Blog - McCann Techhttps://evanmccann.net/blog/Sat, 07 Feb 2026 22:39:58 +0000en-USSite-Server v@build.version@ (http://www.squarespace.com)UniFi Protect Comparison ChartsUbiquitiComparison ChartsGuideEvan McCannSun, 10 Aug 2025 17:08:00 +0000https://evanmccann.net/blog/ubiquiti/unifi-protect-comparison-charts5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:64cd170fbae0f45b8e77898eOriginally Posted: August 4th, 2023
Last Edited: August 10th, 2025

UniFi Protect Comparison Charts

These charts compare the specs of all available UniFi Protect devices — Cameras, Doorbells, NVRs, and All-in-one UniFi Cloud Gateway NVRs. They are available as images and in other mobile-friendly formats on Google Drive.

Other Ubiquiti Comparison Charts:

Table of Contents

UniFi Protect Camera Comparisons

Dome and Turret Cameras

We’ll start with the dome and turret cameras. These are meant to be mounted on a wall. They can be used outdoors, but dome models should be in a protected area to prevent fogging and condensation in their protective bubble. The turret models can be used outdoors, and all of these models have a variety of accessories for different mounting options.

The G5 Dome Ultra and G5 Turret Ultra are newer options, meant to deliver a lot of value for a low cost. The new AI models are larger and have features like advanced AI detections, microSD card recording, noise cancellation, a floodlight, and better and longer-range night vision.

The old, discontinued G3 Dome is included for comparison. All links are affiliate links to Amazon when available, otherwise they are non-affiliate links to Ubiquiti’s store.

View fullsize UniFi Protect Dome Cameras
 UniFi Protect Dome Cameras View fullsize UniFi Protect Turret Cameras
 UniFi Protect Turret Cameras

UniFi Protect — Dome and turret camera comparison

Return to Table of Contents

Bullet and Pro Cameras

All UniFi Protect bullet cameras. These are meant for general-purpose outdoor use, offering a balance of image quality, size, and cost.

The pro models add optical zoom, higher image quality, and better night vision. The G4 and newer pro models also have optional vision enhancers which add floodlights, extends IR range, and other features.

View fullsize UniFi Protect Bullet Cameras
 UniFi Protect Bullet Cameras View fullsize UniFi Protect Pro Bullet Cameras
 UniFi Protect Pro Bullet Cameras

UniFi Protect — Bullet and pro camera comparison

Return to Table of Contents

Compact and Wireless Cameras

All UniFi Protect compact cameras. The instant models are wireless, and the flex models are cheap and small cameras that can work in a variety of situations. The G3 Instant is not outdoor rated but the other models can be can be mounted indoors or outdoors, on a wall, hard ceiling, desktop, or pole. You can also buy accessories for additional mounting options.

These compact models offer the lowest cost and smallest size, at the expense of low-light performance and overall image quality. The Instant models are the only wireless cameras in UniFi Protect, so if you don’t have Ethernet available these are your only options. All other cameras will require Ethernet and PoE, or something like the UniFi Device Bridge to connect it to your wired network.

View fullsize UniFi Protect Compact Cameras
 UniFi Protect Compact Cameras View fullsize UniFi Protect Wireless Cameras
 UniFi Protect Wireless Cameras
Return to Table of Contents

Panoramic and PTZ Cameras

Panoramic is a newer category for models with fisheye lens or the upcoming dual lens options in the G6 line. These are good for getting a broad view of a large or wide room, or covering a large outdoor space.

  • G6 180 (UVC-G6-180) — Coming Q3 2025

  • G6 Pro 360 (UVC-G6-Pro-360) — Coming Q3 2025

  • AI 360 (UVC-AI-360) — A 360° fisheye lens for mounting on a wall or ceiling.

  • AI Theta Kit (UVC-AI-Theta) — The non-pro kit offers a wide and 360° lens. Other lens sold separately.

  • AI Theta Pro Kit (UVC-AI-Theta-Pro) — This kit includes the pro version of the 360° lens. Other lens sold separately.

PTZ cameras are specialty models with motorized pan, tilt, and zoom. The G4 PTZ Industrial is older, but is still the only model with anything like it’s enormous 22X optical zoom. The G5 PTZ is much cheaper, but is limited to a 2X optical zoom. The newer G5 does offer some additional features though, like a floodlight and microphone.

The newer G6 PTZ model is a big step up from the G5 PTZ in image quality and features, featuring a combination of 5X optical and 2x digital for a 10 “hybrid” zoom. The AI PTZ models are the closest to the older G4 PTZ Industrial, offering large optical zoom, good image quality and strong night vision performance. The upcoming AI PTZ Precision adds even further zoom and LiDAR for enhanced auto focus.

View fullsize UniFi Protect Panoramic Cameras
 UniFi Protect Panoramic Cameras View fullsize UniFi Protect PTZ Cameras
 UniFi Protect PTZ Cameras
Return to Table of Contents

Doorbells

The UniFi Protect ecosystem isn’t just for standard security cameras. These models act as doorbells, offering features like a package camera, two-way audio, and a customizable display. The G4 Doorbell is often hard to find, but the two configurations of the Pro model are probably what you want anyway. Make sure to pick the right one for your power source and connection to the network - wired or wireless.

View fullsize UniFi Protect Doorbell Comparison
 UniFi Protect Doorbell Comparison
Return to Table of Contents

Cameras By Generation — G3, G4, G5, and AI

G3 Cameras

All G3 UniFi Protect cameras compared:

UniFi Protect — G3 camera comparison

G4 Cameras

All G4 UniFi Protect cameras compared. For the G4 doorbells, see the doorbell section above.

UniFi Protect — G4 camera comparison

G5 Cameras

All G5 UniFi Protect cameras compared:

UniFi Protect — G5 camera comparison

G6 Cameras

The G6 line is the latest, which are an upgrade over the older G4 and G5, and right below the AI series cameras when it comes to features and image quality. These have most of the AI bells and whistles for smart detections and license/facial recognition. They also have improved 4K image quality and a lower price than the AI models. We’re up to five models, with two more coming soon.

All G6 UniFi Protect cameras compared:

UniFi Protect — G6 camera comparison

Return to Table of Contents

AI Cameras

And finally, all UniFi Protect AI cameras. These are some of the newest cameras, and generally the most expensive. They offer advanced AI detections, including license plate, people, or pet detection. They also tend to have some of the best low light and IR range. The AI Theta and AI DSLR both offer two lenses and some unique features.

I’ll break them into two groups of standard models, and specialty models that have a unique feature or a high price.

UniFi Protect — Standard AI camera model comparison

  • AI Theta Kit (UVC-AI-Theta) — The non-pro kit offers a wide and 360° lens. Other lens sold separately.

  • AI Theta Pro Kit (UVC-AI-Theta-Pro) — This kit includes the pro version of the 360° lens. Other lens sold separately.

  • AI LPR (UVC-AI-LPR) — Coming in January 2025, meant for license plate recognition at night and in motion.

  • AI DSLR (UVC-AI-DSLR) — Interchangeable lens and micro 4/3rds sensor with high image quality.

  • AI PTZ Industrial (UVC-AI-PTZ-Industrial)

  • AI PTZ Precision (UVC-AI-PTZ-Precision) — Not included here, coming Q3 2025

UniFi Protect — Specialty AI camera model comparison

Return to Table of Contents

UniFi Protect NVRs

The Cloud Key Gen 2 Plus is an older UniFi OS console that can act as an NVR with a single hard drive. You may see this listed as CloudKey+, which was a minor hardware revision which switches the 1 TB HDD for a 1 TB SATA SSD. These are otherwise the same. Both of these Cloud Keys can run all other UniFi applications, including Network, Access, and Talk.

The UNVR, UNVR Pro, and new Enterprise NVR are dedicated network video recorders, and offer the most storage and drive bays.

  • CloudKey+ (UCK-G2-Plus or UCK-G2-SSD) — SSD model shown, older version had 1 TB HDD

  • Network Video Recorder (UNVR)

  • Network Video Recorder Pro (UNVR-Pro)

  • Enterprise Network Video Recorder (ENVR)

UniFi Protect — NVR comparison

Return to Table of Contents

UniFi Protect Gateway NVRs

With UniFi Protect you don’t necessarily need a dedicated NVR like the models shown above. You can also use all-in-one UniFi Cloud Gateways to run Protect and record your camera’s footage.

These are primarily Network devices — acting as firewalls/routers, switches, and/or wireless access points — but can also act as a Protect NVR. These generally have lower storage and camera limits than the standalone NVR options. If you have a small setup with only a few cameras, these may be all that you need.

View fullsize Small UniFi Cloud Gateway NVRs
 Small UniFi Cloud Gateway NVRs View fullsize Large UniFi Cloud Gateway NVRs
 Large UniFi Cloud Gateway NVRs
Return to Table of Contents

Recent UniFi Posts

]]>UniFi Protect Comparison ChartsUI Chat May 2025: A Router and Two Rooters with ‪JimtheITguy‬Evan McCannSat, 31 May 2025 18:08:46 +0000https://evanmccann.net/blog/2025/5/ui-chat-may-20255d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:683b3f760f378326341f5c83Originally Posted: May 31st, 2025

I haven’t posted about them here since our 2024 Year In Review, but every month Alex and I have a new UI Chat Podcast episode to discuss Ubiquiti news.

On the May 2025 episode of the UI Chat Podcast, we had James Regler, also known as Jim the IT Guy from Influx Solutions on as a guest. You probably know him from the JimTheITGuy YouTube channel, or his TikTok account. If you don’t, you should check out his work.

On this episode we cover the new G6 and AI PTZ cameras, AI Horn Speaker, and U7 LR access point. We also discuss UniFi Network 9.2 and UniFi OS 4.2, Wave AP Gen2, Alex’s and Jim’s experience at UWC London, how to pronounce the “router”, and how afraid we should be about our AI overlords.

As always, you can check out the UI Chat Podcast on YouTube, or your podcast service of choice:

]]>UI Chat May 2025: A Router and Two Rooters with ‪JimtheITguy‬Ubiquiti 2024: Enterprise-Grade Year In ReviewUbiquitiPodcastNetworkingMiscellaneousEvan McCannSun, 22 Dec 2024 19:52:16 +0000https://evanmccann.net/blog/2024/12/ubiquiti-2024-year-in-review5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6768506dfe381505bd9c3bacOriginally Posted: December 22nd, 2024

Ubiquiti 2024: Enterprise-Grade Year In Review

On the December 2024 UI Chat Podcast, we had Cody from the Mactelecom Networks on as a guest. You probably know him from the Mactelecom Networks YouTube channel, or Instagram, or Twitter/X, or TikTok account. If you don’t, you should check out his work as he’s one of the most prolific Ubiquiti video makers and has a ton of good content covering Ubiquiti news and reviews.

On this episode we went through the monthly Ubiquiti news as we always do, but we also took the 2nd half of the episode to review all of the things that Ubiquiti released in 2024. The list of hardware was so long that we didn’t get a chance to cover all of the software and other bits of news that came out throughout the year. That’s what I want to cover in this post, and some of my thoughts on where Ubiquiti is after a very busy year.

As always, you can check out the UI Chat Podcast on YouTube, or your podcast service of choice:

UI Chat December 2024: Enterprise-grade Year In Review on YouTube

With that out of the way, let’s take a look at all the things that Ubiquiti released in 2024. First up, we have the hardware. Any product links below are non-affiliate links to Ubiquiti’s US store.

Ubiquiti Hardware in 2024

  • January - UniFi Swiss Army Knife AP, UISP Switch Plus and Box Plus, U7-Pro, PDU Pro, toolless mini rack stacking kit

  • February - Cloud Gateway Ultra, Ultra switches, Wave Pico, Wave AP micro 360° mount, UISP dual 2.5 Gbps PoE injector, USB-C charge cable, precision rack mount kit

  • March - G5 Turrent Ultra and G5 Dome Ultra, a lot of camera accessories, UniFi Access Intercom, and the EV Station Pro payment terminal and stand

  • April - UXG Max and UDM Pro Max

  • May - EFG and U7 Pro Max announced as coming soon, Pro Max 16-port switches, U6 Mesh Pro AP, Access reader accessories, Enterprise HDD, U7 Pro paintable cover

  • June - U7 Pro Max, U7 Pro Wall, U7 Outdoor, Access Ultra, EV Connect Lite, AI Pro Vision Enhancer

  • July - Cloud Gateway Max, EdgeMAX refreshed with new logo, and G5 PTZ

  • August - UXG Enterprise and EFG, UMR Industrial, Display Cast Pro, UniFi Power Amp, black version of G5 Dome Ultra, SSD version of UCK-G2+, Gate Access Starter Kit, exit button for UniFi Access, RIP SolarSwitch

  • September - Enterprise NVR, Flex Mini 2.5G

  • October - UNAS Pro, Enterprise Campus switches (24/48 port and aggregation), UniFi Device Bridge and Device Bridge Pro, UMR Ultra, and Wave MLO/Gen2 previewed 

  • November - UniFi Protect AI Turret, AI Dome, AI LPR, and AI Port, white version of AI 360, and new camera accessories 

  • December - E7, E7 Campus, and E7 Audience APs, 12U and 42U cabinets

I covered a few of these devices throughout the year:

Mostly, I tried to keep up with the deluge of new devices in my comparison charts.

As you can see there are a lot of devices which I didn’t cover, and many that I don’t have hands-on experience with. More than any year prior, 2024 felt like a fire hose of releases one after another. It was overwhelming to me, and even people like Cody which are used to covering every minor update and release.

While the quantity of new hardware was overwhelming, the more important thing to discuss is the quality. In years past a common complaint was that Ubiquiti seemed distracted. While the core UniFi Network devices like the USG aged, we got new products like the UDM that didn’t satisfy everyone. With the initial release of the Dream Machines back in 2019 and 2020, MSPs and enthusiasts were worried that self-hosted UniFi was going away. It seemed like Ubiquiti only cared about locking you into buying more Ubiquiti hardware.

I think enough time has passed and there is a long enough track record to show that this isn’t the case. UniFi Networks are still modular, and you don’t need to buy into their ecosystem for everything. The other products like UniFi Protect are mature and complete options now, and they work together and compliment each other well. There were some lean years with some less-than-ideal hardware releases and some slow progress in software, but that’s definitely not the case now.

Notable Hardware Releases

  • The Swiss Army Knife is still the weirdest product name they have, but it’s a good option for cheap outdoor Wi-Fi. It’s a sideways upgrade from the older AC-Mesh, but when you consider the accessories like the desktop stand and panel antenna, it’s worth considering.

  • Gateways galore! We got six new gateway options in 2024. At the end of 2023 we got the new baseline Express and UXG Lite, and now we have the full picture of this generation of UniFi Gateways. There’s a model or two for everyone, and all of them are compelling in their own way. The Ultra and Max models are good for smaller setups, and with the UDM Pro Max and the Enterprise models, UniFi can fit into larger networks than they ever could before.

  • Goodbye USG and USG-Pro: 2024 was the year the elder USG and USG-Pro gateways finally got put to rest. Earlier on in the year they were marked as legacy devices, meaning that software and security updates were coming to an end. In UniFi Network 8.6, we got the warning that configuration changes won’t be possible going forward.

    • While I don’t like the idea of forcing upgrades and these devices become e-waste, this was probably the right time. They are old and not powerful enough to keep up with new software features. We also have a ton of gateway options to replace them now. If you’re still running a USG or USG-Pro, take a look at the UXG models or possibly a Cloud Gateway. You’ll see a huge jump in performance and a ton of new features.

  • Wi-Fi 7 APs: U7 Pro, U7 Pro Max with spectral analysis, U7 Outdoor, and U7 Pro Wall. We also got the high-end Enterprise models and outdoor/standard power 6 GHz radios the E7 and the upcoming E7 Campus and E7 Audience.

    • There have been a few rough edges with the U7 models and their compatibility with IoT and 2.4 GHz devices, but that’s not something I’ve personally run into. I think that’s a real shame because it’s distracted from an otherwise impressive lineup of new APs. If you’re considering one of these models, keep an eye on the release notes and the progress they’re making with those issues.

  • New Markets: The UniFi Power Amp made Ubiquiti a Sonos competitor, and the UNAS Pro was an impressive first entry into the world of file storage. These are both fully-featured and mature releases which impress on their own. They also point towards Ubiquiti entering more areas outside of their core of networking. In the past they didn’t always pull that off, but I think these are two good entries. I expect we’ll see more things like this as Ubiquiti' drifts away from being just a network device maker.

  • UniFi Protect got a lot of love. We saw a lot of new camera options, and Enterprise NVR for large scale setups. We also saw a lot of progress on the software, which I’ll cover below.

2024 Hardware: Overall, Excellent

All in all, I think Ubiquiti did a great job with the hardware they released in 2024. It was an ambitious and relentless schedule, and for the most part I think think they pulled it off. The negative things I can point to — the USG going away and the Wi-Fi 7 2.4 GHz/IoT issues — shouldn’t take away from the dozens of great products they released.

I’m mostly interested in their networking products, and there are a lot of models to call out and recommend. Now that the gateway lineup is (likely, mostly) complete, I think there’s a model for everyone and a lot of good choices to build a network around. I’m running a Cloud Gateway Ultra at home and it’s been great for me. If the Max models were out then I probably would have picked one of those instead, but I have no complaints. The Enterprise models pushed the high end upwards, but I don’t have any experience with those, so I can’t say much else.

For UniFi switching, the Ultra is easier to recommend than the Lite 8 PoE or older 1st generation models if you need a small switch for a handful of PoE devices. The 2.5 Gbps version of the Flex Mini was another nice option if you just need a few ports and beyond gigabit speeds. The Pro Max and Enterprise Campus models filled out the top end, complimenting the Enterprise gateways and all of the software features that came along with those.

The new Wi-Fi 5 and 6 APs like the Swiss Army Knife and U6 Mesh Pro filled some holes in their lineup, and the new Wi-Fi 7 models are mostly excellent, especially at the high end. We’ll see more of those in 2025 I’m sure, and hopefully they can get their IoT/2.4 GHz issues ironed out.

I’d typically caution people from being early adopters in new categories like the UNAS Pro or Power Amp, but Ubiquiti seemed to do a good job with their first steps into those new areas. The positive reception of the UNAS Pro and UniFi Drive showed some growth and maturity for them as a company. It appears that they spent the time they needed to get things right from the beginning.

This is a big improvement from how they handled the transition from UniFi Video to UniFi Protect, and the initial state of things like UniFi Talk and Access. I don’t know how they’re juggling so many products, but it seems like they’re doing a better job of expanding their existing product areas and adding new ones.

Ubiquiti Software Releases in 2024

Just as relentless as the hardware releases, we saw a ton of software releases in 2024. UniFi Network went from 8.0 to 9.0, with an absolutely massive list of additions and improvements. UniFi Protect 5.0 brought a new and improved system architecture, better performance, h.265 encoding, ONVIF support, and a ton of features like Vantage Point. UniFi OS 4.0 brought shadow mode, and other UniFi OS releases improved a ton of things with how UniFi Gateways are managed.

If I can complain about anything on the software front, it’s the slower pace of progress with UISP. That’s probably my bias showing, but I wish Ubiquiti paid a bit more attention to UISP hardware and software. We still have EdgeRouters and EdgeSwitches in a very sad zombie state, with long gaps between minor software updates, and an unclear future. UISP hardware devices like the UISP Switches and UISP Routers did move forward with some nice software feature additions, but they pale in comparison to UniFi.

Here’s a month-by-month look at some of the major releases throughout the past year:

  • January 

    • UniFi OS 3.2.x added missing features like IGMP proxy, VLAN magic, hostname IPsec, DNS Shield, Loop provention to the UXG Lite and Express.

    • EdgeRouter 3.0.0 RC 6 with local GUI overhaul, IPsec and Wireguard

    • Connect 3.5.6 added YouTube mode

    • WiFiman released for Windows

    • UniFi Network 8.0.28 fixed some bugs

    • UniFi Talk 2.2.3 with UK support

    • SolarPoint 2.0.1 beta

  •   February

    • UniFi Network 8.1 EA releases with OSPF, Network Viewer, Site Score, custom NAT pools, L3 ACLs, side panels, rotated topology view, and IPv6 improvements

    • UniFi Protect 2.11.21 added animal and audio detections, vehicle type and color classification, multi-language support, and dark mode

    • UniFi OS 3.2.12 released with SFP port and minor bug fixes

  • March

    • UniFi Network 8.1.113 went GA with features discussed in February

    • Protect 3.0.22 added face recognition and person of interest alerts, multi-camera playback and archive to Google Drive

    • UniFi Switch 7.0.44 added ACL rules, PoE usage, PoE and port locating controls added to touchscreens, increased max LAG groups

    • Switch Ultra added custom port profiles and VLAN tagging

    • UISP Router 5.0.0-rc.1 added local web GUI, OSPF, BGP, Wireguard, IPsec, logging improvements

    • UISP Switch 1.8.0 added remote access via UISP and CLI for UISP Switch Plus

    • SolarPoint 2.0.1 GA

  • April

    • UniFi Network 8.1.127 added bug fixes, improved firewall rule visibility, tunnel IPs and OSPF support for site-to-site VPNs

    • UniFi OS 3.2.x added bug fixes for high CPU usage, crashes, and memory leaks

    • Design Center 2.1.0 added more products, product selection wizard, Wi-Fi coverage, floorplan editor and PDF export

    • UISP 2.4.93 added configurable/sortable devices view, local web interface access via UISP, data VLAN and traffic shaping for Wave, new import tool, bug fixes

    • UISP Router/Console 5.0.1 finally goes GA

    • EdgeRouter 3.0 RC 8

  • May

    • UniFi OS 4.0 EA added shadow mode, VLAN magic, IPv6 for local web interface, improved logging and SNMP support

    • UniFi Network 8.2 EAs with ACL rules, custom DNS records, inspection page, BGP support (requires upcoming UniFi OS 4.1), Wi-Fi 7 MLO (requires AP 7.1.3 which we still haven’t seen).

      • Announced as coming soon: 1:1 NAT, SSL/TLS decryption, sandboxing/anti-malware, packet captures

    • UniFi Protect 4.x GA with re-architected NVR core engine, increased camera capacity, enhanced (h.265) encoding, new dashboard, Recording Manager and global settings, bulk export/archive, camera shortcuts and filtering, PTZ patrol mode, and custom GIF support for G4 Doorbell Pro

    • UniFi Access 2.x with centralized location management, visualized unlock activity, enhanced live view, portal for device management, better performance

  • June

    • Site Manager 3.42 beta added Vantage Point, Zero Touch Provisioning (ZTP) and Update Manager

    • UniFi OS 4.0.6 EA added automatic failover for Shadow Mode, SNMP, improved memory usage and VPN throughput

    • UISP 2.4.126 EA with migration tools, bug fixes

    • UniFi Talk 3.2.0 added number porting in the UK and international mode for 3rd party SIP servers

  • July

    • UniFi OS 4.0.6 went GA with VLAN Magic, SNMP, IPv6 local web interface, screen rotation and bug fixes

    • UniFi Network 8.3.32 with custom NAT, domain whitelisting for Ad Blocking, improved inspections tab and downloadable logs, Suspicious Activity became Intrustion Prevention

    • Site Manager 3.42.6, 3.44.1 GA added Vantage mode for Protect and ISP Viewer

    • EdgeMAX got some small updates to local web interface and security fixes

    • Protext 4.1.31 added Alarm Manager and export to SMB support

  • August

    • UniFi Network 8.4.59 added Passpoint / Hotspot 2.0, packet captures for APs and switch ports, AP Analyzer, Pro AV support and advanced IGMP snooping, UI enhancements, and ability to rename default network

    • UniFi AP 7.1.18 EA added MLO on U7 Pro, Pro Max, Pro Wall, and Outdoor, still no GA release

    • UniFi AP 7.0.66 and 6.6.77 added Hotspot 2.0 / Passpoint, packet captures, as well as roaming, Ethernet negotiation, and roaming fixes

    • Protect Chime 1.7.14 added custom chime sounds and ringtones

  • September

    • Protect 5.0.33 added ONVIF support, archive to Dropbox, device tags, Storage Manager, improved recording service, and ability to pair Chime with multiple doorbells

    • UniFi Network 8.4.622 GA had bug fixes and improved DNS Shield validation

    • UniFi Network 8.5.1 and 8.5.5 EAs added improved dashboard, customizable widgets, NetFlow and SIEM server log export, packet capture on gateways, OpenVPN and IPsec for PBR on S2S VPNs, OSPF Neighbors visibility, WPA2/3 Enterprise mixed mode, egress rate limit for gateways, and stats in the AP Analyzer

    • Network 8.5.5 EA included warning that USGs will not be supported in next release

    • Site Manager 4.0 renamed UniFi OS Settings to Control Plane, added Co-located Consoles, increased Site Magic limit to 20, and added Site Support option for Cloud Keys, NVRs, and self-hosted Network Servers

    • Switch Ultra 1.2.3 added Loop Protection

    • UISP Power 1.1.2 added a local web GUI

    • EdgeMAX EdgeSwitch 1.10.4 includes some bare minimum security updates

  • October

    • UniFi Drive debuts with UNAS Pro

    • Network 8.5.6 goes GA

    • Network 8.6.x EAs add 2.4 GHz enhanced IoT connectivity option, packet capture on WAN ports, improved search, and moved/renamed a few things

    • UniFi OS 4.1.5 EA brought all the features requiring in from recent Network app updates: BGP, NetFlow, packet captures, etc

    • UISP Router 5.1.0-rc.4 added captive portal for setup, improved USPF support, and updated a lot of underlying packages for better stability and security

    • Switch Ultra and Flex Mini 2.0.5 added STP support

    • EdgeRouter 3.0.0-rc.9 followed five months after rc.8, improved the config tree and UISP remote access, IPSec and wireguard bug fixes, and UI improvements

  • November

    • Network 8.6.9 and UISP Router 5.1.0 went GA

    • UniFi OS 4.1.9 went GA for all UniFi OS devices, adding directory Integration, custom certificates (for web GUI), BGP, NetFlow, and packet captures.

    • Protect 5.1.57 added Case Manager, Sensor Manager, long-promised NFC/Fingerprint support for G4 Doorbell Pro, thumbnails in push notifications

    • UniFi AP 7.0.84 EA were one of many in a line of updates attempting to fix the U7 line issues with certain IoT devices and setups

  • December

    • Network 9.0.92 and 9.0.106 EAs with zone-based firewall, CyberSecure add-on for IPS/IDS, Network Application API, link aggregation support for EFG and UXG-Enterprise, SD-WAN hub & spoke networks, and increased default 5 GHz width to 80 MHz

    • Protect 5.1.78 EA added ONVIF PTZ camera controls and improved recording resilency

Miscellaneous Ubiquiti News for 2024

Finally, for a bit of fun, here are some of the miscellaneous news for Ubiquiti over the past year.

  • January - UNVR promo sale, cloud account requirement removed for UniFi Protect remote connections, EFG hit hit FCC, and the 2FA account requirement was announced

  • February - FBI removed Russian malware from EdgeRouters, UWC announced, my $10K setup posts flooded Reddit, techspecs.ui.com got comparison tables and marketing images, and the UniFi Cable Internet was rebooting itself thanks to ISPs pushing out firmware early

  • March - First UWC happens in Chicago, and we suffered through Screengate with slightly misaligned Cloud Gateway Ultra screens. We also got the new UniFi Portal iOS app, “UniFi GPT” AI advisor, and NAS rumors

  • April - UWC London, USG and USG-Pro listed as legacy, G5 PTZ and Access Ultra rumors

  • May - Custom GIF support for G4 Doorbell Pro, Tech Field Day presentations, UniFi Enterprise routing features and Wi-Fi 7 MLO promised

  • June - Cody published Unifi Network Complete Setup 2024 and we got our first podcast review. Slow month!

  • July - UniFi Cloud API and https://developer.ui.com/unifi-api/ announced

  • August - Enterprise partner program and UWC Miami announced, UniFi Integrations video with Alarm Manager, Passpoint, Pro A/V and API

  • September - The wait for UniFi OS 4.1 continued

  • October - Free UISP hosting went away

  • November - Black friday deals

  • December - Holiday sale

Hopefully 2024 was as good for you as it was for Ubiquiti’s hardware, software, and stock price. They’re a fun company to pay attention to and write about. I think we’re in for a very busy 2025 as well.

Cheers, and happy holidays!

]]>Ubiquiti 2024: Enterprise-Grade Year In ReviewUniFi Enterprise Wi-Fi 7: E7, E7 Campus, and E7 Audience OverviewUbiquitiWi-FiWi-Fi 7NetworkingPreviewEvan McCannWed, 04 Dec 2024 01:18:09 +0000https://evanmccann.net/blog/2024/12/unifi-enterprise-wi-fi-75d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:674e7a1ae659da780a5db6a4Originally Posted: December 3rd, 2024

UniFi Enterprise Wi-Fi 7

E7, E7 Campus, and E7 Enterprise Overview

On December 2nd 2024, Ubiquiti announced the first Early Access build of UniFi Network version 9 with some big feature additions: zone-based firewall rules, an optional CyberSecure subscription to improve Suricata IDS/IPS, and the Network Application API. They also released a video announcing three new Wi-Fi 7 access points: the E7, E7 Campus, and E7 Audience.

While UniFi Network version 9 is exciting, this article focuses on the new hardware. Let’s take them one by one before we zoom out and discuss where they fit in the lineup and what this all means.

