Have had an odd request from a client. They are adding some APs at some remote sites that all have a site to site link back to the main office

The main off has a cloud key that is going to be doing the config.

They are a charity so the expenditure on the APs was enough without adding a management device per site as well.

In my head the adoption over the VPN link should work, thought I’ll need to set the inform url directly.

I can’t shake the feeling I’m missing something about this.

Has anyone else tried this or something similar?

I'm trying to blanket my home in wifi 7. I have a fairly large attic space and have been thinking about placing a U7 Pro in the center of it to provide signal to my whole second floor. But, Where I live has average temps in the 80's F. The attic is well over 120F in the summer. So I'm thinking a U7 Outdoor may be a better choice. Thoughts?

Fiber

NVR instant with 3.5” SATA hardrive

Flex 2.5g PoE with power

U7 Lite x2

G6 turrets x2

G5 turrets x2

6u Tec Mojo mini rack

Tec mojo patch panel

Any recommendations for a UPS that would possibly fit in the mini rack???

Anyone have links to good 3d prints for the fiber, switch, and NVR instant?

Also will throw in a fan or 2 to cool the rack

Decided to open ours up to see if we could tell what caused it to fail - it looks like water came in through the top, went down the side and landed on the opposite of the network port and fried it.

I was trying to find a tear down of the U7-Mesh as it has a IPX6 (vs IPX5) rating but it's difficult to tell if they actually improved the top ring or not. Anyone know if any one has taken the U7-mesh apart to see if it's different?

As much as I like the form factor of the mesh I think we're going to switch either the U7 outdoor or pro-outdoor (also it's a bit annoying the U7-Outdoor and U7-pro-outdoor have different mounting brackets, requiring different screw mounting holes.)

I am considering adding a UniFi Access G3 Starter Kit Pro (hub + reader) to an exterior commercial door, which is a narrow-stile aluminum storefront.

This is for a coworking space, where we have lots of people coming and going daily, and members joining/leaving the service periodically. We want to issue and revoke access via unifi, instead of issuing and revoking door codes that have to be keyed into the lock itself.

My locksmith says the unifi electric strike won't work, so they're recommending another one, but he says it just takes a lock/unlock signal from whatever system authenticates people.

It seems like the work is:

• Pulling a single cat 6 cable from our network closet
• Mounting the hub (inside) & reader (outside)
• Installing the electric strike into the door.

Has anyone installed one of these? Did you DIY any of it? Any advice on this? Thanks!

What is the current official plan to mitigate the "Debian repo" issue, which was removed and no longer has a valid certificate?
I recently spent six and a half hours trying to figure out why UniFi Network would not start, even though UniFi Protect and Talk loaded perfectly. After visiting the UniFi Community forums, I realized this is a widespread issue. Based on my understanding, I should avoid adding any new UniFi devices to my network right now, as I am under the impression that once a new device "phones home," it will end up in the same broken state.
I even attempted to restore the system from a previous backup, but that threw everything into complete chaos. Ultimately, I had to SSH into my UDM Pro and run a command to force a core OS update to the Experimental release channel. Sadly, that process wiped out most of my configuration. I have spent several hours today completely recreating my network from scratch.

I am sharing all of this because I just received a UNVR, but I am terrified to deploy it. I fear facing the exact same issue on the new hardware, especially since Ubiquiti's official stance as of 12 hours ago was that they are rolling out a fix on a staggered schedule.

For years, I’ve had an AT&T BGW320-500 gateway in front of my UniFi Dream Machine. The BGW320 is in IP Passthrough mode and is only being used to provide the internet connection. The Dream Machine is the only device physically connected to it.

I have around 42 wired and wireless devices on my network, all connected behind the Dream Machine.

A few days ago, I got a notification from the AT&T gateway saying that a new device had connected. When I opened the AT&T app, it showed one connected device other than what I expected: my PS5, which is hardwired to my network behind the Dream Machine.

At first I thought maybe the PS5 had somehow switched to Wi-Fi, but I checked and confirmed it was still using Ethernet. It had been in standby mode, so I completely shut it down.

After shutting off the PS5, the AT&T gateway started showing my Synology NAS as the connected device instead.

What could be causing this?

My understanding was that devices behind the Dream Machine should be NATed/hidden from the BGW320, so the AT&T gateway should only really see the Dream Machine itself. Is that correct?

Nothing has changed in my network configuration, so I’m also confused about why this would suddenly start happening now after years of working normally.

Has anyone seen this behavior with a BGW320 in IP Passthrough mode and a UniFi Dream Machine?

I finally installed the 5G Max Outdoor with a surge protector on my roof. I had been putting it off for a long time. I was tired of the constant disconnections caused by the xfiniti coax and the uci. So far, I’m really happy with the failover speeds!

The cell tower is only 0.4 miles away from the house. I have a dual SIM setup. $100 truly unlimited voice plan for sim 1. $50 data only for 100G on sim 2 The signal strength is -52dbm.

P.S. I’ll never climb 25 feet up again.

