Ubiquiti issue

[mmerry]

Can't explain it, but wondering if anyone can. Dream Machine SE suddenly started dropping packets on the WAN interface. No updates were done at that time, in fact no updates for a few weeks. Plugged into a Cyberpower PR1000LCD USP so should not be power issues.

ISP rolled a truck and verified the connection was fine. Rebooted the entire internal network, and still dropping packets. All network equipment is up to date with software and firmware, and verified to have no loops. Reset the DMSE to factory defaults and restored a config from 10 days ago and now all is fine.

I can't explain what happened as the logs show nothing. Just wondering if anyone else has experienced it?

 

[YeOldeStonecat]

What is the ISP CPE?
Is it properly "bridge" or in "bypass mode"...so the public IP hits the DMs WAN interface? Or is it still running as a gateway...thus double NAT?

What model ISP CPE?
Replace the patch cable between it and the DM?

I do recall a few years ago, working with an ISP common in the area of our main office (Breezeline)....there was a customer that had a similar issue...basically connectivity issues 'tween the WAN of the (back then) USG3P....and the cable modem (not gateway...just a pure modem). The tech did state that he was aware of firmware issues with that particular model modem with a certain firmware version......would flap a lot with auto negotiation. He replaced that modem with a different model...and all was good again.

 

[mmerry]

It is fiber, the ONT was replaced about a year ago. Did the basic troubleshooting like take computer and connect directly to ONT, used the same cable as the DM and worked and pings were fine. Tech that came ran ping test for 15 minutes with no drop. I know ping is not the best test but I was getting ping failures from both machines on the network and the DM itself. I am at a loss. The system has been up and solid with no drops for 36 hours now with the rebuild. I am still under the idea that the ISP triggered something that cause the DM to loose it's mind.

 

[YeOldeStonecat]

Ahh yes....fiber with ONT..I've seen a few people mention issues with that in some tech forums. I've not had to deal with that setup much at all.

 

[brandonkick]

First thing I was thinking was bad patch cable somewhere. I've seen bad cables cause packet storms and cause switches to reboot frequently. It was wildly infuriating until a cable was replaced. Or at least.. finding the bad cable was infuriating.

 

[NETWizz]

I personally have a Dream Machine SE and don't like it. I mean it works and is good enough for a single home with three APs, and it is better than most home networking systems, but I am really not a fan.

I much prefer Green Lake and Meraki for WiFi

 

[YeOldeStonecat]

Dream Machine SE good enough for more than just a home with 3 APs.
It can handle larger networks..over 100 Unifi switches and APs....over 1000 clients.....and with full IDS/IPS on it will still pump out 3.5 gigs of throughput both ways.

Use them in a lot of our installs. Here is one on a gig fiber pipe, 10 gig aggy switch TOR, 10 gig downlinks to the 48 port switches. It's at a bio-medical lab here.

 

[NETWizz]

I feel sorry for whoever has to manage anything much larger than that setup. Once you start scaling Ubiquiti beyond a handful of switches and APs, the limitations really start to show. There is no true switch stacking, no multi-chassis EtherChannel, no VRRP, etc. so redundancy is… well non-existent. Everything is also still tied back to the Dream Machine as both the controller and the gateway, which makes it a single point of failure for both management and policy enforcement. If that box goes down, you lose visibility and control over the entire network and likely reachability, too.

You cannot even add or remove an SSID without the entire Wi-Fi going down for a brief minute kicking everyone. That might be fine for a coffee shop, but in an environment with dozens of switches, hundreds of APs, and well over a thousand clients, Ubiquiti is a huge operational pain. Sure, it is a step up from Netgear, D-Link, and Linksys probably good enough for any residential and many small businesses while being a lot less expensive than Aruba, Meraki, or Cisco, but that does not scale well with growth. In larger deployments you want a distributed control plane, a proper core/aggregation layer, and the ability to make topology or configuration changes without touching each switch one at a time. With Ubiquiti, you are basically babysitting a big pile of standalone devices.

I probably should not even get started on the firewall side... there are no true security zones, so policy control is a pain. Logging is also non-existent, so good luck doing any real troubleshooting or forensic work. In a larger environment this is not an inconvenience, but a compliance nightmare, too.

 

[Sky-Knight]

@NETWizz Wait until Unifi support lets you know that a "reboot" isn't really a reboot, and you have to roll a truck 300 miles to pull a power cable. Fully implemented Unifi switches need IP Power switches!

