8 ms·

Fine, I'll say it: Ubiquiti is not suitable for a business environment. They don't have a good track record of pushing out security fixes. They've blatantly v

Fine, I'll say it: Ubiquiti is not suitable for a business environment. They don't have a good track record of pushing out security fixes. They've blatantly violated the GPL (and introduced security vulns in the process). Their "enterprise" features don't work well (e.g. hardware acceleration, WPA+Radius). Depending on what you buy the PoE may be non-standard passive or it may not. Unfortunately because they're primarily in the business of slapping a slick web interface on Vyatta they don't have the skill required to debug the hardware acceleration. They don't have a single clue how to get RADIUS to work with their fork of Vyatta. And their support is fine for a home lab situation. And let's not speak of the chronically overheating stuff.

metildaa 8y ago
Note that nearly all of Ubiquiti's offerings are running modified OpenWRT, with a handful running a fork of VyOS which happens to be Debian plus some packages.
- inferiorhuman 8y ago
  > Note that nearly all of Ubiquiti's offerings are running modified OpenWRT, with a handful running a fork of VyOS which happens to be Debian plus some packages. EdgeOS is a Vyatta fork. Has Ubnt abandoned EdgeOS? It's been a few months since I've looked, but the version of Debian that's being used was end-of-lifed on MIPSLE hardware a while back so security updates are entirely incumbent upon Ubnt. There is no upstream support. Which offerings are on OpenWRT?
  - tmottabr 8y ago
    The next version of EdgeOS , 2.0 that is currently in alpha, was rebased to Strech so this should be fixed soon enough. Their Unifi APs have option of a LEDE based firmware option, but think it is just beta at the moment. You can choose between the LEDE version and the regular version.
    - inferiorhuman 8y ago
      On the one hand it's good they're updating to a supported version of Debian. On the other, how is it still in alpha? Wheezy was EOL'd on all architectures in May.
  - metildaa 8y ago
    All of their wireless gear is OpenWRT based, EdgeOS is only used on the switching hardware. Their wireless gear has been mmuch more popular and has significantly more variety than the switches/routers Ubiquiti offers.
auxym 8y ago
I've always so far heard a lot of good for ubiquiti on HN. What would you suggest instead?
walterbell 8y ago
Which network vendor has better security updates? Can you point to a specific example of them not fixing a security issue that was addresssd by others? How would you compare Microtik to Ubiquiti?
- inferiorhuman 8y ago
  > Which network vendor has better security updates? I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc) > Can you point to a specific example of them not fixing a security issue that was addresssd by others? I haven't looked recently, but when I last updated my ER-X I noticed that the latest available packages included a large number that were not up-to-date with the latest available security fixes. One of the problems is that the version of Debian that the hardware (MIPS) Ubnt uses is end-of-lifed on the old version of Debian that EdgeOS is based on. Where most vendors could simply track the official Debian repositories, Ubnt is stuck rolling their own packages. If Ubnt has finally moved on to an officially supported version of Debian then this is less of an issue. This is one of those I wish I had a better solution moments. For the home user this may not pose a challenge, but in a business environment I'd say that it's probably worth spending the big bucks on a vendor with a better track record. That's not to say there aren't other bad vendors, but it is to say that Ubnt gear does not belong outside of a home lab. I haven't evaluated Mikrotek because the Ubnt stuff works well enough (but certainly not great) for me in the two locations I've got it deployed.
  - walterbell 8y ago
    Cisco has not been having a good year, https://www.bleepingcomputer.com/news/security/hardcoded-password-found-in-cisco-enterprise-software-again/ https://www.bleepingcomputer.com/news/security/hardcoded-pas... Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.
    - twunde 8y ago
      This is actually good news. Cisco has been doing real security audits, where they go through the source code with a fine tooth comb and look for hidden backdoors. And even better they're actually telling us about them instead of turning them off silently. You can bet that a significant number of competitors have similar issues with backdoors. This is a case where a vendor is actively looking for security problems and putting in place processes to prevent them vs the normal vendors who just respond to security reports.
deleted 8y ago
[deleted]
dogecoinbase 8y ago
_Thank you_. I'm constantly astonished to see folks extolling UBNT gear for anything other than WISP purposes (where it admittedly fits a price profile that's unmatchable). Read about the first ~10 months of the ES16-XG DAC support issues. Read about how EdgeRouters could never approach even 40% of line rate with fq_codel running. Read about how they lied about the future of the mFi line for 8+ months before abandoning it entirely. Not to mention the GPL stuff you note, the inconsistent and semi-nonfunctional PoE, and general lack of support or consistency. At some level, you really do get what you pay for. They are great for people who want to set up a "homelab" without learning anything about actual networking, though.
