We dive into a more enterprise-level of network security and feature set for our offices. Should you?
For longtime readers, it should come as no surprise the robustness of our internal network at the PC Perspective offices isn't necessarily our primary focus. We spend a lot of time here dealing with misbehaving hardware and software, so when something works, we tend to stick with it—especially when our day-to-day workflow depends on it.
However, I have recently taken it upon myself to make some changes. The main impetus for this project was our desire to move to a mostly 10 Gigabit-enabled network. With the release of lower cost NICs such as the ASUS XG-C100C, it finally started to seem like the right time to
upgrade our network.
Previously—and try not to laugh too hard—the backbone of our production network was the Zyxel Gateway included with our Gigabit fiber service from our ISP. Honestly, this piece of hardware worked surprisingly well. We were able to get full Gigabit download speeds (our upload speed is restricted at the ISP level to about 300Mbps), and it worked without much of a fuss. The router interface was fairly awful, and confusing at times, but it worked. Additionally, we were using an ASUS RT-AC66U as an access point, not the built-in wireless from the Zyxel.
In the past few months, we started to see some odd performance issues with our network and streaming video. While we could do standard file transfers and HTTP traffic at the full 300Mbps upload speed, video streaming from applications like Plex seemed to stop working at about 4 or 5 Mbps. After diagnosing our internal network performance, we started to place blame on the ISP-provided Zyxel gateway.
After talking to a few friends who are invested into the HomeLab communities and doing some additional research, I decided that while roll-your-own solutions like pfSense are compelling and have come a long way, they weren't quite right for us. We were looking for more of a turnkey solution that remained flexible, but would also require less initial setup.
In the end, we decided to go with the Unifi family of networking gear from Ubiquiti as the backbone of our new network. Ubiquiti was kind enough to send over the UniFi Security Gateway Pro 4 (USG Pro 4), and the UniFi AC Pro AP to give us a great start. We chose not to integrate a UniFi switch into our network as we already had a Netgear XS716E 10 Gigabit switch available and Ubiquiti doesn't seem to offer an equivalent 10 Gigabit option currently. However, users who are looking for only 1 Gigabit connections should add a UniFi switch as it provides additional integration with the rest of the equipment.
For those of you not familiar with Ubiquiti or their Unifi product line, they are a company that prides themselves on the idea of "Software Defined Networking." Essentially what this means is, if your entire network stack consists of Unifi gear, you gain more advanced control over the network. Originally geared more towards the enterprise market, enthusiasts have started adopting Unifi gear into their home networks due to the impressive amount of customization that they offer while remaining in a similar price range to the highest end of home networking gear.
The USG Pro 4 is the device that serves as the backbone of our internal network. Connected directly to our ONT (Optical Network Terminal) for our fiber connection, the USG acts as both a router and a firewall. Setup of this device from a physical perspective is effortless. Once you plug in your internet connection to one of the available WAN ports on the USG Pro and your switch into the first LAN port, then you are done hardware wise.
The software side of the UniFi networking products is where Ubiquiti excels but is also where I had to adjust my preconceptions the most coming from consumer-level networking gear.
Instead of being controlled individually, all UniFi products link to one central web interface. However, instead of running web servers on all the individual pieces of gear, you instead have to run the Unifi Controller application yourself on any device on your network. The controller is a lightweight application, able to be run on devices like Raspberry Pis, but keep in mind that it should be running at all times.
We had a bit of issue setting this up on our network, and I would recommend that anyone who is seriously deploying a UniFi network pick up a Cloud Key, essentially a preconfigured single-board computer that Ubiquiti sells to run the controller application. It's a $80 device but is dead simple and Power over Ethernet-enabled allowing you to plug it into your network and not worry.
Once you have the Unifi controller application running on your network, you can configure your network using the UniFi web interface. While I haven't had any experience with similar enterprise-grade networking solutions, I can say that the UniFi interface is miles above anything I've ever experienced with consumer equipment.
The UniFi interface is responsive and is organized in a way that allows you to view the data you are most often looking for without having to dig into menus upon menus. Additionally, if configured, you can gain remote access to your network console from anywhere via Ubiquiti's website, as well as apps for iOS and Android.
For the most part, I haven't delved too deep into many of the advanced features of the USG Pro. However, I am in love with a particular feature called Deep Packet Inspection (DPI.) DPI gives you a real-time breakdown of traffic categorized into typical applications, as well as what clients are doing what.
For example, here you can see that someone on our network has been doing a lot of uploading to BackBlaze lately. While this might not be a problem, it's great to be able to see what traffic is slowing down your network when you are running to an issue. From this same menu, you can drill down another level and see what clients are responsible for the traffic from any given application as well. DPI does require additional processing power from the USG, and some users have reported slowdown on their connections in some scenarios, but the USG Pro 4 can handle DPI enabled on our 1Gbps/300Mbps connection with no issues.
One complaint I do have is that there's no way to view historical DPI data. The counters continue counting up from when they were last manually reset. I'd love to see a feature where I can display DPI data over specific time frames such as the previous 24 hours, week, month, etc.
