Read the map. It flags three things: a device with no free port, a switch with no uplink, and a cable with a loose end. Clear every flag so each device is cabled to a free port.
{"access-event":{"t":"Access event","d":"The event a door fires in Home Assistant when someone tries to get in: access_granted or access_denied, with who it was and how (NFC, PIN or Face)."},"access-port":{"t":"Access port","d":"One VLAN only, untagged. Fine for a printer. Wrong for an AP that serves multiple SSIDs."},"adopt":{"t":"Adopt","d":"Bring a new UniFi device under your UniFi app so you can manage it. Until then it shows Pending Adoption."},"api-token":{"t":"API token","d":"The key Home Assistant uses to talk to UniFi Access. Made in Access under Settings, General, API Token, and shown only once. A key from the console Integrations page is a Protect key, and Access rejects it."},"aux":{"t":"AUX","d":"Extra Door Hub relay for a door operator (dry) or a siren or chime (powered 12V). Not for the main lock."},"backup-wan":{"t":"Backup WAN","d":"A second internet line, like UniFi 5G Backup or Starlink, that the gateway switches to when the main line drops."},"basic-protection":{"t":"Basic Protection","d":"RAID 5 with 3 or more drives. Protects against 1 drive failing."},"bpdu-guard":{"t":"BPDU Guard","d":"Port setting for client ports. A spanning tree message (BPDU) from a switch that should not be there shuts the port, and an admin has to re-enable it."},"broadcast-storm":{"t":"Broadcast storm","d":"What a loop does: the same traffic copies itself around the loop again and again until links fill up and devices drop off."},"client-device-isolation":{"t":"Client Device Isolation","d":"WiFi setting that stops guest clients on the same AP from talking to each other. Keep it on for Guest."},"com":{"t":"COM","d":"Common side of the LOCK relay pair. It lands with NC or with NO, not both."},"debug-console":{"t":"Debug Console","d":"Built-in browser shell on the console."},"device-bridge":{"t":"Device Bridge","d":"A pair of UniFi radios that replaces a network cable between two buildings or spots."},"device-ssh-settings":{"t":"Device SSH Settings","d":"Network setting holding the SSH login an adopted device uses. Factory default devices use ui / ui."},"dhcp-option-43":{"t":"DHCP Option 43","d":"DHCP option that hands devices the Network host address so they adopt across VLANs."},"door-attendant-receiver":{"t":"Door Attendant / receiver","d":"User assigned to get the door call. Not on the list means no Unlock for that door."},"door-attendant":{"t":"Door Attendant","d":"The smallest Access admin role that can see, talk to and unlock a door for a visitor. Enough for a shared reception phone."},"door-hub":{"t":"Door Hub","d":"The Access controller at the door. It wires the lock, door sensor, exit button and reader."},"door-position-sensor-dps":{"t":"Door position sensor (DPS)","d":"A contact on the door and frame that tells the hub whether the door is open or closed."},"doorbell-call-receiver":{"t":"Doorbell Call receiver","d":"Who a reader rings when a visitor presses the doorbell. Set in Access, Interface Designer, Doorbell Call for that reader."},"dry":{"t":"DRY","d":"LOCK mode with no power from the hub. An outside supply can run a non-12V lock, up to 30V DC at 1 A."},"early-media":{"t":"Early media","d":"A SIP feature that carries audio and video before the call is answered. Without it a SIP phone can ring with no intercom video."},"evacuation":{"t":"Evacuation","d":"Access emergency mode that unlocks every door the controller manages at once. Keep it off dashboards and out of automations."},"factory-reset":{"t":"Factory reset","d":"Clears the camera so it isn't adopted anywhere."},"fail-safe":{"t":"Fail-safe","d":"A lock that needs power to stay locked, like a maglock. Wire it to LOCK NC and COM."},"fail-secure":{"t":"Fail-secure","d":"A lock that needs power to unlock, like most strikes. Wire it to LOCK NO and COM."},"flex-budget":{"t":"Flex budget","d":"USW-Flex downstream totals by input: AF 8W, AT 20W, BT or 60W injector 46W (set Power Source to PoE Injector)."},"free-egress":{"t":"Free egress","d":"Leaving without badging out."},"gateway-zone":{"t":"Gateway zone","d":"The router itself, which answers DHCP and DNS. Block a network's zone from the Gateway and its clients get no IP or DNS."},"high-quality-period":{"t":"High-quality period","d":"Recent footage stays full quality. Older footage is kept at low quality."},"home-assistant":{"t":"Home Assistant","d":"Home automation software. Here it runs on a Raspberry Pi, listens to UniFi Access, and sends unlock to the deadbolt."},"hot-swap":{"t":"Hot swap","d":"Replace a drive while the UNVR stays on."