Unifi Controller Can't Download Updates/Firmware thru Proxy Internet

[PotNoodleTech]

Hi Guys and Gals

 

Anyone else run into this? I've installed the Unifi Controller software on a Windows 2012R2 server and it all works nice has picked up my 2 test switches. I need to upgrade the firmware on the switches but the controller software won't download any firmware - it just sits there and eventually times out with no error or code.

 

I am assuming that this is because of proxy server use - the servers can see the internet through a web browser if they wish - but Uifi Controller software can't.

 

I can't for the life of me find anywhere to put a proxy server ip and port in the software?

 

Other schools must have run into this?

 

Many Thanks!

 

Andrew

[jthompson]

Yes, we ran into this. Earlier versions of the controller came bundled with supported firmware packages, such that nothing needed to be downloaded, the UniFi devices would just grab the required firmware package directly from the controller. Now the controler first needs to download the firmware before it can then be transferred to devices.

 

You can download the required firmwares manually from Ubiquiti's website and install them by SSH'ing onto each device in turn to run it. Details: https://help.ubnt.com/hc/en-us/articles/204910064-UniFi-Changing-the-Firmware-of-a-UniFi-Device#SSH

 

This might be another way of doing it (the screenshot is our own documentation for manually upgrading our AP-AC-PRO waps). The UBNT documentation online describes a slightly different approach.

Edited May 25, 2018 by jthompson

[PotNoodleTech]

Thanks for the reply I was really hoping this was not the case. I can't believe modern networking software can not cope with a proxy server that's use in every school and large business in the bleedin world!!

[Dom_]

Do you have an unfiltered IP range configured? I tend to put my unifi devices on an IP address in this range and the updates work fine then.

[PotNoodleTech]

No that's the problem internet through LEA = no unfiltered. I'll ask them if it can be done!

[pete]

We download the firmware and put it on an internal webserver, then point the APs to that (needs to be http link, https doesn't work) via the custom upgrade URL option.

 

It's a bit less of a faff than SSH-ing into each one, but you need to do it for each AP.

[PotNoodleTech]

Ok I found a way around it that involves less work.

 

So I set up a 4G router and popped a sim card in it. Disabled DHCP etc and gave it a static IP on my server range.

 

Then you can log onto the server that the unifi controller is installed on, and temporarily change the default gateway to the address of your 4g router.

 

Now if you run the controller software it will be able to see the internet (through 4g) and you can click a switch and click upgrade and it works. Takes a little while to do - but deffo works in about 5-10 mins depending on how good your signal is, mine is not good here.

 

Once you finished updating, set the default gateway back to your normal ISP and turn off your 4G router.

 

Just went from old to latest on my two test switches.

 

[chazzy2501]

omg sometimes I forget that Ubiquity have some alarming blind spots when it comes to enterprise networks. The refusal to acknowledge the need to use proxies in almost every enterprise environment. Changes in the way the product fundamentally works without notice. (see this firmware issue) Which I can't resolve.

 

The rebranding of their devices to hide shortcomings (like the disappearing L3 ability of the XG product ((which changed from a core switch to an edge switch)) The failure to deliver on zero handoff for the uap-ac access points and their eventual abandonment. Which then leads, not just to no further updates but also the inability to configure them!

 

 

You get what you pay for I guess. buy cheap buy twice.

[jslate1980]

I installed 50 unifi wireless ap’s at my school over the summer. At the same time I moved the schools filtering from Lightspeed to smoothwall. To get around the proxy I just set unify urls to bypass authentication. And so far it’s been able to pull the firmware updates to the controller.

[pete]

^ Yeah, as of 5.8.30 (at least), they've updated the console/firmware so that upgrades work correctly via a proxy (provided you've got the proxy configured to allow the traffic).

[uke]

I installed 50 unifi wireless ap’s at my school over the summer. At the same time I moved the schools filtering from Lightspeed to smoothwall. To get around the proxy I just set unify urls to bypass authentication. And so far it’s been able to pull the firmware updates to the controller.

 

Thats what I would like to do as well, what addresses/ports did you set to bypass please?

[jslate1980]

All I put in Auth Bypass was

https://unifi-report.ubnt.com

 

Edit:

 

Just remembered there were more URLs

https://www.ubnt.com

https://dl.ubnt.com

https://fw-update.ubnt.com

https://elite-device.svc.ubnt.com

Edited December 5, 2018 by jslate1980

[uke]

All I put in Auth Bypass was

https://unifi-report.ubnt.com

 

Edit:

 

Just remembered there were more URLs

https://www.ubnt.com

https://dl.ubnt.com

https://fw-update.ubnt.com

https://elite-device.svc.ubnt.com

 

Thanks, will give it a go! (annoying that this was not an issue with old versions!)

[chazzy2501]

I'm still poo out of luck, I can't upgrade the controller software as my 4 year old AC 1750 APs are now EOL and will be unconfigurable.

[PotNoodleTech]

Still using my 4G router here to get around this glaring bug.