Originally Posted: December 22nd, 2024

Ubiquiti 2024: Enterprise-Grade Year In Review

On the December 2024 UI Chat Podcast, we had Cody from the Mactelecom Networks on as a guest. You probably know him from the Mactelecom Networks YouTube channel, or Instagram, or Twitter/X, or TikTok account. If you don’t, you should check out his work as he’s one of the most prolific Ubiquiti video makers and has a ton of good content covering Ubiquiti news and reviews.

On this episode we went through the monthly Ubiquiti news as we always do, but we also took the 2nd half of the episode to review all of the things that Ubiquiti released in 2024. The list of hardware was so long that we didn’t get a chance to cover all of the software and other bits of news that came out throughout the year. That’s what I want to cover in this post, and some of my thoughts on where Ubiquiti is after a very busy year.

As always, you can check out the UI Chat Podcast on YouTube, or your podcast service of choice:

• Apple Podcasts‍

• Pocket Casts‍

• Podchaser‍

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

• Overcast

UI Chat December 2024: Enterprise-grade Year In Review on YouTube

With that out of the way, let’s take a look at all the things that Ubiquiti released in 2024. First up, we have the hardware. Any product links below are non-affiliate links to Ubiquiti’s US store.

Ubiquiti Hardware in 2024

• January - UniFi Swiss Army Knife AP, UISP Switch Plus and Box Plus, U7-Pro, PDU Pro, toolless mini rack stacking kit

• February - Cloud Gateway Ultra, Ultra switches, Wave Pico, Wave AP micro 360° mount, UISP dual 2.5 Gbps PoE injector, USB-C charge cable, precision rack mount kit

• March - G5 Turrent Ultra and G5 Dome Ultra, a lot of camera accessories, UniFi Access Intercom, and the EV Station Pro payment terminal and stand

• April - UXG Max and UDM Pro Max

• May - EFG and U7 Pro Max announced as coming soon, Pro Max 16-port switches, U6 Mesh Pro AP, Access reader accessories, Enterprise HDD, U7 Pro paintable cover

• June - U7 Pro Max, U7 Pro Wall, U7 Outdoor, Access Ultra, EV Connect Lite, AI Pro Vision Enhancer

• July - Cloud Gateway Max, EdgeMAX refreshed with new logo, and G5 PTZ

• August - UXG Enterprise and EFG, UMR Industrial, Display Cast Pro, UniFi Power Amp, black version of G5 Dome Ultra, SSD version of UCK-G2+, Gate Access Starter Kit, exit button for UniFi Access, RIP SolarSwitch

• September - Enterprise NVR, Flex Mini 2.5G

• October - UNAS Pro, Enterprise Campus switches (24/48 port and aggregation), UniFi Device Bridge and Device Bridge Pro, UMR Ultra, and Wave MLO/Gen2 previewed 

• November - UniFi Protect AI Turret, AI Dome, AI LPR, and AI Port, white version of AI 360, and new camera accessories 

• December - E7, E7 Campus, and E7 Audience APs, 12U and 42U cabinets

I covered a few of these devices throughout the year:

• U7-Pro Preview: Welcome to Wi-Fi 7

  • A brief look at 802.11be and Ubiquiti’s first Wi-Fi 7 AP, the U7-Pro.

• UXG-Max Preview: Modern Multi-Gig

  • My preview of the UniFi UXG-Max covering the specs, my initial impressions, and where it fits in the increasingly crowded UniFi gateway lineup.

• More UniFi Wi-Fi 7: U7 Pro Max, Pro Wall, and Outdoor Preview

  • This preview covers the specs and my initial impressions of Ubiquiti’s latest batch of Wi-Fi 7 UniFi access points: the U7 Pro Max, U7 Pro Wall, and U7 Outdoor.

• UniFi Gateways Explained as Simply as Possible

  • My attempt to explain the difference between UniFi Gateways and Cloud Gateways in the simplest way possible.

• UniFi Enterprise Wi-Fi 7: E7, E7 Campus, and E7 Audience Overview

  • An overview of the new UniFi E7, E7 Campus, and E7 Audience Wi-Fi access points. It includes spec comparisons to other models, attempts to explain 6 GHz standard power, and if UniFi is truly enterprise-grade now.

Mostly, I tried to keep up with the deluge of new devices in my comparison charts.

• UniFi Network Comparison Charts for UniFi Gateways, Switches, and Access Points

• UniFi Protect Comparison Charts for UniFi NVRs, Cameras, and Doorbells

As you can see there are a lot of devices which I didn’t cover, and many that I don’t have hands-on experience with. More than any year prior, 2024 felt like a fire hose of releases one after another. It was overwhelming to me, and even people like Cody which are used to covering every minor update and release.

