Initial review - Ubiquiti UDM SE

[OVERKILL]

My MX subscription was up for renewal so I figured now would be a good time to try out something new. @Rand had told me of his positive experience with his UDM, so I ordered one up to lab it out and see how it compared.

Previously, I was using a Cisco Meraki MX64 w/SEC subscription, which gives you IDS, AMP and content filtering in addition to the basic firewall functions. Before that I was using a Cisco ASA, before that, a Juniper SSG.

On to the UDM:
This unit can be both cloud or locally managed. While you can do pretty much everything through the cloud/WebUI, as @wwillson is eager to point out, since these are just a Linux box, you can SSH into it and manage IPTables directly through the CLI, as well as perform other functions that the GUI doesn't allow you to do.

McCann has a great table that compares the specs of the different models:

UniFi Router Comparison: USG vs UDM vs UXG — McCann Tech

Overview and comparison of all UniFi router models: USG, USG-Pro. UDM, UDM-Pro, UDM-SE, UXG-Pro and UDW.

evanmccann.net

With 3.5Gbit of IDS/IPS throughput, it is massively more powerful than the MX64, and this is quite obvious in use where the reduction in latency is quite apparent.

It shows up in a big box:

And this is what it looks like installed (it's rack-mount):

You are prompted to perform the initial setup using the phone app, which wants you to create an account to manage it through the cloud. The process is very straight-forward, I just recreated my VLAN config and everything just "worked" out of the box.

The unit had to reboot 3x times for firmware updates. Despite the unit being fresh stock, it had to do 1x V2 firmware upgrade, then an upgrade to 3.x a then a further upgrade to 3.1.x to get on the current release.

You don't have a lot of control over the switch ports, unlike the MX64, which allowed granular config of each port (the lower end ASA's are the same way).

The Dashboard looks great, and is easy to navigate. However, it's a bit disjointed compared to the Cisco Meraki one, but then you aren't paying for a subscription, so I'm not going to harp too hard on it.

Configuration was very straight-forward, though some of the category descriptions are a tad vague.

I ran into an interesting artifact/bug with respect to trying to control DNS traffic, which took me longer than it should have to figure out:

I created a rule to block all outbound DNS queries, placing it after a rule to allow DNS queries to my specific DNS servers. Neither rule worked. I played around assigning it to different interfaces, changing the scope, changing how it was applied...etc. I even created an explicit single rule to block all queries to Google DNS, I could still hit it with nslookup and resolve queries, but could no longer ping it.

On a hunch, I removed one of the networks from the ad blocking, and then all of a sudden the rules for that network worked. It was at that moment I realized that the ad blocking on the device must re-route DNS queries and it creates a DNS allow rule that you can't see from the GUI, that of course then overrides any of the DNS blocking rules I was creating. Turning off the ad blocking feature removes the hidden rule, and the user defined rules then work as expected.

While this unit is a bit expensive for Joe Average home user, I do think that the more consumer-geared models with integrated Wi-Fi, priced more moderately, are a very good option for people looking for something better than your Best Buy/Walmart special.

 

[Rand]

The UDR is currently in stock. $199

Dream Router - Ubiquiti Store

Desktop UniFi Cloud Gateway with an integrated WiFi 6 access point and PoE switch.

store.ui.com

If you have gigabit+ internet you need a higher up model.
other than that and the limitation of 2 applications (I only run 1)
it has almost all the features of the higher end models.
Built in wifi 6, regular POE... etc.

 

[Pew]

It looks like a great middle ground between run-of-the-mill consumer routers and an enterprise router. Lots of options for the power user, enough options for IT experts, good controller UI layout, and all their hardware aren't exploding in colors or shape. And they all integrate with one another!

 

[dogememe]

I used to love Ubiquiti.

Then I experienced the unreliability of their hardware. Failing power supplies due to poor quality capacitors in UniFi switches. Failing flash storage in EdgeRouters because of cheap flash drives. To name just a few instances. Yes all things fail and Ubiquiti is far cheaper than real business class gear but it's prosumer at best and should not be relied upon. I cringe when people use it in an environment where uptime is important esp when no spares are on site.

 

[Pew]

I used to love Ubiquiti.

Then I experienced the unreliability of their hardware. Failing power supplies due to poor quality capacitors in UniFi switches. Failing flash storage in EdgeRouters because of cheap flash drives. To name just a few instances. Yes all things fail and Ubiquiti is far cheaper than real business class gear but it's prosumer at best and should not be relied upon. I cringe when people use it in an environment where uptime is important esp when no spares are on site.

