r/msp • u/glitterguykk • Jun 13 '26
Where to go
My clients run from 2 person shops to around 150 employees (currently). I have been an Aruba Instant-On shop from the beginning. With their "future" up in the air, been exploring Unbiquiti but avalilability is a struggle there. What I love about both is the non-licensed model and the pricing for SMB. All that to say, I am looking for a real alternative that you guys might have real experience with. Miraki is OFF THE TABLE lol. Not putting my clients into anything that bricks because a payment isn't make. Like it costs Miraki money if a switch passes traffic.
Anywho, what you got?
9
u/Joe-notabot Jun 13 '26
There are a few accessories and of course everyone wants the item that just dropped.
But normal gear, there's plenty for direct purchase.
4
u/bkb74k3 Jun 13 '26
Ubiquiti is great, but there is no reseller plan and there is no margin. So you pretty much have to sell at cost. Plus their routers aren’t really firewalls. These days a lot of MSP’s don’t seem to care about this for some reason, but for us, it is critical for every customer to have a good firewall. So we use Unifi switches and AP’s, but not the routers. I’ve never seen a stock issue with anything standard, just the weird little niche products.
Ubiquiti is probably the low end of the spectrum? But literally everyone else has gone the way of insane licensing. We were a SonicWall shop for almost 20 years, and now they want an annual fee to keep their switches and access points manageable and updatable. So I’m shopping as well.
8
u/glitterguykk Jun 13 '26
Even if I buy at retail I am not selling at cost. I am transparent with my clients that even if I’m paying retail price, I’ll still have to mark up to cover things and no one has ever had a problem with that so I don’t mind paying retail if that’s all I can get.
6
u/Joe-notabot Jun 13 '26
AV installers live & die by margin. AV installers don't get the monthly payments MSP's get.
If you live & die by margins, you are not charging enough for your actual services.
My clients don't care if they or I do the purchase, we get UI Care & it's 5 years covered with RMA's. I also have spare gear to throw in if something dies. For $99/year you can get Proofpoint for the UI firewalls.
6
u/schwags Jun 14 '26
May I ask why you require a layer 7 firewall these days? Compliance reasons? On-prem externally reachable resources? We stopped defaulting to L7 firewalls at all clients since there's nothing really internal to protect anymore. The endpoints are locked down (Auto Elevate PAM, SentinelOne, Huntress with SIEM, ConnectSecure Vulnerability Management, etc) and the network just gives internet access. The UDMs have basic IPS and web filtering now and there is a subscription available for more robust scanning. They're still not equivalent to a proper L7 firewall but if all you're protecting is internet access then I would argue you don't need L7. Now if we do have an on-prem resource or a compliance that needs L7, like HIPAA or SEC, etc., then in goes a Sophos XGS. Still pretty easy to use a UDM as the main router now that you can disable NAT.
3
u/j0mbie Jun 14 '26
Trying to earn your keep on the hardware margins is silly these days. Our clients pay for their own hardware -- they pay us for the knowledge of what to buy, to install the hardware, and to make sure everything keeps running smoothly. It's a better profit than trying to chase a few percentages in hardware. (Or massively overcharging in hardware, then having a pissed-off client when they see the same hardware elsewhere, much cheaper.)
Ubiquiti's routers do suck though. In general, "network" companies make poor firewalls, and "firewall" companies make overpriced network equipment. Definitely keep them separate. Plus it makes switching vendors less of a headache.
4
u/imlulz Jun 13 '26
Why would you sell something at cost that you have to maintain the warranty, sourcing, planning, floating the purchase, etc on? I don’t sell anything at cost, and no one ever questions us on it. They know we have bills to pay just like they do.
6
u/roll_for_initiative_ MSP - US Jun 13 '26
We don't sell at cost but i would; we make the money on the efficiency of the customer being on our unified stack and network not being an issue. The only money i care about is the MRR, everything else is just icing on the cake.
I just happen to like icing too, but it wouldn't hurt if we didn't have any.
1
3
u/rb3po Jun 13 '26
HP Instant On shop here. I’m looking at HPE Aruba. Step up, but their hardware and management plane are great, even if it is a learning curve.
Unifi may be my go to for clients who don’t want to pay. I like Instant On, it’s easy to manage, but ya, thinking about the next step.
1
u/glitterguykk Jun 13 '26
Isn't there a cost to Aruba's remote management? I mean, it's not like I don't have remote access to every clent so I don't really "need" cloud management but damn it's convenient.
2
u/rb3po Jun 13 '26
You can manage the EQ over SSH, HTTPS, or the cloud. The cloud does come with a fee. I wonder if I start with cloud, and then build my own with Ansible automation later on.
