Ubiquiti Inter-VLAN Routing Options

[speakercon]

I know this topic has been discussed in quite a few other threads but I've been unable to come up with a conclusion on the best way to do this, and know others are interested in this too.

 

I'm looking to do a refresh on our switching and as we use Ubiquiti wireless it makes sense to look at their switching (that along with all the positive feedback from edugeek members). The edge stuff is obviously easy, its the routing that seems to cause some debate on how best to achieve this. It seems to me that there are a few options and the cloud key controller alone cannot do this, so:

 

 

• Use either a security gateway or a dream machine.
  
• Use a Ubiquiti Edge Switch
  
• Use a HP/Cisco layer 3 switch.
  

 

Security gateway/dream machine - concerned about their ability to handle the sort of traffic a secondary schools would need routing, and them acting too much like a firewall than I would like and potentially hinder the Fortigate.

 

Edge Switch - Not managed from the 'cloud' dashboard, and there doesn't seem to be a way to stack or have any redundancy (apart from buying a spare on the shelf)

 

HP/Cisco - Solid tried and tested way of routing, but it would be nice to have everything the same brand and managed centrally

 

If anyone has any thoughts on these ideas or if anyone has had the same conundrum it would be great to hear what route you went down.

Edited April 27, 2021 by speakercon

[computer_expert]

Stay away from unifi routers like the UDM or USG. While they do the job for a home environment, I wouldn't want to use it in a business/school as I found them lacking to say the least...If you have a fortigate, keep it - it's much much better.

 

Option 3 is the best option if you ask me. We have ubiquiti L2 switches at the edge and a HP L3 switch at the core. It works fine for us and has been solid. Plus from a quick search unifi L3 switches don't yet appear to support things like ACLs.

[speakercon]

Stay away from unifi routers like the UDM or USG. While they do the job for a home environment, I wouldn't want to use it in a business/school as I found them lacking to say the least...If you have a fortigate, keep it - it's much much better.

Option 3 is the best option if you ask me. We have ubiquiti L2 switches at the edge and a HP L3 switch at the core. It works fine for us and has been solid. Plus from a quick search unifi L3 switches don't yet appear to support things like ACLs.

 

Do you mind me asking what model HP you use at the core and did you set it up yourself? I've been looking at the JL253A (2930F).

[Aprice]

For a secondary generally I would suggest something like the Aruba 5400r or 3810 as a core switch, The 2930F can do L3 but its really more of an access switch than a core. Depending on how big your network is it may be suitable for a couple of static routes. I do like the Ubiquiti EdgeSwitches / Unifi Switches but I've had 4 or 5 power supplies fail in them over a few sites so it might be worth having a spare just in case if you go down that route.

 

How many client devices do you have roughly?

 

Alex

[DGardiner]

the new gen2 ubiquiti switches have layer3 functionality - not used it yet but worth a look

[Primus]

We use Ubiquiti Unifi WiFi and edge switching and we have a pair of HPE 5940 switches at the core.

[caffrey]

The weird thing is the USG pro hardware can do most things you need yet it's just not in the interface. A lot of it is in the CLI e.g. I use policy based routing on ours and it works but you need janky JSON files to preserve settings.

On my switch \ wifi refresh I'll be considering other vendors too

[Jaan]

I've got my eyes on these:

 

https://store.ui.com/collections/unifi-network-switching/products/unifi-switch-aggregation-pro

[Davit2005]

I've got my eyes on these:

 

https://store.ui.com/collections/unifi-network-switching/products/unifi-switch-aggregation-pro

 

Last thing I heard on the Aggregation Pro was the L3 was in Beta or Alpha. There is the ES-16-XG that can do L3 though.

 

But I do like the look of it with all those ports and 25Gb uplinks.

 

Also bear in mind that there is no stacking or IP redundancy that I am aware of on Unifi or Ubiquti switches so if you had a failure would prob need user intervention to bring up networking again.

[Jaan]

I got excited when i first saw this image as its shows that maybe the switches are stacked.... although in the tech data, nothing to suggest it is possible.

