My setup is definitely more on the prosumer side, but it's been so build out and inspect my network with their tools.
I've also had three instances where upon rebooting due to a power outage or a system update, my inbound firewall / port forwarding was just broken. UniFi simply did not pass packets to my server. Once again, a full reboot of every UniFi device on the network resolved it.
I really want to like UniFi, and I appreciate how much access I have to SSH in and figure out what's going on (and I did take tcpdumps and have a support case open), but it has definitely not been plug-and-play for me.
I'm using a UDR7, U7 Lite, a number of managed UniFi switches, and just recently added the U6 extender.
The primary case I have open currently is in regards to the port forwarding / routing breaking on some restarts.
Still 100X better than the competition though. My UDM has worked wonderfully with support for dual IPs and seamless failover
I was quite a lot happier after the switch, as I didn't have to hassle with UniFi and my APs stopped needing roughly-monthly reboots.
Their long-distance wireless and outdoor wireless are great, but their regular WiFI access points and software are at most adequate. They are not keeping up with the state of the art.
Does that mean that the performance is middling (making them -IME- equal to UBNT's APs), that they never have APs that use the very latest and greatest WiFi version, or both?
I think they've just given up on that sector, and they're focusing on more specialized outdoors/long-distance wireless.
I don't want to get into the Ubiquity ecosystem because it's typically all-or-nothing plunge. And I distrust complicated managed systems out of general principles.
They have several APs that have 2.5Gbit ethernet (one with a 2.5Gbit SFP+ cage), and one AP with a 10Gbit SFP+ cage. Additionally, all their APs run RouterOS, which means that you can bond links together to fairly-reliably get additional throughput. [0]
In regards to Wifi 6e and Wifi 7, it looks like Mikrotik takes quite a long while after a new Wifi version to release hardware that runs it. I expect your assertion that they've given up on 6GHz for home/small-office APs is incorrect.
[0] Yes, I've personal experience with using link bonding on Mikrotik hardware. As a knowledgeable someone would expect, it usually provides you with additional throughput proportional to the number of bonded links.
But I've just checked the Mikrotik hardware list, and I don't see indoor APs that are PoE-powered and have more than one Ethernet port. Maybe I'm overlooking something?
a) Who said anything about that? In the four comments prior to this one, that set of requirements wasn't brought up.
b) Yes, you are absolutely overlooking something. On the Products page, try expanding the "Features" widget of the "Product filters" section, checking the "PoE-in" option, and hitting the "Use filters" button. Even the AP I mentioned with the 10Gbit SFP+ cage has PoE in.
I tried again, and I see only mANTBox and NetMetal ax access points. Both are designed for outdoor deployment and would be very awkward indoors.
I'm not sure what you've done to only see those two APs. Based on your confusing report, it seems like you're also looking in the "Wireless systems" category. Try the "Wireless for home and office" category.
If you try and fail again, please do post the URL of the page you're looking at.
I definitely see more options now. Still not super great (no 6E), but definitely viable.
My experience is very binary. I had some Mikrotik RF installs that Just Worked, and never needed attention. And some that were just problem children constantly demanding reboots.
Mikrotik code isnt the most stable beast in the world, but if you keep it at a certain point in time you are usually safe. But then that brings you back around to the security issues again.
How's that different from a Unifi AP? Unless they changed something in the past five, eight years, the software running on the AP is pretty much OpenWRT with the serial numbers hastily filed off. [0] Get a shell, and you get to download whatever to do whatever you need.
[0] Me coming to this realization is what lead me to switch over to OpenWRT. I didn't need any of the fleet management stuff provided by UniFi, and was constantly frustrated that the APs had to totally reboot whenever you changed nearly any setting on them. (I heard that they eventually fixed that particular shortcoming. Good for them, I guess.)
Cambiums shell from memory is much further locked down. IIRC you need a possibly predictable password form cambo to do get full root shell on a lot of devices.