UniFi Enterprise 7: A preview of the E7, E7 Campus and E7 Audience Wi-Fi 7 access points

E7: Don’t Call It Enterprise?

Curiously, the first model is simply called E7. Ubiquiti has mostly used a naming convention of generation-model for their UniFi access points. The U7-Pro followed the U6-Pro, which followed the AC-Pro. Following that, I would expect this to be the U7-Enterprise, a generational jump over the Wi-Fi 6E flagship U6-Enterprise.

It’s actually a bit deeper than the shortened name. The three E7 models are part of a new enterprise category, a tier above the normal flagship models. The U6-Enterprise is not an “enterprise” model, only these three new E7 models are.

Ubiquiti explains the different categories like this:

  • Enterprise: Incredible 1,000+ client capacity, long-range 6 GHz performance, and 10 GbE PoE connectivity with native high availability architecture for critical enterprise environments.

  • Flagship: High-performance ceiling-mounted access points.

  • Wall: Sleek APs that plug directly into a wall outlet for meshed connectivity*, or transform an ethernet drop into an AP.

  • Outdoor: Versatile, weatherproof APs that can be mounted to poles outside, or conveniently placed on a surface indoors.

  • Mega Capacity: Great for stadiums or amphitheaters with a very high density of connected devices.

  • Building Bridge: Serves as a high-performance network bridge, without the wire.

No matter how you categorize it, the E7 is for sale now in the US ($499 USD) and other regions. From the Ubiquiti store page for the E7:

Enterprise-grade indoor access point with 10-stream WiFi 7 performance, a 10 GbE uplink, and a redundant GbE port for high availability.

- WiFi 7 with 6 GHz support
- 10 spatial streams
- Real-time spectral analysis for enhanced channel selection
- Dedicated spectral analyzer radio
- Long-range 6 GHz performance with AFC (Available in FCC/IC region only)
- 185 m² (2,000 ft²) coverage
- 1,000+ connected devices
- (1) 10 GbE RJ45 port and (1) GbE RJ45 port for power & data redundancy
- Backwards compatible mounting system (WiFi Access Point Ceiling Mounts)
- Powered using PoE++

Note: 6 GHz operation is supported in these countries.

View fullsize e7-1.png
 View fullsize e7-4.png
 View fullsize e7-5.png
 View fullsize e7-9.png

Until now, the best Wi-Fi 7 omnidirectional indoor access points you could get were the U7 Pro or U7 Pro Max. The U7 Pro ($189) was the first, and is still the entry-level model for Wi-Fi 7. It is a tri-band BE10800 class AP with 2x2 radios for 2.4 GHz, 5 GHz, and 6 GHz. It requires PoE+, can only be used indoors, and has a single 2.5 Gbps RJ45 Ethernet port.

The U7 Pro Max ($279) upgrades the 5 GHz radio to 4x4 and increases transmit power, client capacity, and coverage area. It also adds a spectral analysis radio which is used in the UniFi Network Application to scan the RF environment, pick better channels, and monitor for issues.

So, what does the E7 ($499) add over the U7 Pro and U7 Pro Max? More spatial streams and more throughput on 6 GHz, more coverage capacity and area, dual uplinks with one 10 Gbps and one 1 Gbps RJ45 port, and — because, of course — RGB lighting. The E7 is also the first standard power 6 GHz AP from UniFi, where all previous models were low-power indoor. I covered the difference between SP and LPI back in 2021, but I’ll discuss that more below.

There are a lot of details to consider, so it’s helpful to see a direct spec comparison of all of the Enterprise models, and all of the Wi-Fi 7 UniFi APs.

View fullsize Enterprise UniFi APs
 Enterprise UniFi APs View fullsize Wi-Fi 7 UniFi APs
 Wi-Fi 7 UniFi APs

Across all categories, the E7 is the most technically impressive omnidirectional AP UniFi offers. For nearly double the price of the U6 Enterprise or U7 Pro Max, you get more features and more power. You’ll need to weigh how much those are worth to you.

On the other hand, if the E7 isn’t enough or you want 6 GHz coverage outdoors, let’s take a look at the E7 Campus.

E7 Campus: Outdoor with PRISM RF-Filtering

The E7 Campus looks like the regular E7 at first glance, but it’s different in a few key areas.

The name lines up with their new Enterprise Campus line of UniFi switches, which are focused on very-high throughput and high availability. The E7 Campus AP features the same 10-stream set of radios as the E7, with the same transmit power. The E7 Campus adds a few unique features:

  • High-gain directional antennas: 9 dBi for 2.4 GHz, and 12 dBi for 5 GHz and 6 GHz.

  • You can use the U7 Campus outdoors. It’s waterproof and rated at IPX6, or IP67 if you use the included port and cable cover kit. See their UniFi Device IP and IK Ratings help article for more specifics.

  • You can mount it to a ceiling, wall, pole, or 100x100 VESA mount with the included articulating mount.

  • It features PRISM™ RF filtering — previously found in the AirMAX 5AC Gen2 point-to-multipoint APs like the AirMAC Rocket 5AC Prism or PrismStation 5AC. The feature is all-caps now, but it performs the same function as before. It filters out surrounding RF noise from the environment or other APs. This leads to less noise, higher SNR, improved efficiency, and ultimately, better performance.

It’s not for sale yet, but it will be available for $799 USD in January 2025. From the Ubiquiti store page for the E7 Campus:

Enterprise-grade indoor/outdoor access point with ‎10-stream‎ ‎‎WiFi 7 performance, PRISM™ active RF filtering technology, and integrated directional antennas.

- WiFi 7 with 6 GHz support
- 10 spatial streams
- Real-time spectral analysis for enhanced channel selection
- High selectivity PRISM™ RF filtering technology
- Dedicated spectral analyzer radio
- Directional high gain antenna array
- Long-range 6 GHz performance with AFC (Available in FCC/IC region only.)
- 465 m² (5,000 ft²) coverage and 1,000+ connected devices
- (1) 10 GbE RJ45 port and (1) GbE RJ45 port for power & data redundancy
- Versatile articulating wall/pole mount for precise position (included), VESA 100x100 compatibility
- Powered using PoE++

Note: 6 GHz operation is supported in these countries.

View fullsize e7-campus-us-1.png
 View fullsize e7-campus-us-7.png
 View fullsize e7-campus-us-6.png
 View fullsize e7-campus-us-18.png

E7 Campus Antenna and Coverage Differences

The E7 Campus spec list is light on specifics, but the antenna differences are worth discussing. The lower-gain antennas in models like the U7 Pro, U7 Pro Max, and E7 are omnidirectional and designed to evenly cover a broad area. The higher-gain antennas in the E7 Campus are meant for long-range coverage in a concentrated area.

As a general rule, the higher gain an antenna is, the more directional it is. To reach long distances, you have to give up broad coverage. These high-gain antennas make the E7 Campus not the best option for evenly covering a broad area. You can still mount it on a ceiling, but the coverage pattern of the E7 Campus won’t be the same as other omnidirectional models like the E7 or U7 Pro.

They haven’t updated their antenna radiation charts to show these new models yet, but I suspect that the E7 Campus is going to be heavily weighted to push signal out of the top of the AP. Whether you mount it on a ceiling, wall, or pole, you’ll want to face the flat white top of the AP towards the area you want to cover. You’ll also want to carefully consider placement and cell sizes when planning a network with these APs.

A better model to compare the E7 Campus against might be the U7 Outdoor. The U7 Outdoor also has high-gain directional antennas. The U7 Outdoor’s internal 5 GHz antenna is specified as 12.5 dBi, with a 45° beamwidth. The 12 dBi antennas in the E7 Campus should be similar, and cover a roughly 45° arc over long distances. The U7 Outdoor features RP-SMA to connect other antennas like the included 4 dBi omni antennas, but you’re stuck with the internal ones on the E7 Campus.

You don’t have to use the E7 Campus outdoors, you could also use it in a large indoor space, like say in a warehouse. You could use multiple E7 Campus APs to break up a large space into multiple smaller coverage cells. Combined with the spectral analysis radio and RF-filtering, the E7 Campus should be a significantly more capable AP for those kind of situations.

We’ll need to wait until January 2025 to get real-world reviews of how this all works in practice. Until then, the promise of what this AP can do is exciting, just don’t expect it to be a drop-in replacement for an omnidirectional AP you currently have.

View fullsize Comparison of E7 Campus and other UniFi APs you can use outdoors
 Comparison of E7 Campus and other UniFi APs you can use outdoors

E7 Audience: An Upgraded BaseStation XG

Finally, we have the most expensive and most niche of the three models. The E7 Audience is a spiritual successor to the Wi-Fi 5 BaseStation XG (UWB-XG). These two mega capacity models are designed for truly large networks — picture an arena or stadium, convention center, or large outdoor event.

Their unique design and capabilities are meant to be used in those kind of demanding situations, and are definitely not meant to be a normal AP in a normal Wi-Fi network. These are for the highest-density and highest-end Wi-Fi networks.

From the Ubiquiti store page for the E7 Audience:

Enterprise-grade, indoor/outdoor access point designed for high-density environments with 12-stream 5 GHz and 6 GHz WiFi 7 performance, a 10 GbE uplink, and a redundant GbE port for high availability.

- WiFi 7 with 6 GHz support
- 12 spatial streams
- Real-time spectral analysis for enhanced channel selection
- High selectivity PRISM™ RF filtering technology
- Dedicated spectral analyzer radio
- Selectable directional beamforming antenna (15 dBi, 50° or 11 dBi, 90°) allows for cell size optimization
- Long-range 6 GHz performance with AFC (Available in FCC/IC region only.)
- 465+ m² (5,000+ ft²) open space coverage
- 1,500+ connected devices
- (1) 10 GbE RJ45 port and (1) GbE RJ45 port for power & data redundancy
- Versatile wall and pole mounting
- Powered using PoE++
- IP68 Waterproof

View fullsize e7-audience-us-2.png
 View fullsize e7-audience-us-3.png
 View fullsize e7-audience-us-5.png
 View fullsize e7-audience-us-6.png

Also, one small thing worth noting. There is a small screen on the bottom of the U7 Audience which shows the current IP address and number of connected clients. Is it necessary? Probably not, but it’s a nice little extra feature only found on this AP.

I’ve wondered for a long time if we would ever see an updated BaseStation XG. The Wi-Fi 6 era came and went without one. I can’t image Ubiquiti sells a ton of these, so maybe it was a lower priority. Maybe they wanted to wait until all the technical pieces — Wi-Fi 7, 6 GHz, and standard power operation — were in place before releasing a new model.

Either way, the E7 Audience is a big jump over the BaseStation XG. The BaseStation XG may be the better option for 5 GHz today. As we build our way to the Wi-Fi 7 and 6 GHz future, the E7 Audience will stand alone as the top option when it’s released in March 2025.

View fullsize Comparison of Mega Capcity UniFi AP models
 Comparison of Mega Capcity UniFi AP models

UniFi E7 Details and Nit Picks

Low-Power Indoor (LPI) 6 GHz APs

As I mentioned above, the differences between low-power indoor (LPI) and standard power 6 GHz APs are important. This is a complex topic, but I’ll try to keep this simple and understandable. If I’ve missed anything or got anything wrong, please let me know. We’ll start with LPI models like the U7 Pro.

Effective isometric radiated power (EIRP) is a measure of the power output of a radio. Based on where you are in the world and which channels you are using, there are different limits to EIRP. For 6 GHz in the US, LPI models like the U7 Pro are limited to 30 dBm EIRP. Also, as the name implies, they can only operate indoors.

6 GHz isn’t the same as 5 GHz or 2.4 GHz when it comes to EIRP and power limits. The maximum EIRP for LPI APs changes based on channel width. 6 GHz mandates a maximum Power Spectral Density limit, or PSD. For LPI APs, this limit is 5 dBm/MHz.

This means that the EIRP limit for 6 GHz LPI access points increases with wider channels. For the U7 Pro to operate at the maximum 30 dBm EIRP, you need to use a 320 MHz channel. With every reduction in channel width comes a reduction in power. This is a good thing though, as it encourages the use of wider channels.

With 2.4 GHz and 5 GHz, there is a noise penalty with wider channels. Every time you double the channel width, you also double the noise. With a static maximum EIRP, narrow channels have an advantage. Wider channels tend to be noisier and less efficient.

With LPI 6 GHz APs, there is still a noise penalty with wider channels. However, every time you double the channel width, you can offset this by doubling (+3 dBi) your transmission power.

AFC and Standard Power 6 GHz APs

Standard power APs like the E7 or E7 Campus have slightly different constraints. They can be used outdoors, and have a much higher PSD limit of 23 dBm/MHz. They are limited to just the U-NII-5 and U-NII-7 channels, and an absolute maximum of 36 dBm EIRP.

While a 6 dBm increase over LPI may not sound like a lot, the logarithmic scale means that is a 4X increase in power. Also, it’s important to remember that due to a higher PSD limit, you can operate at higher power even when using narrower channels.

While standard power APs can operate at higher power and outdoors, they are required to use Automated Frequency Coordination (AFC). The AFC system leverages GPS to ensure that there are no incumbent users trying to access the same channels in the same area. These would typically be for things like links to geostationary satellites, or television broadcasts.

On top of all this complexity is the fact that 6 GHz operation rules vary by region. Currently these E7 models can only operate as standard power in the USA (FCC) or Canada (IC). They operate as LPI APs in all other regions, but that may change in the future as regulations are approved and rules are changed.

Along with these higher power limits, the addition of outdoor operation is a huge landmark. It’s been a long few years of waiting for the AFC system and everything to be worked out, but I am so glad to see more outdoor and standard power 6 GHz equipment available.

These features excite RF nerds like me. More importantly, they allow for better and more-scalable Wi-Fi networks to be built, which will improve everyone’s experience going forward. It’s an exciting time for wireless networks and the wireless industry as a whole.

Nit Pick: Coverage Area and Concurrent Clients

Recently Ubiquiti started specifying the estimated coverage area for each AP model. It was a useful addition, but it’s worth taking this claim with a grain of salt. A claim of 185 m² / 2,000 ft² doesn’t mean that it’s guaranteed to cover exactly that much area. It also doesn’t mean that a 20,000 ft² building is going to be covered by exactly 10 APs. That said, it’s a useful metric to have when comparing models. It’s much clearer than the complicated math of TX power, antenna gain, and EIRP.

The flip side of this has been the client capacity numbers that are advertised. These numbers are absurd, with the U7 Pro claiming over 300 clients, and the U7 Pro Max claiming over 500. Can they connect that many clients at once? In a lab, I’m sure. The real world is different.

It doesn’t matter how great the AP is, if several hundred clients are connected and active at once, no one will be happy. All of those clients will have low throughput and high latency, or try to roam to a less-crowded AP. Even with Wi-Fi 7, 6 GHz, and the widest channels possible, there’s a limited amount of airtime for transmissions. The more clients you have, the less each can use.

While you may be able to get 300, or 500, or even 1000 clients to associate to a single access point, if more than a small fraction of them are active at once, it’s not going to work well. Ubiquiti was challenged on this by Wi-Fi legend Keith Parsons in their Wi-Fi Field Day talk. That whole session is worth watching, but I really enjoyed that portion.

Despite the push back from professionals, they are still making these inflated concurrent client claims. I think you should dismiss them as marketing numbers, and never plan to push a single AP to the limits they define. High-density wireless networks are hard to design and perfect, and claims of 1000+ clients per AP only muddy the water and set up false expectations.

Is UniFi Enterprise-Grade Yet?

To wrap up this news, I can’t help but reflect on this past year and all of the hardware and software we’ve seen from Ubiquiti. It’s pointed out often that despite their marketing, UniFi isn’t truly enterprise-grade. Discussions from 5 years ago sound a lot like the discussions you’ll hear today. A lot of it comes down to the definition of the word enterprise, and what that means to you or your company.

For me, in my day job and my career as a network engineer, UniFi is not enterprise-grade. We use Cisco for switching and wireless, and our CTO will never approve of UniFi in our production facilities. If it were up to me, I would be OK with using UniFi switching and wireless in our offices or smaller locations. UniFi gateways and their firewall and routing capabilities are a discussion for another time, I just want to focus on wireless and switching here.

UniFi has had a reputation for a long time of being pretty to look at but sometimes ugly to use. There are years of history backing that up with buggy software, and promises that were bigger than what was delivered. Their lack of licenses and subscription fees are good things, but their perceived unreliability and lack of support are non-starters.

I believe that time may be coming to a close, but there is always some lag between reality and reputation. It will take time for their perception to change, and for more businesses and “enterprise” customers to start considering a UniFi network. It’s up to Ubiquiti to prove that, and that work is ongoing.

On the UI Chat podcast, we’ve been reviewing the monthly Ubiquiti news. I pay more attention to Ubiquiti’s every move than most people, but even for me it’s been overwhelming at times. I think for the average technical person, they’ve either made up their mind years ago that UniFi isn’t serious enough for their needs, or they just aren’t aware of all that has changed.

Just focusing on the UniFi Network software itself, the amount of progress over the past year or two has been impressive. BGP, OSPF, spectrum analysis, native packet capture, NetFlow, custom NAT, better logging, SNMP, Wi-Fi 7 MLO, L3 and L2 ACLs, PPSK, an API — the list goes on. Add in the countless hardware options and the ecosystem they’ve built around it, it’s a good solution for a lot of different networks and needs.

I still have complaints and you probably still have some reservations, but I believe this year has proved that UniFi is a serious competitor and worth considering. They are growing up, expanding, and maturing. They are fixing long-standing issues and delivering a seemingly non-stop flow of major software and hardware releases. They do some things better than their competitors — design, ease of use, cost — but still have things to catch up on and areas to improve. No vendor is perfect.

These three new access points are just another step on UniFi’s Enterprise-Grade™️ journey, but when you take a broader view, it’s hard to be unimpressed with everything they’ve done in 2024.

I don’t know about you, but I’m excited for what’s next.

]]>UniFi Enterprise Wi-Fi 7: E7, E7 Campus, and E7 Audience OverviewUniFi Network Comparison ChartsUbiquitiWi-FiNetworkingGuideComparison ChartsEvan McCannWed, 27 Nov 2024 21:33:00 +0000https://evanmccann.net/blog/ubiquiti/unifi-comparison-charts5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:60844824fc04bf5c498f4f5cOriginally Posted: April 24th, 2021
Last Edited: August 28th, 2025

UniFi Network Comparison Charts

These charts compare all available UniFi Network devices — Gateways, Cloud Keys, Switches, and Wireless Access Points. They are available as images and in other mobile-friendly formats on Google Drive.

Other Ubiquiti Comparison Charts:

Table of Contents

UniFi Gateways and Cloud Keys

There are two categories of UniFi gateway: Independent and Cloud.

Independent Gateways are just routers and nothing else. These are managed by a Cloud Key, self-hosted, or cloud-hosted UniFi Network application. They don't run any software, and don't do anything besides act as a firewall/gateway/router.

Cloud Gateways are routers that run software. At a minimum they run the UniFi Network application. They manage themselves and other UniFi switches and APs. They can't be managed by a Cloud Key or self-hosted controller*.

  • These have been called "UniFi OS Consoles" or "Gateway Consoles" and other terms, but Cloud Gateway™ is the current branding.
  • Some of these run other UniFi software like Protect, Talk, Access, or Connect.
  • *Besides the UniFi Express (UX) and UX7, which can be used as access points. There is always an asterisk on everything.

Current UniFi Gateways

Cloud Gateways - Wi-Fi Integrated

  • Express (UX)
  • Express 7 (UX7) — Wi-Fi 7 update to the UX
  • Dream Router 7 (UDR7) — Wi-Fi 7 update to the UDR
  • Dream Wall (UDW)

Cloud Gateways - Compact

Cloud Gateways - Large and Enterprise

Independent Gateways (UXG)

Unlisted and Discontinued UniFi Gateways

These may still be for sale, but are not promoted on the Ubiquiti website or listed in their respective categories in the Ubiquiti store. The USG and USG-Pro are legacy products, no longer supported, and should not be considered for new installs. I'll include them when relevant for comparison if you're considering an upgrade.

  • UniFi Dream Machine (UDM)
  • UniFi Dream Router (UDR)
  • UniFi Security Gateway (USG)
  • UniFi Security Gateway Pro (USG-Pro)
View fullsize All Current UniFi Gateways
 All Current UniFi Gateways View fullsize Unlisted or Discontinued UniFi Gateways
 Unlisted or Discontinued UniFi Gateways

UniFi Cloud Gateways

Wi-Fi Integrated

  • Express (UX)

  • Express 7 (UX7)

  • Dream Router 7 (UDR7)

  • Dream Wall (UDW)

Wi-Fi integrated Cloud Gateways have… integrated Wi-Fi. You can expand your wired network with additional switches, and your wireless network with additional APs, but these all-in-one models are an easy way to get started.

The Express (UX) is the cheapest and least powerful option. It is a gateway, wireless access point, and can control up to 4 additional UniFi Network devices. The Express can also be used as an access point in any other UniFi network.

The Express 7 (UX7) is an updated UX with Wi-Fi 7 support and higher performance. It is a gateway, wireless access point, and can be the UniFi Network controller for 30 additional devices. The Express 7 can also be used as an access point in any other UniFi network.

The Dream Router 7 (UDR7) is the updated version of the original Dream Router, with Wi-Fi 7 support and higher performance. It is a gateway, wireless access point, and can be the UniFi Network controller for 30 additional devices. It also runs all of the other UniFi applications — Protect, Talk, Access, and Connect.

The Dream Wall (UDW) is meant to be installed on a wall rather than a typical network rack or shelf. It runs all UniFi OS applications, and includes a built-in router, switch, and Wi-Fi access point, along with support for UniFi Protect, Talk, Access, and Connect.

The UDR and UDM are unlisted, but still supported and OK to use. You should consider the UX7, UDR7, and other current models for new installs, but they’re useful to compare against.

The Dream Router (UDR) is a router, 4-port switch, and Wi-Fi 5/6 access point. It has 2 PoE ports and the ability to run two additional UniFi applications. It’s a bit under-powered, and not the best deal in comparison to the newer options.

The Dream Machine (UDM) is a router, 4-port switch, and AC Wave 2 Wi-Fi access point. It only runs the Network application and UniFi Identity. It’s fairly capable, but surpassed by the UDR7 for those looking for this kind of device.

View fullsize Wi-Fi Integrated Cloud Gateway Comparison
 Wi-Fi Integrated Cloud Gateway Comparison View fullsize Wi-Fi Integrated models with the UDM and UDR for comparison
 Wi-Fi Integrated models with the UDM and UDR for comparison

Compact

Compact Cloud Gateways lack built-in Wi-Fi, and should be paired with UniFi switches and APs to form a complete network. They can offer more flexibility and more performance than the Wi-Fi Integrated models, especially the latest option, the UCG-Fiber.

The Cloud Gateway Ultra (UCG-Ultra) is a gateway and UniFi Network controller for 30 additional UniFi devices. It has a 2.5 Gbps RJ45 WAN port, but it is limited to gigabit speeds by the backplane and it’s internal connection to it’s four switch ports. It doesn’t run any additional UniFi applications.

The Cloud Gateway Max (UCG-Max) offers higher performance than the UCG-Ultra, five 2.5 Gbps RJ45 interfaces, and runs all UniFi applications. For $199 it comes without storage for UniFi Protect, but you can purchase a M.2 SSD Tray and an SSD, or opt to buy it with 512 GB, 1 TB, or 2 TB SSD pre-installed.

The Cloud Gateway Fiber (UCG-Fiber) is the newest and highest performance model in this category, with more processing power and 10 Gbps RJ45 and SFP+ interfaces. It runs all UniFi applications and also has storage options, with $279 as the base price and 1 or 2 TB options available.

The 2nd image here combines the compact models with the desktop size Wi-Fi Integrated models above. These are all the Cloud Gateways which don’t need to be mounted in a network rack.

View fullsize Compact UniFi Cloud Gateways Comparison
 Compact UniFi Cloud Gateways Comparison View fullsize All desktop size Cloud Gateways
 All desktop size Cloud Gateways

Large Scale and Enterprise Cloud Gateways

Large Scale and Enterprise models are meant to be installed in a network rack and used in bigger or more demanding networks. These offer some features that other models don’t, such as Shadow Mode (VRRP) for hardware redundancy and BGP.

The Dream Machine Pro (UDM-Pro), Special Edition (UDM-SE), and Pro Max (UDM-Pro-Max) are 10 Gbps rackmount gateways that run all UniFi OS applications — Network, Protect, Talk, Access, and Connect. They have built-in 8-port Ethernet switches, but don’t provide Wi-Fi. The UDM SE adds 2.5 Gbps WAN, PoE, and internal 128 GB SSD. The UDM Pro Max doesn’t offer PoE, but offers a 2.5 Gbps WAN, 128 GB SSD, a 2nd HD bay, more RAM, a more powerful CPU, higher throughput, and double the management limits of the Pro and SE.

The Enterprise Fortress Gateway (EFG) is the latest, biggest, and baddest option. For $1999, you get more of everything. Higher speed interfaces including two 25 Gbps SFP28, higher throughput, higher management limits, and exclusive features like SSL/TLS inspection. It only runs UniFi Network, so you’d need to add a Cloud Key or NVR if you want to use additional UniFi applications.

View fullsize Large Scale and Enterprise Cloud Gateway Comparison
 Large Scale and Enterprise Cloud Gateway Comparison

Independent Gateways — USG and UXG

These gateways do not run any UniFi software. They require the UniFi Network application to be run on another piece of hardware such as a Cloud Key, local PC/server, or cloud service. The USG models are discontinued and end of life, while the UXG models are current.

View fullsize Indepent UniFi Gateways (UXG) Comparison
 Indepent UniFi Gateways (UXG) Comparison View fullsize Legacy USG vs. UXG Comparison
 Legacy USG vs. UXG Comparison

UniFi Cloud Keys

Cloud Keys are different. They are not gateways or routers, they just run UniFi OS and it’s applications such as UniFi Network and UniFi Protect. Cloud Keys are half of a complete network. They need to be paired with UniFi switches and APs, and a UXG if you want to do your routing and firewall functions with UniFi.

  • The original white CloudKey (UC-CK) is discontinued and not supported

  • The 2nd generation CloudKey (UCK-G2) only runs UniFi Network, but the CloudKey+ (UCK-G2-Plus or UCK-G2-SSD) runs all UniFi applications and can act as a small NVR for UniFi Protect

  • The CloudKey Enterprise (CK-Enterprise) is for large scale, multi-site UniFi Network setups

You can always download the UniFi Network application for free and run it yourself, but you can use these hardware options or pay Ubiquiti monthly for their Official UniFi Hosting (Official UniFi Hosting) instead.

Cloud Keys run UniFi software. These are not gateways, they only run the software and manage other UniFi devices.

Return to Table of Contents

UniFi Wi-Fi Access Points

All UniFi APs, as of August 2025. See my (needs to be updated!) UniFi Wi-Fi Access Point Buyers Guide for more details.

Comparison of all current UniFi Wi-Fi access points

Wi-Fi 5 UniFi APs

The older Wi-Fi 5 models are broken up into two tiers. The AC Wave 1 models are the oldest UniFi APs still for sale. The slightly newer AC Wave 2 models mostly have “HD” in their name, and the additional features that AC Wave 2 added to the 802.11ac standard.

Curiously, in January 2024 we got a new AC Wave 1 model, the Swiss Army Knife. It’s similar to the AC Mesh, and it can be used with a optional RP-SMA antennas.

AC Wave 1

AC Wave 2

View fullsize Wi-Fi 5 — AC Wave 1
 Wi-Fi 5 — AC Wave 1 View fullsize Wi-Fi 5 — AC Wave 2
 Wi-Fi 5 — AC Wave 2

Wi-Fi 6, 6E, and 7 UniFi APs

Wi-Fi 6

Wi-Fi 6 UniFi AP Comparison

Wi-Fi 6E and Wi-Fi 7

The U6-Enterprise and U6-Enterprise In-Wall are the only Wi-Fi 6E models, but we now have a lot of Wi-Fi options as well. In January 2024, Ubiquiti released their first Wi-Fi 7 model, the U7-Pro. In May 2024, they added three more Wi-Fi 7 models: the U7 Pro Max, U7 Pro Wall, and U7 Outdoor. See my U7-Pro and U7 Pro Max, Pro Wall, and Outdoor Preview for more details about those.

  • U7 Lite (U7-Lite) — Entry-level Wi-Fi 7 model (no 6 GHz)

  • U7 Long-Range (U7-LR) — Higher TX power and range than U7-Lite

  • U7 Pro (U7-Pro) — Cheapest Wi-Fi 7 with 6 GHz

  • U7 Pro Max (U7-Pro-Max) — Upgraded U7-Pro with real-time spectral analysis

  • U7 Pro XG (U7-Pro-XG) — New flatter design with 10 Gbps RJ45 uplink

  • U7 Pro XGS (U7-Pro-XGS) — New flatter design with 10 Gbps RJ45 uplink and real-time spectral analysis

  • U7 In-Wall (U7-IW) — No 6 GHz, two 2.5 Gbps LAN ports

  • U7 Pro Wall (U7-Pro-Wall) — Supports 6 GHz, no downstream LAN ports

  • U7 Outdoor (U7-Outdoor) — First Wi-Fi 7 outdoor model, no 6 GHz

  • U7 Pro Outdoor (U7-Pro-Outdoor) — Outdoor, standard power 6 GHz

There are 2 older Wi-Fi 6E models, the first to support 6 GHz. In December 2024 we got three more enterprise WI-Fi 7 models. See my E7, E7 Campus, and E7 Audience Overview for more details.

