unify with AI
Open your dashboard ↗
A CLEAR FIRST ASSESSMENT

Understand your network.
Start with a safe read.

Connect UniFi, let Unify discover its configuration, and review what the evidence shows. Assessment requests only read settings. They never apply firewall, Wi-Fi or network changes.

Already connected on this Mac?

Reuse the existing secure local connection. You do not need to find or paste its permanent key.

Connecting another environment?

Use an official Site Manager API key and console ID with a compatible Cloud Connector.

1. Use your existing connection

  1. Open Unify and sign in.Use the workspace login created for this private pilot. If you are already signed in, keep that session.
  2. Select Connect UniFi.Give the environment a name you recognize, such as “Home”.
  3. Choose “Existing UniFi connection on this Mac”.This option reuses the configured Keychain credential and stored controller certificate. Keep the local connection helper running. The UniFi key is not shown in the browser.
  4. Select Connect & assess.Unify retrieves the available sites, network details, Wi-Fi settings, devices, firewall zones, policy inventory and ordering.
  5. Open Networks.Review each network’s VLAN, zone, Wi-Fi assignment and configured connection directions. Expand a firewall row to see the policy evidence.

You do not need to know your guest/IoT network mapping before you start. Unify discovers explicit controller settings and shows uncertain labels separately.

2. Connect through UniFi Cloud Connector

For operation entirely in Cloudflare, use unifi.fw.ms and a dedicated UniFi Site Manager cloud API key. The cloud app does not depend on the Mac or reuse its local-only credential.

  1. Open UniFi Site Manager.Sign in at unifi.ui.com using an account that owns or can access the intended console.
  2. Check compatibility.Cloud Connector requires console firmware 5.0.3 or later. The available Network endpoints also depend on the installed Network application version. In UniFi Network, open Integrations for documentation matching that installation.
  3. Create a dedicated API key.In Site Manager, open Settings → API Keys. Use the least privileged account supported by your console. Do not use a local-only Network API key for the cloud route. Never paste a key into chat, screenshots or reports.
  4. Find the console ID, rather than the site ID.The official Site Manager API documentation lists consoles through the read-only GET /v1/hosts endpoint. Use the returned host ID for the intended console. If you only have a local connection, choose the existing Mac route instead; opening inbound ports is not required.
  5. Enter the name, console ID and API key in Unify.Select UniFi Cloud Connector, then Connect & assess. The key is encrypted server-side and is never displayed again.

A key’s broader permissions are determined by UniFi. Unify’s assessment adapter itself issues GET requests only. The hosted pilot at unifi.fw.ms uses approved-account sign-in on our own branded page. Microsoft and Google require a configured, linked provider account. Public self-registration is not enabled.

3. Find guest and IoT configuration

  1. Start with the Networks view in Unify.Read discovered VLANs, zones and explicit Wi-Fi assignments. “Native/AP network” means the API did not give a specific network ID; it is not silently treated as VLAN 1.
  2. Inspect the guest evidence.An explicit captive-portal configuration linked to a network can establish configured guest intent. A name containing “Guest” is a hint, not proof. No identified guest configuration does not establish that no guest devices connect.
  3. Inspect the IoT evidence.An explicit IoT-optimized Wi-Fi configuration linked to a network establishes configured intent. Network and zone labels can suggest a candidate. The boundary matrix shows what that network’s policies allow even when device placement is uncertain.
  4. Compare the source configuration if more detail is needed.In UniFi Network, read Settings → Networks and Settings → WiFi. Open each relevant network/SSID and inspect its assigned network, guest/hotspot settings and client-isolation settings. Menu names may vary by application version. Do not press Save, Apply, Update or Restart during this review.
  5. Read both traffic directions.Trusted → IoT may be allowed while IoT → Trusted blocks new connections. Allowing established return traffic does not mean an IoT client can start a new connection.

4. Get the evidence for every check

A high score with low coverage is a partial result. PASS describes the named control and its stated scope, not a certification of the whole network.

