Unifi - Repair or Replace

[Jobos]

I started a new school last week basically taking over from an MSP and I'm finding new horrors everyday like the guest wifi running on the domain network without VLANS.

 

Today I'm looking at the unifi cloud key and see for the it is a CK2 and it is reporting a degrading disk and is at risk of failure, so I'm off to a great start already but to be fair the warning is only a month old. I've used unifi for a few years so familiar with it but that unifi was running on a VM and it looked slightly different to this cloud key which brings me to my questions.

 

1. The cloud key runs 22 APs mostly UAP AC LR but with a UAP AC Lite thrown in, 6 USW Pro 48 PoE switches and 2 cameras. I do not know how old the cloud key is so is it better to replace the failing drive or replace the cloud key altogether? I'm looking for the easiest option.

 

2. Where is the setting to change the wifi key? Unifi is running 3 SSIDs and I see them listed under settings / wifi but when I click manage the only option is to pause or remove the SSID. There was some talk that the MSP was going to install RADIUS but there's no sign of it but I'll still be checking the invoices.

 

Thanks.

[Oaktech]

The CK2 is still current, so I'd just do a disk.

 

You should be able to change password on settings cog, wifi, change password.

[TheHyperTechie]

I started a new school last week basically taking over from an MSP and I'm finding new horrors everyday like the guest wifi running on the domain network without VLANS.

 

Today I'm looking at the unifi cloud key and see for the it is a CK2 and it is reporting a degrading disk and is at risk of failure, so I'm off to a great start already but to be fair the warning is only a month old. I've used unifi for a few years so familiar with it but that unifi was running on a VM and it looked slightly different to this cloud key which brings me to my questions.

 

1. The cloud key runs 22 APs mostly UAP AC LR but with a UAP AC Lite thrown in, 6 USW Pro 48 PoE switches and 2 cameras. I do not know how old the cloud key is so is it better to replace the failing drive or replace the cloud key altogether? I'm looking for the easiest option.

 

2. Where is the setting to change the wifi key? Unifi is running 3 SSIDs and I see them listed under settings / wifi but when I click manage the only option is to pause or remove the SSID. There was some talk that the MSP was going to install RADIUS but there's no sign of it but I'll still be checking the invoices.

 

Thanks.

 

I suppose it depends on budget, I would probably get a new cloud key (Gen2 Plus ~£160) and manage the devices through that. However, you could simply host your controller in a virtual machine on an old desktop.

 

As for changing the Wi-Fi key, you should simply be able to go into the settings of your location (site) and then click on the SSID and edit the password there. If you can't see this, it sounds like you might not have manager access (?) I had this at the school I currently work at. I spoke to their old MSP and they wanted to charge me £60 for simply clicking a few buttons and assigning me as the new owner. I politely declined, took a back up of the config and reset/restored it with me as the owner.

[PotNoodleTech]

Dont have unifi any more but when I did I would never use a physical cloud key as it's a garunteed single point of faliure built onto a cheap component - instead just created a VM and installed the windows cloud key software that way it inherits the ultra-reliability (hopefully) of your VM infratructure.

[TheHyperTechie]

Dont have unifi any more but when I did I would never use a physical cloud key as it's a garunteed single point of faliure built onto a cheap component - instead just created a VM and installed the windows cloud key software that way it inherits the ultra-reliability (hopefully) of your VM infratructure.

 

This is a fair point. However, the controller is only needed for changes to config and for notification purposes. So if it did fail, the access points would still work.

[PotNoodleTech]

This is a fair point. However, the controller is only needed for changes to config and for notification purposes. So if it did fail, the access points would still work.

 

Yeh but then you've got the potch of getting it all back up and running and hoping nothing goes wrong? Was the config backuped? What about the changes you made at 3.59 last night will they be lost? Etc?

 

I preferred for it not to fail in the first place and the VM solves that issue.

[Jobos]

Thanks everyone. I looked again and clicking the SSID name opened the settings where I could find all the info I needed. Silly me I just clicked the manage box and expected to find the info there!

 

All servers bar 1 have been moved offsite by the old MSP, and they have had a couple in the last few years. The school is still paying the MSP to host the servers but the school's domain has been replaced by the MSP and is now part of the MSPs forest which makes moving away from the MSP a large job. The remaining onsite server is for or was for MDT and MDT is not working either. The files are there but nothing about MDT on the start menu or server manager so sadly I think it may have been uninstalled.

[PotNoodleTech]

Sounds like you've got an uphil struggle ahead of you!