  • U6 Enterprise (U6-Enterprise) — First AP with 6 GHz support

  • U6 Enterprise In-Wall (U6-Enterprise-IW)

  • E7 (E7) — top-of-the-line “enterprise” omnidirectional AP

  • E7 Campus (E7-Campus) — An outdoor version of the E7 with high-gain directional antennas

  • E7 Audience (E7-Audience) — An updated Wi-Fi BaseStation XG, a mega capacity model meant for high-density networks

View fullsize UniFi APs (August 2025) - 6 - Wi-Fi 7.jpg
 View fullsize UniFi APs (August 2025) - 7 - Wi-Fi 6E and E7.jpg

Omnidirectional UniFi APs — Flagship

Since there are so many access points to pick from, it's better to break things down by category.

The biggest category is flagship, which is UniFi's term for the (generally) rounded disc shape, omnidirectional AP you'd typically find on a ceiling. Flagship models are the default option for most networks in most situations, offering broad coverage of an indoor area.

Here are the older Wi-Fi 4 and Wi-Fi 5 flagship models. These may still be around and for sale, but generally aren't the best purchase in 2025.

Flagship — Wi-Fi 5

More people should consider the Wi-Fi 6 and 6E flagships, or the latest Wi-Fi 7 flagship options.

Flagship — Wi-Fi 6 and Wi-Fi 6E

Flagship — Wi-Fi 7

  • U7 Lite (U7-Lite) — Entry-level Wi-Fi 7 model (no 6 GHz)

  • U7 Long-Range (U7-LR) — Higher TX power and range than U7-Lite

  • U7 Pro (U7-Pro) — Cheapest Wi-Fi 7 with 6 GHz

  • U7 Pro Max (U7-Pro-Max) — Upgraded U7-Pro with real-time spectral analysis

  • U7 Pro XG (U7-Pro-XG) — New flatter design with 10 Gbps RJ45 uplink

  • U7 Pro XGS (U7-Pro-XGS) — New flatter design with 10 Gbps RJ45 uplink and real-time spectral analysis

  • E7 (E7) — Top-of-the-line “enterprise” omnidirectional AP

The first set of images break the flagship down by Wi-Fi generation. The 2nd set breaks things down by tier: Lite and Long-Range, Pro and HD, then XG and Enterprise.

View fullsize Flagship UniFi APs - Wi-Fi 4 / 5
 Flagship UniFi APs - Wi-Fi 4 / 5 View fullsize Flagship UniFi APs - Wi-Fi 6 / 6E
 Flagship UniFi APs - Wi-Fi 6 / 6E View fullsize Flagship UniFi APs - Wi-Fi 7
 Flagship UniFi APs - Wi-Fi 7 View fullsize Flagship UniFi APs - Lite / Long-Range
 Flagship UniFi APs - Lite / Long-Range View fullsize Flagship UniFi APs - Pro / HD
 Flagship UniFi APs - Pro / HD View fullsize Flagship UniFi APs - XG / Enterprise
 Flagship UniFi APs - XG / Enterprise

Mega Capacity UniFi APs

These models are meant for very high density networks in a stadium, arena, convention center, or large outdoor space.

View fullsize UniFi APs (August 2025) - 20 - Mega Capacity.jpg

Outdoor UniFi APs

These access points can all be used outdoors. Technically the E7-Campus and others can be used outdoors as well, but these are the models in the “outdoor” category on the Ubiquiti store.

View fullsize UniFi AP Comparison - Outdoor Wi-Fi 4 / 5
 UniFi AP Comparison - Outdoor Wi-Fi 4 / 5 View fullsize UniFi AP Comparison - Outdoor Wi-Fi 6 / 7
 UniFi AP Comparison - Outdoor Wi-Fi 6 / 7

UniFi APs - Wall

  • AC In-Wall (UAP-AC-IW)

  • BeaconHD (BeaconHD) — No Ethernet ports, wireless backhaul only

  • AC In-Wall HD (UAP-IW-HD)

  • U6 Extender (U6-Extender) — No Ethernet ports, wireless backhaul only

  • U6 In-Wall (U6-IW)

  • U6 Enterprise In-Wall (U6-Enterprise-IW) — Wi-Fi 6E with 6 GHz

  • U7 In-Wall (U7-IW) — No 6 GHz, but two 2.5 Gbps LAN ports

  • U7 Pro Wall (U7-Pro-Wall) — Supports 6 GHz, but no downstream LAN ports

View fullsize UniFi AP Comparison - Wall Wi-Fi 4 / 5
 UniFi AP Comparison - Wall Wi-Fi 4 / 5 View fullsize UniFi AP Comparison - Wall Wi-Fi 6 / 7
 UniFi AP Comparison - Wall Wi-Fi 6 / 7

Building and Device Bridges

The Building Bridges can be used to to bridge your network to another location a couple hundred feet or meters away. The recently announced Device Bridge and Device Bridge Pro are for connecting a far away camera or other PoE device.

The basic Device Bridge is meant for indoor deployments, and connects to an existing UniFi Wi-Fi network. The Device Bridge Pro can do that too, or you can use a pair of them for longer or outdoor point-to-point links, up to 5 km or 3.1 miles. You could also consider a UISP device like an AirMAX or GigaBeam instead.

View fullsize UniFi Building and Device Bridges
 UniFi Building and Device Bridges

UniFi APs — All-in-one Wi-Fi Gateways

These models were covered above, as gateways. These gateway models also act as Wi-Fi access points, so it’s worth covering their wireless specs as well.

  • Dream Machine (UDM) — Unlisted, available via search

  • Dream Router (UDR) — Unlisted, available via search

  • Express (UX)

  • UniFi Dream Wall (UDW)

  • Express 7 (UX7)

  • Dream Router 7 (UDR7)

View fullsize Comparison of UniFi Gateways with Wi-Fi built-in
 Comparison of UniFi Gateways with Wi-Fi built-in
Return to Table of Contents

UniFi Switches

There are over 50 different UniFi switch models, including some that are no longer sold or mentioned on Ubiquiti's website. There are so many in fact, that I've run out of shades of blue.

Ladies and gentlemen, I regret to inform you: We've gone purple.

Comparison of all current UniFi switch models

The sheer number of switch options makes breaking things down by category and size necessary. We'll start with the smallest Flex and Utility models then work our way up.

Utility is the largest category, containing the smallest and cheapest switches. These models don't live in a network rack, and are typically placed on a flat surface or mounted to a pole, DIN rail, or wall.

Flex models can be powered by PoE input, and the USW-Flex is unique in offering an optional outdoor enclosure. This flexibility comes with tradeoffs, with most of these missing out on common L2 features such as spanning tree (STP/RSTP) and LACP port aggregation.

The models listed with "limited" L2 features do not support features such as IGMP and DHCP snooping, ACLs, voice VLANs, LLDP, and storm control, among others. The Flex 10 GbE is listed as supporting "most" L2 features because it does support those, but lacks QoS (DSCP) and Pro AV Profiles, just like the Standard rack mount models.

Also worth calling out: the Flex and Flex 2.5G PoE do not come with power supplies in their box. Order one separately or have a PoE source available to power them.

“Utility” is another new category on the UniFi store. These models are specialized in some way, either by being small desktop models with PoE, or by being more flexible in where they can be used. The Flex switch has the , and the Industrial is plenum-rated and hardened for harsh environments, as examples. For readability, I’ve split them into two groups.

Utility — Flex

Utility

UniFi Switches - Flex
 UniFi Switches - Flex UniFi Switches - Utility
 UniFi Switches - Utility

Standard UniFi Switches

"Standard" is a term for the normal, rack mount switches. These are limited by their 1 Gbps SFP interfaces and low power budgets, but offer plenty of features and silent fanless cooling.

View fullsize UniFi Swithes - Standard
 UniFi Swithes - Standard

Pro / Pro Max / Pro HD / Pro XG UniFi Switches

The professional models feature UniFi’s Layer 2+/L3 switching features, high PoE budgets, and 10 Gbps SFP+ or 25 Gbps SFP28 ports. The USP-RPS can be used for redundant power on all models that support it.

The Pro Max models were announced in December 2023. They add PoE++ and 2.5 Gbps RJ45 interfaces, making them good for networks with lots of high-power and high-bandwidth needs. They also have RGB lighting that can help identify ports based on activity or VLAN. Ubiquiti has branded this as Etherlighting™️.

The Pro HD and XG models are newer, and add more 2.5 Gbps RJ45, 10 Gbps RJ45, and PoE+++ ports.

View fullsize UniFi Switches - Pro
 UniFi Switches - Pro View fullsize UniFi Switches - Pro Max
 UniFi Switches - Pro Max View fullsize UniFi Switches - Pro HD and Pro XG
 UniFi Switches - Pro HD and Pro XG

Aggregation, Enterprise, and Enterprise Campus UniFi Switches

Aggregation models are meant for connecting multiple additional switches in a large or high-throughput network.

Enterprise and Enterprise Campus are above professional. These models focus on very high throughput and features, like MC-LAG, OSPF/BGP, VRRP, switch stacking, 25 Gbps SFP28 and 100 Gbps QSFP interfaces, and 90W 802.3bt class 8 PoE+++.

View fullsize UniFi Switches - Aggregation
 UniFi Switches - Aggregation View fullsize UniFi Switches - Enterprise
 UniFi Switches - Enterprise
Return to Table of Contents

UniFi Switches — Non-PoE

All UniFi switches that don't have PoE, grouped by port count.

View fullsize No PoE - 16 Ports and Under
 No PoE - 16 Ports and Under View fullsize No PoE - 24 Ports Standard / Pro
 No PoE - 24 Ports Standard / Pro View fullsize No PoE - 24 Ports Enterprise
 No PoE - 24 Ports Enterprise View fullsize No PoE - 48 Ports
 No PoE - 48 Ports
Return to Table of Contents

UniFi Switches — PoE

All UniFi switches that have PoE, grouped by port count.

View fullsize PoE - 8 Ports and Under
 PoE - 8 Ports and Under View fullsize PoE - 9 to 12 Ports
 PoE - 9 to 12 Ports View fullsize PoE - 16 Ports
 PoE - 16 Ports View fullsize PoE - 24 Ports Standard and Pro
 PoE - 24 Ports Standard and Pro View fullsize PoE - 24 Ports Enterprise
 PoE - 24 Ports Enterprise View fullsize PoE - 48 Ports Standard and Pro
 PoE - 48 Ports Standard and Pro View fullsize PoE - 48 Ports Enterprise
 PoE - 48 Ports Enterprise]]>UniFi Network Comparison ChartsUI Chat Podcast September 2024: Crosstalking TogetherUbiquitiPodcastEvan McCannSat, 05 Oct 2024 15:28:28 +0000https://evanmccann.net/blog/2024/10/ui-chat-podcast-september-2024-crosstalking-together5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6701542e9051f7109c74d784Originally Posted: October 5th, 2024

In case you missed it, the September 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

This time we had a special guest: Chris Sherwood from the Crosstalk Solutions YouTube channel! His channel helped me get interested in UniFi way back in 2016, and I’ve watched a ton of his videos over the years. So this was a nice full-circle moment for me, and it was great to get his perspective on Ubiquiti and their latest releases.

We covered the new hardware releases of the Enterprise NVR and Flex Mini 2.5G. On the software side we covered Protect version 5, UniFi Network v8.4.62, and the first two v8.5 EA releases (v8.5.1 and v8.5.5). We also discussed the death of the USG, how much we love ITDRC, Site Manager updates, and some other minor software releases.

UI Chat podcast September 2024: Crosstalking Together

I’ve been dreadfully slow with posting things this summer, and I’ve missed linking a few UI Chat shows since May. So don’t forget to check out our previous episodes, like in August when we had the great Jesse Nowlin (@MrJNowlin) from Tab Geeks and my cat on as guests.

See the links below for the podcast audio, and subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat Podcast Links

X (née Twitter) Links

]]>UI Chat Podcast September 2024: Crosstalking TogetherUniFi's Advanced Wi-Fi Settings ExplainedUbiquitiNetworkingGuideWi-FiEvan McCannTue, 03 Sep 2024 00:02:00 +0000https://evanmccann.net/blog/2021/11/unifi-advanced-wi-fi-settings5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:618dadecf590620b68dae2f6Originally Posted: November 23rd, 2021
Last Edited: September 2nd, 2024

UniFi’s advanced Wi-Fi settings are often misunderstood. While the defaults are usually safe, having a deeper understanding of each setting is helpful when configuring a network or troubleshooting an issue. The tooltips in the interface cover the basics, but we’ll explore them in depth.

The screenshots show UniFi Network Application version 8.4.59, running on a Cloud Gateway Ultra. If you are using a different version or have different hardware, you might not see the exact same things. Most of the interface is the same between a Cloud Gateway and a self-hosted setup, but some settings may have been added, renamed, or moved if you’re running an older version. I’ll point these out along the way.

This guide doesn’t cover everything and it is not perfect. I try to be accurate and keep this up to date, but Ubiquiti’s documentation and your real-world experience should always be trusted over what you see here. If you notice any inaccuracies or have a suggestion, please let me know.

Table of Contents

  • Feature History & UI Overview ↩︎
  • Creating a New Wi-Fi Network ↩︎
  • PPSK, Guest Networks, & Wi-Fi Band ↩︎
  • Advanced Wi-Fi Settings ↩︎
    • Band Steering
    • Hide WiFi Name
    • Client Device Isolation
    • Proxy ARP
    • BSS Transition
    • UAPSD
    • Fast Roaming
    • WiFi Speed Limit (Bandwidth Profile)
  • Multicast Management ↩︎
  • DTIM, Rate Control, & Filtering ↩︎
  • Security & Wi-Fi Scheduler ↩︎
  • Global Settings & Radio Manager ↩︎
  • AP Settings & Manual Control ↩︎
  • Legacy UI Settings ↩︎

UniFi Advanced Wi-Fi Settings Explained — Updated for UniFi Network Application v8.4.59

UniFi Network Application Feature History

Since the software is constantly changing, it helps to know a little history and what version you are using before going through this guide.

  • 8.4 - Passpoint/Hotspot 2.0, packet capture, AP analyzer, pro AV settings, and advanced IGMP snooping

  • 8.3 - Custom NAT on UniFi Gateways

  • 8.2 - Wi-Fi 7 MLO, Inspection tab, ACL rules, and BGP routing (requires UniFi OS 4.1)

  • 8.1 - Network Viewer, NAT pools, L3 network and device isolation ACLs, OSPF routing, enhanced firewall rule visibility, side panels in the UI, and Innerspace for visualizing Wi-Fi coverage.

  • 8.0 - Radio Manager, VLAN Viewer, Wireguard VPN Client, Site Overview, and a professional installer toggle for consoles

  • 7.5 - Wi-Fi Private Pre-Shared Keys (PPSK), improved dashboard for WiFi-only setups, improved topology, latency testing, and DNS Shield

  • 7.4 - OpenVPN Server, Port Manager, and IPTV IGMP proxy

  • 7.3 - VPN client routing, ad blocking, and Wireguard VPN

  • 7.2 - Local DNS records, automatic speed test, global network and switch settings, OpenVPN client, Wi-Fi performance section, and speed limits for Traffic Rules

  • 7.1 - Teleport VPN, Traffic Routes, and switch port insights

  • 7.0 - Global AP settings, improved settings and dashboard UI, per-network mDNS, New Device Auto-Link, MFA support, and auto backup

UniFi Network Application UI Overview

In the desktop web interface, the major sections are represented with icons:

UI Overview of UniFi Network Application v8.4.59 running on the Cloud Gateway Ultra

Return to Table of Contents

Creating a New UniFi Wi-Fi Network

In the UniFi interface, network settings are divided into Wi-Fi, Networks, and Internet.

  • Wi-Fi controls your wireless networks, including SSID, password, and other advanced settings.

  • Networks controls your LAN networks and VLANs, global network and switch settings, and some per-network security and filtering options.

  • Internet controls your WAN connections, including public IP addresses, PPPoE, UPnP, dynamic DNS, and Smart Queues for QoS.

By default, UniFi has one LAN network, 192.168.1.0/24, which is used for all wired and wireless connections. Creating additional virtual networks (VLANs) allows you to segment and restrict traffic. This is commonly used for guest or IoT devices, or separating devices or areas into different network groups. Before diving into wireless settings, setup your networks and VLANs first. This can be done by modifying the default LAN, or by creating a new virtual network under the Networks tab.

If the network you want to use has been created, go to Settings → Wi-Fi → Create New.

Give it a name (SSID), password, and specify which virtual network it is going to use. Then you can select which APs will broadcast this network. If you don’t want to use the default of a WPA2 password, toggle advanced to manual and scroll down to the “Security Protocol” tab. Otherwise, you can hit the blue “Add WiFi Network” button and your new Wi-Fi network will be created.

Creating a new UniFi Wi-Fi network in UniFi Network Application.

Broadcasting APs — AP Groups

This setting controls which APs will broadcast this Wi-Fi network. By default, it will be added to every AP. In multi-site controllers, it will be added to every AP in the current site. If needed, you can select individual APs or create a group of APs to broadcast this network.

  • UniFi APs have a limit of either 4 or 8 SSIDs per band, per AP group. Some older models like the AC-Lite only support up to 4 per band. Most models can have up to 8. This means you can have up to eight 2.4 GHz and up to eight 5 GHz networks, or eight dual-band SSIDs. The same applies to 6 GHz.

  • Enabling wireless meshing limits all UniFi APs to 4 SSIDs per band. This is because wireless meshing adds hidden SSIDs for other APs to connect to.

  • Default: All APs.

  • Recommendation: For smaller networks with only a few APs and no need to limit which APs are broadcasting, use the default “All APs” group. For larger networks, group APs by area or function. Each additional SSID adds overhead and reduces capacity, so you should try to use as few as possible.

If you want a basic network, hit the “Add Wi-Fi Network” button and you're done. If you want more, the good stuff is revealed when you change advanced settings from auto to manual.

Note: Since version 7 there is a warning that applying these changes is going to disrupt users that are currently connected. That is why you might see a triangle with an exclamation mark in the blue “Add Wi-Fi Network” or “Apply Changes” button on the bottom.

Every time you change a Wi-Fi network setting it triggers a provision, which sends the updated configuration to each AP. When it’s applied, connected clients will likely see a short pause in traffic, and possibly a disassociation from the network. It’s best to make changes on idle networks, or during times of low usage.

Return to Table of Contents

PPSK, Guest Networks, and Wi-Fi Band

PPSK: Private Pre-Shared Keys

Private PSKs (PPSKs) are unique pre-shared keys for individual users or groups of users. This feature allows a single SSID to represent multiple networks, each with different access or restrictions. Users will see a single Wi-Fi SSID but be directed to different networks based on the password they provide.

It’s possible to do the same thing with RADIUS, but depending on your requirements, creating a PPSK may be a simpler and better way. RADIUS is likely the better solution for something like employee wireless, where you want a valid username/password tied to network access. Creating a PPSK is a manual process, so maintaining hundreds of them isn’t scalable. If you have distinct groups - trusted users versus guests, or just need a way to cut down on the number of SSIDs you are broadcasting, PPSK may be a good fit.

Currently if you want to create a PPSK network you need to use WPA2, and you can’t use 6 GHz. You can’t use PPSK in combination with a hotspot or captive portal, or RADIUS MAC authentication.

In UniFi, configuring a PPSK network is simple if you already have your networks and VLANs configured. Disable WP3 and 6 GHz if needed, then select the network and define the password.

Creating a PPSK network

Guest Networks: Captive Portal and Passpoint

There are two options for Hotspot 2.0: Captive Portal or Passpoint.

Selecting “Captive Portal” will show a splash page when clients join the network. This could be used to redirect to a website, show a terms and services agreement, integrate with an outside authentication method, or prompt for payment. The settings for this are found under Insights -> Hotspot -> Landing Page. That is where you can change the guest wireless captive portal design, authentication, payment methods, and settings.

  • Default: Unchecked

  • Effect: Applies your captive portal settings and applies client device isolation.

  • Recommendation: Enable for networks meant for guests, where you want them to see a splash page, agree to terms and conditions, authenticate, or pay. Leave disabled on secured networks for trusted devices.

  • Note: In previous versions, this was referred to as Wi-Fi Type, which had a toggle between standard and guest hotspot.

  • Relevant help articles:

View fullsize Setting Captive Portal
 Setting Captive Portal View fullsize Insights -> Hotspot -> Landing Page
 Insights -> Hotspot -> Landing Page View fullsize Landing Page designer
 Landing Page designer

Passpoint

Another Hotspot 2.0 option is Passpoint, which was added in Network v8.4.54. Passpoint is built on the 802.11u standard and it improves network discovery, selection, and can enable cellular network offload to Wi-Fi. See this Ubiquiti help article for more details about Passpoint: Setting Up Passpoint on UniFi Network

Wi-Fi Band

  • Options:

    • 2.4 GHz: Slow, long range, more wall penetration.

    • 5 GHz: Fast, shorter range, less wall penetration.

    • 6 GHz: Fast, shortest range, even less wall penetration. Limited device support, but lots of available spectrum to use wider channels. This requires a Wi-Fi 6E or Wi-Fi 7 access point. See my U6-Enterprise Preview for more details.

  • Default: 2.4 GHz and 5 GHz. If you have a Wi-Fi 6E or 7 AP, the option to add 6 GHz appears.

  • Effect: This setting controls which band your Wi-Fi network broadcasts on. You can pick one, or enable all of them.

  • Recommendation: Leave on dual-band, unless you have connectivity issues with 2.4 GHz devices or want manual control. Enable 6 GHz and change to WPA3 if you have the option.

Note: Dual-band or tri-band SSIDs with multiple access points can lead to roaming issues, with some clients staying on 2.4 GHz, or not roaming to the nearest AP. There are several ways to combat this. Usually adjusting AP placement, lowering 2.4 GHz transmit power, changing channels, or enabling band steering can be effective.

You can also create a separate network for each band if you want guaranteed, manual control over which band is used by which device. Otherwise, it’s up to the client device to do the right thing.

Return to Table of Contents

Advanced Wi-Fi Settings

Scrolling below Wi-Fi Band is where things get fun, and the acronyms take over.

Band Steering

Band steering forces compatible clients to move to 5 GHz. Previously with Band Steering enabled, client devices performing a passive scan would qualify the 2.4 GHz BSSID as hidden. A few years ago a newer method was added, which directs clients to 5GHz post-association using BSS Transition Management frames. This newer method causes less conflicts with older or 2.4 GHz only devices.

  • Default: On

  • Effect: Less clients will use the slow and often crowded 2.4 GHz band

  • Recommendation: Leave enabled, unless you have connectivity or roaming issues. As a normal troubleshooting step, disabling band steering is a good thing to try. It’s possible that band steering causes issues for your devices on your network, even though it doesn’t cause issues on mine.

Hide Wi-Fi Name

  • Default: Off

  • Effect: This forces access points to send out beacon frames with no SSID, meaning the SSID field in the beacon frame is set to null. To join a network with a hidden SSID, clients have to manually enter the SSID name along with the password. Beacons frames are still sent, and “hidden” networks are still easy to detect.

  • Recommendation: Leave disabled. Hiding the SSID does not enhance the security of the network. Hidden networks can still be scanned, found, and joined. Using 802.1X or a more complex password, moving to a newer protocol (WPA2/3 vs. WPA or WEP), or configuring firewall/traffic/ACL rules are better ways to improve security.

Client Device Isolation

Client device isolation prevents clients on the same AP from communicating with each other. Together with network isolation, switch ACLs, and traffic/firewall rules, it can prevent clients from reaching other clients or other networks or specific devices.

  • Default: Off

  • Effect: Restricts clients on the same AP from communicating with each other.

  • Recommendation: Enable on high-security guest networks, or IoT networks that would benefit from this restriction. If you have a full UniFi network, enable “Network Isolation” to isolate the network from your other internal networks, and configure traffic and firewall rules as needed.

  • Enabling this can lead to unintended consequences and prevent AirPlay, Chromecast, Sonos devices, screen mirroring, and wireless printers from working. Test device behavior before and after changing this setting.

  • Note: Client device isolation used to be referred to as “Layer 2 isolation - isolates stations on layer 2 (Ethernet) level”

  • Relevant Help Article: How to Implement Network and Client Isolation

Advanced Wi-Fi Settings in the UniFi Network Application

Proxy ARP

Proxy ARP allows UniFi access points to answer ARP requests. ARP is the Address Resolution Protocol, which is used to learn the MAC address for a given IP address. This allows for discoverability and communication within a layer 2 network or VLAN.

With Proxy ARP disabled, the client device being queried responds with another broadcast. Broadcasts slow down a Wi-Fi network because they are sent at the slowest supported rate, and all devices must listen to them. With Proxy ARP enabled, the AP answers ARP requests with a unicast frame.

  • Default: Off

  • Effect: Enabling this can reduce broadcast traffic, and therefore airtime usage and latency. This is mainly relevant in larger or higher-density networks where broadcast traffic overhead is a major concern.

  • Recommendation: Enable for large or high-density networks.

BSS Transition

This setting enables BSS Transition with WNM, which stands for Wireless Network Management. WNM allows the AP to send messages to clients to give them information about the network, and details of other APs they can roam to. This includes the current utilization and number of clients, allowing the client to make more informed roaming decisions.

  • Default: On

  • Effect: This enables 802.11v, which helps with the roaming process. It is still up to the client device to support 802.11v and make a decision based on the given information. Support for 802.11v is hit or miss, and clients often do the wrong thing anyway.

  • Recommendation: Leave enabled, especially in networks with multiple APs. You can try disabling this while troubleshooting roaming issues, but it is unlikely to solve your issue.

UAPSD

Unscheduled Automatic Power Save Delivery, also known as WMM power save.

  • Default: Off

  • Effect: Enabling allows devices that support UAPSD to save battery power by keeping their Wi-Fi radio in sleep mode for more time. Like a lot of features that are off by default, this can cause issues for some clients, especially older or IoT devices.

  • Recommendation: Turn on if battery life is important, and older/IoT device connectivity is not. Disabling this is a good troubleshooting step if you have performance or connectivity issues, as client support for UAPSD is not universal.

Fast Roaming

Faster roaming for modern devices with 802.11r compatibility. It does this by speeding up the security key negotiation process, allowing both the negotiation and requests for resources to occur in parallel. With 802.1X, keys are cached rather than the client needing to check with the RADIUS server with each roam. With pre-shared key networks such as WPA2, the client goes through the normal 4-way handshake authentication process.

  • Default: Off

  • Effect: Enables OTA (over-the-air) Fast BSS Transition, which allows devices that support it to roam between APs faster. Without this setting enabled, roaming from AP to AP may take a few seconds, and during that time data cannot be sent or received. In most cases you won’t notice this, but latency-sensitive and real-time applications like a VoIP call can perform poorly. Slow roaming during a VoIP call may result in gaps in the audio. With 802.11r fast roaming enabled, the roams should be nearly unnoticeable.

  • Recommendation: Enable on networks with multiple APs that are used for VoIP, video calls, and other real-time applications. If roaming performance is still an issue, consider adjusting band steering, AP placement, and transmit power levels.

  • Note: Fast BSS Transition works with both pre-shared key (PSK) and 802.1X authentication methods. Older devices should not experience connectivity issues with this enabled.

Wi-Fi Speed Limit (Bandwidth Profile)

Wi-Fi Speed Limit allows you to restrict the amount of bandwidth available for clients connected to the network.

  • Default: Off, bandwidth is unlimited.

  • Effect: Allows you to set per-client download and upload bandwidth limits.

  • Recommendation: Enable if needed, especially on guest networks, networks with limited Internet bandwidth, or with high client density.

  • Note: Create new bandwidth profiles under Settings → Profiles → Wi-Fi Speed Limit

Return to Table of Contents

Multicast Management and Client Isolation

Multicast Enhancement (IGMPv3)

Multicast enhancement tries to convert multicast to unicast, when possible. The goal of this setting is to reduce congestion and improve performance by leveraging the IGMPv3 protocol.

Sonos speakers for example, usually function better when…

  • All Sonos devices are in the same network, and all connected in the same way. If some are wired, all should be wired. If some are wireless, all should be wireless and SonosNet should be disabled if possible.

  • Spanning Tree is set to regular STP mode on your switches if using Ethernet. I’d also recommend lowering the priority of your switches so they continue to be the Spanning Tree root bridge.

  • Multicast Filter/IGMP Snooping is on under network settings → advanced. This allows switches to identify multicast groups used in each port. Multicast streams are forwarded only to network devices that should receive them. This enables the IGMP querier service on a UniFi gateway, letting it create multicast groups which *should* improve performance of multicast traffic such as video or audio streams. Some people have had better luck with this disabled, and there may be other issues at fault, such as network topology. Multicast is hard to troubleshoot without a packet capture and knowledge of the protocols involved.

  • Multicast Enhancement (IGMPv3) is on under Wi-Fi settings → multicast management. This allows multicast traffic to be converted to normal unicast traffic when possible.

  • Multicast DNS is on under settings → network, for the network being used. mDNS allows for converting host names to IP addresses in a local network without a DNS server. An example of mDNS is Apple’s Bonjour, which is used to quickly setup sharing between computers and other devices. UniFi’s mDNS service allows you to discover devices on other networks, and can assist with discovery within the network.