While the quantity of new hardware was overwhelming, the more important thing to discuss is the quality. In years past a common complaint was that Ubiquiti seemed distracted. While the core UniFi Network devices like the USG aged, we got new products like the UDM that didn’t satisfy everyone. With the initial release of the Dream Machines back in 2019 and 2020, MSPs and enthusiasts were worried that self-hosted UniFi was going away. It seemed like Ubiquiti only cared about locking you into buying more Ubiquiti hardware.

I think enough time has passed and there is a long enough track record to show that this isn’t the case. UniFi Networks are still modular, and you don’t need to buy into their ecosystem for everything. The other products like UniFi Protect are mature and complete options now, and they work together and compliment each other well. There were some lean years with some less-than-ideal hardware releases and some slow progress in software, but that’s definitely not the case now.

Notable Hardware Releases

• The Swiss Army Knife is still the weirdest product name they have, but it’s a good option for cheap outdoor Wi-Fi. It’s a sideways upgrade from the older AC-Mesh, but when you consider the accessories like the desktop stand and panel antenna, it’s worth considering.

• Gateways galore! We got six new gateway options in 2024. At the end of 2023 we got the new baseline Express and UXG Lite, and now we have the full picture of this generation of UniFi Gateways. There’s a model or two for everyone, and all of them are compelling in their own way. The Ultra and Max models are good for smaller setups, and with the UDM Pro Max and the Enterprise models, UniFi can fit into larger networks than they ever could before.

  • Cloud Gateways: Cloud Gateway Ultra, Cloud Gateway Max, Dream Machine Pro Max, Enterprise Fortress Gateway

  • Non-Cloud Gateways: Gateway Max and UXG Enterprise

• Goodbye USG and USG-Pro: 2024 was the year the elder USG and USG-Pro gateways finally got put to rest. Earlier on in the year they were marked as legacy devices, meaning that software and security updates were coming to an end. In UniFi Network 8.6, we got the warning that configuration changes won’t be possible going forward.

  • While I don’t like the idea of forcing upgrades and these devices become e-waste, this was probably the right time. They are old and not powerful enough to keep up with new software features. We also have a ton of gateway options to replace them now. If you’re still running a USG or USG-Pro, take a look at the UXG models or possibly a Cloud Gateway. You’ll see a huge jump in performance and a ton of new features.

• Wi-Fi 7 APs: U7 Pro, U7 Pro Max with spectral analysis, U7 Outdoor, and U7 Pro Wall. We also got the high-end Enterprise models and outdoor/standard power 6 GHz radios the E7 and the upcoming E7 Campus and E7 Audience.

  • There have been a few rough edges with the U7 models and their compatibility with IoT and 2.4 GHz devices, but that’s not something I’ve personally run into. I think that’s a real shame because it’s distracted from an otherwise impressive lineup of new APs. If you’re considering one of these models, keep an eye on the release notes and the progress they’re making with those issues.

• New Markets: The UniFi Power Amp made Ubiquiti a Sonos competitor, and the UNAS Pro was an impressive first entry into the world of file storage. These are both fully-featured and mature releases which impress on their own. They also point towards Ubiquiti entering more areas outside of their core of networking. In the past they didn’t always pull that off, but I think these are two good entries. I expect we’ll see more things like this as Ubiquiti' drifts away from being just a network device maker.

• UniFi Protect got a lot of love. We saw a lot of new camera options, and Enterprise NVR for large scale setups. We also saw a lot of progress on the software, which I’ll cover below.

2024 Hardware: Overall, Excellent

All in all, I think Ubiquiti did a great job with the hardware they released in 2024. It was an ambitious and relentless schedule, and for the most part I think think they pulled it off. The negative things I can point to — the USG going away and the Wi-Fi 7 2.4 GHz/IoT issues — shouldn’t take away from the dozens of great products they released.

I’m mostly interested in their networking products, and there are a lot of models to call out and recommend. Now that the gateway lineup is (likely, mostly) complete, I think there’s a model for everyone and a lot of good choices to build a network around. I’m running a Cloud Gateway Ultra at home and it’s been great for me. If the Max models were out then I probably would have picked one of those instead, but I have no complaints. The Enterprise models pushed the high end upwards, but I don’t have any experience with those, so I can’t say much else.

For UniFi switching, the Ultra is easier to recommend than the Lite 8 PoE or older 1st generation models if you need a small switch for a handful of PoE devices. The 2.5 Gbps version of the Flex Mini was another nice option if you just need a few ports and beyond gigabit speeds. The Pro Max and Enterprise Campus models filled out the top end, complimenting the Enterprise gateways and all of the software features that came along with those.

The new Wi-Fi 5 and 6 APs like the Swiss Army Knife and U6 Mesh Pro filled some holes in their lineup, and the new Wi-Fi 7 models are mostly excellent, especially at the high end. We’ll see more of those in 2025 I’m sure, and hopefully they can get their IoT/2.4 GHz issues ironed out.

