I'm done with Ubiquiti Unifi. Need help with alternatives.

[jinjuku]

I recently saw a demo on Ekahau's Connect/Sidekick 2 solution. Expensive, but seems like an interesting long-term investment, especially if you do large Wifi Networks often or you hate/wasting time on Wifi mapping

I have a Sidekick 2 along with Ekahau AI Pro. Just load up a map and waypoint along your path, set a gateway to ping, and get tons of telemetry about your wireless network environment.

 

[highfigh]

It's all trade offs, I do switch/route/mobility/firewall. On a project with 74 switches across 30 closets, new collapsed core, and 532 AP's that I'm doing the predictive design for.

The predominate design mandates are for a killer wifi network. We now spec connectivity at 3 wifi clients for every user and 1/8th wired for every user.

I got into this at AVS forum where they wanted to bring up a custom home (we are talking like $10M) and matrix 4:4:2 hdmi over IP. In that case yes you are putting in things like sfp+/sfp28 or 56, SM fiber, sfp+dd, or even odmf. Setting up multicast and 200gb core HA because you may have four 48Gbit streams on mcast terminating at your IGMP querier.

But for the bulk of home owners 2-3 wifi 6 with multi-gig ethernet AP's will more than meet demand.

It's crazy what you can do for well under $1000.

Compared to what we discussed in the networking class, 802.11 ac and beyond are crazy- as I wrote, 802.11n was on the horizon and that was supposed to top out at 150Mbps, dial-up was still being used, typical consumer PCs only had about 4Gb of hard drive storage and RAM was in single digit Megabytes with Windows XP being 'current technology'.

 

[BoredSysAdmin]

Compared to what we discussed in the networking class, 802.11 ac and beyond are crazy- as I wrote, 802.11n was on the horizon and that was supposed to top out at 150Mbps, dial-up was still being used, typical consumer PCs only had about 4Gb of hard drive storage and RAM was in single digit Megabytes with Windows XP being 'current technology'.

802.11ax is now the norm now, with 1Gig AP uplinks considered to be slow, 2.5gig, or faster preferred.
In addition to legacy 2.5 and 5ghz, the 6 GHz range is fairly new with Wifi 6E with next-gen Wifi 7 (802.11be) coming up soon.

 

[jinjuku]

Wifi 7 isn't going to be what everyone thinks that it is. You'll almost have to be standing on it to get any of the speeds claimed.

 

[highfigh]

802.11ax is now the norm now, with 1Gig AP uplinks considered to be slow, 2.5gig, or faster preferred.
In addition to legacy 2.5 and 5ghz, the 6 GHz range is fairly new with Wifi 6E with next-gen Wifi 7 (802.11be) coming up soon.

Is this speed in commercial/industrial? I haven't seen that in resi because gigabit isn't as wide spread as it could be and to be honest, most people don't want to pay the cost of the higher priced models. Besides, by the time their router can use gigabit, it will probably be ready for replacement, using the 3 year lifespan recommendation. I'm literally 250 yards from the border with Milwaukee and I can't even get Verizon high speed. Fiber is in the area, but not on many streets in my area.

 

[BamBam77]

So I realize this may not be the place for this question, but since I trust you people and there are a bunch of us that are in the IT space, I thought I'd give it a try.

So, I'm going to attempt to detail out my current network install to see what you guys think. Bear with me as it's a bit complex.

I have a Sophos UTM box in front of everything in my network. The only reason it doesn't control everything is because it's a home license that is free so I'm limited to 50 IP addresses. I'm far over that sadly. If you know anything about their stuff it's supposed to be among the best at blocking threats. It's been in place for years and has never given me any trouble. If anything, I'm spoiled on how configurable everything is. The down side is that it's massively complex to configure requiring a lot of reading to resolve certain issues.

The rest of my network is all Unifi stuff. I've been using their stuff for years, but their recent antics have me looking elsewhere. Those that know are aware of their security issues around Unifi accounts, but more than that their UI direction is just idiotic. They change things, then roll back, then move to something else and it's all fluff and no substance. Couple that with the fact that my USG (router, security gateway) sucks. It's just not a good piece of equipment. Just getting it up and running had me seriously considering smashing it with a hammer. Before that, all my Unifi APs worked wonderfully when directly connect to the Sophos box.

They still work, but are older tech so no mesh, no fast AP roaming. It's becoming an issue since I'm constantly on conference calls. I can't have drops or garbled voice when doing a presentation. Used to not be an issue, but now it is and I'm done with this stuff.

I had considered upgrading to a better security gateway from Unifi as I'm almost positive most of my issues are with the USG just being underpowered. I had high hopes that their Dream Machine pro could replace my Sophos box, but I don't trust them anymore.

Having said all that, I've currently got two of their AP-LR models that are Wifi 5. One upstairs, one down. I've also got 5 of their flex mini switches that are 5 port managed switches. These are awesome. I have a USG too, but it's honestly not that great and it's only real job is DHCP and traffic monitoring. I just want to be able to see what my devices are doing and how much data they use. I've been able to stop some rouge things from happening so this is a must have feature. Their DPI is also good, but lately it's been resetting the data. Not a fan. I'm also not a fan of the limited configuration options.