In all fairness though in an environment where uptime is critical there's no reason to use a more well established company like cisco or sonicwall. As far as basic office wifi mesh, I haven't run across a better setup for SMBs.

EDIT: But their firmware are garbage.

EDIT 2: Grammar errors.

 

[brianl703]

I used to love Ubiquiti.

Then I experienced the unreliability of their hardware. Failing power supplies due to poor quality capacitors in UniFi switches. Failing flash storage in EdgeRouters because of cheap flash drives. To name just a few instances. Yes all things fail and Ubiquiti is far cheaper than real business class gear but it's prosumer at best and should not be relied upon. I cringe when people use it in an environment where uptime is important esp when no spares are on site.

I'm thoroughly unimpressed with a local company that hawks their hardware. They convinced a friend of mine's company that they could replace a pfsense firewall with the Ubiquiti Dream Machine firewall.

It's been almost a year now, and they still don't have it all working. I'm fairly convinced, from what I've seen, they have NO idea what they're doing. As in using Wireshark or tcpdump to troubleshoot a network problem is beyond their capabilities.

If this is the caliber of IT "professionals" hawking that stuff...no thanks.

 

[OVERKILL]

I used to love Ubiquiti.

Then I experienced the unreliability of their hardware. Failing power supplies due to poor quality capacitors in UniFi switches. Failing flash storage in EdgeRouters because of cheap flash drives. To name just a few instances. Yes all things fail and Ubiquiti is far cheaper than real business class gear but it's prosumer at best and should not be relied upon. I cringe when people use it in an environment where uptime is important esp when no spares are on site.

Well, this is in my house, so no risk of that, lol. I figured for the price, which was less than renewing my MX SEC subscription, it was worth picking up and trying out. I've never used their products before (this is the first time) and since I knew both @Rand and @wwillson have had good experiences with them, that, for my home network, to lab and play with, it was a worthwhile endeavour.

Funny you mention that though. A few years ago, not long after swapping out some garbage gear for a stack of 2960's at the local MB dealership (I do some outside work, some of it favours for friends), I was contacted by the MB hosted internet folks about swapping out the firewall. The unit that was in place was a Juniper SSG5, which, was pretty long in the tooth at this point, about the same vintage and calibre as a Cisco ASA5505.

He told me they were sending me a Fortigate and I paused...

*A couple years prior, a buddy of mine that owns an AV and SMB telecom business was burned pretty badly with the Fortinet phone system products. To call them junk would be a huge understatement. Almost every single one of them failed, and when they did work, they were unreliable, would lock up randomly and have to be restarted. There was never a fix for them and support was horrific. He ended up eating the cost of most of them and swapping them out for Avaya.*

Clearing the obvious shock from my throat, the guy on the other end chuckled and said "that's why we are sending you two, it'll be an HA config that SHOULD fail over". I replied that my experience, admittedly mostly by proxy, had been that they were hot garbage, and he responded that the PAIR of them was less than half the price of a single Juniper unit, which is why they went that route.

Touch-wood, they've been better than the phone systems, but I'm still wary of their products to this day. If it's that cheap, compromises are being made.

 

[OVERKILL]

I'm thoroughly unimpressed with a local company that hawks their hardware. They convinced a friend of mine's company that they could replace a pfsense firewall with the Ubiquiti Dream Machine firewall.

It's been almost a year now, and they still don't have it all working. I'm fairly convinced, from what I've seen, they have NO idea what they're doing. As in using Wireshark or tcpdump to troubleshoot a network problem is beyond their capabilities.

If this is the caliber of IT "professionals" hawking that stuff...no thanks.

Wow, that's just sad.

 

[brianl703]

Wow, that's just sad.

I seriously think that company can't handle any business IT needs greater than that of a corner convenience store.

They also convinced my friend's boss to change out all the Dell switches for Ubiquiti switches. My friend had asked me to be onsite while this was happening. While I was there, the Ubiquiti switch came up with an IP address they didn't recognize, so they immediately claimed that there was a "rogue DHCP server" on the network. They were told that there is no way a rogue DHCP server could be on the network (it would immediately cause problems and so would be discovered very, very quickly). I fired up tcpdump on the still-connected pfsense firewall, and told them there is exactly ONE DHCP server responding to DHCP requests, it's the one that supposed to be, and gave them the MAC address of their Ubiquiti switch that sent the request. They didn't recognize that MAC address (sorry, but if you work with a certain brand of equipment enough, you DO remember what it's MAC prefix is). Then the guy admitted that the switch was pulling a default IP address (again, if you're familiar with the equipment...). I said, "So, do we still think there's a rogue DHCP server on the network?" in the tone of voice I might use when speaking to a 5-year-old.