I’d typically caution people from being early adopters in new categories like the UNAS Pro or Power Amp, but Ubiquiti seemed to do a good job with their first steps into those new areas. The positive reception of the UNAS Pro and UniFi Drive showed some growth and maturity for them as a company. It appears that they spent the time they needed to get things right from the beginning.

This is a big improvement from how they handled the transition from UniFi Video to UniFi Protect, and the initial state of things like UniFi Talk and Access. I don’t know how they’re juggling so many products, but it seems like they’re doing a better job of expanding their existing product areas and adding new ones.

Ubiquiti Software Releases in 2024

Just as relentless as the hardware releases, we saw a ton of software releases in 2024. UniFi Network went from 8.0 to 9.0, with an absolutely massive list of additions and improvements. UniFi Protect 5.0 brought a new and improved system architecture, better performance, h.265 encoding, ONVIF support, and a ton of features like Vantage Point. UniFi OS 4.0 brought shadow mode, and other UniFi OS releases improved a ton of things with how UniFi Gateways are managed.

If I can complain about anything on the software front, it’s the slower pace of progress with UISP. That’s probably my bias showing, but I wish Ubiquiti paid a bit more attention to UISP hardware and software. We still have EdgeRouters and EdgeSwitches in a very sad zombie state, with long gaps between minor software updates, and an unclear future. UISP hardware devices like the UISP Switches and UISP Routers did move forward with some nice software feature additions, but they pale in comparison to UniFi.

Here’s a month-by-month look at some of the major releases throughout the past year:

• January 

• UniFi OS 3.2.x added missing features like IGMP proxy, VLAN magic, hostname IPsec, DNS Shield, Loop provention to the UXG Lite and Express.

• EdgeRouter 3.0.0 RC 6 with local GUI overhaul, IPsec and Wireguard

• Connect 3.5.6 added YouTube mode

• WiFiman released for Windows

• UniFi Network 8.0.28 fixed some bugs

• UniFi Talk 2.2.3 with UK support

• SolarPoint 2.0.1 beta

• February

• UniFi Network 8.1 EA releases with OSPF, Network Viewer, Site Score, custom NAT pools, L3 ACLs, side panels, rotated topology view, and IPv6 improvements

• UniFi Protect 2.11.21 added animal and audio detections, vehicle type and color classification, multi-language support, and dark mode

• UniFi OS 3.2.12 released with SFP port and minor bug fixes

• March

• UniFi Network 8.1.113 went GA with features discussed in February

• Protect 3.0.22 added face recognition and person of interest alerts, multi-camera playback and archive to Google Drive

• UniFi Switch 7.0.44 added ACL rules, PoE usage, PoE and port locating controls added to touchscreens, increased max LAG groups

• Switch Ultra added custom port profiles and VLAN tagging

• UISP Router 5.0.0-rc.1 added local web GUI, OSPF, BGP, Wireguard, IPsec, logging improvements

• UISP Switch 1.8.0 added remote access via UISP and CLI for UISP Switch Plus

• SolarPoint 2.0.1 GA

• April

• UniFi Network 8.1.127 added bug fixes, improved firewall rule visibility, tunnel IPs and OSPF support for site-to-site VPNs

• UniFi OS 3.2.x added bug fixes for high CPU usage, crashes, and memory leaks

• Design Center 2.1.0 added more products, product selection wizard, Wi-Fi coverage, floorplan editor and PDF export

• UISP 2.4.93 added configurable/sortable devices view, local web interface access via UISP, data VLAN and traffic shaping for Wave, new import tool, bug fixes

• UISP Router/Console 5.0.1 finally goes GA

• EdgeRouter 3.0 RC 8

• May

• UniFi OS 4.0 EA added shadow mode, VLAN magic, IPv6 for local web interface, improved logging and SNMP support

• UniFi Network 8.2 EAs with ACL rules, custom DNS records, inspection page, BGP support (requires upcoming UniFi OS 4.1), Wi-Fi 7 MLO (requires AP 7.1.3 which we still haven’t seen).

• Announced as coming soon: 1:1 NAT, SSL/TLS decryption, sandboxing/anti-malware, packet captures

• UniFi Protect 4.x GA with re-architected NVR core engine, increased camera capacity, enhanced (h.265) encoding, new dashboard, Recording Manager and global settings, bulk export/archive, camera shortcuts and filtering, PTZ patrol mode, and custom GIF support for G4 Doorbell Pro

• UniFi Access 2.x with centralized location management, visualized unlock activity, enhanced live view, portal for device management, better performance

• June

• Site Manager 3.42 beta added Vantage Point, Zero Touch Provisioning (ZTP) and Update Manager

• UniFi OS 4.0.6 EA added automatic failover for Shadow Mode, SNMP, improved memory usage and VPN throughput