If we're ignoring access-control-violating logic errors, then Mikrotik's shells are quite locked down. As you'd expect, you can provision multiple users with a variety of privs... and even make a user that has no configuration modification privs at all.
You can also very easily deny remote access to any credentials other than a username and SSH key. Good luck predicting an SSH key.
But if we're not ignoring coding errors that bypass access control, then I expect that Cambium is no less vulnerable than anything else out there. They're certainly using either BSD or Linux with some proprietary goop layered on top to make it look super sexy.
In that same house switching over to Ubiquiti just worked, and worked well. I had the same setup (mesh nodes on every floor), but performance was substantially better (2-4x).
I've moved house, and now have wired APs on every floor, and get phenomenal performance. The management UI to see what is where / how its connected, and when something doesn't work is very good. It also enables things that were hard / difficult with other non-'prosumer' gear. Like I can have multiple WAN ports, and plug in a cellular modem, so that when my internet doesn't just work (which happens way too often) it auto-fails over to the cellular modem, and continues just working.
The reason I went with Ubiquiti in the first place was their Unifi Protect line of cameras, and again those 'just work' from the wireless small ones to domes / etc plugged into wired connections they all just seamlessly connect to my dream machine, and provides a great UI, and the data is on prem which I want.
The only thing Ubiquiti doesn't do the way I want is DHCP + DNS, so I have a seperate raspberry pi doing that.
After years of fussing around with either linux / pfsense / ... routing + firewall solutions, and different AP / meshing configurations the ubiquiti stuff is very hands off.
I don't really do more 'advanced' routing (other than maybe the unifi protect aka camera stuff it sounds like we're describing similar configurations), it's just that when I tried to achieve the configuration you're describing with Asus it was impossible, with TPLink it took a lot of fiddling / configuration and never 'worked right' (right meaning as well as I thought it should, though I've not tried TPLink in a primarily wired configuration) where as the ubiquiti stuff was plug and play and just 'worked right' (close to the speeds and reliability I expected both in a mesh mode and in wired).
The whole camera thing -- which is what really got me to pay the ubiquiti tax -- is another story entirely, I'm sure there are lots of other good options for self hosted IP camera solutions, but I couldn't find any ones I wanted to use, and again with ubiquiti it was super plug and play, and once I'd bought the UDM to do camera stuff and saw how well that worked I wanted to try the ubiquiti networking stuff, and it worked better with less configuration that the other alternatives I'd tried.
With infinite time and finite budget ubiquiti is not the right choice for home networks, with a sizable budget for home networking equipment minimal time investment and a preference for performance ubiquiti has worked out better for me than alternatives out of the box, and better for me after spending time tweaking and trying to optimize TPlink (meaning ubiquiti out of the box was better after trying to optimize TPlink).
If "not ubiquiti" works for you out of the box, or in the configuration you're already in then you're all set, and you're definitely not missing out on anything. If things aren't working out of the box and you're tired of fiddling with it, or your other goals aren't possible, and they are with ubiquiti maybe it's worth the investigation.
I also _hate_ how much I sound like an ad for ubiquiti. I'm really not, but I think I've spent more time writing these two comments than I've spent having to fuss around with my network equipment in years.
It's hard to not notice the ... ubiquity of praise for their gear over the years, but I haven't seen much clarifying what sets them apart. Maybe I should look at them like peak Apple but for networking gear?
When I was willing to spend time on this (home networking + cameras) I would have never touched this equipment. It was all open source / cheap stuff with BSD or Linux routers, random switches, home assistant raspberry pi's connected to USB cameras. It would take some time maybe not a lot, but enough, and it would break frequently enough due to some update somewhere or something.
Right. Just like 5Gbit PPPoE uplinks over VLAN. In fact there is no Ubiquiti router which can handle 1.5Gbit+ PPPoE for some reason. So, I have a mikrotik in front of UDMPM just to termiate PPPoE and I had to buy a IPv4 /29 subnet to avoid double not.