As an example, I'm using the Sophos box to do everything firewall, NAT, DNS, webserver, etc. so it's doing 99% of the heavy lifting. The USG won't let me disable NAT since I've already got that set up on my Sophos box. Not cool, but not the end of the world. If the USG were better, I'd get rid of the Sophos box and simplify my setup to an extent. The USG doesn't have nearly the features that Sophos does when it comes to web serving and the like.

So, that leads me to today. I need help trying to figure out what product suite would replace what I currently have. I looked at TP-link Omada per @jinjuku suggestion and it looks very much like a Unifi clone, but more stable from what I've read. Slow to update firmware so that's a concern, but I don't necessarily update unless I need to so maybe not an issue. I installed the Omada controller and it's pretty similar in what their devices can and can't do. It's all pretty simple still, so I'd probably still use my Sophos box for the heavy lifting.

I know that @BoredSysAdmin has similar complaints about Unifi that I do so I'm curious to see what he plans to move to. I really like what I'm seeing about the TP-link stuff, but I feel it's a lateral move rather than an upgrade. Then I look at more advanced stuff and get sticker shock.

So, what do you guys think? I'd love to hear what you use or what you've done for customers. I think a fresh start would be good.

Hey buddy see your post was from 2 years ago but there is a lot of new UniFi hardware that's come out. Time to get excited. The Dream Machine Pro SE which I also use at home and the Dream Machine Pro Max. And if you want extreme security go for the Enterprise Fortress Gateway think I'm going to buy one myself. UniFi is really coming out with exciting new stuff. And most things aren't perfect coming right out of the gate. Some teething problems are to be expected.

Have a good one

 

[jinjuku]

Hey buddy see your post was from 2 years ago but there is a lot of new UniFi hardware that's come out. Time to get excited. The Dream Machine Pro SE which I also use at home and the Dream Machine Pro Max. And if you want extreme security go for the Enterprise Fortress Gateway think I'm going to buy one myself. UniFi is really coming out with exciting new stuff. And most things aren't perfect coming right out of the gate. Some teething problems are to be expected.

Have a good one

I exited the Unifi economy not because of hardware, but because bug ridden operating system releases. I'm told they have corrected the ship in that regard.

I've been happy with TP-Link in the consumer space and FS/Pica8 in the medium business space. Enterprise it's Aruba, Arista, Juniper, Cisco still.

 

[highfigh]

I exited the Unifi economy not because of hardware, but because bug ridden operating system releases. I'm told they have corrected the ship in that regard.

I've been happy with TP-Link in the consumer space and FS/Pica8 in the medium business space. Enterprise it's Aruba, Arista, Juniper, Cisco still.

I don't know if you saw my question about TP-Link and the possible ban- any thoughts on that? I have used more switches and access points with zero complaints.

Lots of people on an installer/AV contractor forum have used Ruckus and were satisfied- Spectrum uses that brand for commercial accounts.

 

[BoredSysAdmin]

For large enterprises, I still think Ruckus is the king of the hill. I see fewer straight Cisco APs deployed, replaced more with Meraki (owned by Cisco) stuff as it's almost as robust but MUCH easier to manage in scale.
While at home I still rock Unifi stuff for now as it matches the needs (and budget), but I have deployed Omada AP (TP-Link brand) in SoHo very easily and have zero issues.

 

[jinjuku]

I don't know if you saw my question about TP-Link and the possible ban- any thoughts on that? I have used more switches and access points with zero complaints.

Lots of people on an installer/AV contractor forum have used Ruckus and were satisfied- Spectrum uses that brand for commercial accounts.

The TP-Link issue is consumers not changing the factory credentials.

Ruckus is good when you want higher end features but Cisco/Juniper/Aruba have you priced out.

 

[highfigh]

The TP-Link issue is consumers not changing the factory credentials.

Ruckus is good when you want higher end features but Cisco/Juniper/Aruba have you priced out.

So, it's not part of the NDAA, like Dahua and HikVision?

 

[jinjuku]

For large enterprises, I still think Ruckus is the king of the hill. I see fewer straight Cisco APs deployed, replaced more with Meraki (owned by Cisco) stuff as it's almost as robust but MUCH easier to manage in scale.
While at home I still rock Unifi stuff for now as it matches the needs (and budget), but I have deployed Omada AP (TP-Link brand) in SoHo very easily and have zero issues.

I've haven't dealt much with Ruckus but they have a solid reputation and they are a tier 1 WiFi player.

I'm in the middle of our DNAC deployment in Assurance mode currently. We didn't want the 7 year licensing cost associated with Meraki.

Me and another engineer really pushed for an Arista with their Cloud Vision.

Thing that KILLS me with Cisco: DNAC can't do dual stack IPV6. But I'm getting a P.I. IPV6 /32 from ARIN anyways.

Tired of having to renumber at our edge when we switch providers. BGP peering all the way baby.

 

[jinjuku]

So, it's not part of the NDAA, like Dahua and HikVision?