This same company pulled the same "rogue DHCP server" BS when they were setting up the access points. During a conference call to set up a site-to-site VPN, one of their IT guys said "We're going to be nice on this call, because if we aren't, we'll cancel this call". I guess I must have been too mean when I showed them up when they were installing the switches...

I looked up the guy my friend had been dealing with most of the time and in his LinkedIn he has listed that he has a degree from ITT...

The sad part is, I don't think this sort of thing is unusual. I think a lot of these companies with SMB customers are pretty much screwing them, and that's based on my (limited) experience dealing with them.

(One of the reasons I agreed to help my friend deal with this company, in addition to the fact that he's my friend, is that I wanted to experience firsthand what one of these companies is really all about...)

 

[OVERKILL]

In all fairness though in an environment where uptime is critical there's no reason to use a more well established company like cisco or sonicwall. As far as basic office wifi mesh, I haven't run across a better setup for SMBs.

EDIT: But their firmware are garbage.

EDIT 2: Grammar errors.

I'm partial to Cisco, though I have also used Sonicwall for more budget-conscious installs (small clinics), and you tend to get a lot more performance for your dollar from Sonicwall. Watchguard is another well known option for the SMB space, typically good value. Palo Alto is priced out of reach for a large chunk of this segment.

While I have a bit of experience with Juniper, I've never actually provided it to a client, if I'm proposing something, it's typically Cisco.

 

[brianl703]

I'm partial to Cisco, though I have also used Sonicwall for more budget-conscious installs (small clinics), and you tend to get a lot more performance for your dollar from Sonicwall.

One problem I have with Sonicwall is that there's no way to dump the configuration in a human-readable format. If you want to see what all the settings are, that means opening up every single configuration page and looking.

 

[OVERKILL]

I seriously think that company can't handle any business IT needs greater than that of a corner convenience store.

They also convinced my friend's boss to change out all the Dell switches for Ubiquiti switches. My friend had asked me to be onsite while this was happening. While I was there, the Ubiquiti switch came up with an IP address they didn't recognize, so they immediately claimed that there was a "rogue DHCP server" on the network. They were told that there is no way a rogue DHCP server could be on the network (it would immediately cause problems and so would be discovered very, very quickly). I fired up tcpdump on the still-connected pfsense firewall, and told them there is exactly ONE DHCP server responding to DHCP requests, it's the one that supposed to be, and gave them the MAC address of their Ubiquiti switch that sent the request. They didn't recognize that MAC address (sorry, but if you work with a certain brand of equipment enough, you DO remember what it's MAC prefix is). Then the guy admitted that the switch was pulling a default IP address (again, if you're familiar with the equipment...). I said, "So, do we still think there's a rogue DHCP server on the network?" in the tone of voice I might use when speaking to a 5-year-old.

This same company pulled the same "rogue DHCP server" BS when they were setting up the access points. During a conference call to set up a site-to-site VPN, one of their IT guys said "We're going to be nice on this call, because if we aren't, we'll cancel this call". I guess I must have been too mean when I showed them up when they were installing the switches...

I looked up the guy my friend had been dealing with most of the time and in his LinkedIn he has listed that he has a degree from ITT...

The sad part is, I don't think this sort of thing is unusual. I think a lot of these companies with SMB customers are pretty much screwing them, and that's based on my (limited) experience dealing with them.

(One of the reasons I agreed to help my friend deal with this company, in addition to the fact that he's my friend, is that I wanted to experience firsthand what one of these companies is really all about...)

Jesus Christ, that's tragic!

And no, it's not unusual, that's why I sometimes end up doing favours (can you please fix this? so and so installed it and nothing works properly).

 

[brianl703]

Jesus Christ, that's tragic!

They've been around since 2009, which makes it even worse.

And no, it's not unusual, that's why I sometimes end up doing favours (can you please fix this? so and so installed it and nothing works properly).

It's honestly enough to make me think about getting out of IT entirely. Or at least moving away from Washington DC so I can get an IT job that isn't another crappy government contract.