• UISP 2.4.126 EA with migration tools, bug fixes

• UniFi Talk 3.2.0 added number porting in the UK and international mode for 3rd party SIP servers

• July

• UniFi OS 4.0.6 went GA with VLAN Magic, SNMP, IPv6 local web interface, screen rotation and bug fixes

• UniFi Network 8.3.32 with custom NAT, domain whitelisting for Ad Blocking, improved inspections tab and downloadable logs, Suspicious Activity became Intrustion Prevention

• Site Manager 3.42.6, 3.44.1 GA added Vantage mode for Protect and ISP Viewer

• EdgeMAX got some small updates to local web interface and security fixes

• Protext 4.1.31 added Alarm Manager and export to SMB support

• August

• UniFi Network 8.4.59 added Passpoint / Hotspot 2.0, packet captures for APs and switch ports, AP Analyzer, Pro AV support and advanced IGMP snooping, UI enhancements, and ability to rename default network

• UniFi AP 7.1.18 EA added MLO on U7 Pro, Pro Max, Pro Wall, and Outdoor, still no GA release

• UniFi AP 7.0.66 and 6.6.77 added Hotspot 2.0 / Passpoint, packet captures, as well as roaming, Ethernet negotiation, and roaming fixes

• Protect Chime 1.7.14 added custom chime sounds and ringtones

• September

• Protect 5.0.33 added ONVIF support, archive to Dropbox, device tags, Storage Manager, improved recording service, and ability to pair Chime with multiple doorbells

• UniFi Network 8.4.622 GA had bug fixes and improved DNS Shield validation

• UniFi Network 8.5.1 and 8.5.5 EAs added improved dashboard, customizable widgets, NetFlow and SIEM server log export, packet capture on gateways, OpenVPN and IPsec for PBR on S2S VPNs, OSPF Neighbors visibility, WPA2/3 Enterprise mixed mode, egress rate limit for gateways, and stats in the AP Analyzer

• Network 8.5.5 EA included warning that USGs will not be supported in next release

• Site Manager 4.0 renamed UniFi OS Settings to Control Plane, added Co-located Consoles, increased Site Magic limit to 20, and added Site Support option for Cloud Keys, NVRs, and self-hosted Network Servers

• Switch Ultra 1.2.3 added Loop Protection

• UISP Power 1.1.2 added a local web GUI

• EdgeMAX EdgeSwitch 1.10.4 includes some bare minimum security updates

• October

• UniFi Drive debuts with UNAS Pro

• Network 8.5.6 goes GA

• Network 8.6.x EAs add 2.4 GHz enhanced IoT connectivity option, packet capture on WAN ports, improved search, and moved/renamed a few things

• UniFi OS 4.1.5 EA brought all the features requiring in from recent Network app updates: BGP, NetFlow, packet captures, etc

• UISP Router 5.1.0-rc.4 added captive portal for setup, improved USPF support, and updated a lot of underlying packages for better stability and security

• Switch Ultra and Flex Mini 2.0.5 added STP support

• EdgeRouter 3.0.0-rc.9 followed five months after rc.8, improved the config tree and UISP remote access, IPSec and wireguard bug fixes, and UI improvements

• November

• Network 8.6.9 and UISP Router 5.1.0 went GA

• UniFi OS 4.1.9 went GA for all UniFi OS devices, adding directory Integration, custom certificates (for web GUI), BGP, NetFlow, and packet captures.

• Protect 5.1.57 added Case Manager, Sensor Manager, long-promised NFC/Fingerprint support for G4 Doorbell Pro, thumbnails in push notifications

• UniFi AP 7.0.84 EA were one of many in a line of updates attempting to fix the U7 line issues with certain IoT devices and setups

• December

• Network 9.0.92 and 9.0.106 EAs with zone-based firewall, CyberSecure add-on for IPS/IDS, Network Application API, link aggregation support for EFG and UXG-Enterprise, SD-WAN hub & spoke networks, and increased default 5 GHz width to 80 MHz

• Protect 5.1.78 EA added ONVIF PTZ camera controls and improved recording resilency

Miscellaneous Ubiquiti News for 2024

Finally, for a bit of fun, here are some of the miscellaneous news for Ubiquiti over the past year.

• January - UNVR promo sale, cloud account requirement removed for UniFi Protect remote connections, EFG hit hit FCC, and the 2FA account requirement was announced

• February - FBI removed Russian malware from EdgeRouters, UWC announced, my $10K setup posts flooded Reddit, techspecs.ui.com got comparison tables and marketing images, and the UniFi Cable Internet was rebooting itself thanks to ISPs pushing out firmware early

• March - First UWC happens in Chicago, and we suffered through Screengate with slightly misaligned Cloud Gateway Ultra screens. We also got the new UniFi Portal iOS app, “UniFi GPT” AI advisor, and NAS rumors

• April - UWC London, USG and USG-Pro listed as legacy, G5 PTZ and Access Ultra rumors

• May - Custom GIF support for G4 Doorbell Pro, Tech Field Day presentations, UniFi Enterprise routing features and Wi-Fi 7 MLO promised

• June - Cody published Unifi Network Complete Setup 2024 and we got our first podcast review. Slow month!