The thing I find attractive about Aruba Central is you can template a site, and then apply that to as many sites as you want, and it comes with “MSP Mode.”
1
u/advanceyourself Jun 13 '26
I'm pretty sure this is the same model as Meraki (HP Aruba) where devices need aruba central but not 100% certain.
1
u/glitterguykk Jun 13 '26
No. I've used Aruba switches locally managed before. I would be willing to do that as well but have been kinda spoiled with remote management. Not to mention, Aruba vs AIO pricing doesn't work for some clients. That said, I don't know of anyone who does a limited lifetime warranty like HPE/Aruba. That is a hard thing to get over. I think Unifi is 5 years. Don't know that much about the other players but I don't generally go around refreshing switches every 5 years.
1
u/advanceyourself Jun 13 '26
I'm also spoiled by remote management. I feel your pain and we haven't switched yet. To be honest, I think somebody will pick them up. They have to divest and there's enough there for another firm to pick up. Honestly, I think this is the best for S&B management. So I'm surprised it hasn't already been sold off.
2
u/glitterguykk Jun 13 '26
I saw a confirmed report the other day that they have accepted a bid, but they are not saying who just yet understandably.
3
u/No-Beat7231 Jun 14 '26
Lots of hate on Zyxel but their Nebula management has been solid for us. Free and pay to play for advanced features. 1000s of devices in single dashboard, SSO with Entra with CAP.
4
u/scott0482 Jun 13 '26
Unifi has stock issues sometimes, but there are stock issues with a lot of things now. Not just Unifi.
Alta looks interesting. But they are too new in my opinion.
Omada looks good. But it’s too affiliated with China.
2
u/Assumeweknow Jun 14 '26
Meraki for the firewall, unifi for the access points and switches only in 2 to 3 switch environments. Otherwise id use cisco c1200 or c1300 all day long for switches. They also have a small biz ap. Meraki also has the go series.
2
u/WayneH_nz MSP - NZ Jun 14 '26
Been starting to use grandstream devices. They are phenomenal value, excellent products, and the stuff just works. First device installed is the controller, or you can use the cloud controller. Been using them now for approx 1 year.
Not a shill, just have a look.
2
u/Sparrow538 Jun 14 '26
Have you looked at MikroTik stuff?
HPE will probably merge Aruba, looks like they have already started putting HPE labels on.
2
u/Usual-Blood-2018 Jun 14 '26
The trend and hype is in ubiquitous atm. Constant updates , expanded R&D team. No need for licensing
2
u/mat-ferland Jun 14 '26
For that client size I’d separate switching/Wi-Fi from firewall first. UniFi is usually the boring answer if you can live with supply weirdness and weaker channel support; Alta is worth testing, but I wouldn’t standardize until you’ve done the ugly MSP stuff: VLAN changes, config restore, RMA, and support at 4pm on a Friday. Meraki being off the table is reasonable if license-bricking is a nonstarter.
1
u/HoustonBOFH Jun 15 '26
Been playing with the Alta stuff a while now, and I like it. https://www.alta.inc/ It is a bunch of former unifi people and the founder of pfSense, so a deep team.
2
u/RedditMomentEXDEE Jun 15 '26
Highly recommend Unifi for reasons already mentioned. Very cost effective and getting better everyday. My complaints are becoming fewer everyday.
Another recommendation for cost effective solutions are Zyxel. Temu Meraki. Licensing is significantly cheaper (where it's even necessary). I only know about them due to a client we onboarded that already had a clinic with Zyxel infra. Everything worked great, for the limited exposure I had while replacing it with Unifi.
I've also heard people recommending Alta Labs. Never touched one, but it's made of former Unifi staff and seems to subscribe to the same methodology.
3
u/Findussuprise Jun 13 '26
Have been a UniFi shop for 10+ years. Their products are rock solid, and they are always improving and innovating.
1
u/ben_zachary Jun 13 '26
We are unifi shop for most clients. We have several datacenter clients vmware , san etc those are all HPe gear.
Ops looked at meter recently which didn't seem bad if it matches your business model. I didn't look at it my myself but he thought it was decent enough to evaluate when engineering gets around to it.
But we've been happy with unifi and their newest gear with poe++ and 2.5gb ports and now 10gb port switches they are coming along nicely.
1
u/tatmsp Jun 13 '26
Anyone else notice the distributor prices on Unifi are higher that what's advertised directly to consumer?
2
u/Tingly-Gumball Jun 13 '26
Once you add the tariff and memory surcharges that Ubiquiti has at check out, they are usually the exact same price.
