Network Refresh - ProCurve to Unifi Sanity Check

[Jokrr]

Hi All,

A secondary school has joined our trust and their network is in need of a refresh I was originally looking at Aruba kit but looks to be out of reach budget wise so considering Unifi but we've only done relatively small scale deployments in our primary schools so looking for a bit of guidance/sanity check!

The schools current network consists of the below:
Smoothwall S9 (Filter and Firewall)
2x HP ProCurve 5406ZL (Core Switches)
15x HP ProCurve 2520G-24-PoE 
9x HP ProCurve 2610-48

Most of the edge switches have dual SFP links back to the core and all the switches are at max capacity.

My current idea is below:
Smoothwall S9 (Filter and Firewall) (Kept until renewal then move firewall to the EFG and Filtering to Lightspeed)
1x Unifi WAN Switch RJ45 
2x Unifi Enterprise Fortress Gateway (Shadow Mode) (For the time being just doing routing/vlan management and management of the switches via Network )
2x Unifi Hi-Capacity Aggregation 
30x Unifi Pro Max 48 PoE

The idea is to improve the existing resilience, bring the school up to a 10Gig backbone and add some extra capacity to the edge.

I think this covers all the bases but if anyone has any guidance or spots any issues let me know I would greatly appreciate it!

 

[FN-GM]

I would consider eliminating any single points of failure, your WAN switch for example. Ubiquiti don't have a speedy service for hardware replacements. 

[Jokrr]

On 18/10/2025 at 05:56, FN-GM said:

I would consider eliminating any single points of failure, your WAN switch for example. Ubiquiti don't have a speedy service for hardware replacements. 

Good point! Going to add some extras to keep in the server room as cold spares.

[F_admin]

17 hours ago, Jokrr said:

Good point! Going to add some extras to keep in the server room as cold spares.

Rather than a cold spare, IMO it may be worth considering installing a second WAN switch and setting it up to use link aggregation, so in the case of failure you're not having to run up to the server room and plug the new switch in, and also make sure it has the most up to date backup on it etc. 

[DalekSec]

I've recently built a full UniFi Enterprise HA enviroment, WAN Switches, EFGs, Enterprise POEs and Fiber switching. Feel free to DM me any questions

[Bayly2000]

Have you considered TP-Link Omada at all? If we're provided with drawings of the site then we can do a complete network design FOC. We can then get supported pricing in place, I would always say there is no harm in providing your customer with a couple options of pricing/solution. Especially if Budget is an issue, we believe Omada is the perfect cost effective solution for schools. Happy to jump on a call to discuss further? 

[Chris_Cook]

If your upstream device can provide 2 RJ45 ports, then you might not need the wan switch. You would still have a single point of failure though in your upstream device. 

 

If your wan switch fails, you could also just bypass it as its a plain switch with no VLANs or anything. That assumes you are on site though. I think the argument for the wan switch is that switches are fairly reliable, and really its protecting you against a EFG failure which would be more likely as its more complex. Otherwise, you are manually changing over the cable for the internet.

[Tefters]

My current secondary school Unifi stock and this is already 4 years old so none of their new fully fledged "enterprise" or "high capacity" labelled gear.

 

UniFi has come on leaps and bounds over the last 4 to 5 years and continues to make huge improvements and upgrades. Their Capex costs are low, their Opex costs are non-existent, and if you're smart, you would keep a few spare devices on hand in case of an emergency swap and with the copy config option and makes replacing a device a few clicks (barring swapping the actual bugger and plugging all the cables in the correct ports again 🤣).

They update frequently, yes, you get the odd niggle where you need to restart a device due to a hung upgrade or weird glitch and an AP will once in a blue moon show offline to management but actually have POE and provide WIFI as usual and just needs a port recycle or cable out and back in visit. Take into account the price and the fact that schools are not HSBC, AWS, MS or any other big player that cant afford a single minute of downtime, I would say you get a pretty good deal, ow and the management interface and mobile app along with site-to-site VPN among other things is also free and isn't licensed!

 

People complained they didn't offer MLAG, Unifi brought out the ECS-AGG switch which supports MLAG. People complained they didn't offer stacking, they brought out switches that can stack.

 

I replaced our old HP ZL core switch which had 4 fibre modules and 6 ethernet modules with 2x PRO-AGG and 3x PRO-48 and while yes if 1 of the AGG's went down i would lose some edge switches around the school I do have both plugged into my PRO-MAX with STP on so one of the links is always offline / ready to take over from the standpoint of the PRO-MAX, both switches have 2x 25gb links between so one is always routing through the other to get to the internet and my core infrastructure is dual linked into both, ow and I have inter-vlan routing setup on the AGG's to take the load off the gateway. Again, this is a 4-year-old design and when all their 10gb switching was early door's and it's worked pretty well and still does.

 

I would love to replace the PRO-AGG's and PRO-MAX with the new enterprise/campus range and make use of the MLAG and shadowing features (not sure on the WAN switch, haven't looked enough into it but was put off at the release YT video as not sure what it really offers when using 1 of them over just having a normal UDM or Fortress Gateway in shadow mode and manually swapping the WAN cable if 1 fails, I know its supposed to elliminate the need for the manual swap if a UDM goes down but if the WAN switch goes down and you only have 1 your balls either way so would ideally need 2 of them and with 2 WAN links?! anyways, I degress...) but at the same time I have a huge amount of other items that also need replacing / updating / maintaning and pennies to work!

 

 

Long story short, its not perfect but it is very reasonably priced and pretty hassle free. Hell, what nowadays doesn't need a good restart once in a while to solve some sort of matrix glitch!

 

Also: UniFi Case Studies kind of says it all. A lot bigger installs in there than a secondary school.

 

P.S. Don't forget to hit that like and subscribe button, and today's post was brought to you by our kind sponsor, a bottle of Peroni 👍

 

Edited October 20, 2025 by Tefters