• July - UniFi Cloud API and https://developer.ui.com/unifi-api/ announced

• August - Enterprise partner program and UWC Miami announced, UniFi Integrations video with Alarm Manager, Passpoint, Pro A/V and API

• September - The wait for UniFi OS 4.1 continued

• October - Free UISP hosting went away

• November - Black friday deals

• December - Holday sale

Hopefully 2024 was as good for you as it was for Ubiquiti’s hardware, software, and stock price. They’re a fun company to pay attention to and write about. I think we’re in for a very busy 2025 as well.

Cheers, and happy holidays!

Originally Posted: December 3rd, 2025

UniFi Enterprise Wi-Fi 7

E7, E7 Campus, and E7 Enterprise Overview

Yesterday, Ubiquiti announced the first Early Access build of UniFi Network version 9 with some big feature additions: zone-based firewall rules, an optional CyberSecure subscription to improve Suricata IDS/IPS, and the Network Application API. They also released a video announcing three new Wi-Fi 7 access points: the E7, E7 Campus, and E7 Audience.

While UniFi Network version 9 is exciting, this article focuses on the new hardware. Let’s take them one by one before we zoom out and discuss where they fit in the lineup and what this all means.

E7: Don’t Call It Enterprise?

Curiously, the first model is simply called E7. Ubiquiti has mostly used a naming convention of generation-model for their UniFi access points. The U7-Pro followed the U6-Pro, which followed the AC-Pro. Following that, I would expect this to be the U7-Enterprise, a generational jump over the Wi-Fi 6E flagship U6-Enterprise.

It’s actually a bit deeper than the shortened name. The three E7 models are part of a new enterprise category, a tier above the normal flagship models. The U6-Enterprise is not an “enterprise” model, only these three new E7 models are.

Ubiquiti explains the different categories like this:

• Enterprise: Incredible 1,000+ client capacity, long-range 6 GHz performance, and 10 GbE PoE connectivity with native high availability architecture for critical enterprise environments.

• Flagship: High-performance ceiling-mounted access points.

• Wall: Sleek APs that plug directly into a wall outlet for meshed connectivity*, or transform an ethernet drop into an AP.

• Outdoor: Versatile, weatherproof APs that can be mounted to poles outside, or conveniently placed on a surface indoors.

• Mega Capacity: Great for stadiums or amphitheaters with a very high density of connected devices.

• Building Bridge: Serves as a high-performance network bridge, without the wire.

No matter how you categorize it, the E7 is for sale now in the US ($499 USD) and other regions. From the Ubiquiti store page for the E7:

Enterprise-grade indoor access point with 10-stream WiFi 7 performance, a 10 GbE uplink, and a redundant GbE port for high availability.

- WiFi 7 with 6 GHz support
- 10 spatial streams
- Real-time spectral analysis for enhanced channel selection
- Dedicated spectral analyzer radio
- Long-range 6 GHz performance with AFC (Available in FCC/IC region only)
- 185 m² (2,000 ft²) coverage
- 1,000+ connected devices
- (1) 10 GbE RJ45 port and (1) GbE RJ45 port for power & data redundancy
- Backwards compatible mounting system (WiFi Access Point Ceiling Mounts)
- Powered using PoE++

Note: 6 GHz operation is supported in these countries.

View fullsize

View fullsize

View fullsize

View fullsize

Until now, the best Wi-Fi 7 omnidirectional indoor access points you could get were the U7 Pro or U7 Pro Max. The U7 Pro ($189) was the first, and is still the entry-level model for Wi-Fi 7. It is a tri-band BE10800 class AP with 2x2 radios for 2.4 GHz, 5 GHz, and 6 GHz. It requires PoE+, can only be used indoors, and has a single 2.5 Gbps RJ45 Ethernet port.

The U7 Pro Max ($279) upgrades the 5 GHz radio to 4x4 and increases transmit power, client capacity, and coverage area. It also adds a spectral analysis radio which is used in the UniFi Network Application to scan the RF environment, pick better channels, and monitor for issues.

So, what does the E7 ($499) add over the U7 Pro and U7 Pro Max? More spatial streams and more throughput on 6 GHz, more coverage capacity and area, dual uplinks with one 10 Gbps and one 1 Gbps RJ45 port, and — because, of course — RGB lighting. The E7 is also the first standard power 6 GHz AP from UniFi, where all previous models were low-power indoor. I covered the difference between SP and LPI back in 2021, but I’ll discuss that more below.

There are a lot of details to consider, so it’s helpful to see a direct spec comparison of all of the Enterprise models, and all of the Wi-Fi 7 UniFi APs.