- tacoman 8y ago
  Or $1000 switches that fail outside of warranty with no replacement power supplies available. https://community.ubnt.com/t5/UniFi-Routing-Switching/Failed-US-24-500W-13-months-of-use-repair-options/m-p/1578936#M15540 https://community.ubnt.com/t5/UniFi-Routing-Switching/Failed...
- Serow225 8y ago
  Whats the better alternative to fit the needs of a shoestring startup (say 5-10devs)?
  - benjaminl 8y ago
    I have had good experience with MikroTik products. The are at a similar price point, but with a less refined interface but a lot more flexibility.
    - jtl999 8y ago
      Mikrotik suffer from a gross amount of "Not invented here" reinventing existing open source protocols such as OpenVPN, a custom sshd and web server, and it shows with their amount of issues (how many years has it taken to add UDP to their OpenVPN server?). In some ways I think their no better then UBNT in some ways. Tell you what. I used to have a Mikrotik CRS125 switch in my home office, and by default if you have a set of ports where one has no VLAN assigned, and the others have untagged VLAN assignmnets, any broadcast traffic on the untagged port(s) without a VLAN leaks to the ports with an untagged VLAN. This isn't well documented in the manual, and to fix it you either disable "Invalid VLAN Forwarding" (I think) and/or move said ports without a VLAN to a VLAN.
myrandomcomment 8y ago
I have run it at 2 startups and it works great. Current startup is all Unfi stuff including 3 switches and 8 APs for with around ~150 devices connected to Wifi. We use RADIUS just fine for auth for the users. No issues at all. We do not use their firewalls, we use PFSense. I do use a USG at home with no issues.
- inferiorhuman 8y ago
  RADIUS support is a well known issue. In my case it works better with some Apple hardware than others. Conversely, the Cisco gear at megacorp has never given me any authentication problems. https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AC-AP-issues-with-WPA2-Enterprise-with-RADIUS/td-p/522891 https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AC-AP-iss...
detaro 8y ago
Really depends IMHO, at least when it comes to the APs. Yes, it's not enterprise-grade, but their APs are also way cheaper than anything enterprise and do the basics well enough. Average small business office use doesn't require much in the way of features, although how long various RADIUS features took was a bit embarrassing (I seem to remember putting clients in different, RADIUS-controlled VLANs wasn't possible for a long time). Never really trusted their other product lines.
- rayiner 8y ago
  How much does the price difference really matter? An Ubiquiti AC HD is $300. You can get an equivalent Ruckus AP (R710) for about $815. In a small office, that might add up to a couple of thousand dollars extra for APs. That's like a week's rent for a Bay Area office.
petecooper 8y ago
>And let's not speak of the chronically overheating stuff. Some-time wireless installer here, I bring a snippet of anecdata. A recent client had the full Unifi experience for an outdoor network, including 3x EdgeSwitch XP (formerly known as ToughSwitch) in a single IP65-rated, largely airtight enclosure. The network would go offline on summer afternoons. It was overheating, those models run hot and are not recommended for low ventilation areas, but they weren't convinced. I fitted a thermometer, went back three days later and checked the logs. The temperature peaked at 143 Celsius.
- tnorthcutt 8y ago
  143 Celsius??? That's 289.4 Fahrenheit, which I find difficult to believe. Not impossible... just difficult. That's quite impressive.
  - hirsin 8y ago
    The heat problems are real. I mounted one to the underside of a cabinet, and it melted the plastic lining on the opposite side of the wood. They run extremely hot.
  - inferiorhuman 8y ago
    If memory serves the ER-L idles at around 40C exterior temp. That was the primary reason I went with the ER-X despite hooking it up to a gigabit uplink.
  - bscphil 8y ago
    In fact if it was actually reaching 143 C, I'd say that ironically I'm more positively impressed by the fact the hardware works at all at that temperature than I am negatively surprised by the fact that its thermal controls are that bad.
  - petecooper 8y ago
    For completeness, that was when the summer sun was shining directly on the enclosure in the hottest part of the day, during a country-wide hot spell. Still, no airflow, heat generation, etc. Every day, cut out. When it cooled down, it worked again. This continued for about two months, then they failed.
Johnny555 8y ago
Ubiquiti is not suitable for a business environment I'd say that Ubiquiti is perfectly suited for a small business environment -- definitely a big step up from discrete consumer Asus routers throughout the office with no central management (and probably haven't been patched since the day they were installed). Ubiquiti may not be suitable for a mid to large sized business, but for up to a ~100 person office or so, they come in at a great price point and have decent performance and manageability.
- gruez 8y ago
  Asus-Merlin firmware is regularly patched and is available on many models
  - Johnny555 8y ago
