Gbit Tech (818) 809-6743
C-7 #1050088  ·  Liability insured  ·  UniFi Certified PartnerNever the cheapest. Built to last.

UniFi Lab 05

Camera VLAN vs NVR / Protect

Protect camera will not adopt, or it goes offline after you isolate it. VLAN and Protect ports.

IntermediateAbout 9 minConfig only

Your job: adopt on the same VLAN as the NVR, then isolate on Cameras VLAN with Protect ports open.

This run: Break A. NVR on LAN. Cameras VLAN 60.

Protect cameraadopt_missing_wrong_vlan

Adopt not available

adopt_missing_wrong_vlanAdopt not available

Goal: Online, stream healthy on Cameras VLAN

Controls Why

Topology

Site: Protect adopt lab
  1. Console / NVRProtect on Default / LANOnline
  2. Protect ports: BlockedTCP 7442 / 7444 / 7550 / 7552 and related ports.
  3. SwitchProtect path stops hereCamera PoE port + uplink

    Port 4 VLAN Cameras VLAN 60

  4. Camera path: Protect blocked or wrong VLANDiscovery or stream fails here.
  5. Protect cameraG4 / G5 class on PoENot adopted
    adopt_missing_wrong_vlanAdopt not available

Protect device list

1 camera
Protect statusNot adopted
AdoptAdopt not available
Camera VLANCameras VLAN 60
NVR VLANDefault / LAN
Protect portsBlocked
StreamNo stream
Management pingNo reply

Legend

  • Protect path open
  • Protect path blocked
  • Up or allowed
  • Failing symptom
  • Ping only, not Protect

Controls

Same-VLAN adopt first, then move and open Protect ports. Ping is not the Protect path.

Switch, camera PoE port

Camera port VLAN

Default matches the NVR for first adopt. Cameras VLAN 60 is the isolation target.

Protect device list

NVR VLAN
Default / LAN
Cameras VLAN
60
BOM on win
none
Protect adopt

Only works when the camera shares the NVR VLAN.

Firewall between Cameras VLAN and NVR

Protect ports Cameras → NVR

Allow TCP 7442, 7444, 7550, 7552, plus related 7441, 7443, 7445, 7447, and 7888 from Cameras VLAN to the console / NVR.

Management ping (teaching)

Ping replies are not a healthy Protect stream.

Out of scope for this lab

RAID / storage plannerAlarm ManagerTeleport remote adoptThird party ONVIF

Why this fails

copy key: adopt_missing_wrong_vlan

Camera is on the wrong VLAN for first adopt

Adopt not available

Field note: New cameras often need to share a VLAN with the CloudKey or NVR to show Adopt. Isolation between Cameras VLAN and the console blocks discovery.

Fix: Put the camera on the same VLAN as the NVR for adopt, then move and open Protect ports.

Console words

  • Adopt not availableShowing
  • Camera OfflineClear
  • Protect ports blockedShowing
  • Stream unhealthyClear
  • Online, stream healthyClear

Glossary

Core, Labs 01 to 03
Native
Untagged VLAN on a switch port (PVID). Management traffic usually rides here on UniFi device uplinks.
Tagged
VLAN IDs carried with an 802.1Q tag on a trunk. Guest and IoT SSIDs need their VLANs tagged on the AP uplink.
Access port
One VLAN only, untagged. Fine for a printer. Wrong for an AP that serves multiple SSIDs.
Trunk
Native + tagged VLANs. Correct pattern for UniFi switch to AP / switch to gateway when multiple networks exist.
ZBF
Zone-Based Firewall. Policies between zones (Gateway, External, Internal, Guest, etc.), not just classic LAN IN rules.
Gateway zone
Where the router answers DHCP and DNS for a network. Block Guest to Gateway and clients get No IP or DNS unreachable.
Client isolation
WiFi setting that stops guest clients from talking to each other. Keep on for Guest.
PoE class
AF (~15 W), AT (~30 W), BT / PoE++ (higher). UniFi budgets on documented max draw, not quiet daytime watts.
PoE budget
Sum of max PD draws vs what the switch or injector can supply. Exceed it and devices disconnect.
Injector
Power source for a Flex or similar. Wrong class (AF on a loaded Flex) is a classic field fail.
Max draw
Datasheet maximum watts for a PD (IR on, boot). UniFi PoE budget math uses this, not the quiet live reading.
Flex budget
USW-Flex downstream totals by input: AF 8W, AT 20W, BT or 60W injector 46W (set Power Source to PoE Injector).
Remote Unlock via Endpoint
Access setting. When off, Endpoint receivers can talk on a call but cannot unlock.
Door Attendant / receiver
User assigned to get the door call. Not on the list means no Unlock for that door.
Inform
Device check-in URL to the Network application, usually controller host on port 8080, path /inform.
STUN
UDP 3478 helper for L3 / remote adoption. GUI on 443 is not the same path.

Fiber terms, glossary ready for later

OM3 / OM4OS2SFPSFP+DACAOCBiDi

MM and SM grades, cage form factors, DAC, AOC, and complementary BiDi ends. Full rows land with the fiber-sfp-dac lab.

Symptom words (overlay language)

No IPNo gatewayDNS unreachableConnected, no internetConnected, isolated from LANTraffic blocked by firewall

Gear in this lab

  • 1 Console / NVR (Protect)
  • 1 Switch
  • 1 Protect camera
Change on win: none

Config only. VLAN and Protect ports. Counts only, no prices.

A teaching lab, not a quote and not a design for your site. Settings are simplified from the UniFi Network app. The header and footer are the site header and footer.