Everything just works, sure.
I ended up going with TP-Link Omada and have been happy so far (a managed switch and wifi 6 WAPs). I am a bit concerned about their security track record given how bad their soho products are, so I ended up sticking with my opnsense router at the perimeter as the first line of defense.
I’m curious to hear what you think you’re missing out on with Omada.
Well, [0] mentions that they left the ER firmware alone for two years. They also don't sell the ER hardware anymore.
Looking at the changelog in combination with the comments on the news item about the new release, it looks like there are many bugs left unfixed. If this analysis is correct [2], nearly nothing was changed.
That smells an awful lot like abandonment.
> ...VLAN issue unacknowledged and unfixed... were both wrong.
This subthread [3] disagrees with you. As someone who has suffered through multi-quarter "struggle sessions" [4] with UBNT engineering staff about broken basic functionality, I can totally believe a report that UBNT claims something has been fixed when it's very much not fixed.
[0] <https://news.ycombinator.com/item?id=44794857>
[1] <https://community.ui.com/releases/EdgeRouter-3-0-0/33ee3852-...>
[2] <https://community.ui.com/releases/EdgeRouter-3-0-0/33ee3852-...>
[3] <https://news.ycombinator.com/item?id=44756915>
[4] Complete with round after round of them saying "Hey, we fixed it! Try the latest beta!", and me replying "No, you didn't. Did you run my 100% reliable reproducer that I've given you? It sure looks like you haven't because that reproducer still reproduces the problem.".
Ubiquiti has had plenty of bad security issues as well I'm afraid, but fundamentally one of the advantages of both is that with a self-hostable controller and VLAN isolation you should be able to minimize your attack area pretty well from both the LAN and WAN. No remote dependencies at all. But like you I run OPNsense at the edge, you do at least have to trust their firewall and such if you want to go full single-pane.
TP-Link stepped in and have been working hard on Omada being a direct competitor. It's clearly inspired liberally from UniFi but that's A-OK by me, it's healthy for both to be going head to head. In my experience it had somewhat fewer features, particularly initially, and they definitely don't cover the full breadth of cool and useful niches that Ubiquiti does either. But what there is has worked well and been more reliable for me, particularly in a mixed environment. For example Omada worked perfected day 1 with automatic L3 controller discovery using a simple DHCP Option 138 set on my OPNsense unit pointing right at my controller FQDN. It was easy and built-in to supply a proper certificate for the Web GUI. I never got either of those to work with the UniFi controller. The switching has been rock solid reliable and the WiFi more performant, better coverage, and features like PPSK were added way before Ubiquiti did and have a much better interface.
However, Ubiquiti does seem to perhaps be turning things around a bit. Their router hardware is no longer garbage, even if it is of course far less then you can do yourself. From what I can see in simple ongoing tests they do a better job on the software side for router features now as well, so if you're all-in on both systems for the total single-pane experience UniFi might once again be better. Their announcement of the "UniFi OS Server" 3 months ago (in Early Access) and publicly last month was both a surprise and heartening. Rarely does one see companies that start down the path of lock-in reverse course at all. If they make it possible to run all their various controller applications on your own hardware I'd definitely start to add more back into my mix.
So if you've got decently modern Omada hardware (and you probably do because not like it's been around that long, in terms of networks anyway) I'd be in no massive rush to switch to UniFi unless you see some key specific things you'd like. If you think you ever might want to roll your own other infra same thing even harder. But if you're thinking about a bunch of upgrades anyway then worth keeping an eye on and looking carefully at the various feature mixes each have.
And that's a really statement that makes me super happy to say, because I think each is now driving the other, which is really healthy for this ecosystem!
I was more just curious if I was missing out on something great (or if I ever decide to upgrade to WiFi 7+)
I am eyeballing the new NAS to play with soon.