostic path.

Cable runs. Power over Ethernet means one cable per AP, but it also means the run has to terminate somewhere that has a PoE port free and budget left. Pull the cable to the ceiling location you actually want, not to the location that is convenient today.

Write down the native and tagged VLAN path

The switch translates the network plan into a port configuration. In a common design without a device Network Override, the AP uses the port’s native network for management, while additional SSID networks travel tagged. The following is an illustrative port plan, not a configuration to paste into every deployment.

Connection	Native network	Tagged networks to allow
Switch to AP	Device management	Each VLAN assigned to an additional SSID
Switch to gateway	Agreed native network at both ends	VLANs that must reach the gateway
Switch to wired client	That client’s intended network	None unless the client deliberately tags traffic

Follow the full path, including intermediate switches. A tag permitted at the AP port but blocked upstream cannot reach its DHCP service. Ubiquiti also documents a specific failure when an AP Network Override uses the same VLAN as its directly connected port’s native network. Decide whether management is native or explicitly tagged and configure the entire path consistently.

If Wi-Fi association succeeds but no address arrives, inspect DHCP and VLAN tagging before adding another AP. If the AP itself is missing, check its management address and the application path. UniFi’s ports reference distinguishes TCP 8080 device communication from UDP 10001 discovery and UDP 3478 STUN.

Avoid changing every layer at once

Record the working port profile before moving a device’s management network, and keep a way to restore it. Review firmware and application compatibility through the official update workflow. Apply one change at a time so an adoption failure can be tied to the changed VLAN, host or software version.

Radio configuration needs the same discipline. Do not assume maximum transmit power or broadcasting every SSID on every band suits every floor plan. Use Ubiquiti’s guidance for the actual density, then review client connectivity before expanding the design.

What you do not need

A separate CloudKey when your console already runs UniFi Network. The controller is not a fourth box in a modern cloud-gateway build.
A 10 Gbps core in a house whose internet connection is 500 Mbps. SFP+ uplinks are for aggregating many gigabit ports or reaching a NAS at speed, not for making a single laptop feel faster.
IDS/IPS-grade routing throughput you will never enable.

Specify the console by device count, the switch by watts, and the access points by where they will physically hang. Everything else on a UniFi datasheet is a detail you can revisit once the network exists.