 

[NETWizz]

@NETWizz Wait until Unifi support lets you know that a "reboot" isn't really a reboot, and you have to roll a truck 300 miles to pull a power cable. Fully implemented Unifi switches need IP Power switches!

That I did not know. Good to hear.

 

[YeOldeStonecat]

I feel sorry for whoever has to manage anything much larger than that setup. Once you start scaling Ubiquiti beyond a handful of switches and APs, the limitations really start to show. There is no true switch stacking, no multi-chassis EtherChannel, no VRRP, etc. so redundancy is… well non-existent. Everything is also still tied back to the Dream Machine as both the controller and the gateway, which makes it a single point of failure for both management and policy enforcement. If that box goes down, you lose visibility and control over the entire network and likely reachability, too.

You're woefully way behind on the times.
Unifi has "Shadow Mode" on certain model gateways....their version of VRRP.
Unifi has models of switches that are "stackable" (campus models for example)...however, thanks to how Ubiquiti designed the Unifi network management system works...the ease of management of managing "tons of ports across multiple switches" is....wonderful! So...those "old ways" of using modular/blade switches (like we used to do back in the day)....having to individually hit a switch...vs...stackable, well, that isn't necessary with Unifi. They...make management of multiple switches easy peasy!

I see a lot of people never learn how the Unifi system truly works...so they never "get it". For managing just APs...it works. For managing switches...some decent stuff. For managing switches...and APs....it starts to become more powerful. When you have a Unifi gateway...and Unifi switches...and Unifi APs...."Wow, the power of it all starts to really shine". It's sweet how with just a few clicks of the mouse, you can create new things in the network and the Unifi system will "touch each device" in the correct way for you.

HA...yes...HA is there.

"With Ubiquiti, you are basically babysitting a big pile of standalone devices."
Shows you don't know the system.

I came from HP ProCurve, Cisco PIX/ASA/Catalyst, and their APs, and later HP Aruba, and Sonicwall over many years, and have worked on Fortinet and Aruba, Engenius, Meraki, and...yeah..we're all Unifi shop now. Even their gateways. And they have gateways without a built in controller, the UXG Pro for example....you provision that to your own external controller....so if "it" goes down, does not affect the rest. But other "big name" ones that have built in controllers...same point with them too.

Unifi has firewall "zones" too....added that....about a year ago I think. Although their prior method was just fine also.
And for security features, we manage that on the endpoints anyways..these days so many go "work from home" or "out on the road"....so they need the protection anywhere. But...the IDS/IPS in Unifi is Suricata...quite a popular engine. And if you opt for the gateway security feature (pay for...just like the big names)...it's by Proofpoint.

Over 150 networks out there we have, some of the quite large like schools, ...far from an "operational pain"...it's been very good and reliable for us.

 

[NETWizz]

I may be behind the times, but honestly, I think the power of the other platforms has been much greater...

==> Make no mistake I 100% agree Ubiquiti is superb for a home network or small business. Maybe a small school like a Pre-K, but I would not push it beyond that.

Having something called "Shadow Mode" is a very large part of the problem. Nobody with any networking knowledge would thing that might be VRRP/HSRP/GLBP or anything like any of those. It is just weird when they make up terms.

I honestly doubt the performance of any of those Unifi switches could hold up to anything like a Cisco Catalyst or an Aruba CX. What is the stacking bandwidth? Q: Can you do Multi-Chassis Etherchannel spanning a redundant link from different switch chassis like they are part of the same switch?

Case and point, here is my Green Lake for APs. I have 5162 Access Points on my network at work. I cannot even fathom managing this with Ubiquiti:






Q: Do they all have dual, hot-swappable power supplies and multiple hot-swappable fans?








How about shared, power stacking?




What is the stacking bandwidth? Here is 1 Terabit per second stack bandwidth: on some Cisco units in a Stack-Wise 1T ring:



Can you put Cores in physically separate buildings part of the same stack via virtual stacking over single-mode fiber?:

This is a stack of two switches... they are on in different buildings. A fire or flood of one will not take out the entire network.




Each has its place.

I would NOT pay for Meraki licensing for home use. I would NOT buy a Catylyst switch for my mother's home network.

I would 100% buy Ubiquiti for a friend's small lawfirm, or a family restaurant, or a hotel with maybe 20 to 30 rooms.


When you start scaling up... no way would I do it. You can, and you may well have tremendous success.