View fullsize

View fullsize

Across all categories, the E7 is the most technically impressive omnidirectional AP UniFi offers. For nearly double the price of the U6 Enterprise or U7 Pro Max, you get more features and more power. You’ll need to weigh how much those are worth to you.

On the other hand, if the E7 isn’t enough or you want 6 GHz coverage outdoors, let’s take a look at the E7 Campus.

E7 Campus: Outdoor with PRISM RF-Filtering

The E7 Campus looks like the regular E7 at first glance, but it’s different in a few key areas.

The name lines up with their new Enterprise Campus line of UniFi switches, which are focused on very-high throughput and high availability. The E7 Campus AP features the same 10-stream set of radios as the E7, with the same transmit power. The E7 Campus adds a few unique features:

• High-gain directional antennas: 9 dBi for 2.4 GHz, and 12 dBi for 5 GHz and 6 GHz.

• You can use the U7 Campus outdoors. It’s waterproof and rated at IPX6, or IP67 if you use the included port and cable cover kit. See their UniFi Device IP and IK Ratings help article for more specifics.

• You can mount it to a ceiling, wall, pole, or 100x100 VESA mount with the included articulating mount.

• It features PRISM™ RF filtering — previously found in the AirMAX 5AC Gen2 point-to-multipoint APs like the AirMAC Rocket 5AC Prism or PrismStation 5AC. The feature is all-caps now, but it performs the same function as before. It filters out surrounding RF noise from the environment or other APs. This leads to less noise, higher SNR, improved efficiency, and ultimately, better performance.

It’s not for sale yet, but it will be available for $799 USD in January 2025. From the Ubiquiti store page for the E7 Campus:

Enterprise-grade indoor/outdoor access point with ‎10-stream‎ ‎‎WiFi 7 performance, PRISM™ active RF filtering technology, and integrated directional antennas.

- WiFi 7 with 6 GHz support
- 10 spatial streams
- Real-time spectral analysis for enhanced channel selection
- High selectivity PRISM™ RF filtering technology
- Dedicated spectral analyzer radio
- Directional high gain antenna array
- Long-range 6 GHz performance with AFC (Available in FCC/IC region only.)
- 465 m² (5,000 ft²) coverage and 1,000+ connected devices
- (1) 10 GbE RJ45 port and (1) GbE RJ45 port for power & data redundancy
- Versatile articulating wall/pole mount for precise position (included), VESA 100x100 compatibility
- Powered using PoE++

Note: 6 GHz operation is supported in these countries.

View fullsize

View fullsize

View fullsize

View fullsize

E7 Campus Antenna and Coverage Differences

The E7 Campus spec list is light on specifics, but the antenna differences are worth discussing. The lower-gain antennas in models like the U7 Pro, U7 Pro Max, and E7 are omnidirectional and designed to evenly cover a broad area. The higher-gain antennas in the E7 Campus are meant for long-range coverage in a concentrated area.

As a general rule, the higher gain an antenna is, the more directional it is. To reach long distances, you have to give up broad coverage. These high-gain antennas make the E7 Campus not the best option for evenly covering a broad area. You can still mount it on a ceiling, but the coverage pattern of the E7 Campus won’t be the same as other omnidirectional models like the E7 or U7 Pro.

They haven’t updated their antenna radiation charts to show these new models yet, but I suspect that the E7 Campus is going to be heavily weighted to push signal out of the top of the AP. Whether you mount it on a ceiling, wall, or pole, you’ll want to face the flat white top of the AP towards the area you want to cover. You’ll also want to carefully consider placement and cell sizes when planning a network with these APs.

A better model to compare the E7 Campus against might be the U7 Outdoor. The U7 Outdoor also has high-gain directional antennas. The U7 Outdoor’s internal 5 GHz antenna is specified as 12.5 dBi, with a 45° beamwidth. The 12 dBi antennas in the E7 Campus should be similar, and cover a roughly 45° arc over long distances. The U7 Outdoor features RP-SMA to connect other antennas like the included 4 dBi omni antennas, but you’re stuck with the internal ones on the E7 Campus.

You don’t have to use the E7 Campus outdoors, you could also use it in a large indoor space, like say in a warehouse. You could use multiple E7 Campus APs to break up a large space into multiple smaller coverage cells. Combined with the spectral analysis radio and RF-filtering, the E7 Campus should be a significantly more capable AP for those kind of situations.

We’ll need to wait until January 2025 to get real-world reviews of how this all works in practice. Until then, the promise of what this AP can do is exciting, just don’t expect it to be a drop-in replacement for an omnidirectional AP you currently have.

View fullsize

E7 Audience: An Upgraded BaseStation XG

Finally, we have the most expensive and most niche of the three models. The E7 Audience is a spiritual successor to the Wi-Fi 5 BaseStation XG (UWB-XG). These two mega capacity models are designed for truly large networks — picture an arena or stadium, conference center, or large outdoor event.