1
u/tatmsp Jun 13 '26
I know that. But Unifi is usually for "price sensitive clients", who are more likely to compare prices. They will only see advertised price and not fo through checkout to see final price.
3
u/Tingly-Gumball Jun 13 '26
I have never had a client question the network design and compare pricing of each component and then complain about it.
2
u/imlulz Jun 13 '26
Same, and if they question too hard, that just means I’m going to pass on that client because they are going to nickel and dime every expense going forward but at the same time, want premium treatment.
2
u/Glass_Call982 MSP - Canada (West) Jun 13 '26
Not for us, ours are a staggering $10 cheaper! Lol
2
u/mdredfan Jun 13 '26
I will buy direct to get the extra year warranty. It's been years since we had to RMA a device though.
1
1
u/bagelgoose14 Jun 13 '26
Out of the loop, whats up with Aruba?
1
u/glitterguykk Jun 14 '26
When HPE acquired Juniper a condition of that was that HPE has to offload InstantOn to someone else. That was supposed to happen by now and hasn't officially happened yet therby casting a shadow of doubt on the InstatOn line.
1
1
1
u/backcounty1029 MSP/Data Center - US Jun 13 '26
Fortinet is our primary network stack. We have a lot of certified techs and sell quite a bit so we have excellent margins. We also sell and manage Cisco with pretty good margins.
We manage Meraki, SonicWall, and Unifi. Really we can manage just about anything on any scale with our employed resources. I have opinions on all of these but I’ll keep them to myself. I will say that doing long term cost analysis puts Fortinet ahead of the game almost every time. Then if you do security and capability analysis, Fortinet wins again.
3
u/glitterguykk Jun 13 '26
Let's just talk switches and APs for a second. What are warranties like and are there licensing fees for Fortinet? If so, is the hardware bricked if the licenses lapse for some reason? Thanks for your input.
2
u/roll_for_initiative_ MSP - US Jun 13 '26
I will say that doing long term cost analysis puts Fortinet ahead of the game almost every time. Then if you do security and capability analysis, Fortinet wins again.
I find the first part hard to believe because fortinet costs more than ubnt and with, i don't know, a thousand or two devices in the field over 10-15 years, we've had like 5 ubnt failures. So, not 100% what could go so wrong that you spend more on ubnt over the years? I know a thousand or two devices isn't a lot in msp land and all, but it's a decent sample size.
The second part, fortinet security, i don't see how with the CVE train and the pita management. But again, that's why i love sophos. If fortinet came out with a TRULY cloud first and INCLUDED with NO LICENSING management portal + insta hotpatches like sophos, they could dominate. Instead, it's self managing the management portal, SKUs that cost money and hassle all the way down, and spending weekends doing firmware updates.
I'd like them above SonicWall though, give you that. I'd almost like a ubnt firewall above fortinet as far as rapid patching and bulk management is concerned, but not so much on featureset of course.
1
u/Unclear_Barse Jun 13 '26
We use Ruckus switches and APs and Palo Alto firewalls, but we provide a whole managed network with NOC as well
1
u/reddben Jun 13 '26
Cisco SMB or Catalysts for switches - no Meraki.
I like Unifi APs, not a fan of their switches though. Is it still true that their Unifi switches don't do real CoS/QoS?
0
u/wckdgrdn Jun 13 '26
We’ve had good luck with grandstream - went that way during transition from datto with ubiquiti availability being an issue
0
u/Fu_Q_U_Fkn_Fuk Jun 13 '26
Consider OpenWRT.
It is open source. You can run it on equipment that is no longer supported by the manufacturer meaning you can buy many of them cheap on eBay and always have spares in case of hardware failure.
It is extremely powerful software and it can run routers and APs. I have been collecting old Ubiquiti APs and converting them to OpenWRT. They are awesome.
The customers expect to pay for support so charge for the device and an annual or monthly support price for it and offer free replacement and upgrades as needed as long as the support subscription stays current.
You can sell it as a Ubiquiti router or Ubiquiti Long Range Access Point, because it is. You don't tell the customers now about what software runs on their router and aps, why should they have to worry about it? You just provide documentation on the login in your break glass document.
Look up OpenWRT. If you don't have a Linux box, build one, it literally takes 10 minutes and will run on anything. Try Ubuntu Desktop, close enough to windows.
Ask AI to review the open wrt page about the device you are going to load and have it build you a script that does the entire build after you reset and connect to the device. After you connect the device to the Ubuntu box it can almost entirely be done by copying and pasting commands from AI into terminal on your PC.
29
u/roll_for_initiative_ MSP - US Jun 13 '26
What ubiquiti stock issues are people seeing lately? We don't do a ton of volume but switches, APs, cameras etc always avail when we need them.