Help me move from unifi to something else

[crembz]

I know there isn't a lot of love for the unifi ecosystem here. It's been. Fine for me until recently where I expanded my network and want l3 intervlan routing. I bought a usw pro and realised how half baked the implementation is. I'm really after ACLs and dhcp relay, both of which you can't do.

So I'm racking my brain trying to work out an alternate solution. The usw pro agg is a nice switch with 24sfp+ and 4sfp28.

I have an icx7250 enroute and hoping it won't sound like a harrier jet or that will end the plan right there. I need to decide on a router, access switches and wifi.

Router probably pfsense or Sophos on esxi or proxmox cluster although have not ruled out dedicated bare metal on a mini pc, maybe an n100 box or an old m920q.

Access switches I'm thinking tplink managed 10g, 8 ports or more. I understand these can be managed standalone without buying into an ecosystem/controller. Another option might be Aruba.

Wifi ... No idea. Ruckus is non existent here so not sure what else stacks up.

I'm trying to avoid having a million different points of management in the network, just needs to work and be family friendly (I travel for work a fair bit)

I'll be running a VM cluster with 10gb NICs, a workstation with 10g and the usual network services, wifi clients and IOT devices in the house.

So I'm a little overwhelmed with decisions. Part of me things keep it simple and stick with unifi, part of me thinks I should look for a more flexible ecosystem, omada maybe? And then I'm thinking maybe I need to bite the bullet and flex my lack of network skills.

Questions:

How does omada compare to unifi in terms of l3 capability and flexibility? Availability seems much better.

If going with a mixed omada/icx/pfsense setup, how are vlans managed? Do these need to be defined on all network devices manually? I'm hoping no but guessing yes.

Are there any wifi aps that will integrate management into Sophos or pfsense? From what I can tell they all have some.sort of controller.

Esxi or proxmox for a virtual router hosting environment? I kinda prefer esxi, just feel more solid, but the built in zfs mirroring and data protection of pve could mean a standalone network 'host' with storage redundancy rather than a cluster with esxi.

How loud is the icx really? Does it have a noob friendly gui?

Sophos or pfsense? I hear that Sophos is more efficient for network traffic being based on Linux but pfsense is totally free and full of features.

So sorry for the long post, really appreciate any help here because my brain is fried!!

 

[tsteine]

@crembz
Hi, so, I can't speak to all the questions here, but I can give you some information about what I'm doing.

I have a UDM PRO for the "Normal network use" with vlans, firewalling, etc, on a /16 subnet I've set up for it, and all vlans it could possibly require for that.

Then I have a router in my homelab with another /16 subnet, which handles firewalling separately from the UDM, and I've set up static routing between them, so there's no overlap between responsibilities here, with the exception of having the UDM use servers in the homelab for DNS. With regards to firewalling/routing/performance, it seems to work pretty well.

The only thing I would like would be the ability to delete static routes and use BGP/OSPF for dynamic routing, but since Ubiquiti seems set on not providing BGP on the UDM Pro, static routing is the best I got.

 

[kpfleming]

The 'how loud' question will require knowing the exact model you purchased; you can also review the first post in the monster Brocade ICX thread for information about that model.

In my experience the web UI in the ICX series is minimal, at best. It is only sufficient for the most basic configurations.

 

[i386]

Wifi ... No idea. Ruckus is non existent here so not sure what else stacks up.

Where is "here"?

 

[crembz]

Where is "here"?

Australia

 

[crembz]

The 'how loud' question will require knowing the exact model you purchased; you can also review the first post in the monster Brocade ICX thread for information about that model.

In my experience the web UI in the ICX series is minimal, at best. It is only sufficient for the most basic configurations.

It's an icx7250-48p. I've read it's not 'loud' but that's subjective to the noise floor in the room and the listener.

Wrt the ui... Do you need to drop into the cli to setup vlans and ACLs? I'm beginning to think you need to get comfy with the cli to drive it, which in not really sure I'm going to have a good time with.

 

[crembz]

@crembz
Hi, so, I can't speak to all the questions here, but I can give you some information about what I'm doing.

I have a UDM PRO for the "Normal network use" with vlans, firewalling, etc, on a /16 subnet I've set up for it, and all vlans it could possibly require for that.

Then I have a router in my homelab with another /16 subnet, which handles firewalling separately from the UDM, and I've set up static routing between them, so there's no overlap between responsibilities here, with the exception of having the UDM use servers in the homelab for DNS. With regards to firewalling/routing/performance, it seems to work pretty well.

