Some-time wireless installer here, I bring a snippet of anecdata.

A recent client had the full Unifi experience for an outdoor network, including 3x EdgeSwitch XP (formerly known as ToughSwitch) in a single IP65-rated, largely airtight enclosure.

The network would go offline on summer afternoons. It was overheating, those models run hot and are not recommended for low ventilation areas, but they weren't convinced.

I fitted a thermometer, went back three days later and checked the logs. The temperature peaked at 143 Celsius.

Every day, cut out. When it cooled down, it worked again. This continued for about two months, then they failed.

Most electronic devices say operate between x and y degrees and if in full sunlight the temp may have exceeded y, which in a device that generates heat itself led to runaway overheating?

Either way plastic could melt at that temp and you'd definitely burn your hands touching it. Pretty crazy.

I assume the soldered innards failed, though I never did open it up to check properly.

This sounds like unrealistic expectations and a poorly designed implementation.

But that's exactly what "anecdote" means already, why change it?

I'd say that Ubiquiti is perfectly suited for a small business environment -- definitely a big step up from discrete consumer Asus routers throughout the office with no central management (and probably haven't been patched since the day they were installed).

Ubiquiti may not be suitable for a mid to large sized business, but for up to a ~100 person office or so, they come in at a great price point and have decent performance and manageability.

Just because patches are available, doesn't mean that someone's going to take the time to apply them. Having a central management console makes this much easier. Upgrade one node, make sure it works, then roll out to the rest of the nodes one by one with one click.

They run an embedded Mongo DB on their UniFi hardware that (at least in the deployment I've inherited) requires occasional direct interventions[1] to keep running. That's just one example of the many baffling/wrong things they do.

I know Mongo gets quite a bit of undeserved hate, but it really just doesn't seem suitable for this use case.

[1] https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-S...

We have dozens of WAPs under management across the city and state, and I've never seen any of the issues you guys are talking about. We don't have issues with database crashing or overheating. The wap controllers are configurable for automatic firmware updating, so I don't know what the issue is with patching. They definitely support wpa-e/radius because I've configured it and we use it in my my office.

A personal goal of mine is to buy a unifi wap and a modem (already have a router and firewall) and divorce from ISP equipment altogether. Then I can start posting on /r/homelab :)

Sure, and problems with RADIUS auth have been well documented. How much of the not seeing issues is simply a matter of users assuming your setup (or their phones or computers) is flakey? Issues with Mongo are also pretty well documented.

https://www.google.com/search?q=ubnt+mongo+issue

> The wap controllers are configurable for automatic firmware updating, so I don't know what the issue is with patching.

The issue with patching is that Ubnt is in a bad position. They're on their own completely to create and issue patches even for stock packages. That's just what happens when you distribute EOL'd software. So, sure, it's not that hard to apply patches* from Ubnt but it's a lot more work for Ubnt to generate these patches — and last I checked they were pretty well behind with the excuse of "there are no known exploits for ABC in the wild".

* Let's not forget the ER-X bootloader for which end users are entirely on their own. Ubnt has a patch but hasn't applied it to the devices they ship. It's just lazy and sloppy.

(I'll see myself out...)

My experiences aren't wrong, of course, but it's an apples to oranges comparison. My IT MSP is only small to medium sized businesses (as I think all IT MSPs are since Enterprise level environments don't contract out it and hire their own department - this is an educated guess). We do very little Enterprise work and have no single client with more than 300 users.

However, I will defend my position and consumer grade ubiquitis on a (significant) technicality. Higher models beyond what my company sells are not cost effective. Buying higher grade waps at no less than double the price is more expensive than just running cables. If you WANT to make everyone get 200mbps wifi, you will pay for it, but that's a convenience you pay for, not a requirement. UAP-AC-Pros are perfectly capable of handing out up to 50mbps pipes to multiple endpoints without huge (or even medium) upfront capital investments, overheating or DB problems. In my opinion, just run cat6 lines. Itll be cheaper than spending thousands on Enterprise waps for only 30 people.

We could never fix it and switched over to google appliances. We rarely have over 20 people in the office.

I found it weird that the UniFi line of products and the EdgeMAX line of products while very similar in terms of specs and their target markets, use completely different remote management systems (UniFi vs. UMNS).

While some really folks like their management GUI, I found that once you wanted to do anything not bog standard with it, you were on your own. I had to SSH into both devices and enter EdgeOS (Vyatta) commands for even relatively simple things like disabling NAT on the ER4 or configuring mutual TLS with OpenVPN. With IpSec there are so many different possible parameters that the GUI just didn't have enough widgets to cover them all.

I found the USG security gateway too underpowered for my purposes. I wanted a device I could use for IDS/IDP as well as a dedicated VPN. With hardware offloading disabled (which you need for IDS/IDP) the throughput of the USG is limited to around 130 Mbps.