    But can you easily roll out that new firmware to 20 Wifi nodes spread over 3 offices in 3 different cities? Just because patches are available, doesn't mean that someone's going to take the time to apply them. Having a central management console makes this much easier. Upgrade one node, make sure it works, then roll out to the rest of the nodes one by one with one click.
triviatise 8y ago
I loved the ubiquiti stuff for years. Then one day two years ago macs suddenly could no longer reliably connect to the outside world even with a strong wifi connection to the AP. I would send pings and have 40% packet loss. Weirdly I could ssh into any of the APs and ping with 0% packet loss. We could never fix it and switched over to google appliances. We rarely have over 20 people in the office.
spudlyo 8y ago
I've heard great things about Ubiquiti's products, so I recently evaluated both their USG security gateway and EdgeRouter4 products using only wired gigabit ethernet. I found it weird that the UniFi line of products and the EdgeMAX line of products while very similar in terms of specs and their target markets, use completely different remote management systems (UniFi vs. UMNS). While some really folks like their management GUI, I found that once you wanted to do anything not bog standard with it, you were on your own. I had to SSH into both devices and enter EdgeOS (Vyatta) commands for even relatively simple things like disabling NAT on the ER4 or configuring mutual TLS with OpenVPN. With IpSec there are so many different possible parameters that the GUI just didn't have enough widgets to cover them all. I found the USG security gateway too underpowered for my purposes. I wanted a device I could use for IDS/IDP as well as a dedicated VPN. With hardware offloading disabled (which you need for IDS/IDP) the throughput of the USG is limited to around 130 Mbps. Using IpSec on the USG (ESP:AES-128-SHA1) I was able send (encrypt) data at 70 Mbps and 56 Mbps on receive (decrypt). Don't even think about using OpenVPN with this device, as it's single-threaded and can't take advantage of any crypto offload -- only managing around 14 Mbps of throughput. If you are using the USG for a VPN you can get much better performance with WireGuard. I managed to get 90 Mbps encrypt, 111 Mbps decrypt with it, which is likely good enough for a lot of folks. The EdgeRouter4 was faster, but it had a weird issue with IpSec. I was able to get it to encrypt at 631 Mbps, but only decrypt at 229 Mbps. On encrypt (send) I could see that the CPU was 376% utilized (it has 4 cores) with most of that spent dealing with software interrupts. On decrypt (receive) it only 167% utilized -- so something was wrong there. The EdgeRouter4's OpenVPN single core performance was more than 3x faster than the USG, clocking in at 43 Mbps, and best with WireGuard at 636/597 Mbps encrypt/decrypt. I used iperf3 on a remote host on my simulated WAN for measuring throughput like: iperf3 -c host_behind_router -P4 -t120 # decrypt iperf3 -c host_behind_router -P4 -R -t120 # encrypt Ultimately I found the whole dance of having devices being adopted by the controller software and then being provisioned by it to be tedious and unnecessarily faffy -- especially considering how often I had to drop into EdgeOS to get things done.
- basch 8y ago
  You were using the $100 USG? https://unifi-xg.ubnt.com/usg-xg-8 https://unifi-xg.ubnt.com/usg-xg-8 https://www.ubnt.com/unifi-routing/unifi-security-gateway-pro-4/ https://www.ubnt.com/unifi-routing/unifi-security-gateway-pr...
jdiaz5513 8y ago
Yup. The network engineer in me would never recommend Ubiquiti for any scenario. Maybe it works for WISP because of the price point; I'd have to be convinced. They run an embedded Mongo DB on their UniFi hardware that (at least in the deployment I've inherited) requires occasional direct interventions[1] to keep running. That's just one example of the many baffling/wrong things they do. I know Mongo gets quite a bit of undeserved hate, but it really just doesn't seem suitable for this use case. [1] https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-SDN-Identifying-Database-Issues-on-the-Cloud-Key https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-S...
- kryogen1c 8y ago
  My IT MSP solely sells and supports unifi WAPs, and I have no idea what you're talking about. We have dozens of WAPs under management across the city and state, and I've never seen any of the issues you guys are talking about. We don't have issues with database crashing or overheating. The wap controllers are configurable for automatic firmware updating, so I don't know what the issue is with patching. They definitely support wpa-e/radius because I've configured it and we use it in my my office. A personal goal of mine is to buy a unifi wap and a modem (already have a router and firewall) and divorce from ISP equipment altogether. Then I can start posting on /r/homelab :)
  - Grazester 8y ago
    I have an office with a few of those and they are not great and do overheat. I am quite surprised you having been exposed to a great number of them never had an issue.
    - kryogen1c 8y ago
      They have a lot of models and we usually sell ac-pros and ac-lrs. Maybe there are issues with higher/lower grade versions...
      - ShouldBeWorkng 8y ago
jamescampbell 8y ago
Sources for all of these claims? I have and recommend their products wholeheartedly. This isnt something that is opinionated. Their pro products are amazing. Maybe you are referencing outdated or consumer level product offerings? Giving you benefit of the doubt and just going to say, right and roll my eyes.