},"ids-ips":{"t":"IDS/IPS","d":"The gateway checks traffic for known attacks and blocks them. Turning it on lowers how fast the gateway can route, so each model lists an IPS throughput."},"inform":{"t":"Inform","d":"Device check-in URL to the Network application, usually controller host on port 8080, path /inform."},"injector":{"t":"Injector","d":"A box that adds PoE power to a cable. Too weak a class, like an AF injector on a loaded Flex, is a common field mistake."},"ir-range":{"t":"IR range","d":"How far the camera's built-in infrared night light reaches. Past it the night image goes dark fast."},"isolate-spokes":{"t":"Isolate Spokes","d":"Site Magic Hub and Spoke setting. Each spoke site reaches the hub but not the other spokes."},"line-of-sight":{"t":"Line of sight","d":"A clear straight path between the two bridge ends, with no roof, wall, or trees in the way."},"lock":{"t":"LOCK","d":"The Door Hub's main lock relay, with NO, NC and COM terminals. Set it to POWERED for 12V from the hub, or DRY for no power."},"lockdown":{"t":"Lockdown","d":"Access emergency mode that overrides credentials so doors stay locked. An admin can still unlock one door remotely."},"loop-protection":{"t":"Loop Protection","d":"Port setting that spots a loop on its own, even behind a switch that does not speak STP, and blocks the port. The port stays blocked until an admin re-enables it."},"managed-by-other":{"t":"Managed by Other","d":"Devices list state. Another instance of UniFi Network owns the device, including the same console after a factory restore. Fix: restore a backup, factory reset and re-adopt, or reassign in the mobile app."},"max-draw":{"t":"Max draw","d":"The most watts a device can pull, from its datasheet (IR on, at boot). UniFi PoE budgets use this, not the quieter live reading."},"mdns-proxy":{"t":"mDNS Proxy","d":"Gateway setting that passes device discovery between networks, so a phone on one VLAN can find a TV or printer on another. Auto, or Custom with the networks you pick."},"mesh":{"t":"Mesh","d":"Site Magic layout where every site links straight to every other site. It can't NAT overlapping subnets."},"native-vlan":{"t":"Native VLAN","d":"The untagged VLAN on a switch port. UniFi device management usually rides here. Set as Native VLAN in Port Manager."},"nc-com":{"t":"NC/COM","d":"Fail-safe pair. Unlock opens the relay and drops power so a maglock releases."},"no-com":{"t":"NO/COM","d":"Fail-secure pair. Unlock closes the relay and applies power so a strike unlocks."},"passive-poe":{"t":"Passive PoE","d":"Power sent on the cable with no handshake. It's always on when enabled, so only plug in devices made for it."},"pending-adoption":{"t":"Pending Adoption","d":"Devices list state for a device that has checked in and is waiting for you to click Adopt."},"pixel-density":{"t":"Pixel density","d":"Pixels on the target per meter or per foot. The IEC 62676-4 bands: Identify 250, Recognize 125, Observe 62, Detect 25 pixels per meter."},"poe-plus":{"t":"PoE+","d":"802.3at. Up to 25.5W to the device."},"poe-plus-plus":{"t":"PoE++","d":"802.3bt Type 3. Up to 51W to the device."},"poe-availability":{"t":"PoE Availability","d":"The total PoE power the switch can share across its ports."},"poe-budget":{"t":"PoE budget","d":"Every device's max draw added up, compared with what the switch or injector can supply. Go over it and devices lose power."},"poe-class":{"t":"PoE class","d":"AF (about 15W), AT (about 30W), BT / PoE++ (higher). UniFi budgets on documented max draw, not quiet daytime watts."},"poe-output":{"t":"PoE output","d":"A port on the UDB-Pro that powers a PoE device, here the camera. It only runs with PoE+ coming in."},"point-to-multipoint":{"t":"Point to multipoint","d":"One radio serving many bridges at once, like the UDB-Pro-Sector."},"powered":{"t":"POWERED","d":"LOCK power from the hub: 12V DC, up to 1 A. Do not add a second 12V supply."},"recipient-number":{"t":"Recipient Number","d":"On a SIP doorbell call, the extension the reader dials. For a Talk phone in Third-Party PBX mode it is that phone's extension."},"recording-destination":{"t":"Recording destination","d":"The NVR the camera records to. Picked on the phone during adoption."},"recording-retention":{"t":"Recording Retention","d":"A limit on how long recordings are kept. Not a promise."},"remote-unlock-via-endpoint":{"t":"Remote Unlock via Endpoint","d":"Access setting. When off, Endpoint receivers can talk on a call but cannot unlock."},"repair":{"t":"Repair","d":"Rebuilds the protected storage onto the new drive. Things run slower until it finishes."},"request-to-exit-rex":{"t":"Request to exit (REX)","d":"A button, motion sensor, or panic bar that unlocks the door from the inside without a credential."},"root-bridge":{"t":"Root bridge","d":"The switch every other switch measures its paths from. The lowest STP priority wins, so set the core switch to 0."