Unifi UDM Pro Max Firewall/Router Interesting...

[Tefters]

So I just caught up on my blogs and news and saw Unifi have released their new UDM Pro Max Firewall/Router this week.

 

https://uk.store.ui.com/uk/en/pro/category/cloud-gateways-large-scale/products/udm-pro-max

 

As a rather large Unifi network I must admit this has peeked my interest as this was their weakest point up to now and I was clinging on to my good old Sonicwall but the throughput numbers, fully integrated Unifi network management creation, routing and monitoring that you usually get with a UDM and incoming shadow mode is making me want to purchase one and give it a shot over summer at that price.

 

I love how the UDM's really bring all the network together in the portal and now having an enterprise grade version [emoji847]

 

Of course their CCTV offering while impressive is nowhere near Education capable (looks at our 3x 32 camera hikvision boxes) but that's just a feature you ignore.

 

Imagine getting excited over a new firewall...

Edited April 24, 2024 by Tefters

[Davit2005]

Yep interesting dev regarding Shadow Mode. Still to be released in v4? But seems like now Unifi have started implementing some form of HA :-)

 

 

Be nice to see it in depth how it works.

 

UPDATE: "Currently, Shadow Mode operates as a “Warm Spare,” meaning some manual intervention is required, however this will become fully automated in an upcoming release."

Edited April 24, 2024 by Davit2005

[gszech]

I'm ordering two for our secondary school when this is out in the UK.

[DalekSec]

Does look like a good bit of kit, what annoys me is the name!

[midweek]

We use pfsense currently but as we are about to change our ancient netgear switches for Unifi and we already have their APs and a controller I wonder if this would fit in our environment? Secondary school with about 650 pupils and a BYOD.

Been looking at a Fortigate solution but it's pricey compared to this.

[supportman]

Insanely cheap! But what would people do for web filtering?

 

Also I love the Unify CCTV in our school, its a great system.

[midweek]

Insanely cheap! But what would people do for web filtering?

 

We use Securly

[gszech]

We use pfsense currently but as we are about to change our ancient netgear switches for Unifi and we already have their APs and a controller I wonder if this would fit in our environment? Secondary school with about 650 pupils and a BYOD.

Been looking at a Fortigate solution but it's pricey compared to this.

In our secondary school the UDM Pro manages 85 UniFi network devices, over 800 school own devices and pupils are allowed to use their phones. On a daily basis there are over 1200 online devices connected to the network.

UniFi Dream Machine struggles a bit - it's just slow to load pages, but it does the job.

 

We use Network, Connect, Protect (on separate NVRs) and planning to add Talk in near future so this new appliance is perfect for us.

Also can't wait for the version 4 OS and the shadow mode.

[Tefters]

In our secondary school the UDM Pro manages 85 UniFi network devices, over 800 school own devices and pupils are allowed to use their phones. On a daily basis there are over 1200 online devices connected to the network.

UniFi Dream Machine struggles a bit - it's just slow to load pages, but it does the job.

 

We use Network, Connect, Protect (on separate NVRs) and planning to add Talk in near future so this new appliance is perfect for us.

Also can't wait for the version 4 OS and the shadow mode.

 

How many cameras are you running on their setup? I would love to lean into the Protect side of their product but we have like 80 CCTV cameras.

[FN-GM]

Does look like a good bit of kit, what annoys me is the name!

 

I’m surprised Apple aren’t into them about it!

[mrbios]

How many cameras are you running on their setup? I would love to lean into the Protect side of their product but we have like 80 CCTV cameras.

 

I've just started replacing my 64 camera hikvision system with UNVR Pro + G5 domes/bullets. You can stack the NVRs, I'm intending to get 3 in total by the time i've finished deploying. One pane of glass view, they auto balance the cameras across them (Going by what i've read rather than experienced here...) Setup the first as your master, and just "adopt" the new ones. Only key bit of info i read, was to make sure you had the same or similar storage capacity in each to keep retention periods the same across all your cameras.

[Discovery1031]

I believe the Ubiquiti founder did work at apple originally.....

[gszech]

I've just started replacing my 64 camera hikvision system with UNVR Pro + G5 domes/bullets. You can stack the NVRs, I'm intending to get 3 in total by the time i've finished deploying. One pane of glass view, they auto balance the cameras across them (Going by what i've read rather than experienced here...) Setup the first as your master, and just "adopt" the new ones. Only key bit of info i read, was to make sure you had the same or similar storage capacity in each to keep retention periods the same across all your cameras.

 

Last time I checked you can only stack 2 UNVRs but they are planning to get rid of this limit. We are at two UNVRs, everything works fine but we max both UNVRs, so can't add any more cameras.

https://help.ui.com/hc/en-us/articles/14881658961303-UNVR-Stacking

The 2nd option is to buy 3rd UNVR and just keep it as a separate system, for example internal on stacked UNVRs and external cameras on 3rd UNVR.