UniFi’s Multicast Management settings

Multicast And Broadcast Control

Multicast and broadcast control restricts the ability to send multicast or broadcast traffic, and allows you to define a list of exceptions.

  • Default: Off

  • Effect: Prevents the transmission of multicast and broadcast traffic in the network.

  • Recommendation: Enable this setting for high-density or guest networks. You can make individual device exceptions if needed. Leave disabled on smaller or trusted networks.

Return to Table of Contents

DTIM, Rate Control, and Filtering

802.11 DTIM Period

DTIM stands for Delivery Traffic Indication Message, which is a message that is sent along with beacon frames. The role of the DTIM is to let a sleeping client know that it has buffered data waiting for it.

  • Default for 2.4 GHz: 1, meaning every 2.4 GHz beacon will include a DTIM

  • Default for 5 GHz: 3, meaning every third 5 GHz beacon will include a DTIM

  • Effect: Higher numbers buffer longer, potentially saving battery life. Altering these values can cause a variety of issues though, so change them at your own risk.

  • Recommendation: Leave this set to auto.

Minimum Data Rate Control

Minimum data rate control allows you to define the slowest data rate allowed on the network.

Disabling the lowest data rates is a common setting to consider for high-density networks where airtime conservation is important. Lower data rates are less efficient, and distant clients can hog airtime by being less efficient. When data is sent at a low rate, it uses more airtime, limiting the performance of all the other devices using that AP.

This does not limit the range of your AP, and the details are complicated. Rob Krumm has a great analysis of what changing your rate does and does not change if you want more details.

  • Default for 2.4 GHz: All rates allowed (1 to 54 Mbps)

  • Default for 5 GHz: All rates allowed (6 to 54 Mbps)

  • Recommendation: Leave at default for most networks. Disabling rates below 6 or 11 Mbps can improve the efficiency of higher-density networks, but can also lead to connectivity and performance issues. Returning to default settings is a good troubleshooting step.

UniFi’s Data Rate Control and Device Access Filtering settings

Device Access Filtering

  • MAC address Filter allows you to restrict clients from joining the network unless they are on the allow list, or block specific MAC addresses.

  • RADIUS MAC Authentication enables the use of a RADIUS server for client authentication on this Wi-Fi network. The settings for this are controlled by RADIUS profiles.

  • RADIUS Profiles allows you to select pre-defined RADIUS profiles.

    • To create new profile, go to Profiles → RADIUS → Add RADIUS Profile. This is where you define the aspects of your RADIUS server such as IP address, ports, assigned VLAN, shared secrets, and update interval

  • MAC address format allows you to set the format for the MAC address and whether semicolons or hyphens are expected.

Return to Table of Contents

Security Settings and Wi-Fi Scheduler

Security Protocol

  • Open. No password needed to join the network.

  • WPA2. The older pre-shared key security method, which requires a password to join the network. WPA2 is less secure than WPA3, but is more universally supported, especially on older devices.

  • WPA2 Enterprise. The older 802.1X security method, which requires a RADIUS server to allow users to join the network with a username or password. Usually common in larger networks which need to grant or revoke permission to join without changing other people’s access by changing the pre-shared key.

  • WPA2/WPA3. Allows for a mix of WPA2 and WPA3 connections. Devices that support WPA3 will use the newer and more secure standard, while older clients will fallback to WPA2. This is less secure overall than requiring WPA3, but it is more flexible and less likely to cause issues as we transition to WPA3 as a default.

  • WPA3. The newer pre-shared key security method, which does a lot of magic behind the scenes to be more secure than WPA2. WPA3 is still vulnerable to certain attacks, so still make sure to use a complex password and restrict access to that if it matters.

  • WPA3 Enterprise. The newer 802.1X security method, which like WPA3 personal allows for more secure connections.

  • Note: WPA3 is mandatory for 6 GHz networks

If WPA3 is selected…

WPA3 SAE anti-clogging threshold in seconds

  • Default: 5

  • Note: SAE is Simultaneous Authentication of Equals, and anti-clogging is designed to prevent denial of service (DoS) attacks on the AP. This setting affects the time threshold for what the AP considers “too many” requests.

WPA3 Sync in seconds

  • Default: 5

  • Note: Explaining how WPA3 works is beyond the scope of this guide. Only change these if you know what you’re doing, and have a valid reason.

UniFi’s security and group rekey interval settings.

PMF (Protected Management Frame)

Protected management frame (PMF) is a security feature which aims to prevent intercepting or forging management traffic. Management frames include authentication, de-authentication, association, dissociation, beacons, and probes. These cannot be encrypted like normal unicast traffic, so this feature protects from forgery, preventing some common security attacks.

  • Required: APs will use PMF for all stations. Stations without PMF capability will not be able to join the WLAN.

  • Optional: APs will use PMF for all capable stations, while allowing non-PMF capable stations to join the WLAN.

  • Disabled: APs will not use PMF for any stations.

  • Recommendation: Leave disabled for WPA2 networks, and move to WPA3 if possible.

Note: PMF is required for WPA3 networks.

Group Rekey Interval

This setting controls how often an AP changes the GTK, or Group Temporal Key. The GTK is a cryptographic key that is used to encrypt all broadcast and multicast traffic between APs and clients.

  • Default: 3600 seconds.

  • Effect: Lower intervals mean the key changes more often, but can cause the issue of users disconnecting or unable to join the network with the message 'wrong password’, even if the credentials are correct.

  • Recommendation: Leave at default.

Wi-Fi Blackout Scheduler

The Wi-Fi blackout scheduler allows you to turn an SSID on or off at a certain time, or setup a weekly schedule.

Wi-Fi Blackout Scheduler

Return to Table of Contents

UniFi Global Settings and Radio Manager

The UniFi Network Application is updated often, and each version adds improvements. Version 7 introduced global access point, switch, and network settings. Version 8 took this further with a dedicated Radio Manager which handles global AP settings, monitoring, and recommendations.

Before global AP settings, things like channel width and power level had to be changed individually on each AP. Now within Radio Manager, you can view live data and control common settings for all APs. With global network and switch settings, you can do the same for common settings on UniFi networks and switches. You can still manually control individual devices by excluding them from the global rules, if needed.

UniFi Radio Manager

Global AP settings used to be found under Settings → Wi-Fi, but now live within Radio Manager. In Radio Manager, there are five tabs. The Coverage, Connectivity, Environment, and Speed Test tabs provide information about your current network. It’s a good idea to look through them before and after making changes.

The Radios tab shows a list of every AP with filters for frequency band, wired and meshed backhaul, MIMO, and status. When you select a radio, a right-side panel pops up with controls. You can select multiple APs and change settings for them all at one time. The settings are the same as before: Channel width, channel, transmit power, and a toggle for minimum RSSI.

Channel Width allows you to set the channel width for each frequency band of your Wi-Fi radios. 20 MHz is the base channel width for modern Wi-Fi, but multiple channels may be bonded together to increase data rates and throughput.

  • 2.4 GHz should almost always be set to 20 MHz. There is not enough space in the 2.4 GHz spectrum to reliably use 40 MHz channels, especially with multiple APs.

  • 5 GHz can be set to 20, 40, 80, 160, and now with Wi-Fi 7, up to 240 MHz. The best option depends on how much you value AP and client density (20 MHz) vs. maximum throughput (80, 160, or 240 MHz). Some clients may not fully support 160 MHz channels in 5 GHz, which requires DFS. 240 MHz channels are exclusive to Wi-Fi 7 clients, but Wi-Fi 6 or older clients will just use a subsection of the channel if you select a 240 MHz width.

  • 6 GHz can safely be set to 80 or 160 MHz. In the US there is 1200 MHz of available spectrum for these wide channels, and no requirement for DFS or AFC for 6 GHz low power indoor (LPI) access points such as the U6-Enterprise or U7-Pro. With Wi-Fi 7, 6 GHz channels can be up to 320 MHz, but the same asterisks apply as with 240 MHz channels in 5 GHz.

View fullsize Radio Manager in v8.4.59
 Radio Manager in v8.4.59 View fullsize Wi-Fi Settings in v7.5.169, before Radio Manager
 Wi-Fi Settings in v7.5.169, before Radio Manager View fullsize Wi-Fi Settings in v8.2.92, before channelization was shown
 Wi-Fi Settings in v8.2.92, before channelization was shown View fullsize Wi-Fi Settings in v8.4.59, with Channelization
 Wi-Fi Settings in v8.4.59, with Channelization

Transmit Power allows you to set TX power for your radios to low, medium, high, auto, or a custom value. If you think of an AP as a speaker, this is the volume slider. The actual dBm values for low, medium, and high are based on the AP model and what they are capable of.

Broadly speaking, higher transmit power means longer range, higher signal-to-noise, and higher throughput. Higher power levels can also increase co-channel or adjacent-channel interference, so it is a balancing act.

  • 2.4 GHz signals travel longer distances, and through obstructions like walls or trees more effectively than 5 GHz or 6 GHz signals. In a multi-AP network, turning down 2.4 GHz transmit power helps balance the inherent difference in range. This can lead to better performance and more reliable roaming.

  • 5 GHz and 6 GHz signals attenuate more rapidly and are more affected by obstructions, resulting in around half the range of 2.4 GHz. If you have a dense network with multiple APs, setting a unique channel and keeping 5 GHz TX power lower may be best. For those trying to achieve the most range and coverage from the APs they have, high 5 GHz and 6 GHz TX power can be set.

  • Recommendation: Auto is a good default, but usually results in maximum power. If setting manually, use the lowest power level that still results in good coverage and signal strength. Keep 2.4 GHz around 6 dBm lower than 5 GHz or 6 GHz in multi-AP networks if you want to keep their coverage area roughly the same.

Minimum RSSI tries to assist clients with roaming decisions and moving from one AP to another. When enabled, APs will disconnect clients when they reach a certain Received Signal Strength Indication (RSSI) value. Ubiquiti’s Understanding and Implementing Minimum RSSI does a good job at explaining the rest of the basics.

Typical Wi-Fi RSSI values are negative. The closer it is to zero, the stronger the signal is. A value of -80 dBm is a very weak signal, and a value of -40 dBm is a very strong signal.

If you’re running into issues with devices staying connected to a far away AP, you probably want to review your network as a whole, including AP placement and settings like transmit power. Minimum RSSI is another tool, but it won’t fix a badly designed and configured network. That said, if you’re still struggling with clients roaming to a nearby AP, enabling Minimum RSSI and setting a value around -70 dBm or so may be a good starting place. The right value depends on your setup and will vary from AP to AP.

AP and Wi-Fi Settings That Moved

These settings used to be part of the global AP rules, but have migrated to Settings → System → Advanced.

Wireless Meshing allows UniFi APs to connect to the network with a wireless connection to another AP, rather than Ethernet. This enables a hidden SSID on each AP, which other APs can connect to.

  • Mesh APs rely on wireless backhaul, but otherwise act like a normal UniFi AP. They can extend the range of your network, but offer lower throughput.

  • If you can’t run Ethernet to all of your APs and need to rely on wireless backhaul, you should leave this enabled. Otherwise, you can disable it to reduce SSID and management frame overhead.

  • Recommendation: Uncheck for networks where all APs have wired backhaul. Leave enabled for additional redundancy and a small hit to airtime utilization.

New WiFi Device Auto-Link allows wireless UniFi Protect cameras and some UniFi devices to be automatically visible for adoption. Previously this setting enabled a hidden “Element-xxxxxx” SSID, but it now enables a hidden SSID with no name. This makes it easier to set up those devices but can be disabled if you don’t need it.

  • Recommendation: Uncheck once your network is fully set up, or leave enabled if you are often adding new UniFi devices.

Connectivity Monitor Type controls what mesh APs attempt to reach to determine if they are online. This is only available when wireless meshing is enabled.

  • By default, it is the IP of their gateway, typically a UniFi or 3rd party router. You can change this to be any IP you’d like.

  • If the device fails to reach the destination, it will enter an “isolated” state, meaning it can’t reach the network. That usually happens when there is a misconfiguration, such as wireless meshing being turned off, or port or VLAN settings not being correct.

  • Recommendation: Leave at default unless you have a reason to change to a custom destination. Internal resources are better than public services or websites that rely on working Internet access.

Optimize Channelization (Nightly Channel Optimization) has moved around a few times, but currently lives under Settings → Wi-Fi. It is an automated process that looks at all connected UniFi APs and the RF environment they are in. It attempts to automatically pick the best channels for you and usually does a good job.

  • For high-density networks where careful channel planning is important, manual selection may help. For most networks, especially with less experienced administrators, auto-channel optimization usually leads to good results.

  • You can apply this to all APs, or only APs configured to auto channel.

  • Recommendation: Leave enabled if you prefer the ease of use, disable if you are manually setting channels.

Return to Table of Contents

Individual AP Settings and Manual Control

Increasing Wi-Fi Speed and Capacity

At the most basic level, you only want one AP per channel. If you have two APs on the same channel in the same area, they will conflict with each other.

Every Wi-Fi transmission requires the coast to be clear. All Wi-Fi devices (including APs themselves) take turns consuming airtime with their transmissions. When the channel is busy and another device is transmitting, they have to wait. Two devices transmitting on the same channel results in interference and retransmissions. This increases latency and reduces throughput and capacity.

One way to increase overall capacity is to use multiple APs, with unique channels for each. This allows for more devices to broadcast at a given time, and devices on AP #1 to not conflict with devices on AP #2. Another way is to increase channel width. Wider channels increase throughput, but can also create issues.

All of these factors make channel selection, channel width, transmit power, and access point placement some of the key things to focus on when building a network with multiple APs.

Radios: Channel, Width, and Power

2.4 GHz

2.4 GHz channel width should almost always be set to 20 MHz. In the US there are only 3 non-overlapping 20 MHz channels to use, 1, 6, or 11. There is one or two non-overlapping 40 MHz channels, depending on where you are in the world.

For a network with multiple APs, you should stick with 20 MHz and channels 1, 6, or 11. Pick one and try to keep other APs on that channel as far away as possible. 2.4 GHz signals travel further and are better at penetrating obstacles like walls or trees. Turn down your 2.4 GHz transmit power or spread out your APs if you still have too much overlap.

An example would be a two-story house with a basement. If you have one AP per floor, you’d pick channel 1 for the basement, channel 11 for the 1st floor, and channel 6 for the 2nd floor. If you add a 4th AP to cover the backyard, pick the channel with the weakest signal strength and least amount of interference. Adjust your AP placement and power levels to ensure even coverage and smooth AP-to-AP roaming.

5 GHz

The default channel width for 5 GHz is 40 MHz, and that is a good default. There are four non-overlapping 40 MHz channels, and eight more in DFS space. The wider the channel gets, the less unique channels you have to use.

The channel selection in UniFi defines the primary 20 MHz channel that beacon frames and other control traffic is sent on. With 40 MHz width, you’ll also be using the channel above or below. You may see this defined as “channel 38” or “channel 36+1”, but they all refer to the same thing.

Picking channel 36 and 40 MHz width will use both channels 36 and 40. Picking channel 36 and 80 MHz width will use channels 36, 40, 44, and 48. With that in mind, here are the number unique channels you can choose at each width:

  • 20 MHz has nine: 36, 40, 44, 48, 149, 153, 157, 161, or 165

  • 40 MHz has four: 38, 46, 151, or 159

  • 80 MHz has two: 42 or 155

When you add in DFS space, you have several other channels to pick from:

  • Sixteen 20 MHz channels, for a total of 25

  • Eight 40 MHz channels, for a total of 12

  • Four 80 MHz channels, for a total of 6

  • For 160 MHz channels in 5 GHz, you always need to utilize DFS space. There are three non-overlapping channels available: 50, 114, and 163.

  • There is one 240 MHz channel: 130.

Configuring access point radio settings manually in the device settings side panel

For dense networks with 4+ APs, using 20 or 40 MHz width and creating a manual channel plan to minimize overlap usually leads to the best results. For normal home networks that prioritize speed, 40 or 80 MHz is usually a good balance. If you have modern clients, a use case that would benefit from several hundred Mbps, aren’t worried about interference and your Wi-Fi neighbors, or you just wanna go fast: try 160 MHz or 240 MHz.

Using 80 or 160 MHz channels in a multi-AP network requires dealing with DFS, or being limited to two unique 80 MHz channels. Not all devices support 160 MHz, and 160 MHz channels are the most susceptible to noise and interference. These wide channels trade range and noise for speed. You’ll get the most use for your gigabit connection, but 40 or 80 MHz channels may be a better balance overall. Sometimes it makes sense to mix and match, where you’d put a 160 MHz channel in your office, but use a more conservative 20 or 40 MHz channel on the outdoor AP that covers your backyard. Experiment and see what works best for you.

6 GHz

6 GHz is largely the same as 5 GHz, but there is no DFS. For low-power indoor APs like the U6-Enterprise or U6-Enterprise-In-Wall, there is no AFC requirement either. Power limits are set with a constant spectral density rather than a constant EIRP. What that means in practice is that there is no noise penalty for doubling a channel width in 6 GHz. With each +3 dB (doubling) of noise, the EIRP doubles as well. That means for 80, 160, and even 320 MHz width channels, 6 GHz is the best place for them.

If you have 6 GHz APs and 6 GHz devices, set a wide channel, high power, and let it rip. You will also need to enable WPA3, which is required for 6 GHz operation. 6 GHz also has a slightly worse range and penetration than 5 GHz, so it will quickly fall off in strength when it passes through a wall or floor.

Individual AP Settings

Getting outside of Radio Manager and bringing up an individual AP in the Devices tab shows a few other settings.

Band Steering can be set to off, prefer 5 GHz, and balanced. This is separate from the Band Steering setting that is set on the network level, which uses a less disruptive method to encourage clients to move off of 2.4 GHz. This per-AP setting is available as well if you have certain APs that are stickier than others.

With off, the AP doesn’t do anything to encourage clients to join 5 GHz, and clients may prefer to join the 2.4 GHz radio due to it having a longer range and a higher RSSI. Those clients may be closer to another AP and a stronger 5 GHz radio, but a lot of times the Wi-Fi client device will stay connected to the 2.4 GHz radio. Setting band steering to prefer 5 GHz can sometimes help with that. It can also cause issues with some IoT or 2.4 GHz-only devices, so balanced is sometimes a safer choice. This is one more knob to turn when you’re having issues with roaming.

IP settings are where you define the management IP address of the AP. By selecting Network Override, you can have it be in a virtual network rather than the default, untagged network. When doing this, make sure the port you are connecting the AP to is a trunk port, and it has access to the virtual network you are assigning. By default, all networks are allowed. Setting an invalid virtual network or IP configuration will prevent your UniFi Network controller from being able to reach or manage your device. That may require a port change or AP reset to fix.

Under network override are the common settings you’d expect: IP, subnet mask, gateway, DNS, and DNS suffix. Below that you have a few options which vary by AP model, but that is where you’d control the LED, SNMP, copy an existing configuration from another AP, enter the debug terminal, do a manual firmware update, flash the LED to locate it, restart or remove the device from your network.

Return to Table of Contents

Legacy UI Settings

The old “legacy” user interface has been going away for a long time. Turning it on involves a warning that certain features aren’t supported, and Ubiquiti would really prefer you use the new interface for everything. Going forward, all settings and development focus is on the new UI, and the legacy UI is being left to rust. These settings are missing in the new interface, or have been moved/renamed.

RIP Legacy UI

  • Apply Guest Policies is now controlled by Hotspot 2.0 toggle for Captive Portal or Passpoint, and was previously controlled by setting the network type to guest.

  • Multicast and Broadcast Filtering or Block LAN to WLAN Multicast and Broadcast Data are now Multicast and Broadcast Control, under settings → Wi-Fi.

  • Beacon Country - add 802.11d county roaming enhancements is not shown in the new UI.

  • TLDS Prohibit - block Tunneled Link Direct Setup (TDLS) connections is not shown in the new UI.

  • Point to Point - also referred to as P2P is not shown in the new UI.

  • P2P Cross Connect - allow wireless stations to connect to each other through AP using P2P is not shown in the new UI.

  • Send beacons at 1 Mbps is now handled with the minimum data rate control settings.

  • User Group is now called bandwidth profile, for restricting maximum bandwidth for connected client devices.

  • L2 Isolation is now called Client Isolation, and enabled by default on guest networks.

  • Legacy Support - Enable legacy device support (i.e. 11b) is handled by the minimum data rate control settings.

  • High Performance Devices or Connect high performance clients to 5 GHz only is now controlled by the band steering setting.

One last thing to keep in mind: Sometimes, the best solution to a wireless problem is a wire.

]]>UniFi's Advanced Wi-Fi Settings ExplainedUniFi Gateways Explained as Simply as PossibleUbiquitiOverviewGuideComparisonBuyers GuideEvan McCannSat, 31 Aug 2024 15:50:00 +0000https://evanmccann.net/blog/ubiquiti/unifi-gateways-simply-explained5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6567fce8a435c47a172b8700Originally Posted: November 29th, 2023
Last Edited: August 31st, 2024

UniFi Gateways Explained as Simply as Possible

Categories

There are two categories: Gateways and Cloud Gateways.

Gateways are just routers and nothing else. These are managed by a Cloud Key or self-hosted UniFi Network application. They don't run any software, and don't do anything besides act as a firewall/gateway/router.

Cloud Gateways are routers that run software. At a minimum they run the UniFi Network application. They manage themselves and other UniFi switches and APs. They can't be managed by a Cloud Key or self-hosted controller*.

  • These have been called "UniFi OS Consoles" or "Gateway Consoles" and other terms, but Cloud Gateway is the current branding.

  • Some of these run other UniFi software like Protect, Talk, Access, or Identity.

  • *Besides the new UniFi Express (UX), which can be used as an access point. There is always an asterisk on everything.

Controller is a general term for a device that runs the UniFi Network application. It can be self-hosted on your own hardware, a Cloud Key, a cloud server, or a UniFi Cloud Gateway™ like the Dream Machine Pro or UniFi Express.

UniFi Gateways

Security Gateway (USG) = Legacy. Discontinued, old and slow

  • Released: 2014

  • Three gigabit RJ45 and remappable, so you can have a 2nd LAN or a 2nd WAN.

  • Missing most new security, routing, and VPN features

  • Under 100 Mbps for VPN or IDS/IPS

Security Gateway Pro (USG-Pro) = Legacy. Discontinued, rackmount USG

  • Released: 2016

  • Rackmount, dual WAN, dual LAN.

  • Two gigabit SFP/RJ45, two gigabit RJ45.

  • Missing most new security, routing, and VPN features

  • A bit more speed, but still old and slow.

Gateway Lite (UXG-Lite) = New USG

  • Released: 2023

  • One gigabit WAN and one gigabit LAN ports, no dual-WAN support

  • Much faster than USG, supports most of the latest security, routing, and VPN features.

  • Up to 1 Gbps IDS/IPS

Gateway Max (UXG-Max) = A more powerful new USG

  • Released: 2024

  • One 2.5 Gbps WAN and four 2.5 Gbps LAN ports, one remappable as 2nd WAN

  • A larger, faster, more capable UXG-Lite for multi-gig networks

  • Up to 1.5 Gbps IDS/IPS

Gateway Pro (UXG-Pro) = New USG-Pro

  • Released: 2022

  • Rackmount, dual WAN, dual LAN.

  • Two gigabit RJ45, and two 10 Gbps SFP+

  • Up to 3.5 Gbps IDS/IPS

Gateway Enterprise (UXG-Enterprise) = Enterprise Fortress Gateway without a built-in controller

  • Released: 2024

  • Rackmount, dual WAN, dual LAN.

  • Two 2.5 Gbps RJ45, two 10 Gbps SFP+, two 25 Gbps SFP28

  • Up to 23.5 Gbps throughput, or 12.5 Gbps with IDS/IPS enabled

Image credit: ui.com

UniFi Cloud Gateways

Small Cloud Gateways

Express (UX) = Controller + Gateway + Wi-Fi

  • Released: 2023

  • One gigabit WAN and one gigabit LAN ports

  • Does not support IPS/IDS, and some security features aren't in current firmware

  • Multiple UX can join together for a wired or wireless mesh network

  • It has two modes. The UX can be:

    • A gateway and controller for a normal UniFi network with up to 5 other switches and APs

    • An access point in an existing UniFi network

Dream Router (UDR) = Controller + Gateway + 4-port switch (2 PoE out) + Wi-Fi

  • Released: 2022

  • One gigabit WAN, four gigabit LAN ports with two PoE out

  • Can also run Protect, Talk, Access, and Connect -- but only two at a time

  • Manages up to 15 or so UniFi Network devices, less if you’re using Protect or another application

  • Throughput limited with IPS/IDS enabled to around 700 Mbps

  • Protect video storage = internal 128 GB SSD and SD card slot

Dream Machine (UDM) = Controller + Gateway + 4-port switch + Wi-Fi

  • Released: 2019

  • One gigabit WAN, four gigabit LAN ports

  • No PoE. No other UniFi applications

  • Manages up to 40 or so UniFi Network devices

  • Not listed in the Cloud Gateway category of Ubiquiti's store. Still for sale and supported, but may be discontinued soon

Cloud Gateway Ultra (UCG-Ultra) = Controller + Gateway + 4-port switch

  • Released: 2024

  • One 2.5 Gbps WAN, four gigabit LAN ports

  • No PoE. No other UniFi applications

  • Manages 30 or more UniFi Network devices

  • Throughput limited by backplane to 1 Gbps - with or without IDS/IPS

Cloud Gateway Max (UCG-Max) = Controller + Gateway + 4-port switch

  • Released: 2024

  • One 2.5 Gbps RJ45 WAN, four 2.5 Gbps RJ45 LAN ports

  • Runs all UniFi applications, comes with no, 512 GB, 1 TB, or 2 TB of storage

  • Manages 30 or more UniFi Network devices, cameras, phones, etc

  • Full 2.5 Gbps of throughput, up to 1.5 Gbps with IDS/IPS enabled

Rackmount and Large Cloud Gateways

Dream Machine Pro (UDM-Pro) = Controller + Gateway + 8-port switch

  • Released: 2019

  • Dual-WAN, rackmount, with two 10 Gbps SFP+, one gigabit RJ45 WAN, and eight gigabit RJ45 LAN. Ports 8-11 are remappable to WAN/LAN.

  • Runs all UniFi applications and can be NVR for UniFi Protect

  • Manages up to 100 or so UniFi Network devices, and 1000+ clients

  • Protect video storage = single 3.5" HDD bay

Dream Machine SE (UDM-SE) = Controller + Gateway + 8-port PoE switch

  • Released: 2022

  • Adds PoE, 128 GB SSD, and one RJ45 upgraded to 2.5 Gbps compared to UDM-Pro

  • Dual-WAN, rackmount, with two 10 Gbps SFP+, one 2.5 Gbps RJ45, and eight gigabit RJ45. Ports 8-11 are remappable to WAN/LAN.

  • Runs all UniFi applications and can be NVR for UniFi Protect

  • Manages up to 100 or so UniFi Network devices, and 1000+ clients

  • Protect video storage = single 3.5" HDD bay + internal 128 GB SSD

Dream Machine Pro Max (UDM-Pro-Max) = A more powerful UDM-Pro/UDM-SE

  • Released: 2024

  • Adds 128 GB SSD, one RJ45 upgraded to 2.5 Gbps, 2nd HDD bay, double the RAM, and higher CPU performance compared to UDM-Pro

  • Dual-WAN, rackmount, with two 10 Gbps SFP+, one 2.5 Gbps RJ45, and eight gigabit RJ45. Ports 8-11 are remappable to WAN/LAN.

  • Runs all UniFi applications and can be NVR for UniFi Protect

  • Manages up to 200 or so UniFi Network devices, and 2000+ clients. A faster CPU and double the RAM allow for up to 5 Gbps of IDS/IPS throughput, and double the management and client limits of the UDM-Pro/SE.

  • Protect video storage = two 3.5" HDD bays with RAID mirroring + internal 128 GB SSD

Dream Wall (UDW) = Controller + Gateway + 16-port PoE switch + Wi-Fi

  • Released: 2023

  • Dual-WAN, with two 10 Gbps SFP+ and unique wallmount enclosure with touchscreen for status/management

  • Lots of PoE (4 PoE, 4 PoE+, 4 PoE++, 420W budget) and dual power supplies

  • Manages up to 100 or so UniFi Network devices, and 1000+ clients

  • Protect video storage = internal 128 GB SSD + SD card slot with 512 GB card pre-installed

Enterprise Fortress Gateway (EFG) = Network Controller + High-Throughput Gateway

  • Released: 2024

  • Dual-WAN, rackmount, with two 2.5 Gbps RJ45, two 10 Gbps SFP+, and two 10 Gbps SFP28

  • Runs UniFi Network, but no other UniFi applications

  • Manages up to 500 or so UniFi Network devices, and 5000+ clients. An 18-core ARM CPU and 16 GB of RAM allow for up to 23.5 Gbps of throughput, or 12.5 Gbps with IDS/IPS enabled.

  • Supports “NeXT AI” SSL/TLS interception

UniFi Gateway Comparison Charts

For those that prefer more detail, I’ve made some more in-depth comparisons. See the rest of my latest UniFi Network Comparison Charts, and my UniFi Gateway Comparison for more details.