},"rstp":{"t":"RSTP","d":"Rapid Spanning Tree, the faster form of STP. On by default. It blocks the second path of a loop, and the Ports page shows that port as blocked."},"set-inform":{"t":"set-inform","d":"Device SSH command that tells a UniFi device where its Network host is, e.g. http://192.168.1.10:8080/inform."},"sonosnet":{"t":"SonosNet","d":"The speakers' own wireless network. It runs its own spanning tree you cannot configure, and a speaker that is wired and on SonosNet can bridge two wired segments into a loop."},"stp":{"t":"STP","d":"Spanning Tree Protocol. Switches find a second path between them and block it, so traffic cannot circle forever."},"stp-edge":{"t":"STP Edge","d":"Marks a port as a client port, where only end devices plug in. Pair it with BPDU Guard."},"stp-priority":{"t":"STP priority","d":"A number per switch. The lowest becomes the root bridge. Core 0, the next layer 4096, then add 4096 per layer."},"stun":{"t":"STUN","d":"UDP 3478 helper for remote adoption and remote management. Not the adoption path itself: adoption needs TCP 8080 to the Network host."},"super-encoding":{"t":"Super Encoding","d":"Makes each day of recording smaller."},"tagged-vlan-management":{"t":"Tagged VLAN Management","d":"Port setting for which VLANs ride tagged (802.1Q): Allow All, Block All, or Custom. Guest and IoT SSIDs need their VLANs tagged on the AP uplink."},"teleport-adoption":{"t":"Teleport Adoption","d":"Adopts a camera at another location to the NVR at the main house over the internet. No VPN, no port forwarding."},"third-party-pbx-mode":{"t":"Third-Party PBX mode","d":"G3 phone setup that registers the phone as a SIP phone with a SIP server, here UniFi Talk, instead of as a native Talk phone."},"trigger-level":{"t":"Trigger level","d":"Which contact state counts as active. Open active (NC) or close active (NO)."},"trunk":{"t":"Trunk","d":"A port carrying the Native VLAN plus tagged VLANs. The right setup from switch to AP, or switch to gateway, when there are several networks."},"unauthorized-opening":{"t":"Unauthorized Opening","d":"Access status when the door opens while it's locked."},"unifi-endpoint":{"t":"UniFi Endpoint","d":"The phone app path for Access calls. Remote Unlock via Endpoint turns unlock on or off for that path."},"ups":{"t":"UPS","d":"A battery box that keeps the rack powered through a power cut. Size it for the console, switches, PoE and the modem."},"wireless-meshing":{"t":"Wireless meshing","d":"AP setting that lets an AP uplink over the air to another AP. With every AP wired, a wired AP can bridge two segments by air. Turn it off if no APs are wirelessly adopted."},"z-wave":{"t":"Z-Wave","d":"A low-power home automation radio. Home Assistant reaches the deadbolt through a Z-Wave USB stick."},"zbf":{"t":"ZBF","d":"Zone-Based Firewall. Rules are set between zones, like Internal, External, Gateway and Hotspot, plus custom zones such as IoT."}}
✓
All steps
Tap a number
Side by side
lab label
Item
Start
Fixed
About this lab
The map
Gatewaythe way out to the internet, cabled to both switches
SW14 ports: uplink, WiFi 1, Cam 1 and Cam 2
SW2the garage switch, 8 ports, new
Door hubneeds one port
Garage camneeds one port
SW1: 4 of 4 ports in use, and the door hub is one cable too many.
This run: the garage add-on, with all three flags on the map.
Topology mapTopology map
3 flags
Goal: no flags
Switch 1 has all 4 ports in use, so the door hub has nowhere to plug in. The map flags it: no free port.
Gear in this lab
1 Gateway
2 Switches, SW1 and the garage switch
1 WiFi access point
3 Cameras
1 Door hub
Change on win: none yet
Counts only, no prices.
Takeaway
Every cable lit
Every device needs a cable into a free port, and every switch needs a cable up to the gateway.
A topology map shows this at a glance. A red cable means one of three things: no free port, no uplink, or a loose end. Count the ports before you add a device.
Count the ports first. One cable per device, plus one cable up for every switch. Add them up before you plug in the next device.
Move a device to a switch with a free port. If a switch is full, add a switch or move the device. Do not unplug something that works.
Cable every switch up to the gateway. A switch with no cable up is an island. Nothing on it reaches the network.
Plug every cable into a port and check the light. A cable with a loose end carries nothing. Walk the run and confirm the port lights up on the switch.
Networks with enough ports, and a map that has no red on it. We design, wire and set them up.
Camera shows offline because the cable is not plugged in
A teaching lab, not a quote and not a design for your site. The network is a sample, and the flag names follow the topology view we use on real jobs. The status lines are lab labels.