Operator map / graphical redesign artifact

Network Web v2

Now it is the actual operator map instead of just a conceptual graph. Same core redesign, but with three extra layers: physical/topology intent, firewall-flow reasoning, and staged migration sequencing. Click nodes or switch modes to inspect where the pain is and what the end state should look like.

6 target VLANs Topology overlay Firewall flow layer 4-stage migration path Optional downstairs U6 LR
Topology layerShows the cabling/placement story: operator, gateway, switch fabric, APs, and where endpoints really hang.
Firewall layerShows allow, deny, and exception paths so policy intent is visible instead of implied.
Migration layerShows what moves first, what is annoying, and what can wait until the end.
Operator mapUse this to reason about design, staging, and “what breaks if I move this” before touching UniFi.
Operator / routing core Target VLANs and policy lanes Endpoints, legacy scar tissue, migration pressure, and future growth
Stage 1

Stop obvious sins

Move Protect chimes out of Management, stand up Camera VLAN 60, and make Management clean again.

Stage 2

Split infrastructure from life

Move PD, Serenity, Nomad, and Rocinante into Servers VLAN 30 so trusted clients stop sharing a lane with infrastructure.

Stage 3

Drain old IoT

Migrate ecobees, appliances, and low-drama devices first. Leave Google discovery weirdness for last inside IoT.

Stage 4

Refine radio and policy

Decide whether the downstairs U6 LR returns, clean up SSIDs, then tune firewall exceptions with evidence instead of superstition.

Topology interpretation

The UDM is routing brains, the USW is the practical center of gravity, and the APs are infrastructure nodes carrying policy-bound SSIDs. That means client traffic categories should be separated by VLAN intent, not by whatever happened to be easiest last year.

Firewall interpretation

Trusted gets explicit admin reach into Management and Servers. IoT and Cameras only get DNS/NTP/internet plus tightly scoped local-service exceptions. Guest gets nothing but internet. Old IoT gets a one-way ticket to deletion.

What this graph is saying now

  • Management is not a junk drawer.
  • Servers are infrastructure and deserve their own lane.
  • Cameras/security is a first-class lane because future growth is already obvious.
  • Migration difficulty lives mostly in discovery-heavy IoT, not in the easy appliances.

What changes first

  • Move chimes out of Management.
  • Create Camera VLAN 60 now.
  • Pull core servers out of Trusted.
  • Drain and kill Old IoT / VLAN 2.