Standalone just-a-router Gateways

UniFi USG and UXG Comparison

All Cloud Gateways

UniFi Cloud Gateway (UniFi OS Console) Comparison

All Current Gateways

Comparison of all current UniFi Gateways — doesn’t include the UDM, USG, or USG-Pro.

Unlisted Gateways — USG, USG-Pro, and UDM

Comparison of the unlisted UDM, USG, and USG-Pro.

]]>UniFi Gateways Explained as Simply as PossibleGotta Catch ‘Em All: UniFi Cloud Gateway Pokémon CardsUbiquitiMiscellaneousEvan McCannThu, 29 Aug 2024 00:45:55 +0000https://evanmccann.net/blog/2024/8/unifi-cloud-gateway-pokemon-cards5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:66cfc4c31d7ee312d9b3b574Originally Posted: August 28th, 2024

Gotta Catch ‘Em All: UniFi Cloud Gateway Pokémon Cards

I found Pokécardmaker.net the other day, and was inspired to make these for a bit of fun.

I imagined each UniFi Cloud Gateway as a Pokémon, and tried to think of their unique abilities and attacks. I spent a bit too much time putting in little Easter eggs and details. I posted them to Reddit, but those had a few small mistakes and changes I wanted to make. The slightly tweaked versions are below.

If you’re not familiar with UniFi or Pokémon, you might be confused or think I’m a huge nerd. You wouldn’t be wrong. For those that are familiar, hopefully these bring you a little joy.

View fullsize 01 - Dream Machine.jpg
 View fullsize 02 - Dream Router.jpg
 View fullsize 03 - UniFi Express.jpg
 View fullsize 04 - Cloud Gateway Ultra.jpg
 View fullsize 05 - Cloud Gateway Max.jpg
 View fullsize 06 - Dream Wall.jpg
 View fullsize 07 - Dream Machine Pro.jpg
 View fullsize 08 - Dream Machine SE.jpg
 View fullsize 09 - Dream Machine Pro Max.jpg
 View fullsize 10 - Enterprise Fortress Gateway.jpg
]]>Gotta Catch ‘Em All: UniFi Cloud Gateway Pokémon CardsUI Chat Podcast May 2024: Marketing Field DayUbiquitiPodcastEvan McCannSun, 02 Jun 2024 23:16:54 +0000https://evanmccann.net/blog/20245/ui-chat-podcast-may-2024-marketing-field-day5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6657308127bb7134aa96934dOriginally Posted: June 2nd, 2024

In case you missed it, the May 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

This month we recorded the day before Ubiquiti announced the U7 Pro Max, U7 Pro Wall, and U7 Outdoor. So of course, we started by talking about the Mobility Field Day talks and the vague details about the U7 Pro Max we did know at the time. We also talk about new hardware from May, the U6 Mesh Pro, Pro Max 16 switch, and the latest round of software updates.

At the end, we have a brief talk about Alex’s new website for The Interface, Webflow, and how we regret some of our early publishing decisions and hosting platforms choices.

UI Chat podcast May 2024: Marketing Field Day

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat Podcast Links

X (née Twitter) Links

]]>UI Chat Podcast May 2024: Marketing Field DayMore UniFi Wi-Fi 7: U7 Pro Max, Pro Wall, and Outdoor PreviewUbiquitiWi-FiWi-Fi 7PreviewEvan McCannFri, 31 May 2024 16:51:13 +0000https://evanmccann.net/blog/2024/5/unifi-u7-pro-max-wall-and-outdoor-preview5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6659e4180c2a0a080431133aOriginally Posted: May 31st, 2024
Last Edited: June 2nd, 2024

On May 30th, 2024, Ubiquiti announced three new Wi-Fi 7 models:

These three join the U7 Pro, for a total of four different Wi-Fi 7 APs in the UniFi lineup. Since they were just announced and I don’t have any of the hardware in hand, this preview will summarize the news and the specs that were released. All three of these models are interesting in their own way, but we’ll start with the biggest and most expensive, the U7 Pro Max.

More UniFi Wi-Fi 7: Pro Max, Pro Wall, and Outdoor Preview

U7 Pro Max

From Ubiquiti’s store page for the U7 Pro Max

Ceiling-mounted WiFi 7 AP with 8 spatial streams, 6 GHz support, and a dedicated spectral scanning engine for interference-free WiFi in demanding, large-scale environments.

- WiFi 7 with 6 GHz support
- 8 spatial streams
- Real-time spectral analysis for enhanced channel selection*
- 160 m² (1,750 ft²) coverage
- 500+ connected devices
- Powered using PoE+
- 2.5 GbE uplink
- $279 US MSRP
- Note. 6 GHz operation is supported in these countries.
- Multi-Link Operation (MLO) capability is coming soon and will be provided via software update.

The U7 Pro Max is another in the “flagship” category, which are the normal disc-shaped omnidirectional APs you typically mount to a wall or a ceiling. These offer broad coverage for an indoor space, and are the default options for homes, businesses, and general use.

U7 Pro Max Key Specs

  • Networking interface: (1) 1/2.5 Gbps RJ45 port

  • Management interface: Ethernet

  • Power method: PoE+

  • Power supply: UniFi PoE switch (read: no PoE injector included)

  • Max. power consumption: 22W

  • Max. TX power

    • 2.4 GHz: 23 dBm

    • 5 GHz: 29 dBm

    • 6 GHz: 23 dBm

  • MIMO

    • 2.4 GHz: 2 x 2

    • 5 GHz: 4 x 4

    • 6 GHz: 2 x 2

  • Throughput rate

    • 2.4 GHz: 688 Mbps

    • 5 GHz: 8648 Mbps

    • 6 GHz: 5765 Mbps

  • Antenna gain

    • 2.4 GHz: 4 dBi

    • 5 GHz: 6 dBi

    • 6 GHz: 5.9 dBi

  • Claimed coverage: 160 m² (1,750 ft²)

  • Mounting: Wall, ceiling (Included)

  • Ambient operating temperature: -30 to 60° C (-22 to 140° F)

  • Environment: Indoor (no weatherproofing rating)

View fullsize u7-pro-max-5.png
 View fullsize u7-pro-max-6.png
 View fullsize u7-pro-max-3.png
 View fullsize U7 Pro Max Box.png

U7 Pro vs. U7 Pro Max

The U7 Pro Max is similar to the regular U7 Pro, with a few significant improvements.

  • 5 GHz MIMO: 2x2 vs. 4x4

  • 5 GHz Throughput: 2882 Mbps vs. 8648 Mbps

  • 2.4 GHz TX power: 22 dBm vs. 23 dBm

  • 5 GHz TX power: 26 dBm vs. 29 dBm

  • Claimed coverage: 1,500 ft² vs. 1,750 ft² (140 m² vs. 160 m²)

  • US MSRP: $189 vs. $279

  • The U7 Pro Max adds the spectral analysis radio

Arguably the biggest difference with the the Pro Max is the inclusion of a radio dedicated to real-time spectral analysis. We don’t have a ton of details about the function of this, but Ubiquiti says that this will help with enhanced channel selection, continuous background packet, and spectrum capture. From their YouTube announcement video:

Dedicated spectral engine for continuous background packet and spectrum capture. The engine is capable of providing real-time spectral analysis with impressive NEXT AI continuous packet capture capabilities soon to follow.

Many other vendors have similar features on their high-end APs, but we’ll have to wait to see the details of what Ubiquiti has planned outside of those few sentences and video preview. It looks promising and more fleshed out than the AirView feature was on the AC-SHD, but the software isn’t here yet.

The AC-SHD is a good reminder that you should never buy a product based on a promise. I have faith that Ubiquiti will deliver on their promises this time, but it’s wise to wait until the software is finished and these features are delivered before investing in the hardware.

Outside of the spectrum analysis radio and the upcoming software features that will leverage it, the U7 Pro Max is a reasonable step up in price and performance from the U7 Pro. It also compares well to the U6 Enterprise, which is the same price.

We are going to see more models in the future to flesh out the Wi-Fi 7 lineup. We’ll likely see a U7 Enterprise above the Pro Max, and probably a Lite and Long Range model below. Those considering the U6 Enterprise or any of the other Wi-Fi 6 or Wi-Fi 6E models should consider these two Wi-Fi 7 options, and keep an eye out for more models coming soon.

While we’re waiting, here is a comparison of all the Wi-Fi 6/6E/7 flagship omnidirectional UniFi APs you can currently buy. See my UniFi Network Comparison Charts and the rest of my Comparison Charts for more spec comparisons like these.

UniFi flagship Wi-Fi 6E and Wi-Fi 7 comparison

U7 Pro Wall

Next is the U7 Pro Wall, the first Wi-Fi 7 model meant to be mounted in a wall outlet.

From Ubiquiti’s store page for the U7 Pro Wall.

Wall-mounted WiFi 7 AP with 6 spatial streams and 6 GHz support tailored for home builders with seamless installation options.

- WiFi 7 with 6 GHz support
- 6 spatial streams
- 140 m² (1,500 ft²) coverage
- 300+ connected devices
- Powered using PoE+
- 2.5 GbE uplink
- Versatile deployment with optional Flush Mount and Table Stand accessories*

U7 Pro Wall Key Specs

  • Networking interface: (1) 1/2.5 Gbps RJ45 port

  • Management interface: Ethernet

  • Power method: PoE+

  • Power supply: UniFi PoE switch (read: no PoE injector included)

  • Max. power consumption: 22W

  • Max. TX power

    • 2.4 GHz: 22 dBm

    • 5 GHz: 26 dBm

    • 6 GHz: 23 dBm

  • MIMO

    • 2.4 GHz: 2 x 2

    • 5 GHz: 2 x 2

    • 6 GHz: 2 x 2

  • Throughput rate

    • 2.4 GHz: 688 Mbps

    • 5 GHz: 4324 Mbps

    • 6 GHz: 5764 Mbps

  • Antenna gain

    • 2.4 GHz: 4 dBi

    • 5 GHz: 5 dBi

    • 6 GHz: 6 dBi

  • LEDs: White/blue

  • Claimed Coverage: 140 m² (1,500 ft²)

  • Mounting:

    • Wall (Included)

    • Table stand, flush mount (Optional)

  • Ambient operating temperature: -30 to 60° C (-22 to 140° F)

  • Environment: Indoor (no weatherproofing rating)

View fullsize u7-pro-wall-2.png
 View fullsize u7-pro-wall-3.png
 View fullsize u7-pro-wall-4.png
 View fullsize u7-pro-wall-7.png

U7 Pro Wall vs. other In-Wall models

UniFi offers many wall or in-wall APs, from the ancient AC-In-Wall to the U6-In-Wall and U6-Enterprise-In-Wall (Wi-Fi 6E) models. These have all come with built-in switch ports in the past, as well as PoE passthrough. You might see them in a bedroom or hotel room, or maybe behind an entertainment center with Ethernet running to a few bandwidth heavy devices. They’re a handy combination of switch and AP, but the U7 Pro Wall doesn’t include any switch ports.

Ubiquiti confirmed in the YouTube video comments that another wall model is coming that does, so keep waiting if that’s what you’re looking for.

A traditional In-Wall design with a built-in switch is in development for UniFi 7. The U7 Pro Wall is the first design in a series of UniFi 7 APs for wall-mount applications. It's tailored for seamless installation, especially with its Paintable Flush Mount accessory that enables near-invisible, recessed installation. Stay tuned for more UniFi 7 updates.

My assumption is that it is a size/cost/heat thing, and that's why they are splitting it into (at least) two models. Three radios generate a fair bit of heat, and you need room for all the required components and antennas.

Basically, it's tri-band, small/cheap, or built-in switch. Pick two.

  • U6-In-Wall = small/cheap and built-in switch, but dual-band.

  • U6-Enterprise-In-Wall = tri-band and built-in switch, but big and expensive.

  • U7-Pro-Wall = tri-band and small/cheap, but no built-in switch.

  • U7 Pro Max/Enterprise Wall = tri-band and built-in switch, but big and expensive.

Whatever it's called, the U7 Wall model with built-in switch ports is probably going to require a double-width enclosure like the U6-Enterprise-In-Wall. It'll probably require PoE++ for passthough, and be around $299 too.

If you’re OK without the extra ports, the U7 Pro Wall is similar to the U7 Pro from a radio and performance perspective. For $20 more than the U6-In-Wall and $100 less than the Enterprise version, you’ll have to consider what tradeoffs you want to make.

Below is a comparison of all of the wall and in-wall UniFi AP models. Note that the In-Wall HD isn’t listed in the store anymore, and the BeaconHD and U6-Extender don’t offer any Ethernet connections. The main models to compare against are the U6 In-Wall and U6 Enterprise In-Wall. The AC In-Wall is well past it’s expiration date. Even though it is still for sale, I wouldn’t recommend buying one new in 2024.

UniFi Wall AP comparison

U7 Outdoor

Finally, we have the U7 Outdoor, which follows on the heels of the release of the U6 Mesh Pro. While the U6 Mesh Pro was a drop in replacement for the AC Mesh Pro with the same enclosure and some newer radios, the U7 Outdoor is something new.

From Ubiquiti’s store page for the U7 Outdoor:

All-weather WiFi 7 AP with 4 spatial streams, an integrated directional super antenna, and versatile mounting options.

- WiFi 7
- 4 spatial streams
- 465 m² (5,000 ft²) open space coverage with the integrated directional super antenna
- Software-adjustable antenna beamwidth for balanced coverage with the included omni antennas
- 200+ connected devices
- Powered using PoE+
- 2.5 GbE uplink
- Versatile wall and pole mounting
- Weatherproof (outdoor exposed)
- US MSRP: $199, available June 17th.

U7 Outdoor Key Specs

  • Networking interface: (1) 1/2.5 Gbps RJ45 port

  • Management interface: Ethernet

  • Power method: PoE+

  • Power supply: UniFi PoE switch (read: no PoE injector included)

  • Max. power consumption: 19W

  • Max. TX power

    • 2.4 GHz: 23 dBm

    • 5 GHz: 26 dBm

  • MIMO

    • 2.4 GHz: 2 x 2

    • 5 GHz: 2 x 2

  • Throughput rate

    • 2.4 GHz: 688 Mbps

    • 5 GHz: 4324 Mbps

  • Antennas

    • (1) Directional internal antenna

    • (2) External omni antennas

    • (2) RP-SMA connectors for external antenna

  • 2.4 GHz Antenna gain:

    • Directional internal: 8 dBi

    • External omni: 3 dBi

  • 5 GHz Antenna gain:

    • Directional internal: 12.5 dBi

    • External omni: 4 dBi

  • Internal antenna beamwidth (configurable)

    • 2.4 GHz: 90°

    • 5 GHz: 45°

  • LEDs: White/blue, mesh signal

  • Claimed Coverage: 465 m² (5,000 ft²) open space coverage with the integrated directional super antenna

  • Mounting: Wall, ceiling, pole (Included)

  • Ambient operating temperature: -30 to 60° C (-22 to 140° F)

  • Environment: Outdoor

  • Pole mount diameter: 25–60 mm (1–2.36") on pipe outer diameter

  • Wind survivability: 74.6 N at 200 km/h (16.8 lbf at 125 mph)

  • Weatherproofing: IPX6

View fullsize u7-outdoor-2.png
 View fullsize u7-outdoor-7.png
 View fullsize u7-outdoor-8.png
 View fullsize U7 Outdoor.png

Before we get into the asterisks and open questions, here is a comparison of all the outdoor UniFi AP models:

UniFi Outdoor AP comparison

U7 Outdoor Initial Impressions

There’s a lot to discuss here, but we’ll start with the disappointing things. There is no 6 GHz radio.

My speculation is that outdoor 6 GHz operation is something a future model will have. Standard power and outdoor operation of 6 GHz is still a regulation headache, even if you only consider the US. The world is still working on adopting the specific rules. Outdoor 6 GHz operation and standard power APs also require using AFC and built-in GPS. We’ll get outdoor 6 GHz from UniFi eventually, but it’s not here yet. When it is here, it will probably cost more than $199. If 6 GHz is a deal breaker and you want to spend the extra money for it, you’ll need to wait.

Another odd thing is the recessed RP-SMA connectors at the top of the device. Since this is meant for outdoor use and is IPX6 rated, those should be waterproof. I’ve dealt with my fair share of rusted connectors and weathered APs though, so I’m curious what will happen to those connectors if you install it outdoors without antennas attached. It looks like there are little plastic caps in the installation guide images, but they aren’t shown in the other product images. Do you need to install antennas or use the caps for it to be waterproof? What happens if you uninstall the antennas and lose those little plastic caps? Will it all hold up over time?

For reference, as described in UniFi Device IP and IK Ratings, IPX5 means that it is not rated for dust resistance, but it has “water jets” level liquid protection. It should hold up to heavy direct rain, and it matches the IPX5 rating of the U6 Mesh. The U6 Mesh Pro and Swiss Army Knife Ultra are both IPX6 rated, though.

Now on to the good stuff. The U7 Outdoor has unique internal antennas. They are not meant for broadcasting over a broad area, they are directional and configurable. The spec list shows a 90° beamwidth and 8 dBi for 2.4 GHz, and 45° beamwidth and 12 dBi for 5 GHz. Antennas and beam patterns are 3 dimension things though, and they don’t specify the vertical beamwidth. They have not mentioned the specifics of how they are configurable, and they haven’t released their radiation patterns either. Add those to the list of details we’ll need to wait for.

Thankfully, they also include external 3 dBi / 4 dBi omnidirectional antennas, which you can switch to in a drop down menu. If you don’t want the directional high gain coverage pattern, pop on the omnidirectional antennas or other standard RP-SMA antennas if you prefer.

Despite the limitation of dual-band and lacking 6 GHz, the powerful and unique antenna configuration makes it a great choice for covering a large outdoor space. I can see a lot of people mounting these on a wall to cover their backyard, or mounting on a pole to cover a big outdoor area.

Zooming Out: Three Exciting Releases

Stepping back and looking at these three new APs and Wi-Fi 7 as a whole, there is a lot to be excited about.

The U7 Pro Max is a nice step up from the regular Pro, and I’m excited to hear more about what software features are going to be enabled by the spectrum analysis tool. The history of the AC-SHD gives me some pause, but I’m optimistic.

The U7 Pro Wall is a nice compliment to the U6 In-Wall and U6-Enterprise-In-Wall, especially if you don’t plan to leverage any of the built-in switch ports for downstream devices. If you want Wi-Fi and built-in switch ports or PoE passthrough, keep waiting.

Despite the lack of 6 GHz, the U7 Outdoor is the AP I’m most excited about. I love outdoor wireless, and UniFi APs are the foundation of a ton of cost-effective outdoor, public, or event Wi-Fi. The U7 Outdoor offers a lot of value, and features that are not found on any of the other outdoor models. It is a welcome addition to the outdoor line.

The U7 Pro Max, U7 Outdoor, and U7 Pro Wall. Image Credit: Ubiquiti

Note: Defending 2.5 Gbps Uplinks

Oh, and one last thing — I have seen a lot of commenters disappointed that these “only” have 2.5 Gbps RJ45 connections. Yes, Wi-Fi 6/6E/7 APs like these can offer more than 2.5 Gbps of throughput, but I would argue that 2.5 Gbps is more than enough for a single access point. Reliability, airtime utilization, and aggregate performance are more important in large wireless networks.

I wrote a bit about the realities of Wi-Fi data rates vs. real-world speeds in Understanding Wi-Fi Speed and How 6 GHz Compares, but it boils down to this. Quoted data rates are a speed limit, and you only get silly specs like “9.3 Gbps over-the-air speed” by combining all radios into one number. You’ll only achieve a fraction of these aggregate throughput claims. Even then, you’ll only get those multi-gigabit numbers in ideal conditions. Wi-Fi is almost never ideal.

Optimizing for the best-case scenario, with modern clients using the widest possible channels and highest possible data rates is not good engineering. In a typical multi-AP environment, the limit is not the speed of the wire between your switch an AP. It’s airtime, and likely the source of the bandwidth you are downloading from or uploading to.

Yes, in extreme scenarios, if you have a multi-gigabit WAN or LAN, modern Wi-Fi clients, clear and wide channels, no other users, and a bandwidth-heavy application, you’ll be limited by the 2.5 Gbps uplink. If that’s the case though, that device should probably be plugged into the network.

For the foreseeable future, wires will always win for reliability and speed. Increasing the cost and power draw of every AP to include 10 Gbps interfaces for this corner case is a losing argument. You can blame Ubiquiti, or Qualcomm, or the networking industry at large, but that’s the unfortunate reality. I’d love to see 10 Gbps Ethernet be more common, and it’s a shame that gigabit has stuck around as the default option for so long. Sadly, in most cases, it still is good enough. Some may argue that 2.5 Gbps is a pointless half-step, and I can’t say I disagree. That doesn’t make 10 Gbps components cheaper or more common.

Instead of arguing, I choose to enjoy wireless for the convenience it offers, and view these specifications and limits through a real-world lens. Wi-Fi is an amazing technology, and Wi-Fi 7 offers a lot of significant improvements to be excited about. It’s a good time to be a fan of wireless.

In my opinion, Ubiquiti is firing on all cylinders lately. There has been a lot of progress in UniFi software, and they are releasing more hardware than I can keep up with. The jury is still out on how their push into enterprise will go, or if they will deliver on their own spectrum analysis hype. I don’t have any doubts that these U7 APs are great additions to their lineup, though.

]]>More UniFi Wi-Fi 7: U7 Pro Max, Pro Wall, and Outdoor PreviewHome Network Update: Goodnight, UniFi Dream MachineUbiquitiNetworkingMiscellaneousEvan McCannSun, 19 May 2024 17:17:28 +0000https://evanmccann.net/blog/2024/5/home-network-update-goodnight-udm5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6600857259701944d0c77477Originally Posted: May 19th, 2024

Home Network Update: Goodnight, UniFi Dream Machine

It’s been a while since I wrote about my home network, in Zen and the Art of Home Networking. Not much has changed since then, until recently. I finally retired my UniFi Dream Machine and replaced it with the UniFi Cloud Gateway Ultra, Enterprise 8 PoE switch, and U7 Pro access point.

I figured it was time to provide an update and explain why I said goodnight to my trusty Dream Machine. I also want to cover the much-discussed backplane limitation of the Cloud Gateway Ultra, some issues I had with the U7 Pro, and why I already want to make more changes.

Over the past few months, Ubiquti have released a lot of UniFi equipment. Off the top of my head, we’ve seen:

  • Gateways — Cloud Gateway Ultra, Express, Gateway Lite, and Gateway Max
  • Switches — Pro 8 PoE, Pro Max 16/24/48, Pro Max 16/24/48 PoE, and three flavors of Ultra
  • APs — Swiss Army Knife, U6-Mesh-Pro, and U7-Pro

I wrote about a few of them and bought a few of them as well. Over the past few years, I’ve amassed a horde of home networking equipment I don’t need. Some I’ve been able to repurpose, use for testing, or hand off to friends or family that need an upgrade. More than anything, they sit around.

Even with all of those options, I’ve mostly used the UniFi Dream Machine as the core of my home network. I’ve swapped it out to test new products, added switches and APs, ran Ethernet, and reconfigured it more times than I can count. No matter what I did, I always came back to the UDM as an easy option to keep my home network running. It allowed me to experiment off to the side without worrying about the network everyone else was using.

It’s a little beat up but it’s running fine, and it is still supported by current UniFi software. So why the Cloud Gateway Ultra, and why now? Before we cover those details, I want to start at a high level and talk about my layout and the hardware I chose.

Topology and Hardware Selection

Old network:

  • Cable modem
  • UDM

New network:

My home network is small and has a simple layout. There are around a dozen or so client devices, and fairly light usage overall. The main requirement is reliable wireless for working from home, a few extra computers, and wireless security cameras. It’s not a very exciting network.

The WAN is provided by a coax cable modem, which provides Ethernet to the WAN of the Cloud Gateway Ultra. It is a (sadly typical in the US) asymmetric connection with gigabit download, but a tragic 20 Mbps upload.

The Cloud Gateway Ultra acts as the main gateway and UniFi Network controller. It is connected to an Enterprise 8 PoE switch, which powers my U7-Pro access point. When needed, the U7-Pro wirelessly connects to my UniFi Express acting as an AP. This allows me to get Ethernet in my office for test equipment. I also occasionally power up my Cloud Key Gen 2+ (Shown as "CloudKey+ in the Ubiquiti store) and G4 Instant camera for use as a pet camera.

This is the normal layout, but it often changes. While running speed tests for my UXG-Lite Review, I ran Ethernet and built my lab network off the USW-Enterprise-8-PoE. I have two computers with 2.5 Gbps NICs to break beyond the gigabit barrier on LAN-to-LAN connections. Ideally, the link between my switch and gateway would also be 2.5 Gbps, which brings me back to the Cloud Gateway Ultra and the newer UXG-Max.

I made my initial network changes and started writing this before the new Gateway Max (UXG-Max) was announced. The UXG-Max is the gateway I would use if I was building this from scratch, today. I would be able to use my CloudKey+ or self-host the controller if I wanted. I wouldn’t be able to use the Cloud Gateway Ultra for anything, due to the controller and gateway functions being tied together. Sadly, it would join my Gateway Lite in the pile of spare equipment.

Due to my gigabit WAN and light needs, the UCG-Ultra is not a limitation in day-to-day use. Switching to the UXG-Max would allow me to not worry about gigabit links becoming a bottleneck in my testing though, so it’s on my long list of equipment to purchase. I also just generally prefer the flexibility of a standalone gateway and standalone controller, even if I don’t strictly need multi-site support or the other benefits of a modular setup. There are advantages to both, and the UXG-Ultra is a convenient combination of gateway and controller, just like the UDM was.

If I wanted to expand my wireless coverage, the first thing I would do is look into running Ethernet cabling, and putting an AP on the 2nd floor, or one outside to ensure coverage on our back deck. The U7-Pro is close enough to make that not necessary though. As I said, my network is small and my needs are low.

Making The Change

The swap-out process was simple. UniFi networks are software-defined, and importing a backup makes swapping hardware a non-issue. If you change from one controller or gateway to another, you can just import a UniFi Network backup file. Your networks, clients, Wi-Fi settings, and everything else will be back to how they were.

I could have done that, but I chose to build it from scratch and start fresh. I’ve built up a lot of cruft over the years and changed a lot of settings in the process of experimenting and testing. The main things I cared about took maybe 10 minutes of clicking around to duplicate, so I did it that way.

Starting from a fresh slate, the first thing I did was modify the built-in “default” network. This is the 192.168.1.1/24 subnet you’ll see when you set up a new UniFi gateway. The default network can’t be removed, but you can rename and redefine it, or not use it. Network engineers like me tend to not like using the default untagged network, or VLAN 1 in most vendor’s terms. It’s a common basic practice to use tagged networks and leave the default untagged network as a dead end. This would prevent someone from connecting a cable and gaining access to your management network, for example. This isn’t a realistic concern in my home network, but old habits die hard.

My Dead-Simple VLAN and IPv4 Scheme

I have a very simple IPv4 scheme for my home network. I allocate the whole 10.250.0.0/16 subnet, split it into /24s, and match my VLAN ID with the 3rd octet of the subnet. My untagged default network, AKA VLAN 1, is 10.250.1.0/24. My main LAN is VLAN 10, which is 10.250.10.0/24. My usual testing or lab network is VLAN 99, 10.250.99.0/24. The numbers are arbitrary, but this simple scheme is easy to remember.

If I only have a dozen or two devices on the network, why would I even bother with an overkill /16 subnet assignment and 65,536 IP addresses? Well, mainly for testing and segmentation. It’s helpful to be able to leave the main LAN network alone when testing new equipment or labbing something up to play around with. Separating your networks at layer 2 (VLANs) and layer 3 (subnets) allows for segmentation, access control, firewall policy, and routing decisions to be made. This is mainly relevant in larger networks or networks where security matters more than my basic home network. I’m mainly interested in experimenting with the latest controls and features of the UniFi Network application.

View fullsize UniFi topology view
 UniFi topology view View fullsize UniFi network settings
 UniFi network settings

Limiting my whole home network to the 10.250.0.0/16 subnet makes lab network routing dead simple. When I’m running additional gateways or testing site-to-site VPNs like I did in my UXG-Lite Review, I’ll usually use 10.249.0.0/16 for the test network. Then, I’ll add two static routes, each pointing to the other /16. It’s simple, and it works.

For more complex setups that require dynamic routing, transit networks, routed links, or VPN subnets, sometimes I get a little creative. My default is to pick something in the 172.16.0.0/12 space, to make it obvious that it’s separate, and keep it unaffected by my broad static routes. There are many ways to do it, but this works for me and my purposes.

U7-Pro: Wi-Fi 5 to Wi-Fi 7

Now for the fun part. After completing the basic setup on the Cloud Gateway Ultra, I reset and re-adopted my Enterprise 8 PoE switch and U7-Pro access point.

Like most nerds, I’m guilty of over-emphasizing spec differences, or theoretical improvements in newer equipment. Wi-Fi 6 has 25% higher data rates! You need to have 6 GHz to get away from the congested 2.4 GHz and 5 GHz bands! 2x2 MIMO isn’t enough! Multi-link operation with Wi-Fi 7 is a game changer!

In reality, my home network isn’t used for anything extreme. We have a dozen or two devices, and most of them just need to be capable of streaming some video and downloading the occasional software update. Besides some Phillips Hue lightbulbs and some wireless security cameras, there is nothing particularly “smart” about it. Outside of large game downloads from Steam, our bandwidth needs are low. Stability and availability are more important than high data rates, wide channels, new 802.11 wireless standards, and maximum performance. I’m sorry to disappoint you, but that’s the truth.