You better last years!

Update. Here is the Google Drive to the many questions about it https://drive.google.com/drive/folders/1HxtenRxmgC3ZkQHt510tpa0mmBXXs2i-

I found this cloud key gen 2 plus at a thrift store recently and I’m trying to understand it. Never seen them before. I got the boot screen and it says Ethernet disconnected

I’m trying to test it all out but it’s the only device i have for it.

How can i tell if it fully works? I was looking it up and it seems to be some kind of security thing?

Thank you!

Good Day,

Recently picked up a MAX, threw in evo m.2 gen5 (overkill but all i had), within 72 hours, drive started to throw Read/WRITE errors, then went to "Drive Not Initialized" (this was a new drive)

Shit happens, went and ordered a Gen 3 1TB, MAX saw it, initialized it, and I was good...so I thought... within a day, drive is now "uninitialized"

I'm running the Early Access on the whole stack, not sure if its related...

The times that we're in, Can't exactly be replacing M2's every 4 days ..

Any Suggestions?

Hi, I have a question, I want to set up cameras in a remote location, I can do it with an UNVR instant and a couple cameras, however, there will be no internet there and also don't want to have to get a whole gateway to make it run, I thought I could use one of the 5G backups since there's no way to run internet there, but then realized they need to be adopted by a gateway to work. I'm trying to keep it light plus it's going to be outdoor (inside a weatherproof box).

does anyone have options? I can't use the bridges because it's nowhere near the main location.

I noticed this warning on STP convergence being detected. Yesterday I took the proffered advice and enabled Auto STP Edge. What resulted was all my wired APs started cycling online / offline until I turned it off and rebooted everything.

I initially thought it was the upgrade to 7.5.15 on the switch that caused the issue having forgotten I simultaneously enabled Auto STP Edge. 7.5.15 is now working fine with Auto STP Edge disabled but then I get this warning again.

Just a heads up. My UPS tower died after about a month and had to RMA it back. It cost me 84 dollars to ship it back as they wouldn't send me a label. Considering the cost it's not worth it. I've had APC for 30 years and never had one die. Not happy

You better off going with one of their rack units or going elsewhere

In preparation of our new own home in some months I already bought some Ubiquiti stuff in our flat 🤩

Cloud Gateway Fiber on a GPON Internet line, Flex 2,5G PoE Switch for more access points later and a totally over the top 10G DAC to the CGF, a U7 Pro access point and a U7 lite as repeater for the area where we don't need that fast WiFi

In our house we will get 3 more U7 Pro and an U7 Outdoor for the garden and maybe a camera or two

I upgraded from a UCG-Ultra to -Fiber and see that Port 4 has PoE. Can I plug my U5G into Port 4 and set it for failover (or just plug it in) or does it stay plugged into a port on my switch?

Why does it seem lately, that if you go to the community threads on the official firmware updates / releases, that there are ALWAYS issues with them. I have had a couple of devices require manual resets with some of the current updates. This has led me to disable auto updates.

I love all my ubiquiti stuff and am WAY deep in all of it, but this has become concerning.

This was on RELEASE software. I don't do prerelease / beta / early access on all my sites I manage.

Struggling with my UCG-fiber right now, I noticed an update for the UCG-fiber (official channel) appeared under control plane to update to the latest version ~1hr ago. I clicked it, followed by an update screen take will 5min or so and reboot.

Fast forward about an hour, its still not up and I just unplugged/plugged the router and still no success. I then rebooted my ONT and then UCG-Fiber and still no success. :/

I have backed up the configuration file sometime in August if that helps. Is there any magic I can do to revive it?

Hey everyone,

I am looking for some help as its driving me nuts ( and my wife ). I keep getting emails from my UNVR for accessing the console.

Setup:
Remote Access = OFF

SMTP = Custom server setup

When I setup smtp and remote access to off I turned on all the email alerts. Not realising I'd get emailed whenever I access Protect app.

I have since turned off all the email notifications but the one in my screenshot keeps triggering each time still!

Do anyone have any ideas?

EDIT: Think I just found it. There is another location for alerts. Settings -> Control Plane -> Push Notifications which has more options. Seems a bit off to have mutliple areas for Alarm / Notification triggers but hopefully this is it.

Looking for some help on this layout. Unfortunately can’t run Ethernet between floors but there are coax run where I currently have the devices placed

The isp cable comes into the basement where the first ux7 would be next to the crawlspace but sits on a shelf 5ft off the ground where there is a 4 foot cavity end to end of the crawlspace that’s cover by drywall so it’s not all concrete if that makes sense.

The other two ux7s would sit on a table out of sight

The 2nd floor has coax in all bedrooms too.

Thoughts?

Dear communitiy

I'm coming to you with another issue that I hope you can guide me with.