 

[Davit2005]

I got excited when i first saw this image as its shows that maybe the switches are stacked.... although in the tech data, nothing to suggest it is possible.

 

[ATTACH=CONFIG]61638[/ATTACH]

 

Yeah I think they are just uplinked. It is not a unworkable solution for a L3 core if you can afford the downtime for switch re-jiggery and a bit of re-configuration and the switch meets up with performance requirements etc.

 

i.e. buy a 2nd then just reconfigure or have a 2nd sitting in a box ready for swap out and jus restore the config to it.

 

I'm waiting to see a review of it.

 

But the Aruba 5400 series is a good option for core, with multiple PSUs, MGMT modules and multiple links from edge switches for redundancy etc.

Edited April 28, 2021 by Davit2005

[computer_expert]

Do you mind me asking what model HP you use at the core and did you set it up yourself? I've been looking at the JL253A (2930F).

 

I can't remember which but is either a 2920 or 2930 as it was a very small network (400 ish clients inc BYOD). DIY install too.

[speakercon]

Looks like a HP core is the way to go, I was thinking this might be the case and was rather hoping someone had had some good experience doing it one of the other ways.

 

For a secondary generally I would suggest something like the Aruba 5400r or 3810 as a core switch, The 2930F can do L3 but its really more of an access switch than a core. Depending on how big your network is it may be suitable for a couple of static routes. I do like the Ubiquiti EdgeSwitches / Unifi Switches but I've had 4 or 5 power supplies fail in them over a few sites so it might be worth having a spare just in case if you go down that route.

 

How many client devices do you have roughly?

 

Alex

Hi Alex, we have about 500 clients (windows/chrome/iOS) but will be adding voip phones and IP CCTV.

 

I've configured HP edge switches before but not a core, I imagine it's similar to other makes where you create the VLAN's, set the IP range and then add rules into the routing table?

 

I like to try and do things myself where I can, so debating making the purchase and having a go... How hard can it be?

[Primus]

Looks like a HP core is the way to go, I was thinking this might be the case and was rather hoping someone had had some good experience doing it one of the other ways.

 

 

Hi Alex, we have about 500 clients (windows/chrome/iOS) but will be adding voip phones and IP CCTV.

 

I've configured HP edge switches before but not a core, I imagine it's similar to other makes where you create the VLAN's, set the IP range and then add rules into the routing table?

 

I like to try and do things myself where I can, so debating making the purchase and having a go... How hard can it be?

 

If you've got time to concentrate on it, understanding of how to configure switches and the documentation you need then it's not hard.

 

I configured our core - it took a little longer than I was hoping but that additional time was measured in hours not days!

 

I spent some time prior to this reviewing all our documentation and reading the implementation manuals from HPE carefully. I also found some YouTube videos of others setting up the same switch useful to visualise things prior to the kit arriving etc.

 

Ultimately if you get stuck someone one here will help you out but if you're at all concerned I can recommend SwitchShop as I know they provide kit at good prices but also have support available if you get stuck (they'll often even do some assisting for free for schools too!)

[Aprice]

The config is pretty much the same, as you say with the addition of adding an IP on the VLAN interfaces and adding a static route on if needed.

 

I put a 5400r in a couple of weeks ago, and had it configured up in a couple of hours after everyone had gone home. Happy to help with any config if you get stuck

 

Alex

[speakercon]

Slightly different query here, but I didn't want to start a new thread and was hoping you hp experts can help! I'm currently experimenting in the office with 5 X 2810-48G's and getting aggregated links working correctly (for redundancy and increased bandwidth). The crude diagram below is what I want to achieve, the two switches on the right connected together with ports 43,44,45,46 to create a 4GB link between the two, and then a ring from port 47 on both of those through ports 47/48 on the three on the right.

 

 

From reading I believe I can link the right two together using 4 ports by settings ports 43,44,45,46 on those switches to 'Trk1 - LACP'?

 

I'm struggling to find what I need to do on the ports that are creating the ring of five switches. I've enabled spanning-tree on all switches.

 

Thanks

Edited July 23, 2021 by speakercon