My recommended Ubiquiti layout for homes and small businesses: Cloud Gateway Fiber at the edge, a Pro XG 8 PoE at the core, dedicated 10GbE runs to demanding devices, and Flex 2.5G PoE switches for the rooms beyond. Add Pro XG expansion switches directly to the core as needed.
A Pro XG 8 PoE is the core. Add direct expansion branches only as needed.
Start here: connect the gateway's 10G SFP+ LAN directly to the primary Pro XG 8 PoE. It is the central switch for this home or small-business network. Connect APs, NAS devices, and Flex uplinks directly to it. If you need more ports or PoE capacity, attach additional Pro XG 8 PoE switches directly to the primary in parallel, not one expansion switch behind another.
INTERNET / WANFiber ISP & ONT
ISP-approved handoff; keep the ONT unless your provider supports a direct optical connection.
The primary Pro XG is the only central switch. Each endpoint or Flex has its own physical link; devices behind an expansion Pro XG share that switch's 10Gbps uplink to the primary. Additional expansion Pro XGs are sibling branches, not a chain or loop. The primary owns the selected VLAN gateways, while expansion switches carry those VLANs over Layer 2 trunks. More ports do not multiply Internet speed.
02 / THE RECOMMENDED GEAR
Four roles. One UniFi system.
Buy for the port and power requirements, not just the number on the box.
ROUTER / FIBER MODEL01 / 04
Cloud Gateway Fiber
UCG-Fiber
The Internet router and UniFi controller for this layout. Let the Pro XG handle configured local inter-VLAN routing so Cloud Gateway Fiber can concentrate on Internet routing, NAT, and WAN security rather than carrying local transfers. Two 10G SFP+ ports, one 10GbE RJ45 port, and four 2.5GbE RJ45 ports give it useful handoff options. WiFi comes from separate access points.
Keep WAN and LAN distinct For an optical WAN handoff, use one SFP+ for WAN and the other for LAN. For an ONT with Ethernet, use the 10GbE RJ45 WAN and an SFP+ LAN. Confirm port assignments in UniFi. The Fiber name does not make it a universal GPON/XGS-PON ONT replacement; ISP authentication and approved optics still matter.
The central switch, not just an access switch: eight multi-gigabit RJ45 ports supporting up to 10GbE and PoE++, plus two 10G SFP+ ports. Use one SFP+ for the gateway link and the second for an optional expansion Pro XG; further expansion switches can use 10GbE RJ45 ports. Every expansion link consumes a port on each switch. The included AC adapter provides a 155W total PoE budget, with up to 60W per port.
Layer 2 switches within VLANs; Layer 3 routes between them Pro XG 8 PoE supports both. Configure the primary Pro XG's Layer 3 VLAN interfaces to offload local inter-VLAN routing from Cloud Gateway Fiber, and enforce the relevant access rules on the switch. Layer 2 alone cannot do this. Another Pro XG 8 PoE suits a small desktop expansion; for a larger port or power shortfall, step up to a Pro XG 24 PoE or 48 PoE rather than multiplying small switches.
A tri-band WiFi 7 AP with a genuine 10GbE RJ45 uplink, PoE+ power, and 22W maximum consumption. Run each AP straight to a Pro XG copper port so its wired backhaul is not limited by a 2.5GbE edge port.
Use the XG model for a 10GbE run Do not assume every U7 has a 10GbE port. Put APs where coverage needs them, with wired backhaul rather than wireless mesh when cabling is possible. Determine count from floor plan, materials, and a site survey; advertised coverage is not a guarantee through walls.
A great fit for devices that do not support or need 10GbE: streaming boxes, smart TVs, game consoles, printers, cameras, and connected appliances. Eight 2.5GbE PoE++ downlink ports accommodate 1GbE and 100Mbps Ethernet devices too; each negotiates its supported speed, not an automatic upgrade to 2.5GbE. A direct 10GbE copper uplink from a Pro XG carries shared data and PoE++ power to the Flex. Ordinary non-PoE clients can still use their own power supplies.
Power source changes the usable budget A Pro XG's PoE++ feed gives the Flex a published 46W downstream budget, not 196W. PoE+ input provides 16W; PoE+++ input provides 76W. For up to 196W, buy the separate 210W AC adapter. RJ45 and SFP+ are alternatives for the single combo uplink, not two independent uplinks; SFP+ does not carry PoE power.
One compatible 10G SFP+ DAC for nearby equipment, or matched optical modules and fiber for longer runs. The Pro XG provides the central switching and configured local routing.
