Can a simple change in connectivity speed up rollouts and cut mistakes across multiple Singapore sites? We believe it can—and we will show how.
Site Magic turns repetitive tunnel work into a managed workflow. Instead of handcrafting each site-to-site vpn, we pick sites in the Unifi Site manager and connect them. This reduces configuration time and human error.
For multi-branch businesses in Singapore, the value is clear: predictable performance, central governance, and secure access to shared resources. The approach ties branches, HQ, data centers and the cloud without redesigning every tunnel.
We will explain what this managed model solves—and what it will not fix by itself (overlapping subnets, poor IP planning, or unclear ownership). We’ll preview topology choices—Mesh vs Hub & Spoke—and why topology shapes control, performance, and operations. By the end, decision-makers will see how proper setup of gateways and routing delivers faster rollouts and fewer misconfigurations.
Key Takeaways
- Site Magic simplifies multi-site connectivity and reduces manual vpn setup.
- The model supports branches, HQ, data centers and cloud without redesigning tunnels.
- Choose topology—Mesh or Hub & Spoke—to balance control and performance.
- SD-WAN reduces misconfigurations but requires good IP planning and ownership.
- We will cover prerequisites, topology selection, and security for confident deployment.
What You Need Before You Deploy UniFi Site Magic SD-WAN in Singapore
Before you flip the switch on Site Magic, confirm the account and network basics that keep deployments predictable. We focus on ownership, software baselines, and reachability so rollouts across Singapore sites run with fewer surprises.
Confirm UI Account ownership across all UniFi gateways and sites
You must be the UI Account owner for every participating unifi gateways and site. Without owner access, Site Magic cannot link devices—no exceptions. Verify each site is visible in the UniFi Site Manager and that we can change core settings centrally.
Verify minimum versions for present-day deployments
Use UniFi Network 9.0.108+ and gateway firmware 4.1.3+ as minimums. Matching controller and gateway versions avoids failures that look like network faults but are really software mismatches.
Plan for at least one public IP address and understand gateways behind NAT
At least one site needs a public address for initial reachability. We recommend more public-facing endpoints to boost resilience. Gateways behind NAT—branch ISP routers or upstream firewalls—change how connections form and how we troubleshoot them. Plan IP ranges so sites use unique subnets where possible to reduce later complexity.
- Checklist: owner confirmed, all sites visible, versions aligned, public address planned.
Choosing the Right ubiquiti sd wan Topology with Site Magic
Picking the right Site Magic topology sets how sites talk, how fast you deploy, and how simple operations stay.
Mesh topology works well for small multi-site setups. Each site builds direct vpns to peers so traffic can take the shortest path. This reduces transit delay and speeds rollout. Note scale limits—practical caps are commonly cited between 15 and 20 sites.
Hub & Spoke suits centralized control. Branches send traffic to one or more hubs for inspection, logging, and consistent policy. This model supports SNAT to handle subnet overlap and lets hubs manage outbound routes to cloud or data centers.
Trade-offs at a glance
- Scale: Mesh is simple but limited; Hub & Spoke scales better.
- Traffic: Mesh favors peer-to-peer flows; Hub & Spoke centralizes traffic for control.
- Failover: Hubs can keep multiple active tunnels; Mesh commonly uses single peer tunnels.
- Subnet overlap: Hub SNAT handles overlaps; Mesh requires careful IP planning.
| Characteristic | Mesh topology | Hub & Spoke | Best fit (example) |
|---|---|---|---|
| Primary benefit | Direct peer paths, low latency | Central control and inspection | Small branch network vs HQ-centric services |
| Scale | Up to ~15–20 sites | High—hubs add capacity | Distributed shops vs centralized offices |
| Subnet overlap | Limited tolerance | SNAT support | Unique subnets vs overlapping branch ranges |
| Routing behavior | Peer routes, direct shortest paths | Hub chooses routes, enforces policies | Local collaboration vs controlled access to cloud |
Routing uses OSPF and shortest-path selection to pick live routes automatically. We recommend monitoring and change control so path shifts don’t surprise operations.
How to Set Up Site Magic SD-WAN Mesh (Fastest Path to a Working VPN Mesh)
A quick, repeatable mesh setup lets teams connect sites reliably without redoing tunnels. We walk through the exact steps to create a working mesh, validate readiness, and lock down inter-site access with simple rules. Follow these actions from UniFi Site Manager to a validated, healthy fabric.
Start in UniFi Site Manager and create a Site Magic group
Open UniFi Site Manager, choose Site Magic SD‑WAN, then create a new site magic group. Name the magic group clearly for Singapore operations—this helps governance and audit trails.
Select sites and validate public-address readiness before connecting
Pick the participating unifi site entries and confirm gateways public ips. Ensure at least one gateway has a public address to bootstrap tunnels. Gateways public ips increase resilience and simplify troubleshooting.
Select networks and VLANs to include in the VPN mesh fabric
When you select networks, include only the subnets that must participate. Limit VLAN exposure to avoid accidental flat networking across branches. Use descriptive names so teams know what we include and why.