Before I dive into the details, I just want to be clear. The Wi-Fi 5 wireless AP built-in to the UDM wasn’t a significant limitation. Wi-Fi 5 is more than capable of delivering a good experience for most people. Wi-Fi 6 is better and Wi-Fi 7 is better yet, but don’t let anyone tell you that you need it. If your setup works for you, enjoy it and save your money for a bigger upgrade later.

That said, this was the most fun part of the upgrade because wireless is my favorite aspect of networking. Home networking and testing the limits is a fun hobby. I’ve used almost every model UniFi offers and tried many other vendors. I’ve built or worked on countless networks, including large ones filled with expensive enterprise gear. I work with Cisco for my day job, but in my home, the UDM was good enough.

In my real-world use, the U7-Pro doesn’t do anything massively better than the UDM. Adding 6 GHz coverage for a few Wi-Fi 6E devices was the most noticeable change. The best parts of the 802.11be standard are lost on me because I don’t have any clients that support it. You probably don’t either, yet. I want to learn and write about Wi-Fi 7 more, but first I need to find a compatible PCIe card that works with my AMD Ryzen PC, or a decent USB solution. It’s early days, and there are always issues and costs that come from being an early adopter.

Speaking of early adopter pains, after I switched to the U7-Pro, I started having audio quality issues on Microsoft Teams video and audio calls. I was able to hear everyone just fine, but everyone I talked to said that my audio sounded awful, and was cutting out every second or two. This issue was only with Teams and only with my work laptop, so I believe it was a client-side issue. Switching to Ethernet fixed it, as did switching the U7-Pro out for a U6-Enterprise.

I haven’t dug any deeper into what caused that, but that is one more data point to show that sometimes the latest isn’t always the greatest, and changes aren’t always for the better. I assume this is a small issue with the firmware on the U7-Pro or some driver on my Windows machine, but that is just an assumption. I’ll provide an update if I’m able to troubleshoot that more, or if newer firmware addresses the issue I was running into. For now, I’ll stick with the U6-Enterprise and what works.

Open Question: UDM Future Support?

This is a silly issue, and it shouldn’t matter to most people. It matters to me though.

Ubiquiti isn’t listing or promoting the base UDM on their store, even though it’s still for sale. They removed most mentions of it on their website, and don’t list it under any of their product categories. You have to search for it, just like you had to search for the USG and USG-Pro while they were waiting on their official end-of-life announcement. The UDM isn’t end-of-life and it still receives software updates, but the writing is on the wall.

Rather than announcing something is end-of-life as they did for some APs years ago, Ubiquiti has moved to a strategy of removing references to old products, delisting them, and leaving them in a kind of zombie state. They’re not alive, they’re not dead, but they’re not the best choice for a new purchase. This was the state the USG and USG-Pro were in until they were recently listed as legacy or vintage products.

The UDM is in this zombie state now, with no mentions of it on their home page or in the ui.com store. It doesn’t have a “vintage” or “legacy” status officially, but the writing is on the wall and we know how this script ends. Over time, the UDM will fall behind. It will continue to be updated for a while, but it may be excluded from new features. Some features may not make their way to the UDM, or they won’t be complete, just like the USG and USG-Pro. The UDM should get security updates and be safe to use for several more years, but there is no guarantee.

This gentle neglect was welcomed for the USGs, because they were ancient hardware with significant performance limits. It’s trickier to justify with the UDM because it is still a very capable device and it’s very similar to the UDM-Pro, UDM-SE, and UDW internally. They all have the same Annapurna Labs ARM chipset with a quad-core ARM A57 CPU at their heart. Ubiquiti can’t claim the UDM doesn’t have the CPU power, or that it would take a lot of custom work to make new features available on the UDM. It actually has more computational power than newer devices like the UDR, Express, and UXG-Lite.

Even if the UDM does stay current with all the other features, I think the UDM is going to be in this zombie state for a while. It’s no longer a first-class citizen in the UniFi world. Rather than wait for the inevitable, I chose to take the leap.

Cloud Gateway Ultra: Backplane Pain

Network performance is a tricky topic to discuss, with a lot of common misconceptions. I just want to focus on a few small areas here: backplanes, throughput, and wireless. There was a lot of discussion about the 2.5 Gbps WAN port and the backplane limitation of the Cloud Gateway Ultra. For our purposes, the “backplane” refers to the connections between internal components of the device. The speed of the backplane determines the speed at which data can move between the LAN, the CPU, and the WAN.

The underlying architecture of all recent UniFi Gateways and Cloud Gateways are similar. Start with a chipset featuring an ARM CPU and hardware for common networking functions, connect some interfaces to it, and leverage the UniFi Network software to configure it. Ubiquiti buys components from Qualcomm, MediaTek, and others, and designs their hardware around them. This is how most consumer-grade networking equipment is built.

For interfaces, the UDM has one gigabit WAN, and four gigabit LAN. The Cloud Gateway Ultra has one 2.5 Gbps WAN, and four gigabit LAN. On the surface, it looks like the UCG-Ultra is a straightforward upgrade. A faster WAN port should be faster, right? More LAN ports should allow for more total throughput, right? It should, but that is where the limitation comes in.

These unofficial block diagrams are from the Ubiquiti Community Wiki, and they’re a helpful reference point when talking about backplanes. On the UDM, you can see the 4 gigabit LAN ports all connect to a switch chip, and that switch chip has a 1 Gbps connection to the CPU. Traffic between LAN port 1 to LAN port 2 is handled by the switch chip, but traffic between the LAN and WAN needs to go to the CPU, which handles routing, NAT, and other network tasks.

Since the UDM’s WAN is a gigabit interface connected with a gigabit backplane, the design is balanced. Any of the four LAN ports can fully utilize the 1 Gbps WAN port. A single port can send or receive 1 Gbps of data, or all 4 ports can share that bandwidth. You wouldn’t be able to send 1 Gbps of data from all four LAN ports at once, but you could send 250 Mbps from each. Even if that connection was faster, the 1 Gbps WAN port would be the limit. This is a typical setup for a gigabit home router.

Unofficial UDM diagram from Ubiquiti Community Wiki

With the UDM-Pro, the backplane limitation is more obvious. The UDM-Pro has two 10 Gbps SFP+ interfaces, a gigabit WAN, and an 8-port gigabit LAN switch. Those eight switch ports are connected to a switch chip, and that switch chip has a single gigabit connection to the CPU.

That means that collectively, all eight of those LAN ports share a single gigabit connection to the CPU, and in turn, the 10 Gbps WAN or LAN interfaces. This limitation means the 8-port switch is best used for low-bandwidth devices, like maybe a smart home bridge or a small server handling light tasks. You wouldn’t want to connect something like your NAS or an access point to those ports. If you had eight data-hungry devices you might hit the 1 Gbps limit and not fully utilize your multi-gig WAN or 10 Gbps LAN connections. With the UDM-Pro, you should use the 10 Gbps SFP+ interface to connect to a switch capable of handling 10 Gbps of bandwidth.

With all of these limits, the direction and type of traffic matters. Local traffic from LAN to LAN is handled by the switch chip and doesn’t need to go to the CPU. As an example, 1 Gbps of traffic coming in LAN 1 and going to LAN 2 would be no issue. At the same time, you could also have 1 Gbps of traffic coming in LAN 3 and going to LAN 4, LAN 5 to LAN 6, etc. Those links are full-duplex, line-rate, and non-blocking. In a typical Ethernet switch, all interfaces can be used at line rate simultaneously. In this diagram, the traffic would only be going down to the switch chip, and then back to the destination interface.

Unofficial UDM-Pro block diagram from Ubiquiti Community Wiki

The backplane limitation comes in when traffic is bound for other interfaces or other networks. This is mainly LAN to WAN, but traffic passing between VLANs also has to go through the CPU for processing and routing. All the non-local traffic from those 8 LAN ports uses the shared gigabit link to the CPU. This limits throughput on each LAN interface to whatever capacity is not in use by the other 7 interfaces. It’s like going from an 8-lane highway down to 1.

UniFi Cloud Gateway is similar to the UDM. It upgrades the WAN port to 2.5 Gbps, but nothing else has changed. This results in an imbalance, where only the WAN port can go beyond gigabit speed. Putting this all together, we can make a theoretical block diagram for the Cloud Gateway Ultra, and use it to illustrate when the backplane is a limitation, and when it isn’t.

Theoretical block diagram from the Cloud Gateway Ultra

This same principle applies to other UniFi gateways like the UDM, and the UCG-Ultra. The Cloud Gateway Ultra is a little more egregious of an example, due to it having a 2.5 Gbps WAN interface but no realistic way to fully utilize it.

The four gigabit LAN ports can pass 1 Gbps in and out of their ports with no issue, as gigabit switch ports typically do. If you want to go between VLANs or out to the Internet through your WAN port, there is a single gigabit link that all four need to share. You’ll never see more than 1 Gbps download and 1 Gbps upload speeds through your WAN port. Yes, there is a 2.5 Gbps WAN port, but you have no realistic way to use it. I’m not sure why they included the 2.5 Gbps interface and their justification for it is silly.

I assume this limitation comes back to cost and a choice that Qualcomm or some underlying component manufacturer made. The components within the UCG-Ultra are commodity parts, picked for one reason over any other: their cost. What we’re left with is a cheap product that delivers a lot for the price, with the big asterisk of the backplane and a 1 Gbps throughput limitation. It can deliver 1 Gbps with IPS/IDS on or off, but nothing more. It has a 2.5 Gbps WAN, technically, but you can’t use it in any meaningful sense.

The UXG-Max takes a very similar base and makes other tradeoffs. If you’re looking for a small 2.5 Gbps gateway, that’s the one to buy. If you want a built-in controller and are fine with gigabit throughput, the UCG-Ultra is a good value. We have more choices than ever, but each one has a tradeoff or limitation to consider. I chose the convenience of the UCG-Ultra, but you probably have different priorities. I just wish Ubiquiti made fewer compromises in their low-end products.

Wrapping Up

The further I get in my career as a network engineer, the less willing I am to take on those early adopter penalties or experiment on the bleeding edge. I prefer one thing over everything else: stability. I don’t want to spend my weekends fixing broken networks, I spend enough of my time doing that already. It’s hard to have something be your everyday job and your source of weekend fun.

I’ve followed UniFi closely for many years now, but it’s still fun to see what’s new and what’s next. In the future, I’d love to have a complex homelab and a bunch of rackmount equipment to work on and test with. That could be useful for my Cisco-focused day job, where the networking issues are more complex and I can’t just click a checkbox to make a change. I think that’s the main thing I enjoy about UniFi. Simplicity is good, and Ubiquiti balances simplicity and power about as well as anyone.

If you’re limping along with older equipment, you may want to consider an upgrade. Ubiquiti has tons of new hardware to pick from, and new software features to explore. Before you do that though, have a realistic look at what you use your home network for, and what you’re looking to get out of the upgrade. Hopefully, that answer is something important, and you’re looking to address a specific shortcoming of your current setup. Maybe you’re looking to expand wireless coverage, take advantage of your new fast Internet connection, or keep up with your demanding tasks and throughput needs. If you’re like me and just want to justify an upgrade, that’s OK too.

I think it helps to look at this with a clear perspective and be realistic. I didn’t need to buy any of this gear, my UDM was fine. Home networking is a hobby for me, and maintaining this website encourages me to keep up with the latest changes and releases. Maybe that’s the case for you, or maybe you just feel like it’s time for something better. I think that’s a good enough reason to upgrade, and hopefully, it ends up being worth it.

For me, the main thing I’m looking to get out of this new equipment is a couple more years of hassle-free use. If something fails or becomes an issue, I’ll still have my trusty UDM.

]]>Home Network Update: Goodnight, UniFi Dream MachineUXG-Max Preview: Modern Multi-GigUbiquitiPreviewComparisonEvan McCannWed, 10 Apr 2024 14:22:11 +0000https://evanmccann.net/blog/2024/4/uxg-max-preview5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6612ce0fd4cbe27f68c1dcc5Originally Posted: April 10th, 2024
Last Edited: April 27th, 2024

TL;DR:

  • The UniFi Gateway Max (UXG-Max) is the latest gateway from Ubiquiti, offering 2.5 Gbps WAN and LAN interfaces, with more power than the UXG-Lite

  • The UXG-Max is just a gateway — it does not act as a UniFi Network controller or Wi-Fi access point.

  • The Gateway Max is for sale for $199 in the US and Canada, with availability in other regions coming soon.

Last week, Ubiquiti released the Gateway Max (UXG-Max). Like the Gateway Lite (UXG-Lite) and Gateway Pro (UXG-Pro), it doesn’t run any software, and it doesn’t act as a UniFi controller. You need to pair all UXG models with a Cloud Key, Official UniFi Hosting, or a cloud/self-hosted UniFi Network application for management. They are the modern equivalents of the old USG and USG-Pro.

This preview will cover the specs, my initial impressions, and where the UXG-Max fits in the increasingly crowded UniFi gateway lineup. Before we dig into those details, we’ll cover the information Ubiquiti provided. See my UXG-Lite Preview and full UXG-Lite Review for more background and context on UXGs as a whole.

From the Ubiquiti store page for the Gateway Max:

Compact, multi-WAN UniFi gateway with full 2.5 GbE support for high-performance networking at small-to-medium sites.
- Managed with a CloudKey, Official UniFi Hosting, or UniFi Network Server
- Up to 1.5 Gbps routing with IDS/IPS
- (1) 2.5 GbE WAN port
- (4) 2.5 GbE LAN ports, including (1) remappable to WAN
- USB-C powered (adapter included)
- Managed with UniFi Network 8.1.113 and later

UXG-Max Preview: Modern Multi-Gig

Gateway Max (UXG-Max) Specs

  • Name: Gateway Max

  • SKU: UXG-Max

  • US MSRP: $199

Mechanical and Physical

  • Dimensions: 141.8 x 127.6 x 30 mm (5.6 x 5 x 1.2")

  • Weight: 520 g (1.1 lb)

  • Enclosure materials: Polycarbonate

  • Resistance: IK04

  • Ambient operating temperature: -10 to 40° C (14 to 104° F)

  • Ambient operating humidity: 5 to 95% noncondensing

  • Certifications: CE, FCC, IC

  • LED: Ethernet, White: link/activity

  • Button: (1) Factory reset

Hardware and Power

  • Networking interfaces:

    • (1) 2.5 Gbps RJ45 WAN port

    • (4) 2.5 Gbps RJ45 LAN port — (1) remappable as 2nd WAN

  • Management interface: Ethernet, Bluetooth

  • Power method: USB type C (5V DC/3A)

  • Max. power consumption: 9.6W

  • Supported voltage range: 100–240V

  • Processor: Quad-core ARM A53 @ 1.5 GHz

  • SoC/Chipset: Qualcomm IPQ5322

  • Memory information: 2 GB DDR4

Gateway Features

Performance

  • WiFi QoS with UniFi APs

  • Application, domain, and country-based QoS

  • Application and device type identification

  • Internet quality and outage reporting

Next-generation security

  • Application-aware firewall rules

  • Signature-based IPS/IDS threat detection

  • Content, country, domain, and ad filtering

  • VLAN/subnet-based traffic segmentation

  • Full stateful firewall

Advanced networking

  • License-free SD-WAN* (Site Magic)

  • WireGuard, L2TP and OpenVPN server

  • OpenVPN client

  • OpenVPN and IPsec site-to-site VPN

  • One-click Teleport* and Identity Enterprise VPN**

  • Policy-based WAN and VPN routing

  • DHCP relay

  • Customizable DHCP server

  • IPv6 ISP support

*When paired with a Cloud Key or Official UniFi Hosting.
**When paired with a Cloud Key.

View fullsize uxg-max-2.png
 View fullsize uxg-max-5.png
 View fullsize UXG-Max-Ports.png

Gateway Choice Paralysis

When the UXG-Max was announced, I was happy to see a model between the UXG-Lite and UXG-Pro. There is a big gap between those. For some the UXG-Lite is too limited, but the Pro is too big, too much, and too expensive. The UXG-Max fits in the middle, and it addresses the biggest limitaitons of the UXG-Lite.

I’m always happy to see more devices with 2.5 Gbps ports, and more options for self-hosted or modular UniFi networks. Most people don’t seem to have the same opinion as me, though. Reading through various threads, comments, and discussions on the UXG-Max, one of the main themes was confusion, and occasionally anger.

I saw many variations of:

  • I’m confused, which gateway should I buy?

  • Why wasn’t this released with the UXG-Lite? I would have bought this instead!

  • 2.5 Gbps interfaces, but only 1.5 Gbps of IDS/IPS throughput?! 😮

Those are fair questions, and I’ll try to answer them. Unless you’re a nerd like I am and study these products, it is hard to know what hardware you need, or which model you should choose. Additional choices are good, but too many can lead to confusion. With UniFi gateways, we seem to be well into confusion territory.

Unfortunately, you can’t just discuss the UXG-Max in a vacuum. It isn’t a standalone device, and it is only one part of a UniFi network. It handles routing, VPN, and firewall functions, while other devices are needed to run the UniFi Network application or handle switching and wireless duties. If that isn’t clear enough, refer to my UniFi Gateways Explained as Simply as Possible post for a more complete explanation.

Before you consider the UXG-Max, you have to answer a few questions. Do you want to self-host? Do you have or want a Cloud Key? Do you want a gateway with a built-in controller? Do you care about UniFi Protect, Talk, Access, or Connect? Do you care about centralized management for multiple sites?

The hardest part of discussing the UXG-Max is that you can’t put that context aside and just focus on the specs. You have to keep it in mind when considering a purchase, or comparing the UXG-Max to alternative UniFi gateways. I tried building a UniFi Gateway decision tree for this article but I gave up. It’s hard, even for someone who knows these products well.

Years ago we had a simple choice: USG or USG-Pro. Now there are 11 additional models with overlapping uses and features. To start, I’m going to put the Cloud Gateways aside and focus on just the UXG Lite, Max, and Pro.

UXG-Lite vs. UXG-Max vs. UXG-Pro

What is the Gateway Max and where does it fit? The easy answer is between the Gateway Lite and Gateway Pro. It’s between those two in price and capability, but closer to the Lite. It’s a desktop enclosure, powered by USB-C, and small enough to fit on shelf or slide under your cable modem.

As the name implies though, the Max offers a few advantages. In a way, Max = Lite + 3 LAN + all interfaces upgraded to 2.5 Gbps + Dual-WAN + more CPU power and throughput. It’s a little bigger and a little more expensive, but it addresses the biggest limitations of the UXG-Lite.

This is the way I see these models and what they are meant for:

  • The Lite ($129) is for small networks with a single WAN below 1 Gbps.

  • The Max ($199) is for small to medium networks, or enthusiasts. It adds 2.5 Gbps RJ45, dual-WAN, more power, and more ports. It is a big step up from the Lite for $70 more.

  • The Pro ($499) is for medium to large networks, or those with a network rack. It offers 10 Gbps SFP+ WAN and LAN, up to 3.5 Gbps IDS/IPS, and the most power you can currently get on a standalone UniFi gateway.

As always, consider your current and future needs, the size of your network, your Internet connection speed, and what you’re going to be using the network for. You should also try to leave headroom for growth or changes if you can. If your needs or budget are low, the UXG-Lite may be enough. If you can spare the extra $70 for the UXG-Max, I think that would be money well spent.

Sometimes it helps to just see all of the specs in one view.

USG and UXG Comparison Chart

UXG-Max vs. Cloud Gateways

Stepping back and adding all of the Cloud Gateways makes things much less clear. To quickly review, from low to high in price:

  • Cloud Gateway Ultra (UCG-UItra) - $129

  • Express (UX) - $149

  • Dream Router (UDR) - $199

  • Dream Machine (UDM) - $299, but not listed in store

  • Dream Machine Pro (UDM-Pro) - $379

  • Dream Machine SE (UDM-SE) - $499

  • Dream Wall (UDW) - $999

The newest and cheapest options are the easiest to compare, so we’ll start there. They aren’t exactly the same, but if you squint both the UXG-Lite and UXG-Max have silbings, which make different tradeoffs.

Siblings: UXG-Lite and UX

The Gateway Lite and UniFi Express have similar hardware. They are the same size, with a low power, dual-core ARM-A53 base and two gigabit RJ45 ports. Neither of them support dual-WAN, and the Express doesn’t support IPS/IDS. These are the lowest power and lowest performance options.

They are different, though. The UXG-Lite is just a gateway for a self-hosted and Cloud Key network. The Express can be everything all-in-one: controller, gateway, and Wi-Fi AP. It can also be used as a normal wired or wireless mesh AP in any UniFi Network.

For $149, the Express can be everything you need for a very small and limited setup. You can only add up to 4 additional UniFi switches and APs to it. If you outgrow the Express, you can repurpose it as an access point. If you’re starting from scratch and planning to expand beyond 5 total devices, you might want to look elsewhere. If you want to start small though, the Express is a flexible and easy way to do that.

For $129, the Gateway Lite requires a CloudKey+ ($199), Official UniFi Hosting server ($29+/month), or a self-hosted installation of the UniFi Network software. It can handle gigabit speeds, but only has one WAN and one LAN port. You can use just one, or deploy them at multiple locations, and control them all centrally.

With a CloudKey+ you’ll have access to all the other UniFi Applications, and a few network features which require Ubiquiti hardware. For cloud or self-hosted networks, you can scale this setup to cover hundreds or thousands of devices over multiple sites. You can also swap out the UXG-Lite for a larger model if needed, without changing your controller.

Siblings: UXG-Max and UCG-Ultra

The Gateway Max and Cloud Gateway Ultra have similar hardware. Compared to the Lite and Express, these offer more CPU power, more interfaces, and higher limits. The UXG-Max offers full 2.5 Gbps connectivity for WAN and LAN. It is capable of 1.5 Gbps with IDS/IPS, or near line rate with it turned off. One of the four LAN ports can be remapped as a 2nd WAN, which isn’t possible on the UXG-Lite.

The Cloud Gateway Ultra can manage over 30 UniFi devices - significantly more than the Express. It’s comprimised in other ways though. It doesn’t have Wi-Fi built-in, and it’s slow internal backplane limits it to 1 Gbps of throughput, despite the 2.5 Gbps WAN port. It also doesn’t run all of the other UniFi applications, so you’d need a Cloud Key, NVR, or other hardware depending on which you want to use.

Of course, you can also consider a Dream Router, or a Dream Machine Pro, or… if you’re confused and overwhelmed, you’re not alone. Hopefully a spec comparison of all Cloud Gateway models, and all current gateways will help.

Cloud Gateway Comparison Charts

Comparison of All Current UniFi Gateways

In general, the biggest deciding factor between a UXG gateway and a Cloud Gateway is the controller. Do you want to have your controller built into your gateway, or on a separate device? There are advanatages and disadvantages to both.

Notes on Components

Both the Gateway Max and Cloud Gateway Ultra are built around the Qualcomm IPQ5322. The U7-Pro is built around the IPQ5332. In fact, most UniFi devices are built around a system-on-a-chip (SoC) from Qualcomm or MediaTek.

The IPQ5322 features many components, including a general-purpose CPU, PCIe and USB connections, and a 12-thread Network Processing Unit (NPU). The NPU offloads networking functions like routing and QoS from the CPU. Qualcomm leverages the NPU so that a faster (and more expensive) general-purpose CPU isn’t required.

While the four CPU cores within this SoC — ARM A53, clocked at 1.5 GHz — aren’t cutting-edge, this hardware isn’t old. The IPQ5322 is part of Qualcomm’s new Immersive Home 326 platform made for Wi-Fi 7 devices.

From Qualcomm’s product brief:

The Qualcomm Immersive Home 326 Platform’s specialized Packet Processing Engine offloads WAN networking and QoS traffic management, thereby freeing up powerful Quad-core Cortex-A53 Arm CPU compute to support differentiating services and applications, such as device management and control, content filters, and security features.

Powerful Quad-core CPU and specialized Packet Processing Engine provides powerful networking acceleration and QoS traffic management while offloading CPU

Dedicated Security Processing Engine ensures secure network transactions with embedded networking crypto engine, Secure Boot with root-of-trust transfer and TrustZone

Another concern I’ve seen is the 2 GB of RAM in the UXG-Max, vs. the 3 GB of RAM in the Cloud Gateway Ultra. I personally wouldn’t worry about that, since the UXG-Pro also has 2 GB, and the Cloud Gateway Ultra uses some of that extra RAM to run the UniFi Network Application. Routing and firewalling don’t require a ton of RAM.

Notes on UXG-Max… imum Throughput

The specs show up to 1.5 Gbps of IPS/IDS throughput, but how much should we expect when IDS/IPS is turned off? What is the maximum throughput of the UXG-Max?

To review, these are the advertised IDS/IPS throughput limits:

  • UX: IDS/IPS not supported

  • USG: 85 Mbps

  • USG-Pro: 250 Mbps

  • UDR: 300 Mbps

  • UXG-Lite and UCG-Ultra: 1 Gbps

  • UXG-Max: 1.5 Gbps

  • UXG-Pro, UDM-Pro, UDM-SE, and UDW: 3.5 Gbps

For the UXG-Max, according to some initial iPerf testing by arthurdent on the Community forums:

  • With DHCP, DPI, DNS Shield and Ad Blocker enabled = 2.1 to 2.3 Gbps

  • Adding IPS/IDS turned to high = 1.7 Gbps

  • Adding PPPoE = 1.4 to 1.6 Gbps

  • With PPPoE and IDS/IPS turned to high = 1.0 to 1.3 Gbps

Most features — DHCP, DPI/traffic inspection, DNS Shield for encrypted DNS, ad blocking, maybe some custom firewwall rules — can be enabled without significantly limiting throughput. PPPoE is still a significant drag on maximum throughput, as is enabling the Suricata intrusion detection and prevention “Suspicious Activity” settings. Without those, over 2 Gbps should be achievable, and multi-gigabit inter-VLAN traffic is possible as well.

Notes on Branding and Naming

I’m exhausted. Trying to explain any new UniFi product these days feels like an excercise in comparisons, contrasts, exceptions, and asterisks. Sometimes it feel like you need a cork board and some red yarn, but we all know that there is no Pepe Silvia.

I believe UniFi products themselves are not that confusing. They are easy to use. The hardware is good, the software is good, and their documentation is getting better. It’s just hard to talk about the products because the naming is inconsisent and can change over time.

Ubiquiti’s institutional love of Apple extends to their sometimes non-sensical marketing names. Why did UniFi OS Console become Cloud Gateway? Are the UXG models “next-generation” or current? Why is UXG-Max below UXG-Pro, doesn’t max stand for maximum? And what does “Ultra” mean, exactly? You can drive yourself mad trying to find answers to these questions, or you can focus on what matters.

The UXG-Max is the right gateway choice for those who:

  • Self-host the UniFi Network application or use a Cloud Key

  • Want 2.5 Gbps Ethernet and Dual-WAN

  • Don’t want or need 10 Gbps SFP+

If those don’t apply, consider the alternatives:

  • If you don’t want to self-host or use a Cloud Key — consider a Cloud Gateway

  • If you don’t want 2.5 Gbps Ethernet or dual-WAN — consider the UXG-Lite

  • If you want 10 Gbps SFP+ — consider the UXG-Pro and a full network rack installation

And some universal product purchasing advice — buy something if it is worth the price you pay for the benefits you get at the time of purchase. New and better things will always be coming. If you felt the UXG-Lite was worth $129 four months ago, but now you’re disappointed that this is available for only $70 more, I understand. I have a UXG-Lite sitting in a box right next to me as I type this. I have some other equipment too, but that’s a story for another time.

Unfortunately for those of us on the outside, we can’t read Ubiquiti’s mind. They control how they release information about current and upcoming products, and when everything happens. It would have been nice to know this was coming, but the UXG-Max is yet another gateway option. For some, it’s the right one. For now, at least.

]]>UXG-Max Preview: Modern Multi-GigUI Chat Podcast March 2024: ScreengateUbiquitiPodcastEvan McCannThu, 04 Apr 2024 14:11:41 +0000https://evanmccann.net/blog/2024/3/ui-chat-podcast-march-2024-screengate5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:660eb1898ad449084dcfada9Originally Posted: April 2nd, 2024

In case you missed it, the March 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti. This was recorded just before the UXG-Max was released, so we’ll be discussing that on the next show.

We cover the little bit of news we got from the UniFi World Congress conference in Chicago, some recent leaks, and the pricing update for the Professional Site Support. We also cover the new Ubiquiti Portal application, some new cameras and accessories, and the notable software releases we saw in March.

Most importantly, we cover the very serious issue of the Cloud Gateway Ultra screens being slightly misaligned — Screengate. Thankfully, Ubiquiti is replacing them under warranty.

UI Chat podcast March 2024: Screengate

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat Podcast Links

X (née Twitter) Links

]]>UI Chat Podcast March 2024: ScreengateUI Chat Podcast February 2024: My Not $10K SetupUbiquitiPodcastEvan McCannThu, 29 Feb 2024 22:50:02 +0000https://evanmccann.net/blog/2024/2/ui-chat-podcast-february-20245d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:65e10498bb2ce337a0365a25In case you missed it, the February 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti. This was (sorry if you’ve heard this before) yet another packed month for Ubiquiti news.

