UniFi-SonicWall VLAN Configuration

I want my UniFi switches and access points to pass three clearly separated VLANs—staff, guest Wi-Fi, and office devices—through to a SonicWall firewall. The end goal is for staff and office devices to communicate as normal, while anyone on the guest Wi-Fi SSID sees nothing but the open internet; no visibility or reachability to staff workstations, servers, printers, or any other internal resources.

Current gear: several UniFi 8- and 24-port PoE switches, a mix of UniFi UAP AC access points, and a SonicWall TZ series firewall already in place. Firmware on everything is current, and the UniFi Controller is cloud-hosted.

Scope of work
• Define VLAN IDs for staff, guest, and office devices inside UniFi Controller and on the SonicWall.
• Tag and trunk the appropriate switch ports, then assign the wireless SSIDs to the correct VLANs.
• Build matching sub-interfaces/routing rules on the SonicWall, including DHCP scopes.
• Apply SonicWall firewall rules to ensure the guest network is restricted to “Internet only, no LAN.”
• Verify end-to-end: devices in each VLAN receive correct IPs, can access intended resources, and cannot cross into other VLANs.
• Provide a short hand-off document outlining the final topology, VLAN IDs, and any core rules you created.

I will supply remote access to the UniFi Controller and SonicWall management interface. Once the VLAN segregation and guest isolation test cleanly, the job is done.