Check tunnel status, then adjust settings when adding sites or networks
Click Connect and wait for vpn tunnels to form. Confirm tunnel status shows healthy/green, then run reachability tests between intended networks.
To modify later, use the gear icon to change settings and re-validate tunnels. Repeat validation whenever we add a site or a network to prevent configuration drift.
Secure inter-site access with zone-based firewall policies for VPN traffic
Use zone-based firewall policies to control traffic. In the VPN zone, other gateways appear as peers—apply rules that match business intent.
| Task | Action | Acceptance test |
|---|---|---|
| Create magic group | UniFi Site Manager → Site Magic SD‑WAN → New group | Group listed and named in Site Manager |
| Select sites & validate IPs | Choose unifi site entries; confirm gateways public ips exist | At least one gateway public IP present; resilience plan documented |
| Select networks/VLANs | Pick only needed networks; exclude sensitive VLANs | Only intended networks reachable over vpn tunnels |
| Monitor tunnels & change control | Connect → verify green status → use gear icon to edit | All vpn tunnels healthy; reachability test passes |
Example firewall policy: “Block VPN to VLANs” — Source Zone: Internal, Destination Zone: VPN, Action: Block, IPv4, All protocols, Always. Document policies and apply them before full rollouts.
How to Configure Hub & Spoke Site Magic for Branch Offices, Data Centers, and Cloud
When branches must reach shared services or the cloud reliably, a hub-centric model is the practical choice. We use Hub & Spoke to centralize inspection, control outbound egress, and simplify policy for Singapore deployments.
Pick supported hub hardware and plan capacity
Choose a supported gateway as your hub. Models like Enterprise Fortress Gateway and UXG Enterprise scale to 1,000 vpn tunnels unifi. The udm pro max supports about 200 tunnels. UDM SE, udm pro, UXG-Pro and UDW typically handle ~100.
| Model | Vpn tunnels capacity | Best fit |
|---|---|---|
| Enterprise Fortress Gateway / UXG Enterprise | 1,000 | Large hub clusters, heavy traffic |
| UDM Pro Max | 200 | Medium HQ or cloud gateway |
| UDM SE / UDM Pro / UXG-Pro / UDW | 100 | Small HQ, branch aggregation |
Choose hub topology and redundancy
Pick single hub, failover hub pair, or custom per-spoke failover based on risk tolerance. For redundancy we map options to WAN reality:
- Failover — simple restart behavior when a link drops.
- 2 vpn tunnels — primary and secondary links when both sides have dual wan.
- 4 vpn tunnels — maximum resilience with independent WAN-to-WAN paths.
Control access, routing, and overlapping subnets
Define hub networks, enforce route selection at the hub, and use “isolate spokes” to reduce lateral traffic. When branches share IP ranges, enable SNAT at the hub to avoid costly renumbering during mergers or rapid rollouts.
Integrate cloud gateways and validate routes
Cloud gateways (including AWS examples) can terminate IPsec at the hub. We validate that routes advertise into the Site Magic fabric—community reports show some site vpn tunnels may appear greyed out if participation is not fully supported. Always confirm participation in Site Magic rather than relying solely on static routes.
Governance note: Document hub hardware, gateway roles, networks, routes, firewall intent, and redundancy settings. This keeps the hub spoke design supportable as branches scale.
Conclusion
Site Magic gives teams a repeatable way to link sites fast while keeping policy and audit controls intact.
We see it as an operational shortcut: with the right ownership, versions, and public-IP planning, Site Magic SD‑WAN connects networks faster than manual VPN builds and cuts configuration errors.
Choose mesh topology for small, collaboration-heavy setups. Choose Hub & Spoke when you need scale, SNAT for overlaps, and strict governance. Validate firewall intent and document routes before rollout.
Security and change control make the difference — we do not rely on defaults. Validate network selection, apply zone policies, and expand resources methodically with traceable change procedures.
For release details and high-availability features that support resilient gateways and failover, see the Site Magic SD-WAN notes.
FAQ
What prerequisites do we need before deploying UniFi Site Magic SD-WAN in Singapore?
We need verified UniFi Cloud accounts that own every UniFi gateway and site, confirmed device software meets minimum supported versions, and at least one public IP address per gateway or a clear plan for gateways behind NAT. Also prepare site inventory, VLAN mappings, and admin access to the UniFi Site Manager so deployments proceed without delays.
How do we confirm UI account ownership across all UniFi gateways and sites?
Sign in to the UniFi Cloud portal, check each gateway is listed under the same organization, and verify site ownership by viewing device details. If devices appear under different accounts, transfer ownership or invite the owning account to the organization. Clear ownership avoids provisioning and tunnel-establishment failures.
Which minimum software versions should we verify for present-day deployments?
Check controller, gateway, and security appliance firmware against the vendor’s current compatibility matrix. We recommend staying on the latest stable controller release and ensuring gateway firmware supports Site Magic features—this prevents VPN handshake issues and improves tunnel reliability.
Do we need a public IP for each gateway, and what about gateways behind NAT?