Their unique design and capabilities are meant to be used in those kind of demanding situations, and are definitely not meant to be a normal AP in a normal Wi-Fi network. These are for the highest-density and highest-end Wi-Fi networks.

From the Ubiquiti store page for the E7 Audience:

Enterprise-grade, indoor/outdoor access point designed for high-density environments with 12-stream 5 GHz and 6 GHz WiFi 7 performance, a 10 GbE uplink, and a redundant GbE port for high availability.

- WiFi 7 with 6 GHz support
- 12 spatial streams
- Real-time spectral analysis for enhanced channel selection
- High selectivity PRISM™ RF filtering technology
- Dedicated spectral analyzer radio
- Selectable directional beamforming antenna (15 dBi, 50° or 11 dBi, 90°) allows for cell size optimization
- Long-range 6 GHz performance with AFC (Available in FCC/IC region only.)
- 465+ m² (5,000+ ft²) open space coverage
- 1,500+ connected devices
- (1) 10 GbE RJ45 port and (1) GbE RJ45 port for power & data redundancy
- Versatile wall and pole mounting
- Powered using PoE++
- IP68 Waterproof

View fullsize

View fullsize

View fullsize

View fullsize

I’ve wondered for a long time if we would ever see an updated BaseStation XG. The Wi-Fi 6 era came and went without one. I can’t image Ubiquiti sells a ton of these, so maybe it was a lower priority. Maybe they wanted to wait until all the technical pieces — Wi-Fi 7, 6 GHz, and standard power operation — were in place before releasing a new model.

Either way, the E7 Audience is a big jump over the BaseStation XG. The BaseStation XG may be the better option for 5 GHz today. As we build our way to the Wi-Fi 7 and 6 GHz future, the E7 Audience will stand alone as the top option when it’s released in March 2025.

View fullsize

UniFi E7 Details and Nit Picks

Low-Power Indoor (LPI) 6 GHz APs

As I mentioned above, the differences between low-power indoor (LPI) and standard power 6 GHz APs are important. This is a complex topic, but I’ll try to keep this simple and understandable. If I’ve missed anything or got anything wrong, please let me know. We’ll start with LPI models like the U7 Pro.

Effective isometric radiated power (EIRP) is a measure of the power output of a radio. Based on where you are in the world and which channels you are using, there are different limits to EIRP. For 6 GHz in the US, LPI models like the U7 Pro are limited to 30 dBm EIRP. Also, as the name implies, they can only operate indoors.

6 GHz isn’t the same as 5 GHz or 2.4 GHz when it comes to EIRP and power limits. The maximum EIRP for LPI APs changes based on channel width. 6 GHz mandates a maximum Power Spectral Density limit, or PSD. For LPI APs, this limit is 5 dBm/MHz.

This means that the EIRP limit for 6 GHz LPI access points increases with wider channels. For the U7 Pro to operate at the maximum 30 dBm EIRP, you need to use a 320 MHz channel. With every reduction in channel width comes a reduction in power. This is a good thing though, as it encourages the use of wider channels.

With 2.4 GHz and 5 GHz, there is a noise penalty with wider channels. Every time you double the channel width, you also double the noise. With a static maximum EIRP, narrow channels have an advantage. Wider channels tend to be noisier and less efficient.

With LPI 6 GHz APs, there is still a noise penalty with wider channels. However, every time you double the channel width, you can also double (+3 dBi) your transmission power. Standard power APs have slightly different rules though.

AFC and Standard Power 6 GHz APs

Standard power APs like the E7 have slightly different constraints. They can be used outdoors, and have a much higher PSD limit of 23 dBm/MHz. They are limited to just the U-NII-5 and U-NII-7 channels, and an absolute maximum of 36 dBm EIRP.

While a 6 dBm increase over LPI may not sound like a lot, the logarithmic scale means that is a 4X increase in power. Also, it’s important to remember that due to a higher PSD limit, you can operate at higher power even when using narrower channels.

While standard power APs can operate at higher power and outdoors, they are required to use Automated Frequency Coordination (AFC). The AFC system leverages GPS to ensure that there are no incumbent users trying to access the same channels in the same area. These would typically be for things like links to geostationary satellites, or television broadcasts.

On top of all this complexity is the fact that 6 GHz operation rules vary by region. Currently these E7 models can only operate as standard power in the USA (FCC) or Europe (IC) regions. They operate as LPI APs in all other regions, but that may change in the future as regulations are approved and rules are changed.

Along with these higher power limits, the addition of outdoor operation is a huge landmark. It’s been a long few years of waiting for the AFC system and everything to be worked out, but I am so glad to see more outdoor and standard power 6 GHz equipment available.