Small expansion without a rack
Primary Pro XG 8 PoE → additional Pro XG 8 PoE
Use the primary's remaining SFP+ port for the first expansion switch, or a 10GbE RJ45 link. Expansion switches attach directly to available primary 10GbE ports as parallel branches. Reserve ports for local clients and Flex uplinks; each expansion branch shares its 10Gbps link, and all Internet traffic shares the gateway link.
The logical larger upgrade keeps ports and power on one central switch instead of adding more small boxes and shared uplinks. These are full-width, 1U rack switches; plan rack depth, ventilation, power, and UPS capacity. A rack-sized Dream Machine becomes worth considering alongside them.
10GbE APs and clients
Dedicated solid-copper Cat6A runs
Plan for 10GBASE-T channels up to 100m including patch leads. Use properly terminated, tested cable; avoid copper-clad aluminum. NAS and workstation NICs must also support 10GbE.
Flex at the room edge
10GbE copper + PoE++, or SFP+ data + local AC
Use Flex ports for streaming boxes, TVs, and other sub-10GbE clients. Keep NAS devices and access points on the top-level switches, especially models with 10GbE uplinks. The eight 2.5GbE ports can total 20Gbps of demand into a shared 10Gbps uplink.
Power continuity
UPS for ONT, gateway, primary Pro XG, and expansion switches
A PoE-powered Flex follows its upstream switch's power. A locally powered Flex needs its own backed-up outlet if continuity matters.
Keep the topology loop-free: use one uplink per branch in this design. Do not add a second cable between switches as an improvised speed upgrade. Carry the required client and routing-transit VLANs on uplinks, assign endpoint port profiles, and enforce inter-VLAN restrictions where routing actually occurs: switch ACLs for switch-routed traffic, gateway firewall rules for gateway-routed traffic.
04 / VLANs, PRIVACY & LOCAL ROUTING
Share the wiring. Not the trust.
Separate personal computing from appliances. Route locally only with the right controls.
A VLAN creates a separate logical network on shared switches, cables, and access points. Your laptop and a smart TV can use the same Flex or AP without belonging to the same network. Assign wired ports to the appropriate VLAN and map WiFi networks to their intended VLANs; an AP's management network is separate from the client networks it carries.
Streaming boxes, TVs, voice assistants, and connected appliances may collect usage data, contact advertising or analytics services, or receive uneven security updates. Keeping them away from personal computers and private storage reduces local discovery and limits what an intrusive or compromised device can reach. A VLAN is not a privacy filter by itself: routed networks can still communicate unless firewall rules or ACLs restrict them, and segmentation does not stop a device sending its own telemetry to the Internet.
A practical starting separation policy
Network
Devices
Access to allow deliberately
Personal computing
Trusted laptops, desktops, phones, and tablets
Internet and required NAS services. Permit only the specific printer, casting, or appliance-control services you use across other VLANs.
Storage / servers
NAS, backups, and home servers on top-level switches
Only approved clients and service ports. Do not expose backup shares or administration interfaces to appliances or guests.
Appliances / media
Streaming boxes, smart TVs, and IoT devices, often on Flex switches
Required DNS, time, and Internet services. Block access to personal, storage, and management networks except narrowly defined necessities.
Guests
Visitors' devices
Internet access without private LAN access. Use client isolation too if guests should not reach each other.
Management
Gateway, switches, and AP management interfaces
Only designated administrator devices. Keep appliance and guest clients out of network administration.
Start with denied access between trust groups, then add the minimum service exceptions. Preserve required DHCP, DNS, and time services. Casting and discovery may need narrowly scoped mDNS forwarding plus the actual application ports; do not flatten the networks just to make discovery work. Devices within one VLAN can still communicate locally unless separate client-isolation controls prevent it.
VLANs reduce local exposure, but do not make appliances anonymous or stop vendor cloud collection. Review device privacy settings and use appropriate outbound firewall or DNS restrictions where practical; these can affect functionality and cannot reliably classify every encrypted connection as essential or telemetry.
Capacity where it helps. Limits where they matter.
This is a higher-performance home and small-business recommendation, not a claim that every network needs 10GbE or WiFi 7. Start with one Pro XG 8 PoE as the central switch and enough APs for measured coverage, then add direct Pro XG expansion branches and room switches only as needed.
The sources beside each pick are Ubiquiti's specifications and store pages. They distinguish physical link rates from routed throughput and PoE output from PoE input. Budgets are published ceilings, not promises under every cable length or operating condition. Independent site; not affiliated with or endorsed by Ubiquiti.
It Sparks Joy