So I just added a TP-Link switch (TL-SG3428X) and access point (EAP670) to my network, using OPNSense for routing, and was previously using a TP-Link SX-3008F switch as an aggregate (which I no longer need). I’m still within the return window for the new switch and access point, and have to admit the sale prices were my main reason with going for these items. I understand there have been recent articles mentioning TP-Link and security risks, so I’m thinking if I should consider returning these, and upping my budget to go for ubiquity? The AP would only be like $30 more for an equivalent, so that’s negligible, but a switch that meets my needs is about 1.6x more, however still only has 2 SFP+ ports, while I need 3 at absolute minimum.
I’m generally happy with the performance, however there is a really annoying bug where if I reboot a device, the switch drops down to 1G speed instead of 10G, and I have to tinker with the settings or reboot the switch to get 10G working again. This is true for the OPNSense uplink, my NAS and workstation. Same thing happened with the 3008F, and support threads on the forums have not been helpful.
In any case, any opinions of switching to ubiquity would be worth it?
I run infrastructure that’s mostly ubiquity, with a sprinkling of mikrotik. I have no complaints, I really like the devices. They just work.
A switch you need to manually configure after every reboot sounds quite annoying. I don’t know if that’s something you can fix in software, if not sounds like a deal breaker to me.
As far as security risks go: you really need to model your threats, and your level of risk tolerance. Every single device, everyone, regardless of who makes it, has security faults. There is a remote code exploit for every device out there, some of them haven’t been discovered yet, some of them will never get discovered, but they all exist. So the real question is, how much work, how much money, do you want to spend to reduce the probability? And if it does get exploited what is your next fallback? Your network should have defense and depth. Breaking into one component should not breach everything.
Ubiquiti is great, because they’ve supported all of their devices, automatic updates. But they’re a big force now, which means they’re a big target. Which means there’s more effort put into breaking into the systems. Not to mention they really really really really really really want to control everything via cloud accounts, so that’s a huge risk surface that other network products don’t have.
Going onto your risk tolerance, if you’re trying to do all the best practices, internally in your network you would have some intrusion detection system, maybe a honey pot. Those would alert you. These systems exist because it’s inevitable eventually your system will get breached, the question is how long before you notice?
Never used their switches but their AP points are good. When I switched from Unifo to Omada the performance improvement was very noticeable. Better range better speed. This was awhile ago now so maybe they have gotten better.
Yeah they’re good now. In the early days they had a lot of quirks and also a lot of people weren’t settling them up correctly so older support posts have a lot of negative guff. But with their new setup and support apps (Unifi+wifiman) the success rate of getting things working how you want for a first timer is much higher these days.
Their new policy VPN routing and DNS filtering options in the ultra and max units makes the loss of full x-sense control less of an issue.
I used to have 2 gateways one pfsense VM and one physical to sort out filtering and stuff but I switched to ubiquiti and it does everything I need in one easy to manage unit again.