All I am saying is there is a place for everything, and we all draw the line at a different spot. You are more comfortable scaling Ubiquiti to maybe a few hundred users. I would be a bit concerned before 200 for sure. Does not mean there is not a place for both technologies. I am fully aware there is a budget; in fact, that is why I have Ubiquiti at home... because I am cheap, and it is a good value for my money.

 

[phaZed]

Another super-positive view of Ubiquiti here. I both run a full Ubiquiti stack here at the shop, but also have a dozen or so clients on Ubiquiti... and it's been wonderful.

 

[Sky-Knight]

I haven't felt the need to do anything Unifi, since Aruba Instant-On.

I am however rather onboard with how Unifi works, because the security is on the endpoint now. The more cloud I make places, the more their office networks just need to be Internet on ramps.

Unifi makes a PERFECT stack for that use case.

 

[YeOldeStonecat]

I may be behind the times, but honestly, I think the power of the other platforms has been much greater...

==> Make no mistake I 100% agree Ubiquiti is superb for a home network or small business. Maybe a small school like a Pre-K, but I would not push it beyond that.

Having something called "Shadow Mode" is a very large part of the problem. Nobody with any networking knowledge would thing that might be VRRP/HSRP/GLBP or anything like any of those. It is just weird when they make up terms.

All I am saying is there is a place for everything, and we all draw the line at a different spot. You are more comfortable scaling Ubiquiti to maybe a few hundred users. I would be a bit concerned before 200 for sure.

I'll pretty much stop reading and keep my reply most minimal when you drop snobbery insults like "Nobody with any network knowledge would think that might be VRRP...."

Uhm, I'm worked with VRRP before Ubiquiti.

https://help.ui.com/hc/en-us/articles/19581768432535-Shadow-Mode-High-Availability-on-UniFi-Cloud-Gateways

Shadow Mode ensures gateway high availability by seamlessly transferring gateway and management functionality to a secondary unit in the event of a primary unit failure. Leveraging Virtual Router Redundancy Protocol (VRRP) and firewall connection state tracking, this transition is virtually invisible to end users, maintaining uninterrupted productivity.

Shadow Mode is just one component of UniFi’s full-stack high availability and redundancy solution.


Even just the Dream Machine Pro can handle over 1,000 clients maintaining 3.5 gigs IPS throughput.
Their Pro Max...over 2,000 clients and 5 gigs IPS throughput.
Their Enterprise Fortress Gateway, (costs $2,000) can handle over 5,000 client support, 25 gig throughput, still 12.5 gigs with IPS.

Their mainstream low budget router, the Cloud Gateway Ultra, at just 129 bucks, will handle over 300 clients > 1 gig with IPS.

We have oodles of long time clients with larger networks....that we have on full UI stacks....we have nothing to bit concerned about, the proof is in years worth of every day use.

of course, every IT person is entitled to lean in towards the network product of their choice.
At the end of the day, it's what they know and support. I just can't stand seeing mis-truths spewed...everyone is entitled to not like a product, but..keep the facts...to actual facts.

To Skyes preference of Aruba...yeah they have good stuff. If I could not do Ubiquiti for some reason, it would be a close call between Aruba Instant On....and Engenious. I'd probably lean Engenious, because as an MSP, I prefer a single pane of glass for all the network stack. As far as I know, HP...err...Aruba...hasn't come out with a gateway yet, last I knew...was still just switches and APs. I don't want to be bothered with 2x panes of glass for just one customers network. But good product, I worked with Aruba back when it was still just Aruba..before HP inhaled them.

 

[britechguy]

It appears that eero's line goes from dual-band to tri-band when you hit the Pro level (which handles 5Gbps service & 6K sq ft with 3 units). They also have a Max line that handles 10 Gbps service and 7.5K sq ft with the same setup. Both far exceed the number of devices in use simultaneously than I'm looking at.

The entry level is dual band, 6K sq ft (3 units), and handles 2.5Gbps service.

Since the service they're using is Xfinity, that maxes out at 2.1Gbps so any of the above would likely be fine based on that, as well as what I perceive as likely daily use cases. Offices of any common sort are not particularly "throughput intensive." I probably have more internet throughput here at home with a streaming smart TV and two constantly active PCs than many offices with 10 people do for activities of daily working.

 

[NETWizz]

There are many great setups. It really depends on what you need. 3.5 Gbps... nothing in the Cisco world will do that unless you spend a bunch of money for the better equipment that does 5 Gbps and 10 Gbps.