metildaa 8y ago

Note that nearly all of Ubiquiti's offerings are running modified OpenWRT, with a handful running a fork of VyOS which happens to be Debian plus some packages.

inferiorhuman 8y ago
> Note that nearly all of Ubiquiti's offerings are running modified OpenWRT, with a handful running a fork of VyOS which happens to be Debian plus some packages. EdgeOS is a Vyatta fork. Has Ubnt abandoned EdgeOS? It's been a few months since I've looked, but the version of Debian that's being used was end-of-lifed on MIPSLE hardware a while back so security updates are entirely incumbent upon Ubnt. There is no upstream support. Which offerings are on OpenWRT?
- tmottabr 8y ago
  The next version of EdgeOS , 2.0 that is currently in alpha, was rebased to Strech so this should be fixed soon enough. Their Unifi APs have option of a LEDE based firmware option, but think it is just beta at the moment. You can choose between the LEDE version and the regular version.
  - inferiorhuman 8y ago
    On the one hand it's good they're updating to a supported version of Debian. On the other, how is it still in alpha? Wheezy was EOL'd on all architectures in May.
- metildaa 8y ago
  All of their wireless gear is OpenWRT based, EdgeOS is only used on the switching hardware. Their wireless gear has been mmuch more popular and has significantly more variety than the switches/routers Ubiquiti offers.

auxym 8y ago

I've always so far heard a lot of good for ubiquiti on HN. What would you suggest instead?

walterbell 8y ago

Which network vendor has better security updates? Can you point to a specific example of them not fixing a security issue that was addresssd by others? How would you compare Microtik to Ubiquiti?