[TheHyperTechie]

Yeh but then you've got the potch of getting it all back up and running and hoping nothing goes wrong? Was the config backuped? What about the changes you made at 3.59 last night will they be lost? Etc?

 

I preferred for it not to fail in the first place and the VM solves that issue.

 

Also fair points. But if you have automatic backups enabled, it isn't really an issue. I think the last time I restored our cloud key from a backup it took about 5 mins max. I feel some could argue that finding a replacement desktop, or building a new VM on your host, and installing the controller software on it, could be more problematic and time consuming.

 

I don't think there is a right or wrong choice really OP.

Edited November 14, 2024 by HyperTech

[Davit2005]

Unless you are using the captive portal part of Unifi I don't think it matters if the VM is only running when you need to make changes. So in that case put it on a VM and forget about it.

 

However if you are using Unifi Protect I think they still need a Unifi NVR?

 

TBH I don't think much of the CK2, I have a CK2 Plus at home and not only did I have the bulging battery issue the PoE failed too. It still works OK with the original disk which is surprising as it is a good few years old but jus powered by a USB cable rather than PoE.

 

Jus backup the VM or at minimum automate config backups and store them elsewhere.

 

802.1x is still the preferred way for wifi. MPSK not bad but has it's cons, but the same pre-shared key for all devices is jus too risky.

Edited November 14, 2024 by Davit2005

[Jobos]

Slightly OT but I’ve found a couple of old servers in a stock room that the school had before the MSP wiped the domain. I don’t know if they will power up or what they are running, probably need server installing anyway so is [emoji638] VMs I can run on a host before I need extra licenses?

[TheHyperTechie]

Slightly OT but I’ve found a couple of old servers in a stock room that the school had before the MSP wiped the domain. I don’t know if they will power up or what they are running, probably need server installing anyway so is [emoji638] VMs I can run on a host before I need extra licenses?

 

Yes, two virtual machines if you are using Windows Server standard.

[Davit2005]

Slightly OT but I’ve found a couple of old servers in a stock room that the school had before the MSP wiped the domain. I don’t know if they will power up or what they are running, probably need server installing anyway so is [emoji638] VMs I can run on a host before I need extra licenses?

 

Stick ProxMox on them if the VMs are not mission critical and you are going to run a Linux VM i.e. Unifi Controller. And if you have a few servers spare setup a ProxMox cluster. 3 is best for Quorum but the 3rd device could simply be a Raspberry pi with the quorom software installed.

[Jcx500]

Thanks everyone. I looked again and clicking the SSID name opened the settings where I could find all the info I needed. Silly me I just clicked the manage box and expected to find the info there!

 

All servers bar 1 have been moved offsite by the old MSP, and they have had a couple in the last few years. The school is still paying the MSP to host the servers but the school's domain has been replaced by the MSP and is now part of the MSPs forest which makes moving away from the MSP a large job. The remaining onsite server is for or was for MDT and MDT is not working either. The files are there but nothing about MDT on the start menu or server manager so sadly I think it may have been uninstalled.

 

Jeez, usual MSP behaviour, why just why would you use a shared AD forest across multiple customers….

[Jobos]

[emoji637]][emoji[emoji6[emoji640][emoji638]][emoji640][emoji6[emoji640][emoji638]]][emoji[emoji6[emoji640][emoji638]][emoji640][emoji6[emoji640][emoji638]]];[emoji638][emoji[emoji6[emoji640][emoji638]][emoji640][emoji6[emoji640][emoji638]]][emoji6[emoji640][emoji637]][emoji6[emoji640][emoji638]][emoji6[emoji640][emoji637]][emoji[emoji6[emoji640][emoji638]][emoji640][emoji6[emoji640][emoji638]]][emoji639]]Jeez, usual MSP behaviour, why just why would you use a shared AD forest across multiple customers….

 

If I was a cynical person I would say because it makes it harder for the school to leave the MSP.

[TomL]

If the two cameras they've got are recording to the CloudKey - you'll need to keep it running/replace it with something else (i.e a UNVR) to keep it working. For the sake of a couple of quid short-term, I'd just replace the disk.

 

UniFi have brought in ONVIF to their own ecosystem lately (still in labs); but it doesn't (yet) work the other way round w/ using a third-party NVR. If the cameras you have are UniFi - you're stuck in their Ecosystem w/out having to do some messing around (

)

 

Given that it's only two cameras - I'd look to replace them with something else entirely and then you can power down the CloudKey & use the VM you're planning on provisioning.