WIFI Recommendations

[TMBS]

Hi everyone

 

We currently have Unifi wifi around school but most of our ACs are becoming EOL. Unifi has worked reasonably well over the years but with having to replace so many I wanted to look into alternatives, preferably something with good support too.

 

Any recommendations?

 

Thanks!

[MartinT]

I can recommend Ruckus with their virtual controller, supplied and installed by Net-Ctrl.

 

The performance is leagues better than our previous Meru setup.

[jslate1980]

Hi everyone

 

We currently have Unifi wifi around school but most of our ACs are becoming EOL. Unifi has worked reasonably well over the years but with having to replace so many I wanted to look into alternatives, preferably something with good support too.

 

Any recommendations?

 

Thanks!

 

Which unifi access points do you have?

[mavhc]

I see Aruba Instant on charging about £100 for an 802.11ax AP, with $15/year/device for bug fixes, max 25 APs per site

 

Then Meru/Fortinet with their FAP-23JF for £300 each, with $100/year for bug fixes. And a fortigate as a controller, max APs depends on fortigate model.

 

Then Cambruin, Extreme/Aerohive/Aironet for about £400/AP, and Ruckus/Aruba £500/AP

[psydii]

Get competitive quotes - but Aruba Instant Access points come with my recommendations at the moment. Make sure they know who they are bidding against. Set it and forget it. (Well... update the firmware every so often as device drivers evolve).

 

I think Extreme should be pretty good too - they have the people that made great Wifi back when only Aruba, Chantry and Cisco could do it, and now they own Aerohive too.

Edited April 27, 2021 by psydii

[armadillo]

I'm in the same situation, will start to plan replacement. Currently using Ruckus since 2012, added newer APs throughout that period. I know Unifi are very cost effective, but I;'m not sure how robust and if they support as many features as ruckus, things like Radius, BYOD etc.

 

Thanks in advance for your input

[Primus]

I'm in the same situation, will start to plan replacement. Currently using Ruckus since 2012, added newer APs throughout that period. I know Unifi are very cost effective, but I;'m not sure how robust and if they support as many features as ruckus, things like Radius, BYOD etc.

 

Thanks in advance for your input

 

Unifi supports RADIUS, BYOD etc. I've got nigh on 100 APs in a decent sized secondary school with loads of Chromebooks and other WiFi devices and it hasn't had a single issue.

 

If you list all of the features you need someone on here will be able to identify if there are any Unifi can't do (unlikely).

 

When I went with Unifi for ours I had all the horror stories from other vendors, the usual bad-mouthing of alernatives and upstarts like Unifi. In the end it saved us an absolute packet and has been (touch wood) spot on. When I'm replacing the WiFi at other schools I'd obviously get quotes for all the possible options but given how cheap Unifi is and how good it's been for us I wouldn't hesitate to go with them again.

[armadillo]

Ruckus features are as shown in the photo

[Primus]

Ruckus features are as shown in the photo [ATTACH=CONFIG]61637[/ATTACH]

 

Which services in particular are you wanting to know about since that's just a screengrab of a UI as far as I can see?

[mavhc]

https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ main problem with unifi is they don't know how to make secure software, which is rather bad

[Primus]

https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ main problem with unifi is they don't know how to make secure software, which is rather bad

 

There have been issues yes, but you could say that about almost any vendor. If you take steps to mitigate such as hosting the controller locally and not connecting it to the cloud, using MFA etc etc then you'll be fine.

[chris11256]

I can happily recommend Aruba instant access points. We've got the IAP-315 and they've been solid as a rock. As others have said other than firmware updates, they're set and forget.

[armadillo]

Which services in particular are you wanting to know about since that's just a screengrab of a UI as far as I can see?

 

Things like device access policy (BYOD working on Android and IOS devices), radius with Smoothwall, wpad for automatic proxy, VLAN aware, AD integration, meshing, DHCP relay and intrusion detection and prevention.

 

Thanks in advance

[Primus]

Things like device access policy (BYOD working on Android and IOS devices), radius with Smoothwall, wpad for automatic proxy, VLAN aware, AD integration, meshing, DHCP relay and intrusion detection and prevention.

 

Thanks in advance

 

So what are you using device access policy to do?

 

RADIUS is supported and works fine here with Smoothwall.

 

WPAD is not something that is supported by your WiFi - it's a network level configuration so Unifi obviously supports that.

 

Unifi is vLAN aware.

 

What AD integration are you looking for - this is usually tied to RADIUS through NPS which works fine.

 

Meshing works but I wouldn't do it - with any provider!

 

DHCP relay is supported.

 

If you want to use intrustion detention or prevention you'll need a USG - what are you wanting to do IDS or IPS on and where in your network do you currently perform this?

Edited April 28, 2021 by Primus

[mavhc]

I can happily recommend Aruba instant access points. We've got the IAP-315 and they've been solid as a rock. As others have said other than firmware updates, they're set and forget.