Using IpSec on the USG (ESP:AES-128-SHA1) I was able send (encrypt) data at 70 Mbps and 56 Mbps on receive (decrypt). Don't even think about using OpenVPN with this device, as it's single-threaded and can't take advantage of any crypto offload -- only managing around 14 Mbps of throughput.

If you are using the USG for a VPN you can get much better performance with WireGuard. I managed to get 90 Mbps encrypt, 111 Mbps decrypt with it, which is likely good enough for a lot of folks.

The EdgeRouter4 was faster, but it had a weird issue with IpSec. I was able to get it to encrypt at 631 Mbps, but only decrypt at 229 Mbps. On encrypt (send) I could see that the CPU was 376% utilized (it has 4 cores) with most of that spent dealing with software interrupts. On decrypt (receive) it only 167% utilized -- so something was wrong there.

The EdgeRouter4's OpenVPN single core performance was more than 3x faster than the USG, clocking in at 43 Mbps, and best with WireGuard at 636/597 Mbps encrypt/decrypt.

I used iperf3 on a remote host on my simulated WAN for measuring throughput like:

    iperf3 -c host_behind_router -P4 -t120 # decrypt
    iperf3 -c host_behind_router -P4 -R -t120 # encrypt

https://unifi-xg.ubnt.com/usg-xg-8

https://www.ubnt.com/unifi-routing/unifi-security-gateway-pr...

What would you suggest instead?

At some level, you really do get what you pay for. They are great for people who want to set up a "homelab" without learning anything about actual networking, though.

Tell you what. I used to have a Mikrotik CRS125 switch in my home office, and by default if you have a set of ports where one has no VLAN assigned, and the others have untagged VLAN assignmnets, any broadcast traffic on the untagged port(s) without a VLAN leaks to the ports with an untagged VLAN. This isn't well documented in the manual, and to fix it you either disable "Invalid VLAN Forwarding" (I think) and/or move said ports without a VLAN to a VLAN.

https://community.ubnt.com/t5/UniFi-Wireless/UniFi-AC-AP-iss...

Never really trusted their other product lines.

How would you compare Microtik to Ubiquiti?

I'd imagine pretty much any network vendor doing business in the enterprise sector (e.g. HP, Cisco, Juniper, Dell, etc, etc)

> Can you point to a specific example of them not fixing a security issue that was addresssd by others?

I haven't looked recently, but when I last updated my ER-X I noticed that the latest available packages included a large number that were not up-to-date with the latest available security fixes.

One of the problems is that the version of Debian that the hardware (MIPS) Ubnt uses is end-of-lifed on the old version of Debian that EdgeOS is based on. Where most vendors could simply track the official Debian repositories, Ubnt is stuck rolling their own packages. If Ubnt has finally moved on to an officially supported version of Debian then this is less of an issue.

This is one of those I wish I had a better solution moments. For the home user this may not pose a challenge, but in a business environment I'd say that it's probably worth spending the big bucks on a vendor with a better track record. That's not to say there aren't other bad vendors, but it is to say that Ubnt gear does not belong outside of a home lab.

I haven't evaluated Mikrotek because the Ubnt stuff works well enough (but certainly not great) for me in the two locations I've got it deployed.

Ubiquiti EdgeRouter Lite (not ER-X) is apparently supported by vanilla OpenBSD.

The issue has more than one dimension. Apart from them being nice and auditing now, there is still the fact that their internal processes have allowed (and probably encouraged) stashed passwords in such a manner that 6 of them has been found in a really short time. Unless your process is total garbage you don't end up with 6 backdoor passwords like that without knowing it.

So for any company that prides themselves with having a device in the middle of LOTS of networks, its a very poor track record to figure out security and backdoors don't really mix in 2018.

The ER-L is what I spoke of when I referred to the chronic overheating problems. From a different reply to my comment it sounds like there may be other Ubnt devices that suffer the same fate. The ER-L also has issues with reordering UDP packets.

Imo ubiquiti works fine for smaller offices. If you don't have enough people to justify an IT org it makes sense.

Disagree, and not just because of the GPL violations and security issues. There are enough subtle bugs (e.g. data corruption with hardware acceleration) and design flaws (e.g. overheating) that you are setting yourself up for intermittent bugs (a.k.a. trouble) if you don't have someone well versed in diagnosing network issues. It's powerful enough to do fun things in a home lab, but it's way too complex for a professional setting where there's nobody around with the skills to troubleshoot it.

Enterprise gear is expensive, yes.

EdgeOS is a Vyatta fork. Has Ubnt abandoned EdgeOS? It's been a few months since I've looked, but the version of Debian that's being used was end-of-lifed on MIPSLE hardware a while back so security updates are entirely incumbent upon Ubnt. There is no upstream support.

Which offerings are on OpenWRT?

Their Unifi APs have option of a LEDE based firmware option, but think it is just beta at the moment. You can choose between the LEDE version and the regular version.