We briefly cover the EdgeRouter malware attack that was handled by the FBI, and the UniFi World Congress conference tour announcement. We also cover the new Ubiquiti hardware, including the UniFi Cloud Gateway Ultra and Ultra switches, UISP Wave Pico, Precision Rackmount Kit, and the really odd AmpliFi USB-C Charge Cable. As well as the UniFi Network 8.1.104 and 8.1.107 early access software updates, along with some Protect and techspecs.ui.com changes.

Also, there is a very special guest appearance from my cat.

She’s always there to help when I’m testing Wi-Fi equipment.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat podcast: February 2024

UI Chat Podcast Links

X (née Twitter) Links

]]>UI Chat Podcast February 2024: My Not $10K SetupAruba Instant On Comparison ChartsArubaWi-FiNetworkingComparison ChartsEvan McCannWed, 28 Feb 2024 16:15:00 +0000https://evanmccann.net/blog/2021/6/aruba-instant-on-comparison-charts5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:60bce10417c67a2cee5ffbb3Originally Posted: June 6th, 2021
Last Edited: March 9th, 2024

  • These charts compare all available Aruba Instant On switches and Wi-Fi access points, as of March 2024.
  • They are available as Images and in other mobile-friendly formats on Google Drive.
  • If you want more background on what Instant On is and my first impressions, see my Aruba Instant On Overview from a few years ago. Not much has changed besides a few new hardware options and some software improvements.

Table of Contents

  • Instant On Access Points  ↩︎
    • Wi-Fi 5
    • Wi-Fi 6/6E
  • Instant On Switches — Grouped By Series  ↩︎
    • 1430 Series
    • 1830 Series
    • 1930 Series
    • 1960 Series
  • Instant On Switches — Grouped By PoE  ↩︎
    • Non-PoE, Under 24 Ports
    • Non-PoE, 24 Ports and Up
    • PoE, Under 24 Ports
    • PoE, 24 Ports and Up
  • Instant On Switches — Grouped By Port Count  ↩︎
    • Under 16 Ports
    • 16 Ports
    • 24-28 Ports
    • 48-52 Ports

Aruba Instant On Access Points

All Aruba Instant On wireless access points, as of March 2024.

Indoor

  • AP11 (AP11) — Wi-Fi 5
  • AP12 (AP12) — Wi-Fi 5
  • AP15 (AP15) — Wi-Fi 6
  • AP21 (AP21) — Wi-Fi 6
  • AP22 (AP22) — Wi-Fi 6
  • AP25 (AP25) — Wi-Fi 6
  • AP32 (AP32) — Wi-Fi 6E

Desk/Wall

  • AP11D (AP11D) — Wi-Fi 5
  • AP22D (AP22D) — Wi-Fi 6

Outdoor

  • AP17 (AP17) — Wi-Fi 5
  • AP27 (AP27) — Wi-Fi 6, available end of March 2024
View fullsize Aruba Instant On APs - Wi-Fi 5
 Aruba Instant On APs - Wi-Fi 5 View fullsize Aruba Instant On APs - Wi-Fi 6 and Wi-Fi 6E
 Aruba Instant On APs - Wi-Fi 6 and Wi-Fi 6E
Return to Table of Contents

Aruba Instant On Switches — Grouped By Series

1430 Series Switches

The Aruba Instant On 1430 Series switches are unmanaged, and offer basic L2 connectivity

1830 Series Switches

The Aruba Instant On 1830 Series switches are managed, offering VLANs and basic L2 connectivity

1930 Series Switches

The Aruba Instant On 1930 Series switches are managed, offering VLANs, basic routing, and some L2+ features

1960 Series Switches

These model names are a little harder to decipher, but it helps to know that "XGT" means 10 Gbps RJ45, and "P2.5" means 2.5 Gbps RJ45 with PoE output.

  • 1960 12XGT 4 SFP+ (JL805A)
  • 1960 24G 2XGT 2 SFP+ (JL806A)
  • 1960 24G 2XGT 2 SFP+ PoE (JL807A)
  • 1960 48G 2XGT 4 SFP+ (JL808A)
  • 1960 48G 2XGT 4 SFP+ PoE (JL809A)
  • 1960 8G 4P2.5 2XGT 2 SFP+ PoE (S0F35A) -- A messy model name, but first with 2.5 Gbps RJ45 in addition to 10 Gbps RJ45 and SFP+

The Aruba Instant On 1930 Series switches are managed and stackable, offering VLANs, basic routing, and some L2+ features

Return to Table of Contents

Aruba Instant On Switches — Grouped by PoE

Non-PoE Switches Under 24 Ports

Non-PoE Switches, 24 Ports and Up

View fullsize Non-PoE switches, under 24 ports
 Non-PoE switches, under 24 ports View fullsize Non-PoE switches, 24 ports and up
 Non-PoE switches, 24 ports and up

PoE Switches Under 24 Ports

PoE Switches, 24 Ports and Up

  • 1830 24G 2 SFP PoE (JL813A)
  • 1830 24G 4 SFP PoE (JL815A)
  • 1930 24G 4 SFP+ 195W PoE (JL683A)
  • 1930 24G 4 SFP+ 370W PoE (JL684B)
  • 1930 48G 4 SFP+ 370W PoE (JL686B)
  • 1960 24G 2XGT 2 SFP+ PoE (JL807A)
  • 1960 48G 2XGT 4 SFP+ PoE (JL809A)
View fullsize PoE switches, under 24 ports
 PoE switches, under 24 ports View fullsize PoE switches, 24 ports and up
 PoE switches, 24 ports and up
Return to Table of Contents

Aruba Instant On Switches — Grouped by Port Count

Under 16 Ports

16 Ports

24 to 28 Ports

48 to 52 Ports

  • 1830 48G 4 SFP (JL814A)
  • **1830 24G 4 SFP PoE **(JL815A)
  • 1930 48G 4 SFP+ (JL685A)
  • 1930 48G 4 SFP+ 370W PoE (JL686B)
  • 1960 48G 2XGT 4 SFP+ (JL808A)
  • 1960 48G 2XGT 4 SFP+ PoE (JL809A)
View fullsize Under 16 ports
 Under 16 ports View fullsize 16 ports
 16 ports View fullsize 24 to 28 ports
 24 to 28 ports View fullsize 48 to 52 ports
 48 to 52 ports
Return to Table of Contents
]]>Aruba Instant On Comparison ChartsUI Chat Podcast January 2024: U7 Swiss Ultra+UbiquitiPodcastEvan McCannThu, 01 Feb 2024 15:58:02 +0000https://evanmccann.net/blog/2024/1/ui-chat-podcast-january-20245d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:65bbbf8ac563ac3891f42c04In case you missed it, the January 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

This was yet another packed month for Ubiquiti news. Ubiquiti have continued their nonstop stream of new hardware, with the U7-Pro, UK-Ultra, and UISP Switch Plus. We also talk about the 2FA changes, SolarPoint’s glorious return, the Enterprise Fortress Gateway and other upcoming hardware, UniFi Talk finally coming to the UK, and the latest software releases.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

Guest Appearance on Crossed Wires

Also, Alex and I were guests on the UniFi Appreciation Show episode of the Crossed Wires podcast. That was a fun discussion, recorded back in December 2023. We spent a lot of time talking about the UXG-Lite and UniFi Express, and how to understand UniFi’s many options and settings. Thanks for having us on, James and Jae!

UI Chat podcast: January 2024

UI Chat Podcast Links

X (née Twitter) Links

]]>UI Chat Podcast January 2024: U7 Swiss Ultra+U7-Pro Preview: Welcome to Wi-Fi 7NetworkingPreviewWi-FiWi-Fi 7Evan McCannMon, 08 Jan 2024 19:53:31 +0000https://evanmccann.net/blog/2024/1/u7-pro-preview5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:659c4118fe40e551f1244104Originally Posted: January 8th, 2024
Last Edited: January 9th, 2024

On January 8th 2023, Ubiquiti announced their first Wi-Fi 7 access point, the U7-Pro:

After years of development, we are proud to introduce UniFi 7 — a massively scalable WiFi 7 platform capable of delivering wired-like user experiences. For the first time in history, exceptional WiFi speeds and predictability can be achieved simultaneously thanks to UniFi 7’s interference-resilient radio technologies combined with an ocean of newly supported 6 GHz spectrum.

Designed specifically for professional and enterprise deployments, the U7 Pro is ideal for applications requiring flawless WiFi service within demanding large-scale environments.

In this preview we’ll take a quick look at the specs of the U7-Pro and how it compares with the U6-Enterprise and other Wi-Fi 6 models. We’ll also briefly cover what Wi-Fi 7 is, and the big features that are included in the new standard.

View fullsize WelcometoUniFi7.png
 View fullsize U7-Pro.png

U7-Pro Key Specs

  • WiFi 7 (802.11be) with 6 GHz support

  • Tri-band, two spatial streams in each band

  • Single 2.5 Gbps RJ45 uplink

  • Powered using PoE+ (802.3at)

  • Claimed 140 m² (1,500 ft²) coverage and 300+ connected devices

  • The U7-Pro is now available on the Ubiquiti Store for $189 USD

Notes:

  • 6 GHz operation is supported in these countries

  • Multi-Link Operation (MLO) capability to be provided via a software update in February 2024

Here are the specs of the U7-Pro compared with other Wi-Fi 6, 6E, and 7 UniFi APs. See my UniFi Comparison Charts for more spec comparisons.

View fullsize U7-Pro vs. Wi-Fi 6E
 U7-Pro vs. Wi-Fi 6E View fullsize U7-Pro vs. Omnidirectional Wi-Fi 6 and 6E
 U7-Pro vs. Omnidirectional Wi-Fi 6 and 6E

Is 2x2 “Pro” Enough?

Some early comments about the U7-Pro suggested it should have been called a “U7-Lite”, due to only having 2x2 MIMO, or two spatial streams per band. I see their point, because the AC-Pro offers two 3x3 radios, and the U6-Pro has one 2x2 and one 4x4 radio. Looking at it another way, all of the “Pro” models offer 6 spatial streams in total. The U7-Pro just spreads them out over 3 spectrum bands.

Although most Wi-Fi clients like phones and laptops are limited to 2x2 operation, there are many benefits to having additional spatial streams on an access point. Having 3 or 4 antennas and 3 or 4 spatial streams on the AP allows for better beamforming, gain, channel sounding, and many other benefits. Aggregate performance should be better with more spatial streams (and frequency bands!) available for clients.

In the end, “Pro” is a marketing term. It can mean whatever Ubiquiti want it to mean.Traditionally, "Pro" means that it is in the middle of the class. For APs you have Lite, Plus, and Long-Range models below, and XG, HD, or Enterprise models above.

The price, specs, and performance are what matters. The U7-Pro is priced, and will likely perform, in line with its name when the rest of the U7 lineup arrives. I assume they will cut down on channel width, TX power, or something for cheaper models, and add TX power, antenna gain, better components, RGB laser beams, and lord knows what else in the models above.

We’ll have to wait for the rest of the U7 models to be released before we can know. I would assume a U7-Lite will exist at some point, and it will be cheaper and offer less in some way. I also assume a U7-Enterprise will come out, for those that want the highest-end possible. If you don’t think the U7-Pro offers enough, wait for additional U7 models or vote with your wallet and buy something else.

Ubiquiti’s U7-Pro FAQ

As part of the announcement post, they answered some frequently asked questions:

Can I install U7 Pro using an existing AP mounting plate?

U7 Pro uses the AP Professional Mounting System. It can be installed using the same metal mounting plate as the following AP models:

  • U6-Enterprise

  • U6-Pro

  • U6-LR

  • UAP-AC-Pro

  • UAP-AC-HD

  • UAP-AC-SHD

  • UAP-AC-XG

What do I need to run U7 Pro?

  • U7 Pro is managed with UniFi Network 8.0.26 and later.

  • U7 Pro is powered by PoE+ with a 2.5 GbE uplink. We recommend pairing U7 Pro with a UniFi PoE switch that features 2.5 GbE performance and PoE+ output, such as Pro Max and Enterprise PoE switches.

  • U7 Pro is fully backward compatible with WiFi 6E and earlier client devices. A WiFi 6E or WiFi 7 client device is required to utilize the 6 GHz band.

Can I customize the appearance of my U7 Pro?

Yes, a fully customizable cover will be available in the second quarter of 2024 for U7 Pro.

View fullsize u7-pro-1.png
 View fullsize u7-pro-4.png
 View fullsize u7-pro-5.png
 View fullsize u7-pro-6.png

What is Wi-Fi 7?

Wi-Fi 7 is the latest generation of Wi-Fi. As with most technologies, a bigger number = better. Wi-Fi 7 isn’t that simple though.

The underlying standard is known as 802.11be, and work on Wi-Fi 7 officially started back in May 2019. The main goal of Wi-Fi 7 is to increase throughput, reduce latency, and leverage all of the available spectrum, ranging from 1 GHz up to 7.25 GHz.

The initial draft of the Wi-Fi 7 standard landed in March 2021, and the Wi-Fi Alliance launched the Wi-Fi 7 certification program on January 8th, 2023. Manufacturers started producing their first products years ago, based on early draft versions of the standard, just like they did with Wi-Fi 6 and past major revisions. Qualcomm, Broadcom, and TP-Link have been aggressive with rolling out early hardware, and now Ubiquiti and the rest of the industry have joined them.

Key Wi-Fi 7 features

  • 320 MHz bandwidth and more efficient utilization of non-contiguous spectrum
  • Increases maximum modulation to 4096-QAM (4K-QAM)
  • Multi-band/multi-channel aggregation and operation, including contiguous and non-contiguous 320/160+160 MHz and 240/160+80 MHz bandwidth
  • 16 spatial streams and Multiple Input Multiple Output (MIMO) protocol enhancements
  • Multi-Access Point (AP) Coordination (e.g. coordinated and joint transmission)
  • Enhanced link adaptation and retransmission protocol (e.g. Hybrid Automatic Repeat Request (HARQ))
  • Frame formats with improved forward compatibility
  • Enhanced resource allocation in OFDMA
  • Reduces airtime consumption with optimized and implicit channel sounding, and a more flexible preamble puncturing scheme
  • Supports direct links, managed by an access point.
  • Integrates Time-Sensitive Networking (TSN) IEEE 802.1Q extensions for low-latency real-time traffic

The Goals of Wi-Fi 7

One of the big themes of Wi-Fi 7 is the same as most new generations of Wi-Fi: how can we make it faster and more reliable?

Until now, Wi-Fi has increased speed and capacity by:

  • More complicated modulation to send more data at once
  • Wider channels to use more spectrum
  • MIMO to use multiple antennas at once

Unfortunately, we are reaching to point of diminishing returns with increases in modulation, channel width, and MIMO. Despite this, Wi-Fi 7 still pushes those forward, increasing maximum modulation to 4096-QAM, channel width to 320 MHz, and MIMO up to 16 spatial streams. The numbers are bigger than ever, but that’s not enough.

4096-QAM offers at most a 20% increase over 1024-QAM, but both of them only work over short distances, in ideal conditions. They require such a high signal-to-noise (SNR) that they are only attainable within a few feet of an AP. Higher data rates deliver more data but are less reliable, so clients need to balance between speed and reliability.

Wide channels have been a big topic since the introduction of Wi-Fi 6E and the addition of 1200 MHz of spectrum in the 6 GHz band. Wi-Fi 7 increases the maximum channel size to 320 MHz, compared to 160 MHz in Wi-Fi 5, 6, and 6E. Double the spectrum equals double the data rates and double the potential throughput. It also doubles the noise and chance for interference, making them challenging to use in real-world networks, particularly those with a lot of clients or density. 320 MHz channels aren’t supported in many countries yet either, but availability will continue to expand.

Wi-Fi 7 will permit up to 16 spatial streams, but those will require large antenna arrays, more expensive internals, and a ton of power. If history is anything to go by, MIMO beyond 4 spatial streams is unlikely to be found in anything beyond high-end access points, and most clients are likely to stay with 2 spatial streams.

With these increases costing more and delivering less, new techniques are needed to see big gains in performance. Wi-Fi 7 does this in several ways, but one of the biggest is with Multi-Link Operation.

Multi-Link Operation (MLO) allows for the aggregation of multiple bands or channels. With MLO, Multi-Link Devices (MLDs) can simultaneously use the 2.4GHz, 5GHz, and 6GHz bands. This can be in the form of load balancing, or aggregation. This allows for higher overall speeds, and reduced latency and congestion for all connected clients.

In previous Wi-Fi standards, clients connect to one band at a time and can switch between them. This introduces overhead when changing frequencies, leading to delays and precious milliseconds being wasted. When load balancing, a client can choose the fastest or least busy channel. With aggregation, latency can be as low as 1 ms when switching bands. This should improve performance overall, especially in real-time audio, video, or gaming applications.

There are several different types of MLO, including:

  • Multi-link single radio (MLSR) which can transmit and receive over one radio at a time
  • Enhanced MLSR (eMLSR) which enhances MLSR with a reduced function radio to choose the best link
  • Nonsimultaneous TX and RX multi-link multi-radio (Non-STR MLMR), which can transmit and receive over 2 or more radios, but with time and frequency separation constraints
  • STR MLMR, which can simultaneously transmit and receive over 2 or more radios

A Splash of Cold Water

There are many other details about MLO that I didn't cover here, and many other features of Wi-FI 7 that address issues and increase performance. The new features in Wi-Fi 7 are exciting, but for now, they are mostly a technical curiosity. I am excited to watch the continued development and rollout of Wi-Fi 7, and get my hands on a U7-Pro to do some testing.

While Wi-Fi 7 is in its early adopter phase, we are going to see a lot of hype and marketing designed to make us think we need it, and we need it right now. I’ll never agree with that mindset, especially when it comes to Wi-Fi standard revisions.

For the vast majority of users, Wi-Fi 5 and Wi-Fi 6 offer more than enough speed and reliability. For the applications most of us use, on the devices most of us have, we’re not going to see a massive jump in experience. What excites me the most is projecting into the future, when multi-link and Wi-Fi 7 become common.

Progress is good, but with all things Wi-Fi, patience is rewarded. Don’t rush out and get the first Wi-Fi 7 equipment you see, let the standard come down to you. That being said, it’s always fun to look out to the edge of the wireless frontier. Welcome to Wi-Fi 7.

References and Further Reading

]]>U7-Pro Preview: Welcome to Wi-Fi 7UXG-Lite Review: Monkey’s Paw GatewayUbiquitiReviewComparisonNetworkingEvan McCannSat, 06 Jan 2024 13:30:00 +0000https://evanmccann.net/blog/2024/1/unifi-uxg-lite-review5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:657fd1303182b30fc6e9e040Originally Posted: January 6th, 2024
Last Edited: January 9th, 2024

TL;DR:

  • The UXG-Lite is a new USG-style gateway for a Cloud Key or self-hosted UniFi network

  • One gigabit WAN, one gigabit LAN, and all the IPS/IDS you want for $129 US

  • VPN performance is limited, usually to under 100 Mbps

  • Seriously, TL;DR: this review is long. Don’t say I didn’t warn you.

Table of Contents

  • Specs and Components ↩︎
  • Defining UniFi Terms ↩︎
  • First Impressions ↩︎
  • Unboxing and Setup ↩︎
  • UniFi Gateway Features ↩︎
  • USG and UXG Differences ↩︎
  • Routing and VPN Speed ↩︎
  • OpenSSL Speed Benchmarking ↩︎
  • Dual-Core Drama and Crypto Offloading ↩︎
  • Monkey's Paw Gateway ↩︎

UXG Lite Spec Review

As I covered in my UXG-Lite Preview, Ubiquiti describes the Gateway Lite (UXG-Lite) as a compact and powerful UniFi gateway with a full suite of advanced routing and security features, ideal for smaller networks.

Hardware

  • SoC/Chipset: Qualcomm IPQ5018

  • CPU: Dual-core ARM Cortex A53 at 1 GHz

  • RAM: 1 GB DDR3L

  • Management interfaces: Ethernet, Bluetooth 5.1

  • Networking interfaces

    • (1) 1 Gbps RJ45 WAN

    • (1) 1 Gbps RJ45 LAN

  • Power Input: USB type C (5V/3A), power adapter included in box

  • Max consumption: 3.83W

  • Dimensions: 98 x 98 x 30 mm (3.9 x 3.9 x 1.2")

Context and Components

The main component of the UXG-Lite and its sibling the UniFi Express is the Qualcomm IPQ5018, from their Immersive Home 216 platform. It is the chipset or system-on-chip (SoC) that both are built around. It combines multiple parts into a single board designed for networking devices.

The IPQ5018 in the UXG-Lite features a dual-core 1 GHz ARM Cortex A53 CPU, 1 GB DDR3L RAM, and a single-core, 12-thread network processing unit (NPU) for offloading functions such as NAT. If you added some interfaces, radios, and a case, you could sell it on AliExpress, or do what many companies have done, and build a consumer networking product around it.

The Cortex-A53 is a relatively old ARM core design. It launched in 2012, and has been used in everything from budget smartphones to the Nintendo Switch and the Raspberry Pi 3B. Old CPU core designs aren’t the whole story though. The Qualcomm NPU handles networking functions like NAT. Also, ARM hardware acceleration helps process crypto operations for VPNs.

Altogether, the components inside the UXG-Lite are just enough for gigabit routing, but VPN throughput is weak. I’ll cover the performance impact more in the speed testing section below.

Return to Table of Contents

Defining UniFi Terms

Before we go any further, we need establish our marketing to English translation. I already attempted to simply explain UniFi Gateways, so I’ll keep this short.

  • UniFi networks are “software-defined” meaning the hardware and software are separate.

  • A UniFi “gateway” is a router AKA firewall AKA layer 3 network appliance. Whatever you call it, it acts as the traffic cop between local networks and the Internet.

  • Switches expand a wired network, and wireless access points (APs) convert wires into Wi-Fi.

  • A UniFi “controller” is a general term for anything that runs the UniFi Network application, the software that manages everything.

The UXG-Lite is a “UniFi Gateway” and it is… just a gateway. It doesn’t have built-in Wi-Fi or additional switch ports, and it doesn’t host any UniFi applications. You need a separate controller to manage a UXG-Lite. You can use a hardware Cloud Key or download the software for free and run it on your computer, server, or cloud service.

The alternative is a UniFi OS Console or Cloud Gateway. The Dream Router (UDR) is a UniFi Cloud Gateway because it acts as a gateway and a controller. All Cloud Gateways are controllers, run UniFi software, and manage themselves. Cloud Gateways can’t be used together with a Cloud Key, self-hosted controller, or a UXG-Lite.

The important thing to remember from this marketing madness is that a UXG can’t stand alone. It needs a separate UniFi Network controller. Use your own hardware, buy a Cloud Key, or rent one from Ubiquiti starting at $29/month.

It is also worth noting that Ubiquiti has confirmed more UXG models are coming.

To be clear: UniFi Express is not a direct successor to the USG. For that, consider the UXG Lite - which is an independent gateway similar to the USG. There will be additional products in the UXG series available in the future to complement the currently available Lite and Pro models

That could mean a new top-of-the-line UXG Enterprise, or something in the middle of the Lite and Pro. It could mean both, eventually. For now, we’ll focus on the hardware options we currently have.

Return to Table of Contents

UXG-Lite First Impressions

First, the ugly: The UXG-Lite has only two gigabit Ethernet interfaces. One WAN, one LAN. The old USG has a 3rd interface which can be assigned as a 2nd WAN or a 2nd LAN. The new UXG-Lite doesn’t. If you need more than two interfaces or more than gigabit speeds, consider the $499 rackmount UXG-Pro, a Cloud Gateway, or another vendor.

The Gateway Lite does technically support the LTE Backup or LTE Backup Pro as a secondary Internet connection. These attach to a LAN switch port, and the UniFi Network software automatically tunnels and configures them to act as a backup cellular WAN. In the US these are locked to AT&T, and require a $15/month for 1 GB of data plan, plus $10 for each additional GB. This may be an option for some, but the lack of 3rd port is limiting.

The UXG-Lite lives up to its “Lite” status, but it’s not all bad. The actual hardware is small, silent, and pretty nice. It has a white, soft-touch plastic enclosure and an LED on the front for status. It supports all of the latest UniFi features, and claims to support gigabit routing, including with Suricata IDS/IPS enabled. More on that later.

USB-C input for power is a welcome change, but the lack of mounting holes is not. Ubiquiti will happily sell you a magnetic Floating Mount for $29. You can also 3D print one, get creative, or just find something flat to place it on top of.

Moving beyond hardware, there are many software features on a UXG that are not present on the USG. Most of the routing and security features added to UniFi gateways over the past few years are on the UXG-Lite, and very few are on the USG. It’s time to boot them up and compare them.

Return to Table of Contents

Initial Setup

As with other UniFi devices, you can use the mobile app or desktop web interface for setup. For devices like the UXG-Lite that have Bluetooth, initial setup with the UniFi mobile app is usually the easiest. If you have an existing network running on a Cloud Key or self-hosted controller, it might be easier to use the desktop interface.

This is a quick look at the setup process, with UniFi Network version 8.0.26 and UXG Lite firmware 3.1.16. It will help you connect to your ISP and guide you through the first time setup process. If you have multiple controllers or UniFi sites, select the appropriate one, hit next a few times, and that is about it.

Setting up the UXG-Lite with the mobile app

There is a similar process in the desktop web interface. One way to use that is to plug a computer into the LAN port of the UXG-Lite, and navigate to the default IP of 192.168.1.1 in a web browser. You’ll see a few options for manually connecting to a controller, signing into your ui.com account, and changing WAN settings to get connected.

After it’s adopted, you’ll need to use the Network application for everything else. The UXG-Lite doesn’t have the bare bones post-adoption web interface the USG has, only a “Setup Complete!” message and link to unifi.ui.com.

View fullsize The post-setup web interface for the UXG-Lite
 The post-setup web interface for the UXG-Lite View fullsize The post-setup GUI on a USG, which lets you configure a few settings and view status
 The post-setup GUI on a USG, which lets you configure a few settings and view status

Setup is less straightforward if you have an existing UniFi network and gateway. UniFi Network sites can only have one gateway at a time. Before doing anything, take a backup, and see if you need to install any updates.

For those migrating from a USG or USG-Pro, you have to remove them first. Then you’ll be able to adopt the new UXG-Lite to take it’s place.

For those migrating from a Dream Machine or Cloud Gateway, you’ll want to setup your new controller first. Import your UniFi Network backup, remove the old, offline gateway if needed, then adopt the UXG-Lite. If you get stuck, try using the UXG’s initial setup web interface to point it in the right direction.

After the gateway shuffle is complete all of your network, security, and firewall settings will be applied. Anything custom you’ve changed in the config.gateway.json file on your USG will not carry over. None of the current UniFi gateways support that backdoor for custom configuration tweaks, everything lives in the GUI.

Return to Table of Contents

UniFi Gateway Features

There are a couple of ways to look at the features of the UXG-Lite. The spec sheet lists them out if you just want a quick overview. For those looking at migrating to a UXG from an EdgeRouter or another vendor, it’s worth looking at the current state of networking features for UniFi gateways as a whole. This is a (mostly) complete list of what you’ll get with UniFi at layer 3. As always, asterisks apply.

WAN Networking Features

  • IPv4 - DHCP, PPPoE, DS-Lite, or static

  • IPv6 - SLAAC, DHCPv6, or static

  • DHCP client options and Class-of-Service (CoS)

  • VLAN ID

  • MAC address clone, for dealing with MAC address authentication from your ISP

  • Smart Queues, for automated QoS on connections under 300 Mbps

  • UPnP

  • Dynamic DNS

LAN Networking Features

  • Virtual networks (VLANs) for segmenting traffic, up to 255 on most devices

  • DHCP server, relay, snooping, and guarding

  • IPv6

  • Multicast DNS

  • Content filtering (Work or Family) for restricting explicit or malicious content

  • Spanning Tree (STP, RSTP) and Ubiquiti’s proprietary Loop Prevention

  • Network Isolation

  • IGMP Snooping and IGMP Proxy

  • Jumbo Frames, Flow Control, and 802.1X control

  • VLAN Viewer, Radio and Port Manager, which are new ways to visually configure VLANs, ports, and assess Wi-Fi performance.

Security

  • Device and traffic identification for clients on your network

  • Country restrictions to block public IPs or web traffic by region

  • Ad blocking and DNS Shield — encrypted DNS over HTTPS (DoH)

  • Internal Honeypot to help detect malicious devices

  • Suspicious Activity (Suricata) — previously known as Intrusion Detection or Prevention (IDS/IPS)

  • Port forwarding

  • Traffic Rules for policy-based routing. They allow you to block, allow, or speed limit applications, domains, IP addresses, or regions on a per-device or per-network basis.

  • Manual firewall rules

Routing

  • Static routes

  • Traffic Routes, another newer feature that allows you to route specific traffic to a VPN or WAN interface. This can be for a single device or an entire LAN network. Together with Traffic Rules, it is UniFi’s solution for policy-based routing.

VPN Options, generally:

  • VPN Servers: Wireguard, OpenVPN, L2TP

  • VPN Clients: Wireguard, OpenVPN

  • Site-to-site VPNs: OpenVPN, IPsec

VPN Options with Asterisks*

  • *These aren’t supported when using a UXG Lite/Pro with a self-hosted controller. They require either Ubiquiti’s $29/month-and-up official UniFi Hosting service or a hardware Cloud Key.