 

[OVERKILL]

One problem I have with Sonicwall is that there's no way to dump the configuration in a human-readable format. If you want to see what all the settings are, that means opening up every single configuration page and looking.

I've never tried with a Sonicwall, so I'll take your word for it, though that's the case for most equipment that doesn't have its genesis in console management. It's nice to have a collection of switch and router configs that you can just open in gedit, change a few things, and then dump on a new device. Cuts a lot of time off. Can't do that with the config backups from most of these web-UI driven units.

Now, you CAN do that with the Ubiquiti units, since you can just SSH into it play around with IPTables.

 

[OVERKILL]

They've been around since 2009, which makes it even worse.



It's honestly enough to make me think about getting out of IT entirely. Or at least moving away from Washington DC so I can get an IT job that isn't another crappy government contract.

I recommend healthcare, if you are looking to make the leap from these contract gigs. The IT admins and managers I've dealt with tend to be pretty happy people.

 

[brianl703]

I've never tried with a Sonicwall, so I'll take your word for it

I had a Sonicwall to deal with on a Federal contract, so I got very familiar with it. (Who used a Sonicwall for that, anyway? The same company that used Netgear switches, of course! Not the company I work for, but the one that set that up and then went bankrupt. How mismanaged of a company do you have to be to have a Federal contract AND go bankrupt??)

Now, you CAN do that with the Ubiquiti units, since you can just SSH into it play around with IPTables.

Mikrotik's RouterOS has a command-line interface as well as a GUI. Can export the config and cut and paste it back in to a new device.

 

[Pew]

I've never tried with a Sonicwall, so I'll take your word for it, though that's the case for most equipment that doesn't have its genesis in console management. It's nice to have a collection of switch and router configs that you can just open in gedit, change a few things, and then dump on a new device. Cuts a lot of time off. Can't do that with the config backups from most of these web-UI driven units.

Now, you CAN do that with the Ubiquiti units, since you can just SSH into it play around with IPTables.

Yea sonicwall's interface is just a colorful upgrade of the past 20 years. Nothing really new added in. In a way it's nice because by this point I can remember where everything is and not worry about it changing. It's not nice because sonicwall never tries to add something new that could help.

 

[brianl703]

I recommend healthcare, if you are looking to make the leap from these contract gigs. The IT admins and managers I've dealt with tend to be pretty happy people.

The contract gigs wouldn't be so bad if they weren't "deal with the mess the previous contractor made", but that's how they always seem to end up.

Gonna have to do something at some point.

 

[brianl703]

Yea sonicwall's interface is just a colorful upgrade of the past 20 years. Nothing really new added in. In a way it's nice because by this point I can remember where everything is and not worry about it changing. It's not nice because sonicwall never tries to add something new that could help.

They may keep the interface the same, but there are other changes...

I had to upgrade the Sonicwall on this Federal contract. When I plugged the new Sonicwall in, it worked for about a 1 minute and then lost connectivity.

After multiple attempts and hours on the phone with Sonicwall's support...

*I* discovered (without any help from Sonicwall's support) that the new version of the Sonicwall doesn't like it when packets are able to get from the LAN interface to the WAN interface without passing through the Sonicwall. (Basically the WAN and LAN were connected to the same network).

The old version had no problem with that.

It's been so long that I don't recall the exact details, but it had to do with a connection to the F5 load balancer for IPV6 traffic where the F5 had a direct connection to the WAN side of the network for that traffic because it didn't pass through the Sonicwall. And the F5 had it's IPV6 interface on the same physical ethernet interface as the LAN interface.

The fix was to configure the F5 to put the IPV6 interface on it's own physical ethernet interface. Then connect it to a set of switch ports configured on it's own VLAN just for the WAN traffic, along with the WAN port to the Sonicwall and the WAN connection from the datacenter.

Again, Sonicwall support was USELESS for figuring out that this was the problem. I realize that it's a non-standard config, but (1) I didn't set it up that way (2) the old Sonicwall worked fine with it.

 

[OVERKILL]

Mikrotik's RouterOS has a command-line interface as well as a GUI. Can export the config and cut and paste it back in to a new device.

Yeah, Cisco has that as well on anything newer, even switches, but the GUI just ultimately makes CLI entries (and they are often far messier than just doing it by hand). Cisco's ASDM was also that way, it was software, that just fed the CLI, lol.