 

Is Instant the same as Instant On? Instant On seem to be limited to 25 APs per site.

[chris11256]

No they're different things with similar sounding names.

 

https://www.arubanetworks.com/en-gb/products/instant/

[Norphy]

Is Instant the same as Instant On? Instant On seem to be limited to 25 APs per site.

 

Aruba have three tiers aimed at different kinds of markets.

 

They have their Mobility products, which consist of controllers and ‘Campus’ APs which connect to those controllers. Controllers can be clustered for redundancy or for additional power. They have features like Remote APs, where access points connected to the Internet tunnel back to their controllers and present a wireless network to a remote site as if they’re connected to your LAN. Optionally, you can have multiple controllers managed from a ‘Mobility Master’ to manage several controllers from a single pane of glass. These are designed for very large deployments, with hundreds of APs and tens of thousands of users. They’re aimed at large enterprises and companies.

 

Below that, they have the Instant range which use the same APs as the controller based networks but with a different firmware. These are used without controllers and can be used in networks of up to 127 APs and thousands of users. Instant APs can be converted to campus APs if the size of your network grows and you need the extra power or management features. They compete with the likes of Aerohive and are aimed at medium sized businesses.

 

Finally they have their InstantOn range which are completely cloud managed and limited to 25 access points per site but you can have a lot of sites. They’re aimed firmly at SOHO and these days WFH workers. They’re priced like Unifi APs and are managed similarly to Meraki but don’t have the subscription fee.

 

All three ranges have their place. My MAT has a Mobility infrastructure with coming on for 400 APs. I personally own an InstantOn AP which I like a lot but wouldn’t recommend for a school other than a small primary. I will say that they’ve gone a bit Microsoft when it comes to naming these things, they could have chosen a more distinct name for the InstantOn range to avoid confusion.

Edited April 28, 2021 by Norphy

[mavhc]

Ah, they're the ones that cost £500 (AP-505) instead of £100 for Instant On, are they 5 times better?

[Norphy]

1) That's an unfair comparison. The AP-505 is an 802.11x AP, while the only InstantOn AP that costs £100 is the AP11 which is 801.11ac. The AP22 is the closest in terms of hardware to the AP505 and that's £170.

 

2) The AP505 only £500 if you buy them one at a time from retail. You're unlikely to do for a big wifi deployment. Instead, you'll go to your favourite Aruba vendor and say "I have a big wifi deployment coming up, what can you and Aruba do for me?". They'll come back to you with a price far below list, especially if you're a school. If you're buying lots of them for a large deployment, they're nothing like £500. Probably closer to £200 an AP. I don't like that pricing model any more than you do but it's the reality that we live in and that's what we've got to work with.

 

So, is an Instant twice as good as an InstantOn? Tricky question. They can be used in much bigger deployments. They have more features, such as IDS, bonjour publishing, the ability to tunnel over the internet back to a controller and more, but you not be interested in any of that. It depends on your use case and the size of organisation you're putting the network into.

 

The InstantOn covers the basics well, it supports all the usual authentication types, guest networks, captive web portals et al but you may find them a bit limiting for anything but the most basic of networks.

[mavhc]

Twice is expensive isn't bad.

 

I found the AP22 for £106 somewhere, can't see it now, more like £140. But the $15/device/year will double that cost anyway.

 

How much do you have to pay for the Instant (not on) bug fixes? Why are we paying them to fix their own bugs anyway?

 

If they don't start putting actual prices online they're going to lose customers

[jmak]

I'm looking to replace my home wi-fi. Is Aruba's cloud management free for <25 devices using instant-on or is it chargeable?

 

Original plan was to upgrade my unifi APs and use a "Cloud Key" to manage. Trying to decide what is more secure: unifi with their known problems, but shouldn't be an issue because it's hardware behind my firewall or Aruba fully cloud, so potentially exposed, but with the credentials of a tier one supplier (HP).

[mavhc]

"If you want the same easy to use features on a bigger screen, there’s cloud-based access that lets you manage your network from the browser of your choice, from anywhere. No license or subscription fees needed."

 

However https://community.arubainstanton.com/blogs/jamie-easly1/2019/12/04/aruba-instant-on-warranty-and-support-services-faq

 

Software Updates

(includes all generally available software/OS releases when and if available within the warranty period)

90 days (from warranty start date*)

 

But wait, you can pay $45/device for 3 years more security updates, bug fixes, and new features, yay?

 

We totally didn't hide that at the bottom of a pdf stapled to a filing cabinet in a basement.

[Norphy]

I've had my InstantOn for over a year now and it got a firmware update last month.

[mavhc]

How odd, can you just download the firmware and install it, or only via the management website? I didn't see any download links

[Norphy]

InstantOn access points are managed by the cloud interface, either through the app or the management website. Firmware updates are automatically made available to your devices and are applied automatically. You're given a window to install them but it happens without user interaction for the most part. Just like with Meraki.