  • Site Magic, an automatic site-to-site option available on unifi.ui.com for those with multiple UniFi sites and multiple Cloud Keys or Cloud Gateways

  • Teleport, which is Wireguard with a QR code scanning setup process

  • Identity one-click VPN, which is part of the new UniFi Identity application and subscription service. This is not supported on official UniFi Hosting, only Cloud Keys and Cloud Gateways.

Return to Table of Contents

USG and UXG Feature Differences

They are old, but the USG and USG-Pro are still supported by current UniFi software. They continue to get occasional firmware updates, mostly for security flaws and small component updates. The last one was v4.4.57 in January 2023, for reference.

Even with the latest Network application version, USGs don’t support most of the new features like Wireguard, Traffic Rules, or Traffic Routes. You’ll only find those on a UXG or Cloud Gateway. Some features that are supported on both USGs and UXGs can have differences, so lets go through all of them.

Top to bottom: UXG-Lite, USG, and Cloud Key Gen 2 Plus

The USG doesn’t have:

  • Wireguard server or client, OpenVPN client, Teleport, Site Magic, or Identity VPN options

  • Content Filtering

  • WAN MAC Address clone and WAN DHCP Client Options

  • Device Identification

  • Ad blocking

  • Internal Honeypot

  • Traffic Rules and Traffic Routes

  • WiFiman

  • The new port and VLAN viewer, as well as port insights

  • IGMP Proxy

You can also look at the same thing in reverse. There are some older features or things you can do with a USG that you can’t with a UXG-Lite. Besides the obvious limitation of a single WAN port, these are mostly older options that have been replaced or made obsolete.

The few others that are missing, like SNMP monitoring, will hopefully be added in upcoming firmware updates. It’s possible they never will be though, and you should never buy a product based on the hope that a missing feature will be added.

The UXG doesn’t have (at least not yet):

  • SNMP monitoring

  • DNS Shield (DNS Shield added in v3.2.11)

  • Loop Prevention (Loop Prevention added in v3.2.11)

  • LLDP

  • The legacy PPTP VPN option

  • Hardware offloading settings

  • The “Traffic Restrictions” system from USG became Traffic Rules

  • IPv6 RA Valid Lifetime and Preferred Lifetime

  • Firewall Options: broadcast ping, receive redirects, send redirects, SYN cookies

  • The ability to edit the config.gateway.json file for custom configuration changes

Return to Table of Contents

Routing and VPN Speed Tests

One of the most common complaints about the USG and USG-Pro are the performance limitations. The USG has a weak CPU with optional hardware offloading, which moves some cryptographic and networking tasks onto dedicated hardware. With offloading enabled, gigabit performance is possible. The downside is that you can’t enable offloading and Suricata IDS/IPS at the same time.

For IDS/IPS, you have to disable the USG’s hardware offloading, dropping performance below gigabit. Performance drops even further with IDS/IPS enabled, usually below 100 Mbps on the USG, and maybe 2 or 3 times that on the USG-Pro. This also affects inter-VLAN routing and VPN traffic. This is one of the main reasons people have been asking for an updated model for so long.

There's good news there. The UXG-Lite can handle gigabit IDS/IPS.

Routing vs. Switching

It’s worth briefly covering what routing is versus switching. Let’s look at a hypothetical example of a UXG-Lite connected to a 2.5 Gbps switch with two PCs connected.

If they’re in the same VLAN or network, traffic from PC1 to PC2 just passes into and out of the switch. The UXG-Lite doesn’t have any work to do at layer 3. That traffic is being switched, and forwarded directly. Traffic from PC1 goes directly to PC2. TCP throughput should be around 2.3 or 2.4 Gbps, due to normal TCP and Ethernet overhead.

If you moved PC2 to another VLAN or network, the traffic has to be routed. Packets from PC1 will go to the switch, then to the UXG-Lite, then back to the switch, and then PC2. PC1 has to rely on it’s gateway to escape the network it is on, and reach PC2.

Even though PC1 and PC2 are connected to the same physical switch, if they’re on separate networks, you need a router to be involved. Traffic from PC1 can’t go directly to PC2. The UXG-lite has to coordinate the dance of electrons, and the routing performance of the UXG-Lite comes into play. All devices on the switch will share a single full-duplex gigabit link to their gateway. TCP throughput should be around 940 Mbps, due to normal TCP and Ethernet overhead.

With that out of the way, onto the numbers!

iPerf Speed Test Results

iPerf is an open-source tool that allows you to synthetically test the performance of a network. For these results, I ran three tests in each direction and averaged out the results. This isn’t a guarantee of performance in your network, this is what I got with my test devices, on a mostly idle USG, UDM, and UXG-Lite. Real-world results will vary.

After spending too much time trying different iPerf versions and options, I settled on using iPerf3 with the following settings for all of my tests:

iperf3 -c -i 10 -O 10 -t 90 -P 10 -w 2M -R

This means I’m using iPerf3, as a client, with interim reports shown every ten seconds. I’m omitting the first 10 seconds of the test to account for TCP windowing and slow starts, and then running the test for 80 seconds. There are 10 parallel TCP streams on a single thread. I added the -R option on half of my tests to reverse the direction and choose if my iPerf server would be either sending or receiving.

Routing Speed

UXG-Lite

  • Same LAN (switching): 940 Mbps

  • InterVLAN routing: 927 Mbps

USG with hardware offload enabled

  • Same LAN (switching): 939 Mbps

  • InterVLAN routing: 924 Mbps

USG with hardware offload disabled

  • Same LAN (switching): 937 Mbps

  • InterVLAN routing: 107 Mbps

UDM

  • Same LAN (switching): 941 Mbps

  • InterVLAN routing: 936 Mbps

As expected, the USG with offloading disabled struggles, but they’re all capable of line-rate performance otherwise. Next, we’ll enable “Suspicious Activity” and see how much Suricata slows them down.

Routing Speed with Suspicious Activity Enabled

UXG-Lite

  • IPS/IDS off: 941 Mbps

  • IPS/IDS on auto: 942 Mbps

  • IPS/IDS on high: 941 Mbps

USG

  • Offload on, IPS/IDS off: 937 Mbps

  • Offload off, IPS/IDS off: 107 Mbps

  • Offload off, IPS/IDS on (low): 87 Mbps

  • Offload off, IPS/IDS on (high): 83 Mbps

UDM

  • IPS/IDS off: 941 Mbps

  • IPS/IDS on auto: 942 Mbps

  • IPS/IDS on high: 941 Mbps

As promised, the UXG-Lite can achieve gigabit IDS/IPS. Judging by how much CPU and RAM usage goes up, that might not always be the case. Real-world networks can get messy, and the hardware seems to be just barely pulling it off. Performance will vary based on sender and receiver, other clients, TCP, and a bunch of other factors.

Generally speaking though, for those with gigabit WANs, enabling the suspicious activity setting won’t slow you down.

VPN Throughput Results

The last set of testing was the most disappointing, and required the most research and explanation. I am not an expert on Linux, cryptography, and low-level hardware. Focusing on what matters: this is where you see the limitations of the UXG-Lite hardware.

Also worth noting:

  • IPsec is a complex kernel-layer protocol suite with many encryption and hashing options in UniFi. I tested with AES-128 and SHA1.

  • AES and other common cryptographic functions can be offloaded onto dedicated hardware, but high performance usually requires high-end components or custom ASICs. You won’t find either of those in UniFi devices.

  • OpenVPN is a TUN/TAP solution using TLS. It’s easier to administer, but with OpenVPN packets must be copied between kernel and user space, reducing performance.

  • Wireguard is the simplest, and doesn’t rely on hardware acceleration. It relies on the good performance of vector math on just about any modern CPU.

iPerf is one way to benchmark, but it’s not always representative of real-world results. I like how Netgate markets their similar SG1100 ($189, dual-core A53) appliance using iPerf3 and IMIX, which is meant to represent complex voice, data, and video traffic.

Netgate 1100 (top row), 2100, and 4200 comparison table

iPerf VPN Results

USG with offloading on and IPS/IDS off

  • IPsec: 20 Mbps

  • OpenVPN: 10 Mbps

  • L2TP: 35 Mbps

USG with offloading off and IPS/IDS off

  • IPsec: 16 Mbps

  • OpenVPN: 9 Mbps

  • L2TP: 24 Mbps

USG Offloading off, IPS/IDS on Auto-Medium

  • IPsec: 14 Mbps

  • OpenVPN: 9 Mbps

  • L2TP: 24 Mbps

UXG-Lite

  • IPsec: 43 Mbps

  • OpenVPN: 24 Mbps

  • L2TP: 19 Mbps

  • Wireguard: 99 Mbps

UDM

  • OpenVPN: 223 Mbps

  • L2TP: 153 Mbps

  • Wireguard: 602 Mbps

Return to Table of Contents

OpenSSL Speed Benchmarking

I can’t test every hardware configuration, and I don’t have multiple units of every model for true site-to-site results. A standardized, repeatable way to measure cryptography performance from model to model would be useful. Thankfully, the OpenSSL Speed command is one way to do that, and test the raw cryptography power of a system.

These results do not represent what you can expect in a real-world network, but it is a level playing field for comparisons. This also let me gather data from some helpful folks that have hardware I don’t have. It also let me put in some silly data points, like my U6-Pro, and some comparisons to higher-end components, like the M1 Pro inside my MacBook, and the Ryzen 7800X3D in my gaming PC. You can also compare them against other public results, like these Raspberry Pi OpenSSL benchmarks from pmdn.org.

For UniFi routers, we can condense the results a bit. The UXG-Pro, UDM-Pro, UDM-SE, and UDW all share the same heart: an Annapurna Labs AL-324 CPU. The UXG-Pro has half the RAM and there are other small differences, but the results I gathered are within margin of error from each other. I’ll just be showing the UXG-Pro from this group.

I didn’t test every cipher, I focused on MD5, SHA-1, SHA-256 and 512, and AES-128 and 256. Lastly, I included ChaCha20-Poly1305. Besides having a delightfully quirky name, it’s the encryption protocol Wireguard uses.

With these numbers you can make the UXG-Lite look really powerful. You can also make it look underwhelming.

View fullsize UXG-Lite versus USG and low-end models
 UXG-Lite versus USG and low-end models View fullsize UXG-Lite versus UXG-Pro and high-end CPUs
 UXG-Lite versus UXG-Pro and high-end CPUs

More importantly, since we’re talking about routing and VPNs, you can see the stark difference between the ARM models and the non-ARM models in MD5 and SHA, and in AES and Wireguard.

View fullsize UXG-Lite MD5 and SHA comparison
 UXG-Lite MD5 and SHA comparison View fullsize UXG-Lite AES and Wireguard Comparison
 UXG-Lite AES and Wireguard Comparison
Return to Table of Contents

Dual-Core Drama and Crypto Offloading

Let’s pull back to what we’re hear to talk about: VPNs, networking, and routing performance. The UDM and UXG-Pro are more capable than the UXG-Lite, and that comes down to two things. The UDM has four ARM A57 cores at 1.7 GHz, the UXG-Lite has two ARM A53 cores at 1.0 GHz. Just based on core count, speed, and power consumption alone, the UXG-Lite has a lot less power for cryptography. This results in much lower VPN throughput.

The Cortex A53 has ARMv8 crypto extensions to allow hardware offload, but they to be licensed. On low-end components without a license like in the Raspberry Pi, encryption is done in software by the CPU. Judging by the performance and the output of the lscpu command, I’m assuming the UXG-Lite has these licensed and enabled. There’s just only so much you can do with less than 4W of power available.

WireGuard is an efficient software-only protocol that can't be hardware-offloaded by design. Unlike OpenVPN, Wireguard supports multi-threading. With only 2 cores and other services to run, the UXG-Lite still struggles with it, but it’s better than IPsec and OpenVPN. For those looking to have a simple remote or site-to-site VPN, the UXG-Lite is good for that. Just don’t expect it to go beyond 100 Mbps or support a lot of simultaneous users.

The older processor, small case, and low-power design keep the UXG-Lite from being a VPN powerhouse. You’re not going to get great VPN performance from something this small, or this cheap. Set your expectations accordingly.

UniFi Gateway Lineup Overview

Now that we’ve covered specs, setup, and performance, it’s time for a broader view. Where does the UXG-Lite fit in?

As I covered before, there are two types of UniFi gateway firewalls. There are standalone, independent USGs and UXGs, and then there are Cloud Gateways. Gateways like the UXG-Lite require something else to run the UniFi Network application, whereas the Cloud Gateways like the UniFi Dream Machine run the application and manage themselves.

Comparison of the UniFi USG and UXG gateways

Return to Table of Contents

UXG-Lite: Our Monkey’s Paw Gateway

As a whole, I think the UXG-Lite is a good product. I’m glad we finally have a good entry-level gateway option again. That said, the UXG-Lite isn’t without limits or problems. A few can be addressed in software updates, but a software update can’t add an interface or increase hardware power. If the UXG-Lite sticks around as long as the USG did, it might look just as embarrassing as the performance of the USG does now.

In 2019, the Dream Machines (UDM and UDM-Pro) were introduced. They were new and exciting all-in-one options with some rough software edges. The biggest negative was that they couldn’t be adopted by a self-hosted controller or Cloud Key. They couldn’t be used in centralized multi-site deployments, which is how a lot of people used UniFi. The Dream Machines represented a change of direction, and the future of multi-site support and self-hosted controllers wasn’t always clear.

What users have wanted since then was simple: a new USG. Something that can be a drop-in replacement, without forcing them into an all-in-one. Over four years later, here it is. The UXG-Lite is the new USG we’ve been waiting for, but it’s not everything we’ve hoped it could be. It feels like the result of a monkey’s paw wish.

“Be careful what you wish for, you may receive it." -Anonymous

For those specifically upset about Suricata IDS/IPS limiting throughput, they got what they wanted. The UXG-Lite has just enough hardware to satisfy that need for gigabit networks. Performance can dip below gigabit speeds with complicated rule sets and other factors, and there isn’t much overhead. It’s as if they made the cheapest and smallest box to satisfy that specific need, and to their credit, they achieved that.

What they didn’t achieve is a bit more subjective. Every product requires compromise. It can’t have every feature and a low price. The smallest and cheapest models always require tradeoffs, and they have to lack some things that more expensive models have.

For the Gateway Lite, Ubiquiti chose to compromise on VPN throughput and the quantity and speed of the networking interfaces. They prioritized low cost, low power, and a small size. It does deliver more performance than the USG, and includes most of the modern UniFi features though. This tier is never going to be a VPN or firewall workhorse though, because those require better hardware, more power, and more money.

For many, the UXG Lite is a glass of ice water in hell. Many bought it as soon as they could, thankful for anything that was able to replace their USG or allow them to build the style of the network they wanted with a self-hosted or Cloud Key controller. Now that we’ve had some time to test, digest, and reflect, I’m still mostly positive about the UXG-Lite. I’ve harped on the limitations and downsides enough.

It’s easy to see something about the UXG-Lite you’d want to change. Maybe it’s adding a 3rd interface to use as a WAN or LAN. Some might begrudge the lack of 2.5 Gbps Ethernet. Some might wish VPN performance was higher. Some might wish they could still make custom configurations changes. Some are rightfully annoyed you need to buy a $29 accessory to mount it on a wall.

Maybe it’s the fact that the UXG-Lite could be so much more if just a few things were different. If you’re like me, you can hold on to hope that a no-adjective UXG, UXG-Plus, or some other future model is coming with more features, higher performance, and however much more cost that will require. I bet we’ll still need an accessory to wall-mount it though.

]]>UXG-Lite Review: Monkey’s Paw GatewayUniFi Express Preview: Flexible and Mesh-ableUbiquitiPreviewNetworkingWi-FiComparisonEvan McCannTue, 05 Dec 2023 17:17:00 +0000https://evanmccann.net/blog/2023/12/unifi-express-preview5d3c73c906ac510001158d1b:5d3ce1b3c7eca3000148d88d:6567f082f333c240b0386f1bOriginally Posted: December 5th, 2023

TL;DR:

  • The UniFi Express (UX) is another new gateway from Ubiquiti, and the cheapest and easiest way to start a UniFi Network.

  • The UX is a Cloud Gateway — it acts as a UniFi Network controller, gateway, and Wi-Fi 6 access point. You can add up to 4 more for a mesh-style network, or repurpose them as access points in any UniFi network.

  • The Express is for sale for $149 in the US, and availability in other regions is coming soon.

UniFi Express Preview: Flexible and Mesh-able

UniFi Express Tech Specs

From the Ubiquiti store page for the UniFi Express:

Powerfully compact UniFi Cloud Gateway and WiFi 6 access point that runs UniFi Network. Powers an entire network or simply meshes as an access point.

  • Built-in WiFi 6 (2x2 MIMO)

  • 140 m² (1,500 ft²) single-unit coverage

  • 60+ connected WiFi devices

  • (1) 1 Gbps RJ45 WAN port

  • (1) 1 Gbps RJ45 LAN port to extend network

  • 0.96" LCM status display

UniFi Express Preview: Flexible and Mesh-able

Mechanical and Physical

  • Dimensions: 98 x 98 x 30 mm (3.9 x 3.9 x 1.2")

  • Weight: 302 g (10.7 oz)

  • Enclosure materials: Polycarbonate

  • Operating temperature: -10 to 45° C (14 to 113° F)

  • Operating humidity: 5 to 95% noncondensing

  • Certifications: CE, FCC, IC

Hardware and Power

  • Networking interfaces

    • (1) 1 Gbps RJ45 WAN port

    • (1) 1 Gbps RJ45 LAN port

  • Management interface: Ethernet, Bluetooth

  • Power method: USB type C (5V DC/3A)

  • Max. power consumption: 10W

  • LCM display: 0.96" status display

  • Processor: Qualcomm IPQ5018 — Dual core ARM A53 @ 1 GHz

  • Memory information: 1 GB DDR3L

Wi-Fi Specifications

  • 2.4 GHz Radio

    • Max TX power: 22 dBm

    • Antenna gain: 4 dBi

    • MIMO: 2x2 (DL/UL MU-MIMO)

    • Max channel width: 40 MHz

    • Maximum PHY (Throughput rate): 574 Mbps

  • 5 GHz Radio

    • Max TX power: 25 dBm

    • Antenna gain: 5.15 dBi

    • MIMO: 2x2 (DL/UL MU-MIMO)

    • Max channel width: 160 MHz

    • Max PHY (throughput) rate: 2400 Mbps

  • Wireless security: WPA-PSK, WPA-Enterprise (WPA/WPA2/WPA3)

  • Max BSSID: 8 per radio

  • VLAN: 802.1Q

  • Advanced QoS: Per-user rate limiting

  • Guest traffic isolation: Supported

  • Concurrent clients: 60+

  • Zero wait DFS: Yes

UniFi Express Comparison Charts

Comaprison of the UniFi Express (UX) and other UniFi Cloud Gateways

Comparison of all current UniFi Gateways, including the new UXG Lite

For more comparisons, see the rest of my UniFi Network Comparison Charts.

A New Kind of Flexibility

The UniFi Express is as small, cheap, and simple as a UniFi Network can be. There are a lot of details to discuss, but I can’t get over one thing in particular. The Express can do what no other UniFi Cloud Gateway can do: turn into a normal Wi-Fi access point.

The Express can either manage your UniFi network or be managed by another UniFi controller. It can be managed by a Cloud Key, Dream Machine, or self-hosted controller if that fits your needs. The other low-end options such as the Dream Router and Dream Machine can’t do that. In fact, no other UniFi device can do that. It makes the UX more flexible and more useful, and worth considering for both new and advanced users.

The UX can be everything you need for a small network, like the Apple AirPort Express used to be, and like most consumer all-in-one routers are now. You don’t need a Cloud Key or any other parts, but you can add up to 4 UniFi switches or APs if you want. You can also repurpose the Express as an AP if you outgrow it, making it arguably the best entry-level option to get started with.

Goodbye AmpliFi?

This all makes me wonder about the future of Ubiquiti’s other easy-to-use products, AmpliFi. Reading the tea leaves, it seems to point to AmpliFi going away and the UniFi ecosystem extending down to uses that are usually covered by mesh Wi-Fi and basic all-in-one Wi-Fi routers.

Traditionally, Ubiquiti’s option in that area has been AmpliFi. It’s a separate brand with different software and more limited features. AmpliFi software updates have been slow and steady over the past few years, but there hasn’t been any new AmpliFi hardware since the Alien in 2019. We’ll have to wait and see about the future of AmpliFi, but UniFi is clearly their priority.

UniFi Express FAQ and Asterisks

With the UXG-Lite and UX, we now have a lot of options for an entry level UniFi router. The UXG-Lite and UXG-Pro are for people with a Cloud Key or self-hosted network controller. The Cloud Gateways like the UDM-Pro and UDM-SE can only be managed by themselves.

The Express is different, and choosing between all of these options can get confusing. I’ve seen a lot of people ask the same questions. Thankfully, Ubiquiti has a FAQ on their website that clears up most of them:

What is UniFi Express?

UniFi Express is a complete UniFi Networking stack in an ultra-compact, plug-and-play form factor. It runs UniFi Network and features a powerful gateway engine and built-in WiFi 6 with seamless meshing.

Which UniFi Applications run natively on UniFi Express?

UniFi Express runs UniFi Network. For expanded application support, add an additional UniFi Console. For example, a Cloud Key or Network Video Recorder can be added to a UniFi Express network to run UniFi Protect for camera security.

How can UniFi Express be deployed?

UniFi Express can power an entire network as an all-in-one gateway, firewall, and WiFi 6 access point. Need more WiFi coverage? No problem - simply power on another UniFi Express and seamlessly mesh it to the gateway UniFi Express for effortless coverage expansion.

UniFi Express can also be deployed as a WiFi access point in existing UniFi Networks with a wired or wireless uplink.

How many UniFi Network devices does UniFi Express support?

When operated as a gateway, UniFi Express manages up to four additional UniFi Network devices such as other UniFi Express units, switches, and WiFi access points.

How many connected client devices does UniFi Express support?

Each UniFi Express can support 60+ connected client devices.

What is the routing performance of UniFi Express?

UniFi Express can route traffic at speeds up to 1 Gbps. Security features such as Device Identification, Traffic Identification, Country Restrictions, and Ad Blocking can all be enabled without impacting routing performance.

Are there any gateway feature limitations for UniFi Express, compared to other UniFi Gateways?

UniFi Express largely offers the same experience as all other UniFi Gateways, with powerful network segmentation, application-aware firewall, VPN, and license-free Site Magic SD-WAN capabilities.

The only exceptions are Suspicious Activity features (also known as IDS/IPS), which are not available on UniFi Express.

How can UniFi Express be mounted?

UniFi Express is designed to be flexibly placed on any flat surface, such as a desk.

A magnetic wall mount accessory will be available soon for expanded mounting versatility.

Those questions and answers clear up most of the confusion, but there are a few things worth calling out. The spec sheet doesn’t specify the CPU, RAM, or storage. Now that it’s released, we can confirm those for ourselves.

The Express has a Qualcomm IPQ5018 chipset, with a dual-core ARM A53 CPU running at 1 GHz. It has 1 GB DDR3L RAM and 4 GB of storage. It’s very similar to the UXG Lite externally and internally.

The ARM A53 core design was launched in 2012, so it’s not exactly cutting-edge tech. With such a low cost and low power budget, it makes sense, even if it is a little disappointing. That puts the Express firmly in the low-end of the gateway lineup. For many reasons, it won’t be competing with the UDM-Pro, UXG-Pro, or even the UDM.

View fullsize The UniFi Express (UX)
 The UniFi Express (UX) View fullsize The front of the UniFi Express
 The front of the UniFi Express View fullsize The back: one WAN, one LAN, and USB-C for power
 The back: one WAN, one LAN, and USB-C for power

Missing Features: IDS/IPS

Another thing worth examining are the limitations of the UX compared to other UniFi Gateways. Those mostly come down to hardware, software, and device management limits. Like the UXG Lite, the UX only has a single gigabit WAN and single gigabit LAN. That will be a restrictive for many larger or faster networks, but the more impactful limitations may be internal.

As a result of the limited hardware power, Ubiquiti chose to not enable Suspicious Activity (read: Suricata IDS/IPS) on the Express. In my opinion, that is probably the right decision. The USG and USG-Pro were similarly under-powered, and we’ve never heard the end of people complaining about throughput limitations. Search for “USG slow” or “USG IPS/IDS” and see for yourself. Enabling those features would lead to low throughput and frustrated users.

In the places where the UX will be used, and for most people most of the time, I don’t see that as a deal-breaker. The modern Internet is mostly encrypted by default. HTTPS, modern browsers and operating systems, and good browsing habits makes Suricata a nice-to-have rather than a strict need. Inspecting encrypted traffic and TLS is possible, but it’s complicated and expensive. It’s also of limited utility in a typical home network with no publicly exposed ports or services outside of maybe a VPN server.

If you’re concerned about the lack of Suricata, consider a more expensive UniFi gateway that has enough hardware power to support it. You can also consider wrapping your traffic in another layer of encryption by using a VPN. You could set up a Pi-hole DNS server or enable UniFi Ad Blocking or DNS Shield to control and protect your DNS traffic. You could also utilize the other security features that UniFi and your devices offer.

Limitations and Alternatives

Another result of the hardware limits is the low number of UniFi devices you can manage. You can manage up to 5 total UniFi devices, and the main gateway UX counts as one of them. That means you can add up to 4 UX, UniFi switches, or APs. There is an error message when you try to add a 6th. The client device limit — the phones, laptops, tablets, TVs, etc that you connect to the network — is around 60. That’s not a hard cap though, just a general guideline.

The 5 UniFi device limit is low, but it also helps put guardrails on who should consider this. If you need a big network, multi-gig throughput, a lot of devices and clients, or IDS/IPS, the UX can’t be your gateway, but it can be an AP in that kind of setup. You might be better served by a purpose-built AP, like the U6-Mesh or U6-Pro.

Another limitation worth calling out: When the UX is acting as a mesh AP, both the WAN and LAN ports are available as normal LAN ports. That’s good news. The bad news is with the current firmware, there is no way to assign a VLAN to those LAN ports. It only extends the default, untagged network. In my home network, I have one SSID using my VLAN-tagged LAN network. I am able to tag the management IP of the UX into that with the “network override” setting, but I can’t change what network is provided on the LAN ports.

If you want to build your network around the Express as your gateway and controller, keep the limits in mind. If you want more details about the other gateway and access point options, see my other posts about them in my Ubiquiti Guide:

UniFi’s Strengths and Weaknesses

With the UX seemingly competing with AmpliFi and the mesh Wi-Fi market, it’s worth comparing them. Why would you chose it over the many other options out there? The differences mostly come down to software.

Most of the mesh systems I’ve tested have a nice mobile app that makes setup easy, but only offer the bare minimum of settings and features. Some of them are better in that area, like ASUS ZenWiFi. Some of them want you to pay a subscription for extra features, like eero Plus or Netgear Armor. UniFi doesn’t do that, offering free software that is regularly updated with new features.

Rather than basic phone-app-only management with a few settings, the Express has the full UniFi desktop web interface. The UniFi mobile app has most of the common settings, and it is one of the better network management phone apps out there.

With that software the Express can do things other consumer equipment can’t, like be a Wireguard or OpenVPN server, or control managed switches. You can create additional VLANs and SSIDs. It can act as a Wireguard or OpenVPN client, and you can control and direct specific traffic with UniFi Traffic Routes, Traffic Rules, and firewall rules.

Another strength of UniFi are the expansion options you have. Rather than settling for another router in bridge mode or a Wi-Fi extender, the UX can be the center of a small, but full-fledged UniFi network. Mesh Wi-Fi systems make this kind of multiple AP setup simple, but UniFi is more controllable and customizable. UniFi can also become your solution for video security cameras, access control, VoIP phones, and identity management if you want to go all in.

UniFi isn’t perfect though, and it isn’t always the best option for a non-technical user. Sometimes it feels like the design and look of the software are more important than how it works. It aspires to be enterprise-grade, but fails to deliver that in some areas. Finding good documentation or support can be tough. Ubiquiti’s support has been hit or miss over the years, even though that’s starting to change.

Despite those and many other asterisks, in a lot of areas UniFi delivers more than other consumer equipment does.

Full Circle: Round Rects Are Everywhere!

I was tempted to put the Apple AirPort Express in the title image for this post. I too, am amazed at my restraint.

If you didn’t know, Ubiquiti’s founder and CEO Robert Pera worked in Apple’s AirPort division before he left in 2005 to start Ubiquiti. The 1st generation AirPort Express resembles a modern MacBook power brick and was released in 2004, and it’s reasonable to think he worked on that product. The 2nd generation took on the familiar rounded rectangle shape that we’ve seen in other products like the Apple TV. The UniFi Express not only has the same product name, it also has a suspiciously similar design.

Despite a few patents, Apple doesn’t own the shape of a rounded rectangle. Apple also chose to stop making Wi-Fi and networking equipment in 2018, leaving a hole that Ubiquiti and other mesh Wi-Fi companies have filled. Ubiquiti has always had a bit of Apple’s DNA in their design, from the products themselves to their packaging and marketing. This is just taking that to the next level, where you might not be able to tell which is which if you placed them side-by-side. We’ve come full circle.

Lastly, I just want to point you to this delightful story from Andy Hertzfeld’s folklore.org. The whole website is a fun read, as it has a lot of anecdotes from the early days of the Mac at Apple. This one in particular seems relevant: Round Rects Are Everywhere!

]]>UniFi Express Preview: Flexible and Mesh-able