Ideally, each gateway has at least one public IPv4 address for straightforward tunnel origination. Gateways behind NAT can still participate—make sure NAT-PMP/UPnP or static port forwarding is configured, and validate that NAT traversal settings are enabled to maintain stable tunnels.
When should we choose a mesh topology for Site Magic?
Choose mesh for smaller multi-site deployments where peer-to-peer traffic is common and you want direct paths between sites. Mesh minimizes latency for inter-branch traffic but can become complex to scale and manage as sites grow.
When is a hub & spoke topology the better option?
Use hub & spoke when you require centralized policy enforcement, integration with data centers or cloud providers, or easier routing control. It simplifies monitoring and security at the hub but can introduce suboptimal paths for branch-to-branch traffic unless hub routing policies are optimized.
What are the key trade-offs between mesh and hub & spoke?
Mesh offers direct paths and lower latency for peer traffic but scales poorly and complicates route selection. Hub & spoke centralizes control and scales more predictably but can increase hop count and bandwidth through the hub. Consider failover behavior, subnet overlap risks, and device tunnel capacity when choosing.
How does routing work in practice with OSPF and shortest-path selection?
OSPF (where supported) advertises networks and calculates shortest paths based on link costs. Site Magic uses route selection to forward traffic via the most efficient tunnel. For deterministic behavior, adjust metrics and use static routes for critical prefixes or to bias traffic through preferred links.
How do we start building a Site Magic mesh quickly?
Begin in the UniFi Site Manager—create a Site Magic group, add participating sites, and ensure each gateway has a verified public address. Select the networks and VLANs to include, enable mesh fabric, and monitor tunnel establishment. Validate connectivity and then tighten access with firewall policies.
What networks and VLANs should we include in the VPN mesh fabric?
Include the subnets that require inter-site access—typically branch LANs, server VLANs, and any management networks. Avoid including guest or public VLANs unless necessary. Document each included network to prevent accidental exposure and to simplify firewall rules.
How do we check tunnel status and troubleshoot when adding sites or networks?
Use the UniFi dashboard to view tunnel health, latency, and packet loss. Check logs on gateways for TLS negotiation or NAT traversal failures. Confirm routing tables and firewall rules at each site. For persistent problems, verify firmware compatibility and public-address reachability.
How should we secure inter-site access for VPN traffic?
Apply zone-based firewall policies to restrict which networks and services traverse the VPN. Enforce least privilege—allow only required ports and protocols. Use VLAN segmentation and monitor flows to detect anomalies. Regular audits keep policies aligned with business needs.
Which hub hardware models are supported and how do we estimate tunnel capacity?
Consult the hardware compatibility list for supported gateway models and their tunnel throughput limits. Higher-end models such as the UDM Pro or gateway appliances handle more concurrent tunnels and higher encrypted throughput. Match model selection to expected site count and bandwidth needs.
How do we design hub topology: single hub, failover, or custom per-spoke?
Single hub suits small deployments. Add a failover hub for resilience—ensure route and health checks switch traffic automatically. For large or security-sensitive environments, use custom per-spoke designs to segregate traffic and apply distinct routing or inspection at each hub.
What redundancy levels should we set for VPN tunnels?
Redundancy depends on available WAN links—use multiple tunnels across diverse uplinks for critical spokes. Configure health probes and automatic failover so traffic shifts when a primary path degrades. Balance redundancy with the hub’s tunnel capacity and management overhead.
How do we control access with hub networks, route selection, and spoke isolation?
Define hub networks to centralize shared services, use route policies or static routes to steer traffic, and apply spoke isolation to prevent lateral movement between branches. Combine network segmentation with firewall rules to enforce access boundaries.
How do we handle overlapping subnets between sites?
When IP ranges overlap, implement SNAT at the hub or specific spokes to translate addresses and avoid collisions. Alternatively, re-IP networks where practical. Document any translations to maintain accurate routing and firewall configurations.
Can we integrate third-party cloud connections like AWS, and what gaps should we avoid?
Yes—connect cloud VPCs by establishing site-to-cloud VPNs or using supported transit gateways. Ensure route propagation, security group rules, and NAT behavior align with on-prem routing. Avoid missing static routes or improper NAT that can block cross-cloud or on-prem traffic.
Are USG-family gateways supported for Site Magic and VPN tunnels?
Some legacy USG models support basic VPN features but may lack full Site Magic capabilities or have limited tunnel and throughput capacity. Verify model-level support and, where necessary, plan phased upgrades to newer gateway hardware for robust performance.
What are common causes when VPN tunnels between UniFi gateways fail to establish?
Typical causes include mismatched firmware, incorrect public IP or NAT settings, blocked ports for tunnel negotiation, and misconfigured routing or firewall rules. Check logs for TLS or IKE errors, validate public-address reachability, and confirm controller settings match on both ends.
How do we monitor and maintain a Site Magic fabric over time?
Use centralized monitoring in the cloud controller to track tunnel health, throughput, and device status. Schedule firmware updates, run periodic configuration audits, and review firewall and routing policies after topology changes. Proactive alerts reduce downtime and preserve performance.