Firewall and actual isolation
  1. Open Networks and expand the relevant source → destination direction.
  2. Review both IPv4 and IPv6, policy order and the terminal action. Unify does not assume a block when data or an implicit default is missing.
  3. Conditional MAC/IP/port rules, schedules or ambiguous ordering can prevent a full verdict. Read the corresponding policy in UniFi’s Policy Engine / Zones view.
  4. Configuration analysis does not prove physical reachability, same-segment isolation or all client placement. A future authorized probe from the relevant network would be separate evidence; this sprint does not run traffic probes.
Administrator accounts and MFA
  1. In UniFi Site Manager, select the console and read its Admins / administrator-management view.
  2. Review each account’s role and whether access is still needed. Distinguish UI accounts from local-only accounts.
  3. Use the account’s security/MFA view to inspect MFA status. Do not share passwords, recovery codes or MFA secrets.
  4. The Network API used here does not expose a complete administrator/MFA inventory. That is why successful network reads do not establish administrator protection. This guide does not change roles or MFA.

Official administrator guide · Official MFA guide

Remote management and WAN exposure
  1. Read Settings → Control Plane → Console and inspect Remote Management.
  2. Review WAN-to-gateway policies and port-forwarding/NAT settings in the controller. A working outbound cloud connection is not proof that no inbound service is exposed.
  3. Record the relevant setting and scope; do not enable remote management, open a port, disable a firewall rule or change a certificate to complete this assessment.
  4. The current Network API does not provide every console/forwarding setting needed for a comprehensive remote-exposure verdict. External scanning is not part of this sprint.

Official location of the remote-management setting

Firmware and available updates
  1. Open UniFi Devices and inspect installed versions and the controller’s available-update indication for each device.
  2. Confirm the selected release channel and applicable available version. An installed version alone cannot establish that a device is current.
  3. Unify shows installed versions and the API’s firmware-updatable flag where available. It does not treat an undocumented flag as a comprehensive release/CVE check.
  4. This review does not click Update, schedule an upgrade or reboot a device.
Wireless network references
  1. Open the SSID in UniFi WiFi settings and inspect its network assignment.
  2. For native/AP assignments, inspect the AP’s uplink/native network and the corresponding switch-port network configuration.
  3. The API’s explicit network IDs can be checked automatically. If a native VLAN association is not exposed, Unify keeps it unverified instead of inventing a match.

5. Review settings and the 200 test plans

  1. Open Settings in Unify.Search for a setting, network or device. Expand a row for its current value, source, decision and reasoning. Use the decision filter and Show 100 more settings to inspect the remaining rows.
  2. Read each decision in scope.APPROPRIATE means the stated criterion is supported, not that the entire network is secure. OBSERVED STATE describes device status. POLICY CONTEXT is interpreted through the ordered firewall matrix. CONTEXT REQUIRED identifies a dependency or purpose that needs evidence. PROTECTED VALUE keeps secrets and addresses at the source.
  3. Inspect Collection coverage.LIMITED distinguishes descriptor-only API lists, collection limits and omitted detail reads. A list of two WAN names is not a complete WAN settings audit. The source-gap section names missing account, console and global configuration.
  4. Open 200 controls.Search or filter by domain. Every plan includes a concrete test method, required data, applicability and primary reference guidance. Ten plans link to the existing assessment engine; the other definitions are not represented as executed tests or added to the score.
  5. Read additional configuration at its source.For switch ports, open UniFi Devices → switch → Ports; for global switching, Networks / Switch Settings; for WAN/NAT/UPnP, Internet and policy views; for backups and update channels, Control Plane. Names vary by version. Inspect without saving changes. This version does not import account evidence or support archives.

Correctness can depend on device compatibility and required services. mDNS, roaming, radio power, PoE and flow control do not have a universal secure on/off value.

6. If connection or collection fails

Authentication or permission denied

Check that the key belongs to the selected connection method, is active and can access the intended console. Do not send the key to support or paste it into a report. A permission error is not an empty, secure network.

The Mac connection is unavailable

Make sure the local helper is running and the Mac is on the same physical LAN as the saved controller. A changed controller certificate or blocked Keychain reader needs the established local owner recovery flow. Do not bypass TLS warnings or broaden Keychain permissions as a shortcut.

A capability is unsupported

Read the reason shown in the network matrix and compare the installed Network version’s Integrations documentation. Other available controls can still be evaluated. Missing evidence never counts as a pass.

An assessment is running or cooling down

Wait at least one minute after a scan before starting another. After an interrupted scan, its short lease must expire. This protects the console from overlapping requests.