inferiorhuman 8y ago
> Which network vendor has better security updates? I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc) > Can you point to a specific example of them not fixing a security issue that was addresssd by others? I haven't looked recently, but when I last updated my ER-X I noticed that the latest available packages included a large number that were not up-to-date with the latest available security fixes. One of the problems is that the version of Debian that the hardware (MIPS) Ubnt uses is end-of-lifed on the old version of Debian that EdgeOS is based on. Where most vendors could simply track the official Debian repositories, Ubnt is stuck rolling their own packages. If Ubnt has finally moved on to an officially supported version of Debian then this is less of an issue. This is one of those I wish I had a better solution moments. For the home user this may not pose a challenge, but in a business environment I'd say that it's probably worth spending the big bucks on a vendor with a better track record. That's not to say there aren't other bad vendors, but it is to say that Ubnt gear does not belong outside of a home lab. I haven't evaluated Mikrotek because the Ubnt stuff works well enough (but certainly not great) for me in the two locations I've got it deployed.
- walterbell 8y ago
  Cisco has not been having a good year, https://www.bleepingcomputer.com/news/security/hardcoded-password-found-in-cisco-enterprise-software-again/ https://www.bleepingcomputer.com/news/security/hardcoded-pas... Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.
  - twunde 8y ago
    This is actually good news. Cisco has been doing real security audits, where they go through the source code with a fine tooth comb and look for hidden backdoors. And even better they're actually telling us about them instead of turning them off silently. You can bet that a significant number of competitors have similar issues with backdoors. This is a case where a vendor is actively looking for security problems and putting in place processes to prevent them vs the normal vendors who just respond to security reports.

deleted 8y ago

[deleted]

dogecoinbase 8y ago

_Thank you_. I'm constantly astonished to see folks extolling UBNT gear for anything other than WISP purposes (where it admittedly fits a price profile that's unmatchable). Read about the first ~10 months of the ES16-XG DAC support issues. Read about how EdgeRouters could never approach even 40% of line rate with fq_codel running. Read about how they lied about the future of the mFi line for 8+ months before abandoning it entirely. Not to mention the GPL stuff you note, the inconsistent and semi-nonfunctional PoE, and general lack of support or consistency. At some level, you really do get what you pay for. They are great for people who want to set up a "homelab" without learning anything about actual networking, though.

tacoman 8y ago
Or $1000 switches that fail outside of warranty with no replacement power supplies available. https://community.ubnt.com/t5/UniFi-Routing-Switching/Failed-US-24-500W-13-months-of-use-repair-options/m-p/1578936#M15540 https://community.ubnt.com/t5/UniFi-Routing-Switching/Failed...
Serow225 8y ago
Whats the better alternative to fit the needs of a shoestring startup (say 5-10devs)?
- benjaminl 8y ago
  I have had good experience with MikroTik products. The are at a similar price point, but with a less refined interface but a lot more flexibility.
  - jtl999 8y ago
    Mikrotik suffer from a gross amount of "Not invented here" reinventing existing open source protocols such as OpenVPN, a custom sshd and web server, and it shows with their amount of issues (how many years has it taken to add UDP to their OpenVPN server?). In some ways I think their no better then UBNT in some ways. Tell you what. I used to have a Mikrotik CRS125 switch in my home office, and by default if you have a set of ports where one has no VLAN assigned, and the others have untagged VLAN assignmnets, any broadcast traffic on the untagged port(s) without a VLAN leaks to the ports with an untagged VLAN. This isn't well documented in the manual, and to fix it you either disable "Invalid VLAN Forwarding" (I think) and/or move said ports without a VLAN to a VLAN.

myrandomcomment 8y ago

I have run it at 2 startups and it works great. Current startup is all Unfi stuff including 3 switches and 8 APs for with around ~150 devices connected to Wifi. We use RADIUS just fine for auth for the users. No issues at all. We do not use their firewalls, we use PFSense. I do use a USG at home with no issues.