The UniFi Wireless products are one of the areas on which Ubiquiti has built their fantastic reputation. UniFi Access Points are meant to support large numbers of clients, at high levels of performance through technologies like band steering, airtime fairness regulation, and seamless handoff between access points. Our UniFi AC AP Pro is a $130 access point which provides dual radio, 3×3 MIMO 802.11ac support.
Personally, I view our move to this gear from Ubiquiti as a much-needed upgrade to our infrastructure. While we aren't using a lot of the more enterprise-level features of the UniFi product line at this point, we now have a lot more flexibility going forward. If we want to add a couple more wireless APs to the office, we can do that with a simple click in the UniFi interface. If we decide to start segmenting our network with VLANs, we can go down that deep and dark path. And no longer will I worry about our network being artificially packet shaped (at least internally, there's still the ISP-level that we can never quite count out.)
The dual WLAN ports of the USG Pro 4 are also appealing to us. While we currently only have one connection from our ISP, we have the flexibility to get a connection from the cable company as a fallback, simultaneously with our fiber connection. This may seem unnecessary, but our ISP's connection going down for 5 hours while I was writing this article has made it more and more appealing.
The UniFi Access Points, in particular, provide an exciting opportunity for some home consumers. My current router at home is an aging ASUS RT-N66U router that is perfectly adequate for my connection speed and the wired portion of my network, but wireless performance leaves something to be desired when used with more modern devices.
For $80, I can disable the wireless portion of my router and hook up a UniFi AP AC Lite and improve my wireless performance without buying a $350 high-end consumer router. And if I want to upgrade the wireless portion of my network, I can only replace the AP or add more to my house.
Keep in mind you are also getting a higher level of support with networking hardware like this. For example, Ubiquiti published firmware updates for the access points dealing with the WPA2 KRACK vulnerability the same day that the details were released to the public.
While I'll admit this isn't a good solution for all users, I think is appropriate for users who are interested in networking as a way to dip their toes into the water.
Stay tuned for more networking articles soon from PC Perspective as we continue to upgrade our network to 10 Gigabit and beyond!
YES. I love Ubiquiti gear.
YES. I love Ubiquiti gear. They add features in firmware updates on a regular basis (like blocking p2p will be available in the basic USG soon), and the AP’s offer the best wifi I’ve seen. Glad to see the upgrade went well!
I have used a combination of
I have used a combination of Cisco, meraki and ubnt stuff. the ubnt gear has not had any issues and is hands down the most cost-effective. meraki is fantastic but you pay a yearly license and that is expensive. the plus side is you get a lifetime warranty and they will upgrade failed APs with new models. the Cisco switches have been the most robust but they cost 3x as much. good warranty.
Interestingly I was in the
Interestingly I was in the boat as you Ken, using a variety of home networking gear which presented several challenges when it came to troubleshooting certain issues. I since have installed a USG Pro, 2 AP Pro’s and two switches. I still have a Cisco switch as well. But the Controller is what sold me. Having all this info available at your finger tips is simply awesome. It’s not the perfect solution as I am still fighting with some problems but overall it far surpasses what I had before, and it’s hard to beat from a cost perspective.
Well they sort of have a 10g
Well they sort of have a 10g product.
I use Ubiquiti at work for a lot of independent systems such as ride cameras and I am going to get it tested by qsc for their Q-Sys system. I really love their products.
The feedback I’ve heard on
The feedback I've heard on this switch isn't great, and lacking RJ-45 is definitely a downside for our particular application. I'm sure it's much more viable for enterprise-level applications though!
Heh. Thats why I said sort
Heh. Thats why I said sort of. I do use the ES‑16‑XG which is the Edgeswitch version (mostly the same) and its a damn good switch. They just released a 10g router so they have to be working on a 10G copper switch.
The success of 10GBASE-T is
The success of 10GBASE-T is not a foregone conclusion. The transceivers use a lot of power (up to 5W per port), and while twisted pair (unshielded or otherwise) is on its absolute last legs, existing fiber can definitely still squeeze out another few orders of magnitude speed gains. Most of the fairly few people who actually need >1Gb speeds are rightfully avoiding buying in when they know that even if they run Cat 6a, they’ll still need to rerun fully shielded Cat 7 etc. if they ever need to migrate to >10Gb.
I have been on Ubiquiti gear
I have been on Ubiquiti gear for about a year now. There are heaps of guides online for trouble shooting and it is rock solid. Haven’t had to restart any of the gear once. I have an Edgerouter X and an AP AC Lite for the house and a M5-16 Nanobeam to share my internet connection with my family two blocks away. Excellent value for time and money, it really is set and forget.
I prefer Mikrotik on the
I prefer Mikrotik on the router side of things but for wireless I find Ubiquiti’s APs are just awesome.
Ken – I assume the 10 gigabit
Ken – I assume the 10 gigabit switch won’t allow 2 x 5 gbps clients to connect at 5gbps?
Switches/Routers/Nics would need to support Nbase-t standard.
On the part of the UniFi
On the part of the UniFi networking product software where Iqbal is improved, it is also where I wanted to adjust my pre-concepts that were more than the consumer level networking gear.
in detail Know more at https://www.hpsupporthelpline.com/.
Instead of being individually controlled, all nonprofit products are connected to a Central Video Interface. However, on any device on your device, the application of a uniform controller application for automated tracking on your service level is also available on any device.