Check the 6 GHz requirement before choosing UniFi PPSK for one-SSID VLAN assignment

UniFi PPSK maps passwords to VLANs, but its WPA2 requirement excludes 6 GHz operation.

Source facts

Ubiquiti documents UniFi Network PPSK as using different shared passwords on one SSID to determine a client’s VLAN. Individual usernames are not required for that method. The documented PPSK option is WPA2-only and therefore does not work on 6 GHz bands. RADIUS-assigned VLANs are a separate approach using user profiles and enterprise-capable authentication. For a client moving between PPSK VLANs, Ubiquiti describes forgetting the saved network and reconnecting with the appropriate new password. The VLANs must already be configured.

Source: Ubiquiti — PPSK and RADIUS VLANs.

Applicability

This applies to UniFi Network PPSK and the documented RADIUS alternative. Confirm the access-point, client, software, and radio requirements before choosing an authentication design for a production SSID.

DSE recommendation

DSE recommends deciding the required client population and radio bands before using PPSK to simplify SSID management. Document which password maps to which VLAN and who may distribute it. If 6 GHz is a requirement, review a supported alternative rather than assuming the PPSK network will use every radio. Keep the downstream VLAN access policy in the network design; choosing a VLAN by password is only one part of that policy. Provide support instructions for removing a saved password when a device legitimately changes VLAN.

Verification

Use test clients representative of the intended device classes. Verify their actual radio band, assigned VLAN, address, and permitted destinations for each test key. Exercise the documented saved-network change when moving between keys, and confirm that the design meets its band requirement before broad rollout.

Official reference

Ubiquiti — PPSK and RADIUS VLANs. Reviewed October 15, 2026.