1

My company (one building, ~100 employees) currently has a very old stack of Cisco blade switches that act as our L3 core. These are no longer supported, due to their age.

About a month ago, our entire network was taken down. Come to find out, an old dev server was turned on accidentally (we figured out how it happened), and it blasted our network with ARP requests (70k/sec) and took everything down. We got the network up and running, but something we discovered was that our switches were too old and did not have flood protection. We tested the problem server with a Unifi switch and the traffic was normal. The Cisco stack was due for a replacement, but this was the straw that broke the camel’s back.

In order to avoid a potential 100k - 150k invoice from Cisco or Fortinet, we have entertained the idea of going with Unifi. They are affordable, but we have some concerns. So, I come to you asking for clarification, and if anyone has been in a similar situation.

One thing I want to make very clear is that we are not using the Unifi Gateway for routing. We are keeping our FortiGate in place. That being said, is Unifi far along enough where it can be a valid contender in a production environment?

Currently, it seems that you cannot make changes via CLI (they reset upon reboot), ACLs require reciprocal rules to be in place (stateless?), ACL limitation, etc.

Basically, my question is this. Are we wasting time with Unifi? Especially if we do not plan to use the Unifi GW? In my opinion, it is more suited for very small businesses, and advanced home networks. Has anyone considered moving to a Unifi stack, but was turned away by lack of features or complexity?

The main reason we are looking into Unifi, of course, is money. Unifi switch stack would cost us 15k vs the previously mentioned 100k or more quote. Obviously, you get more features when you pay 75k more, but I assume everyone understands our reasoning for wishing to save said 75k.

Any advice or insight is appreciated!

6 Spice ups
2

For 100 users? shouldn’t you need like 3x 9200-48P-e and with the acl and layer 3 1x9x00-A ?

Total cost closer to something like 15k? Is there something I’m missing regarding just the stack? Are you needing all 10G copper or some other specialty?

What kind of ACLs are you putting in place? (This is more a question for someone to look at from the ubiquiti side)

5 Spice ups
3

We are using Ubiquiti for switches and APs. Love them. Went for something more robust at the router/firewall level.

2 Spice ups
4

We’ve been beyond happy with our Aruba gear, 2930M stack; we have about 90 users but many have multiple devices. We have a stack of 6 switches, but for your use case you probably only need 2-3 switches for coverage.

They’ve been rock solid for nearly a decade now but are no longer available. From my quick research it looks like the 6200 series is the replacement line going forward for access switches.

We specifically went with Aruba for cost when put up against Cisco, and they were a huge step up in functionality compared to the NetGear hardware we replaced.

3 Spice ups
5

I don’t know if I would put UNIFI equipment into a “business”. I am going to get all kinds of hate for this, but they are NOT business grade (mission critical) switches. And the support is lacking.

In addition to what @BadAtNames said, I will add this:

  • Audit your environment and identify the actual and future port needs.
  • Review the network topology
  • Identify your switch/port requirements
  • Contact 3 Vendors (Meraki, Aruba, Juniper)

Get some pricing and options. I would focus on support as well, since today, that is what really matters. Especially for small IT Department.

6 Spice ups
6

I’ve been eyeing the EFG / Unifi Stack to replace a Meraki Stack .. it seems some fairly good advancements are being made with Unifi IMO.

2 Spice ups
7

Did you start with Ubiquiti? Or did you migrate an existing switching infrastructure?

1 Spice up
8

Thanks for this! I will check these out.

1 Spice up
9

You should have no problem with UniFi switches and keeping the FortiGate for the gateway.
You WILL need a controller to mange the switches, but that’s easily done.
The best option for that is to just add a CloudKey+ to manage the switches.
The other option is to go with the UniFi Hosting, which is a cloud-based management option.
I have several years experience working with the CloudKeys, from their first generation through current, but I’ve never personally used the cloud option so I can’t provide any good opinion on it.
However, from a cost standpoint, the cloud option starts at $29/month whereas the cloud key can be picked up for just under $300. You would pay for the cloudkey in less than a year of the cloud based subscription service.

Bottom Line: Pick up as many UniFi switches as you need PLUS a CloudKey. Management is a breeze with this setup.
There are many options for switches. Your needs will determine which models to purchase.
We primarily deploy the Pro series of switches. The new Pro Max is just too much extra cost for nothing really more than some pretty lighting on them and some 2.5 GbE ports.
If you need 10GbE RJ45 ports, the Enterprise line will fit the bill for that.

3 Spice ups
10

I have to disagree with you. While early UniFi product may not have been business grade, they certainly are now.
We are an MSP with hundreds of UniFi switches across our managed clients. Failure rate has been extremely low. Better than the failure rate we had with HP/Aruba equipment.

While their gateway products are not as robust as FortiGate, SonicWall, or pfSense, they do work fine in small business environments.

But as for the switching and wi-fi equipment, the current and previous generations have been outstanding.

Regarding support, you are correct. Direct support is fairly non-existant. However, their support forums community have been more helpful than many other vendor’s own support.

4 Spice ups
11

Not using their gateway but we use their switches and AP’s. For sure take the time to setup a Linux VM to host the web-based management tool…

IMO after using it for a couple months, I’d prefer Meraki…it just ‘works’ but costs are higher…

2 Spice ups
12

When I started, we had a variety of other switches. Slowly, as budgets allowed, I made the migration to replace all the switches with Ubiquiti. For the APs, we had Cisco APs. I was frustrated with the cost and complicated configurations, and went to Ubiquiti. I have had 2 cycles of upgrades as technology has changed, for the APs.

Side note. If you have any kind of virtual on-prem cluster, you will want an appropriate switch to support the backend traffic for the cluster. Ubiquiti is usually not listed on the hardware list of any virtual environments.

1 Spice up
13

Have you run into any specific limitations using Unifi that you may have not otherwise run into with another provider?

1 Spice up
14

Hypothetically if the cloud key fails, I am unaware of a means of administration. We have tried CLI (we have a test environment with a Cloud key and 2 switches) but the changes don’t stick.

1 Spice up
15

Other than message boards, is there any?

2 Spice ups
16

There is an annual $1500 support through them, which is not bad price wise, but I have not heard much about it.

1 Spice up
17

Personally, with the well being of my company on the line, I am not in the least comfortable with unsupported devices like Unifi. We have Cisco’s in house. We are a large org with 40+ switches and over 150 AP’s on Cisco 9800 WLC’s

1 Spice up
18

Not having fully functional CLI/SSH style access to individual switches has been a learning curve…I can’t just remote in and reboot a switch, for example. I would have to be on-site, yank the cable type management, because the switch in question has lost connection to the management console and I can’t yank it during the day. But other than that, there’s no real issue with how the product runs.

19

Ubiquiti now offers for their switches a 5 year NBD replacement option and they even now offer as an option full support Professional Phone Support - Ubiquiti

3 Spice ups
20

I run my own controller in-house. Like any server, if the controller fails, the equipment continues to run. I stand up a new server or restore from backup. Additionally, I backup the controller data and can restore the data on a new install if that is a better choice.

2 Spice ups