inferiorhuman 8y ago
RADIUS support is a well known issue. In my case it works better with some Apple hardware than others. Conversely, the Cisco gear at megacorp has never given me any authentication problems. https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AC-AP-issues-with-WPA2-Enterprise-with-RADIUS/td-p/522891 https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AC-AP-iss...

detaro 8y ago

Really depends IMHO, at least when it comes to the APs. Yes, it's not enterprise-grade, but their APs are also way cheaper than anything enterprise and do the basics well enough. Average small business office use doesn't require much in the way of features, although how long various RADIUS features took was a bit embarrassing (I seem to remember putting clients in different, RADIUS-controlled VLANs wasn't possible for a long time). Never really trusted their other product lines.

rayiner 8y ago
How much does the price difference really matter? An Ubiquiti AC HD is $300. You can get an equivalent Ruckus AP (R710) for about $815. In a small office, that might add up to a couple of thousand dollars extra for APs. That's like a week's rent for a Bay Area office.

petecooper 8y ago

>And let's not speak of the chronically overheating stuff. Some-time wireless installer here, I bring a snippet of anecdata. A recent client had the full Unifi experience for an outdoor network, including 3x EdgeSwitch XP (formerly known as ToughSwitch) in a single IP65-rated, largely airtight enclosure. The network would go offline on summer afternoons. It was overheating, those models run hot and are not recommended for low ventilation areas, but they weren't convinced. I fitted a thermometer, went back three days later and checked the logs. The temperature peaked at 143 Celsius.

tnorthcutt 8y ago
143 Celsius??? That's 289.4 Fahrenheit, which I find difficult to believe. Not impossible... just difficult. That's quite impressive.
- hirsin 8y ago
  The heat problems are real. I mounted one to the underside of a cabinet, and it melted the plastic lining on the opposite side of the wood. They run extremely hot.
- inferiorhuman 8y ago
  If memory serves the ER-L idles at around 40C exterior temp. That was the primary reason I went with the ER-X despite hooking it up to a gigabit uplink.
- bscphil 8y ago
  In fact if it was actually reaching 143 C, I'd say that ironically I'm more positively impressed by the fact the hardware works at all at that temperature than I am negatively surprised by the fact that its thermal controls are that bad.
- petecooper 8y ago
  For completeness, that was when the summer sun was shining directly on the enclosure in the hottest part of the day, during a country-wide hot spell. Still, no airflow, heat generation, etc. Every day, cut out. When it cooled down, it worked again. This continued for about two months, then they failed.

Johnny555 8y ago

Ubiquiti is not suitable for a business environment I'd say that Ubiquiti is perfectly suited for a small business environment -- definitely a big step up from discrete consumer Asus routers throughout the office with no central management (and probably haven't been patched since the day they were installed). Ubiquiti may not be suitable for a mid to large sized business, but for up to a ~100 person office or so, they come in at a great price point and have decent performance and manageability.

gruez 8y ago
Asus-Merlin firmware is regularly patched and is available on many models
- Johnny555 8y ago
  But can you easily roll out that new firmware to 20 Wifi nodes spread over 3 offices in 3 different cities? Just because patches are available, doesn't mean that someone's going to take the time to apply them. Having a central management console makes this much easier. Upgrade one node, make sure it works, then roll out to the rest of the nodes one by one with one click.

triviatise 8y ago

I loved the ubiquiti stuff for years. Then one day two years ago macs suddenly could no longer reliably connect to the outside world even with a strong wifi connection to the AP. I would send pings and have 40% packet loss. Weirdly I could ssh into any of the APs and ping with 0% packet loss. We could never fix it and switched over to google appliances. We rarely have over 20 people in the office.

