UniFi Network Application 6.5.54

It's possible Unifi configured log4j with outbound traffic disabled so that would have been a true statement.

Afaik newer Java versions prevent the RCE exploit, too (you have to re-enable the LDAP/RMI functionality since it's off by default)

too bad the unifi controller requires the use of a ridiculously outdated version of mongodb, to the extent that installing it to self host unifi on a debian system becomes more of a pain in the ass every year.

ubnt patched this because it's a huge highly publicized hole.

but the software stack that runs under the rest of unifi is a real mess.

people have said to me: "oh, okay, so they're trying to force people to buy their unifi security appliance or cloudkey thing, right?"

but the same very old stuff runs on those as well, if you poke around under the hood

I run it out of docker so I just update the container as I would normally or with something like Portainer/Yacht. Easy enough.

Updates are usually pretty easy. I manage 4 controllers at home, and 2 at work.

All hosted on debian.

I've had just one update go bad, so I do do the recommended backup/export beforehand.

That said, I don't trust Ubiquity much anymore. Use Unifi in QA setups so we are prone to hit cornercases, but they exists.

I still buy their gear as there is no competitors in the price range.

Edit: Spelling

Lots of networking folks play with UniFi at home the way server folks play with Raspberry Pi clusters.

From stories, it seems if you use stable release track, it’s reliable enough to leave on auto-updates. Some folks do the same for the release candidates, some even for betas. But the more you’ve custom configured, the less likely that’s going to go perfectly every time.

Reasonably easy to restore after a bad update though.

That said, depending on your use case, for “reliable (and easy) upgrades” consider Eero Pro kit with 3 bases of 3 radios each.

I have a Cloud Key Gen2 Plus. Updates are super easy via the web U/I and system settings. In there you can update the individual apps like network and protect as well as the core for the UCK-G2-Plus.

They generally go pretty well, I have them setup to happen nightly. This one was already deployed on my network.

>Can folks familiar with UniFi, say how reliable (and easy) upgrades are on the Ubiquiti gear? I'm considering getting some of their hardware.

Running upgrades is certainly easy, always has been a feature of it. But "reliable" isn't a word I'd use for them any longer, internally the company is an absolute dumpster fire with toxic and unaccountable leadership. Upgrade tracks themselves are a total mess now, and whether a given firmware upgrade goes well or introduces new edge cases is a crapshoot. There is essentially zero useful bug/feature tracking system, all nuked along with the great old forums in favor of their current garbage. For the controller itself it's textbook bikeshedding, they keep redoing the UI and making it worse without adding basic features asked for (and in the old days even confirmed as accepted!) years and years ago. Also, a lot of their hardware is ancient now despite selling for the same price (I suppose inflation represents a stealth price cut to some extent).

All that said, if you're only interested in WiFi and Switching it still mostly works albeit whether their current engineering can keep up with the sudden shifts is an open question. And the basic stuff is pretty cheap, reasonably performant overall, and has nice physical design. If you don't use them for routing/firewall/services (where they are utter garbage) but run that via something like OPNsense or VyOS or whatever you like instead, then a lot of the downsides go away or become manageable. Having devices be on a management VLAN and isolated controller is trivial and goes some ways towards helping any security flaws as well.

I'd still hesitate to recommend them for greenfield projects though. But unfortunately there also isn't anything else I can point to and just say "yep that's the drop-in replacement", industry is depressing right now with all the either total isolated individual web management on the one extreme or cloud-subscription-tie-in on the other. UniFi's strengths and model doesn't have an obvious successor. I remember some news that Cisco seemed to be aiming right at them, but haven't been able to locate it again? There are a few other self-hosted options apparently but I at least haven't been able to quite figure out their licensing and limitations yet.

Edit: I'll also add in fairness that even if an upgrade is junk, I've never not been able to recover. Recovery has absolutely been a bit hair-raising on occasion, particularly when the controller once hit its 4GB log limit IIRC and silently corrupted itself then backups for months, but even there I still managed to manually get into mongo and get controller config back out. Just keep an eye on your backup system there. And even super dead devices I've so far over the years always managed to get back with at worst TFTP. In that regard it's been pretty solid though again routing aside.

I seem to have been an outlier, but 3-5 years ago I went all in on Ubiquiti, except for APs, about a year ago pulled it completely out, partly because of problems with updates:

- One switch update enabled some sort of loop detection which broke the Google Wireless meshing with Ethernet backhaul, and their support people, after several attempts, proclaimed was not something that could be disabled. Fixed it by putting in a dumb Netgear switch that only connected the Google mesh nodes, but disappointing to find on a $400 "Prosumer" switch.

- One set of camera updates left 4 of my 5 cameras unbootable and support was unable to provide a solution for. This was after their warranty period, so I have them sitting around because I can't quite bring myself to throw them away.

I replaced the switch with a used Aruba PoE switch ($90), the cameras with a Montavue (VAR for HIKVision cameras), and BlueIris setup. It pained me because the Unifi Protect mobile app really was best in breed, but not too much because I frequently had issues with the cameras reliably booting, and would have to go through rebooting cameras for a few days after updates or a power loss.

I'd recommend Ruckus R610 used gear for wireless, though for the last ~6 months the prices on them have doubled -- I got one 9 months ago for $150 landed, and now they all seem to be more like $300+. Fantastic APs though.

I’ve had regular issues with the software. Every few versions of the AP firmware seems to break mDNS. All wired clients in the VLAN will see the multicast packets but none of the wireless clients will. Super frustrating since it breaks Chromecast and airplay. Luckily when I upgrade to a broken firmware it’s easy enough to downgrade to a working version.

People complain a lot but I’ve run a unifi stack for years for my home network and my parents with auto updates on across a lot of devices and have had zero issues.

Since I bought into the Omada system due to the HN hive-mind shifting against Ubiquiti, I'll take this opportunity to write about the experience.

The system is obviously inspired by Ubiquiti. The hardware seems good, I quite like the wall-mount APs that have a 3-port ethernet switch on the bottom. Be warned that there is different hardware between the similarly-priced wall and ceiling APs - the wall-mount ones have supposedly inferior Mediatek chipsets. The software controller is okay. It has pretty basic features. It doesn't have a real-time per-client bandwidth utilization view, you have to refresh the tabular data screen to see what's using bandwidth. It runs fine without creating a TP-link account and you can control it on the same network with a phone app. You need to create a TP-link account to have the controller check for and download firmware updates. They do provide debs for the Linux controller software, but don't have a repository so you need to update with other means.

The firmware that the router shipped with had a bug that caused attempted firmware updates to fail, and it would then become unresponsive to the controller. Couldn't even reboot it, had to go in-person and power cycle it. Did eventually get it to update by doing it right after rebooting.

I tried to use WiFi rate control to push slow/low-signal 5GHz devices to the 2.4GHz bands, so the remaining devices could use the full data rate. This caused iPhones to regularly determine the WiFi wasn't working and disconnect.

Overall: its' fine. The hardware is a great value. I'm not convinced that TP-Link's software support or security is going to be any better than Ubiquiti's.

Just another data point here...

I upgraded from 5.14.23 to 6.5.54, and it took under a minute to update.

The controller also hooks into their switches, security gateways, etc to give you a single interface to control all the Ubiquiti gear on your network. If you just have their access points, the only reasons you might want to run it after getting the APs configured are checking the status of things and logging (for example, I can work out the schedule for a local wifi-enabled bus service by seeing when their access points were visible to my access points.)

Once your APs are configured, you can shut the controller down and they will hum along just fine. I imagine the phone app you used accomplishes much the same thing.