The only thing I would like would be the ability to delete static routes and use BGP/OSPF for dynamic routing, but since Ubiquiti seems set on not providing BGP on the UDM Pro, static routing is the best I got.

The issue I have with the udm is 10g speeds. Routing between vlans seems limited to 3.5g as it hits the CPU. Thus why I want to offload everything to the l3 switch. But without ACLs the network is wide open.

I suppose the solution could be to only route trusted networks at the switch, but in that case you might as well be running a flat network and using a cheaper l2 switch.

This is where the omada switches caught my attention, looks like they will do l3 switching and ACLs.

I'm trying to avoid dual Nat in the network. Seems like another layer to manage when I could just be using vlans.

 

[tsteine]

The issue I have with the udm is 10g speeds. Routing between vlans seems limited to 3.5g as it hits the CPU. Thus why I want to offload everything to the l3 switch. But without ACLs the network is wide open.

I suppose the solution could be to only route trusted networks at the switch, but in that case you might as well be running a flat network and using a cheaper l2 switch.

This is where the omada switches caught my attention, looks like they will do l3 switching and ACLs.

I'm trying to avoid dual Nat in the network. Seems like another layer to manage when I could just be using vlans.

Yes, inter vlan routing on the UDM Pro is not fast, so everything I have that needs >2.5 gbit is connected to the switch/router in the homelab rack, so I think the reason why it doesn't bother me is quite simply that I don't need>2.5gbit speeds on the UDM.

 

[crembz]

Yes, inter vlan routing on the UDM Pro is not fast, so everything I have that needs >2.5 gbit is connected to the switch/router in the homelab rack, so I think the reason why it doesn't bother me is quite simply that I don't need>2.5gbit speeds on the UDM.

Yeah this is a good point. What do I need. The vlans that need to be isolated won't ever need much in the way of speed for routing and so can live on the udm and have fw rules applied. The rest can live on the usw pro and be open.

I just feel jibbed paying a high price for an l3 switch that isn't an l3 switch. Enough so that I'm willing to pay more to ditch ubiquiti and go on a massive rant about false advertising hahahaha

 

[kpfleming]

Wrt the ui... Do you need to drop into the cli to setup vlans and ACLs? I'm beginning to think you need to get comfy with the cli to drive it, which in not really sure I'm going to have a good time with.

ACLs, yes. It's probably possible to manage VLANs using the Web UI, but I've never tried.

 

[Parallax]

ACLs, yes. It's probably possible to manage VLANs using the Web UI, but I've never tried.

It is. The version 8.x OS has a functional but clunky GUI which you can set up VLANs etc. But I'm not sure about ACLs. 9.x is much better looking but has a similar feature set. The big gain going from 8 to 9 is that with 9 you can upload new firmware to the switch directly from your browser, whereas with 8 you have to set up a TFTP server which can involve misery.

 

[OrlyP]

FWIW, the icx7250-48p has a published acoustics rating of 44.7dB @25°C (77°F). Closest noise comparison is between soft rain and a running fridge.

I use UniFi gear for APs, then a Cisco L-3 switch, Windows Server for DHCP and local DNS, Pi-Hole, and Arista/Untangle as firewall.

I only do ACL for inter-VLAN routing on the Cisco switch. All internet-related policies are handled by the firewall.

The Cisco 3560G-24TTS has a noise figure of 42dBa. It gets loud when the fan goes full-speed during boot-up but it has never come to that under normal conditions.

 

[crembz]

It is. The version 8.x OS has a functional but clunky GUI which you can set up VLANs etc. But I'm not sure about ACLs. 9.x is much better looking but has a similar feature set. The big gain going from 8 to 9 is that with 9 you can upload new firmware to the switch directly from your browser, whereas with 8 you have to set up a TFTP server which can involve misery.

I'm ok with clunky so long as it's functional. I find pfsense clunky compared to unifi but it is functional.

FWIW, the icx7250-48p has a published acoustics rating of 44.7dB @25°C (77°F). Closest noise comparison is between soft rain and a running fridge.

I use UniFi gear for APs, then a Cisco L-3 switch, Windows Server for DHCP and local DNS, Pi-Hole, and Arista/Untangle as firewall.

I only do ACL for inter-VLAN routing on the Cisco switch. All internet-related policies are handled by the firewall.

The Cisco 3560G-24TTS has a noise figure of 42dBa. It gets loud when the fan goes full-speed during boot-up but it has never come to that under normal conditions.