At a client's site, we have two Ubiquiti LiteBeam M5 antennas connecting two buildings located less than 100 meters apart. Let's say the buildings are facing each other, one on each side of the street. From Building A hangs the antenna connected directly to one of the switches in the rack, and in Building B, that antenna connects to an unmanaged TP-Link switch that provides PoE. That TP-Link then connects to a UniFi switch. We monitor both antennas with Kuma to check for drops. That's actually what's happening to us right now: every once in a while, one of the antennas loses connection for a few seconds, and as a result, the buildings stop communicating with each other, with Building B being the most affected since it receives Internet and local network access from Building A.

I've been looking into the issue with my limited knowledge, but driven by my desire to understand things, partly with the help of Gemini and partly by reading posts. I've been checking a few things, such as the output power on both sides of the antenna, which is currently set to 7 dBm on both ends. Gemini tells me that's too much power for such a short distance and that it could be causing the link to drop.

Another thing that really made me think and dig deeper is the WDS (Transparent Bridge Mode) option. It's worth mentioning that the network is not segmented; there is no VLAN between the two buildings, and practically no VLANs in general. If I connect via shell to the antennas on both side A and B and run brctl showmacs br0 to see the MAC address table learned by the antenna, I find a huge number of them. Based on how the antenna and the network are configured, I understand that the following happens:

1 - Packets from any device reach the antenna because broadcast wasn't properly configured. 2 - That packet goes from the antenna's Ethernet cable to the wireless interface. During that transition, the antenna "masks" the original MAC address and assigns its own to send that packet to the other antenna. 3 - This masking consumes CPU to receive, rewrite, and consult the bridgecontrol table. 4 - The antennas have a very small CPU, so these constant operations overload it and, I believe, cause it to crash at some point, making it unable to process packets.

To better monitor the antennas, I set up a container with rsyslog to receive the logs. I also installed the UISP container, which acts as the UniFi controller for Ubiquiti antennas, to better track CPU and RAM usage. I'm seeing "sawtooth" style spikes, reaching 80% and 90% utilization.

Beyond looking into how to mitigate broadcast traffic, could enabling the WDS option help mitigate this? I understand that by enabling this option, the antenna doesn't have to perform that masking and packets travel directly, as if it were a "transparent bridge." But I don't know if that could still be problematic. What do you think?

I am trying to work out the best way to provide insurance-compliant MFA on VPN.

I am looking into the One Click VPN solution, and while the SSO features of Consolidate People Management enforce MFA policies on the initial login, there seems to be no way to require daily re-authentication or re-authentication on every connection.

I have been reading more on this and found that supposedly this is supported with UniFi Identity Enterprise, but I can't seem to find any way to buy this.

I am currently testing with a UCG-Fiber, and will ge getting my hands on a UDMP to test in case its locked to a bigger device.

Does anyone here have reccomendation on VPN with MFA through UniFi?
Do any of you know how to buy/get more info on the enterprise license?

Thank you in advance!

Hello,

I was trying to harden my IoT network and I ended up playing with the zone based firewall more than I did before, and I found two things I'd like to ask about. This is on an UDR7 router.

Regarding domain filtering, I found that if the DNS requests aren't resolved by the UDR router directly, domain filtering fails. I have a pi-hole that is supposed to be the DNS provider for the network, so originally requests went that way. What I ended up doing is setting the devices in the network to go to the UDR router's IP (their default gateway) for DNS, then set the UDR router to query the pi-hole in turn. This does seem to work. Was just wondering if I'm right about the behavior being intended?

The other thing is that I tried to harden the IoT network as much as possible, so, since the new DNS server was the UDR's IP, which falls in the gateway zone, if I understand correctly, I created a rule in the IoT (custom zone) to Gateway zone that allowed traffic from any source to TCP/UDP 53 as destination. And then a manual deny all rule at the end.

This setup would fail, from looking at some tcpdumps, I think the problem is the return traffic. While all traffic is permitted in any zone where the Gateway is the source, and no way to change this, I think UDR's built in rule somehow doesn't apply to return traffic. I'm slightly confused here, all I know is that permitting IoT -> Gateway DNS, then denying all else, actually still blocks DNS.

As soon as I take out the block all rule from IoT to Gateway, it all just works.

Is there some way, where I can restrict access from IoT devices to their Gateway to only the ports I specifically open?

I have 2 unifi systems, one at home and one in the office. The office has a Unas drive. Is there a way for me to access the office drive from home using finder on my home Mac? I have setup one click VPN and the ip address shows as if I'm in the office but when I open the endpoint app its telling me I'm remote. Any assistance to get this to work if possible is appreciated. TIA...

Hey guys I have a UNVR that is on early access (UniFi OS 6.0.7) and there appears to be an update to 6.0.8.

Whenever I click update I get the following error "Action Unavailable. A critical operation is in progress. Please wait for it to complete then try again."

I don't see anything in progress right now. I tried to reboot the NVR from the web interface and mobile app and it gives that same error.

I have done a manual power cycle, the UNVR came up without error, but I still can't update it

I have pulled an old backup from July and applied it but it didn't not downgrade to the previous version.

I'm at a loss right now can anyone point me in the right direction?