[mrbios]

Last time I checked you can only stack 2 UNVRs but they are planning to get rid of this limit. We are at two UNVRs, everything works fine but we max both UNVRs, so can't add any more cameras.

https://help.ui.com/hc/en-us/articles/14881658961303-UNVR-Stacking

The 2nd option is to buy 3rd UNVR and just keep it as a separate system, for example internal on stacked UNVRs and external cameras on 3rd UNVR.

 

Oh i thought i'd read a comment on their forums of someone utilising 3. Maybe it was a typo!

 

Fingers crossed they do get rid of the limit, I'm using entirely 2k cameras, so across two i can match our existing 64 camera setup....but when it comes to putting in extra, i'd need a 3rd. Still, the system is soooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo much easier to use than hikvision, with so much more flexibility around how you set it up, that i'd still go for another NVR standalone, over a larger hikvision system every time.

[gszech]

Oh i thought i'd read a comment on their forums of someone utilising 3. Maybe it was a typo!

 

Fingers crossed they do get rid of the limit, I'm using entirely 2k cameras, so across two i can match our existing 64 camera setup....but when it comes to putting in extra, i'd need a 3rd. Still, the system is soooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo much easier to use than hikvision, with so much more flexibility around how you set it up, that i'd still go for another NVR standalone, over a larger hikvision system every time.

 

Yes the system is amazing and they recently added new camera models for £79 per unit with similar specs to G5 Dome

https://uk.store.ui.com/uk/en/pro/category/all-cameras-nvrs/products/uvc-g5-dome-ultra

https://uk.store.ui.com/uk/en/pro/category/all-cameras-nvrs/products/uvc-g5-turret-ultra

[Tefters]

Cheers guys, until the 2 cap limit changes I'll be stuck but good to know it smashes Hik [emoji106]

[midweek]

Looks like the Dream Machine Pro Max is now available at the UK store.

[Tefters]

So we just got round to installing our new UDM Pro Max last week and wow!

 

The initial setup was extremely easy, remapping ports so our primary WAN is on a 2.5gbE and 2x internal 10gb SFP DAC's.

 

I was a little concerned with moving from a 3rd party router to Ubiquiti but all the networks in Unifi automatically switched to Unifi managed and created firewall rules allowing all networks communication with each other which made further setup easier.

 

We have since implemented basic firewall and Nat rules with ease, a little learning was required for their terminology but with a little testing was easy to work out.

 

Throughput is ridiculous and all our networks are performing much faster when it comes to inter-vlan communication which is over double from our old Sonicwall.

 

We still have a fair few firewall rules to implement over the summer but it's more bulk work now rather than working out.

 

For anyone considering a switch to the UDM Pro Max or Fortress (new firewall/router) I would highly recommend [emoji106]

[midweek]

So we just got round to installing our new UDM Pro Max last week and wow!

 

The initial setup was extremely easy, remapping ports so our primary WAN is on a 2.5gbE and 2x internal 10gb SFP DAC's.

 

I was a little concerned with moving from a 3rd party router to Ubiquiti but all the networks in Unifi automatically switched to Unifi managed and created firewall rules allowing all networks communication with each other which made further setup easier.

 

We have since implemented basic firewall and Nat rules with ease, a little learning was required for their terminology but with a little testing was easy to work out.

 

Throughput is ridiculous and all our networks are performing much faster when it comes to inter-vlan communication which is over double from our old Sonicwall.

 

We still have a fair few firewall rules to implement over the summer but it's more bulk work now rather than working out.

 

For anyone considering a switch to the UDM Pro Max or Fortress (new firewall/router) I would highly recommend [emoji106]

 

Very tempted by one of the Fortress Gateways. How does it deal with pupils using VPNs on their devices? This is our biggest issue with our current PfSense setup. I'd be happy to pay for the extra IDS/IPS license if it gives us control over stuff like that.

Edited September 10, 2024 by midweek

[Tefters]

Very tempted by one of the Fortress Gateways. How does it deal with pupils using VPNs on their devices? This is our biggest issue with our current PfSense setup. I'd be happy to pay for the extra IDS/IPS license if it gives us control over stuff like that.

We don't run BYOD so we have full control over all our kit. They cannot install VPN's.

 

As for packet inspection the Unifi firewall is pretty good and should be able to show you devices using VPN's as it wont be able to identify the traffic.

 

Just looked at mine and its showing me devices using OpenVPN which are our own devices in the IT office if that's any help to you.

 

Had the Fortress released sooner I would of brought that but I am still very happy with the UDM Pro Max thus far.