OK it sounds like it might work out then.

How about ESXi vs pve as the host? Keen on ZFS for storage level redundancy, however if running across an esxi cluster it may not be so relevant. Obviously the nas would present a spof.

 

[crembz]

FWIW, the icx7250-48p has a published acoustics rating of 44.7dB @25°C (77°F). Closest noise comparison is between soft rain and a running fridge.

I use UniFi gear for APs, then a Cisco L-3 switch, Windows Server for DHCP and local DNS, Pi-Hole, and Arista/Untangle as firewall.

I only do ACL for inter-VLAN routing on the Cisco switch. All internet-related policies are handled by the firewall.

The Cisco 3560G-24TTS has a noise figure of 42dBa. It gets loud when the fan goes full-speed during boot-up but it has never come to that under normal conditions.

Received the icx7250 today and plugged it in ... Wow it was loud starting up. The rams ramped down after about 60s but still not something you'd want running outside of an isolated room. Unfortunately for me my study does not have a door and I can hear the switch from anywhere in the house. Frustratingly I had to turn it off after 10 minutes, even the Mrs was asking what that noise was.

I dont think there's any way to control the fan speeds other than physically modifying the box with different fans.

Looks like I've now a choice to just put up with the unifi agg switch or move everything to omada ... Decisions decisions

 

[hmw]

I was in the same spot as you are. Had a Unifi XG24 switch and used that with a Netgear MS510TXPP for POE. Since Ruckus was expensive because of the pandemic - had to go with Unifi APs.

When I built a homelab with an ICX6610 & VLANs, the XG24 had VLANs trunked to my OPNsense firewall and I enabled inter VLAN routing using this guide here. The problem is that the combo of trunked VLANs + OPNsense = instability that manifests in the VLAN interfaces flapping every 5 - 10 mins. This causes all sorts of problems with Zoom/MS Teams and streaming.

I was forced to use Ruckus - got a ICX7650 and it was LOUD, meaning I had to soundproof my server rack. Even compared to my ICX6610, it was loud. OTOH, neither of these switches is suitable for home use unless you have an enclosed server rack + separate room (i.e basement or enclosed closet with acoustic panels / isolation)

If you don't mind spending time or $$$ either doing it yourself ( DIY rack ) or buying something ready made (eg: Star Tech or SysRacks or APC Netshelter CX), you could quieten it down enough for home use

The other option you have is to use ICX 7150-24P or ICX 7150-48P and use it in fanless mode - you're limited to 150W of PoE budget when turning the fans off and these switches have only 4 x 10G ports


You can also do fan mods for the 7250 but that can be problematic

 

[OrlyP]

Just asking... how many PoE devices do you guys actually power with the switch?

I only have two and I'm fine using a couple of discrete power injectors. I was thinking of getting a PoE switch but can't justify the added cost and bulk.

 

[hmw]

Just asking... how many PoE devices do you guys actually power with the switch?

I only have two and I'm fine using a couple of discrete power injectors. I was thinking of getting a PoE switch but can't justify the added cost and bulk.

I have 3 Ruckus APs, a CloudKey, four cameras and a doorbell and looking to do a few iPads in kiosk mode for HomeAssistant (will use PoE to power them)

The Ruckus APs need 802.3bt because they have 2.5GbE ports.

 

[Sean Ho]

I extend all my VLANs out to OPNSense as my sole router, with no instability. I also designed my VLANs so as not to need to route at 10GbE; all the high-bandwidth stuff stays intra-VLAN on the ICX6610. (BTW, fan mod to the 6610 was a fun little project with a 555 timer; several threads here on how to do it.)

I've heard good things about Omada, especially as a competitor to UniFi. I haven't used any single-pane-of-glass interfaces; I just configure each network device separately; VLAN config doesn't need to change often, and I've documented the process so it's not too bad.

 

[crembz]

Tbh I'm not even sure the TP-Link switches do intervlan routing with acl. They market them as layer 2+ whatever that means.

Single pane of glass is nice but yeah I'm seeing the limitations. You have a good point, design vlans in a way that circumvents the need for routing

 

[crembz]

Just asking... how many PoE devices do you guys actually power with the switch?

I only have two and I'm fine using a couple of discrete power injectors. I was thinking of getting a PoE switch but can't justify the added cost and bulk.

I power a couple of passthrough Poe switches atm. Once I add cameras I might end up with more.