The ban has more to do with TP-Links potential ties than any covert code and telemetry it's sending back.

I'm monitoring what is going on but how do you go to customers and tell them the TP-Link they've had working for years has to be ripped out?

I'm running 3 TP Link AP's, a Fortinet Firewall, Aruba switching. If I need to I'll ACL where I need to if push comes to shove.

TP-Link maintains a stance they are NDAA compliant.

 

[Trell]

The ban has more to do with TP-Links potential ties than any covert code and telemetry it's sending back.

I'm monitoring what is going on but how do you go to customers and tell them the TP-Link they've had working for years has to be ripped out?

I'm running 3 TP Link AP's, a Fortinet Firewall, Aruba switching. If I need to I'll ACL where I need to if push comes to shove.

TP-Link maintains a stance they are NDAA compliant.

TP-Link did not pay Trump enough, if at all. How do you think that TikTok is still up, illegally?

 

[TLS Guy]

The ban has more to do with TP-Links potential ties than any covert code and telemetry it's sending back.

I'm monitoring what is going on but how do you go to customers and tell them the TP-Link they've had working for years has to be ripped out?

I'm running 3 TP Link AP's, a Fortinet Firewall, Aruba switching. If I need to I'll ACL where I need to if push comes to shove.

TP-Link maintains a stance they are NDAA compliant.

May be I have just been lucky but I have had zero issues since I went with Netgear Orbi Mesh at our last home and his one we built here just over five years ago.

We have an Arris cable modem going to the Netgear Orbi Mesh, one unit on each of the two floors, with cable connection. There is an ethernet patch bay and two 19" rack mounted hubs for the AV system and local hubs where needed. Only what moves uses Wi-Fi. We have zero issues and can stream anything we want to grab with no issues are all, including 4K and Atmos streaming. May be our luck will run out, but so far so good. Streaming on all our systems is high quality and has been trouble free.
The family who bought our lake home, are friends of ours and we left them our entire Internet infrastructure. They have had zero issues.

 

[BoredSysAdmin]

May be I have just been lucky but I have had zero issues since I went with Netgear Orbi Mesh at our last home and his one we built here just over five years ago.

We have an Arris cable modem going to the Netgear Orbi Mesh, one unit on each of the two floors, with cable connection. There is an ethernet patch bay and two 19" rack mounted hubs for the AV system and local hubs where needed. Only what moves uses Wi-Fi. We have zero issues and can stream anything we want to grab with no issues are all, including 4K and Atmos streaming. May be our luck will run out, but so far so good. Streaming on all our systems is high quality and has been trouble free.
The family who bought our lake home, are friends of ours and we left them our entire Internet infrastructure. They have had zero issues.

To be fair a house on a lake or otherwise rural areas is hardly a challenge for almost any wifi network. Netgear Orbi uses one nice party trick, a second 5ghz radio used exclusively for wireless meshing. This doesn't reduce the speeds of regular 5ghz traffic on wifi, whereas normal 2 radio mesh AP does take a big toll on speed on channels used for a wireless traffic "highway".

I had a shocking (bad) experience with the software quality on some of the so-called "business" grade Netgear equipment and I will do my utmost to stay clear from them for the foreseeable future.

 

[TLS Guy]

To be fair a house on a lake or otherwise rural areas is hardly a challenge for almost any wifi network. Netgear Orbi uses one nice party trick, a second 5ghz radio used exclusively for wireless meshing. This doesn't reduce the speeds of regular 5ghz traffic on wifi, whereas normal 2 radio mesh AP does take a big toll on speed on channels used for a wireless traffic "highway".

I had a shocking (bad) experience with the software quality on some of the so-called "business" grade Netgear equipment and I will do my utmost to stay clear from them for the foreseeable future.

I live in Eagan in the south metro now and have for over five years. The Netgear Mesh has worked fine in both places for years, I also used it in my brother's house in the UK and it has worked well their also. So the systems we have used have been reliable with good measured signals all over the residences. It has been by far the best Wi-Fi system we have ever had. I can honestly say there have been zero issues.

 

[ryanosaur]

I’ve been very satisfied with my Asus Zen WiFi XT8 gear. 3 unit mesh spaced throughout our longer, narrower house. I installed Ethernet drops to wire them which works very well.

 

[highfigh]

The ban has more to do with TP-Links potential ties than any covert code and telemetry it's sending back.

I'm monitoring what is going on but how do you go to customers and tell them the TP-Link they've had working for years has to be ripped out?

I'm running 3 TP Link AP's, a Fortinet Firewall, Aruba switching. If I need to I'll ACL where I need to if push comes to shove.

TP-Link maintains a stance they are NDAA compliant.

WRT the bold part- as apologetically as possible, without sounding like I sold them crap.

I do tell people that technology doesn't last forever, though- ironically, I haven't needed to replace much of it unless it was no longer usable, like when HDMI changes prevent it operating at all.

Unfortunately, a lot of my customers had Apple Airport Extremes and Express crap and it was really hard to get them to release their death grip on those. Once those were gone, I stopped receiving trouble calls. OK for a phone, computer and a few other devices, but not in a larger network that didn't include other brands.