spudlyo 8y ago

I've heard great things about Ubiquiti's products, so I recently evaluated both their USG security gateway and EdgeRouter4 products using only wired gigabit ethernet. I found it weird that the UniFi line of products and the EdgeMAX line of products while very similar in terms of specs and their target markets, use completely different remote management systems (UniFi vs. UMNS). While some really folks like their management GUI, I found that once you wanted to do anything not bog standard with it, you were on your own. I had to SSH into both devices and enter EdgeOS (Vyatta) commands for even relatively simple things like disabling NAT on the ER4 or configuring mutual TLS with OpenVPN. With IpSec there are so many different possible parameters that the GUI just didn't have enough widgets to cover them all. I found the USG security gateway too underpowered for my purposes. I wanted a device I could use for IDS/IDP as well as a dedicated VPN. With hardware offloading disabled (which you need for IDS/IDP) the throughput of the USG is limited to around 130 Mbps. Using IpSec on the USG (ESP:AES-128-SHA1) I was able send (encrypt) data at 70 Mbps and 56 Mbps on receive (decrypt). Don't even think about using OpenVPN with this device, as it's single-threaded and can't take advantage of any crypto offload -- only managing around 14 Mbps of throughput. If you are using the USG for a VPN you can get much better performance with WireGuard. I managed to get 90 Mbps encrypt, 111 Mbps decrypt with it, which is likely good enough for a lot of folks. The EdgeRouter4 was faster, but it had a weird issue with IpSec. I was able to get it to encrypt at 631 Mbps, but only decrypt at 229 Mbps. On encrypt (send) I could see that the CPU was 376% utilized (it has 4 cores) with most of that spent dealing with software interrupts. On decrypt (receive) it only 167% utilized -- so something was wrong there. The EdgeRouter4's OpenVPN single core performance was more than 3x faster than the USG, clocking in at 43 Mbps, and best with WireGuard at 636/597 Mbps encrypt/decrypt. I used iperf3 on a remote host on my simulated WAN for measuring throughput like: iperf3 -c host_behind_router -P4 -t120 # decrypt iperf3 -c host_behind_router -P4 -R -t120 # encrypt Ultimately I found the whole dance of having devices being adopted by the controller software and then being provisioned by it to be tedious and unnecessarily faffy -- especially considering how often I had to drop into EdgeOS to get things done.

basch 8y ago
You were using the $100 USG? https://unifi-xg.ubnt.com/usg-xg-8 https://unifi-xg.ubnt.com/usg-xg-8 https://www.ubnt.com/unifi-routing/unifi-security-gateway-pro-4/ https://www.ubnt.com/unifi-routing/unifi-security-gateway-pr...

jdiaz5513 8y ago

Yup. The network engineer in me would never recommend Ubiquiti for any scenario. Maybe it works for WISP because of the price point; I'd have to be convinced. They run an embedded Mongo DB on their UniFi hardware that (at least in the deployment I've inherited) requires occasional direct interventions[1] to keep running. That's just one example of the many baffling/wrong things they do. I know Mongo gets quite a bit of undeserved hate, but it really just doesn't seem suitable for this use case. [1] https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-SDN-Identifying-Database-Issues-on-the-Cloud-Key https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-S...

kryogen1c 8y ago
My IT MSP solely sells and supports unifi WAPs, and I have no idea what you're talking about. We have dozens of WAPs under management across the city and state, and I've never seen any of the issues you guys are talking about. We don't have issues with database crashing or overheating. The wap controllers are configurable for automatic firmware updating, so I don't know what the issue is with patching. They definitely support wpa-e/radius because I've configured it and we use it in my my office. A personal goal of mine is to buy a unifi wap and a modem (already have a router and firewall) and divorce from ISP equipment altogether. Then I can start posting on /r/homelab :)
- Grazester 8y ago
  I have an office with a few of those and they are not great and do overheat. I am quite surprised you having been exposed to a great number of them never had an issue.
  - kryogen1c 8y ago
    They have a lot of models and we usually sell ac-pros and ac-lrs. Maybe there are issues with higher/lower grade versions...
    - ShouldBeWorkng 8y ago

jamescampbell 8y ago

Sources for all of these claims? I have and recommend their products wholeheartedly. This isnt something that is opinionated. Their pro products are amazing. Maybe you are referencing outdated or consumer level product offerings? Giving you benefit of the doubt and just going to say, right and roll my eyes.