These features excite RF nerds like me. More importantly, they allow for better and more-scalable Wi-Fi networks to be built, which will improve everyone’s experience going forward. It’s an exciting time for wireless networks.

Nit Pick: Coverage Area and Concurrent Clients

Recently Ubiquiti started specifying the estimated coverage area for each AP model. It was a useful addition, but it’s worth taking this claim with a grain of salt. A claim of 185 m² / 2,000 ft² doesn’t mean that it’s guaranteed to cover exactly that much area. It also doesn’t mean that a 20,000 ft² building is going to be covered by exactly 10 APs. That said, it’s a useful metric to have when comparing models. It’s much clearer than the complicated math of TX power, antenna gain, and EIRP.

The flip side of this has been the client capacity numbers that are advertised. These numbers are absurd, with the U7 Pro claiming over 300 clients, and the U7 Pro Max claiming over 500. Can they connect that many clients at once? In a lab, I’m sure. The real world is different.

It doesn’t matter how great the AP is, if several hundred clients are connected and active at once, no one will be happy. All of those clients will have low throughput and high latency, or try to roam to a less-crowded AP. Even with Wi-Fi 7, 6 GHz, and the widest channels possible, there’s a limited amount of airtime for transmissions. The more clients you have, the less each can use.

While you may be able to get 300, or 500, or even 1000 clients to associate to a single access point, if more than a small fraction of them are active at once, it’s not going to work well. Ubiquiti was challenged on this by Wi-Fi legend Keith Parsons in their Wi-Fi Field Day talk. That whole session is worth watching, but I really loved that portion.

Despite the push back from professionals, they are still making these inflated concurrent client claims. I think you should dismiss them as marketing numbers, and never plan to push a single AP to the limits they define. High-density wireless networks are hard to design and perfect, and claims of 1000+ clients per AP only muddy the water and set up false expectations.

Is UniFi Enterprise-Grade Yet?

To wrap up this news, I can’t help but reflect on this past year and all of the hardware and software we’ve seen from Ubiquiti. It’s been pointed out often that despite their marketing, UniFi isn’t truly enterprise-grade. Discussions from 5 years ago sound a lot like the discussions you’ll hear today. A lot of it comes down to the definition of the word enterprise, and what that means to you or your company.

For me, in my day job and my career as a network engineer, UniFi is not enterprise-grade. We use Cisco for switching and wireless, and our CTO will never approve of UniFi in our production facilities. If it were up to me, I would be OK with using UniFi switching and wireless in our offices or smaller locations. UniFi gateways and their firewall and routing capabilities are a discussion for another time, I just want to focus on wireless and switching here.

UniFi has had a reputation for a long time of being pretty to look at but sometimes ugly to use. There are years of history backing that up with buggy software, and promises that were bigger than what was delivered. Their lack of licenses and subscription fees is good, but their perceived unreliability and lack of support are non-starters.

I think that time is coming to a close, but there is some lag between reality and their reputation. It will take time to change their perception, and for more businesses and “enterprise” customers to start considering a UniFi network. It’s up to Ubiquiti to prove that.

On the UI Chat podcast, we’ve been reviewing the monthly Ubiquiti news. We pay more attention than most to Ubiquiti’s every move, but even for me it’s been overwhelming at times. I think for the average technical person, they’ve either made up their mind years ago that UniFi isn’t serious enough for their needs, or they just aren’t aware of all that has changed.

Just focusing on the UniFi Network software itself, the amount of progress over the past year has been impressive. BGP, OSPF, spectrum analysis, native packet capture, custom NAT, better logging, Wi-Fi 7 MLO, L3 and L2 ACLs — the list goes on. Add in the countless hardware options and the ecosystem they’ve built around it, it’s a good option for a lot of different networks and needs.

I still have complaints and you probably still have some reservations, but I believe this year has proved that UniFi is a serious competitor and worth considering. They are growing up, expanding, and maturing. They are fixing long-standing issues and delivering a seemingly non-stop flow of major software and hardware releases. They do some things better than their competitors — design, ease of use, cost — but still have things to catch up on and areas to improve. No vendor is perfect.

These three new access points are just another step on UniFi’s Enterprise-Grade™️ journey, but when you take a broader view and look at all the steps they’ve taken, it’s a compelling story. It’s hard to be unimpressed with everything they’ve done in 2024.

I don’t know about you, but I’m excited for what’s next.

Originally Posted: October 5th, 2024

In case you missed it, the September 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

This time we had a special guest: Chris Sherwood from the Crosstalk Solutions YouTube channel! His channel helped me get interested in UniFi way back in 2016, and I’ve watched a ton of his videos over the years. So this was a nice full-circle moment for me, and it was great to get his perspective on Ubiquiti and their latest releases.

We covered the new hardware releases of the Enterprise NVR and Flex Mini 2.5G. On the software side we covered Protect version 5, UniFi Network v8.4.62, and the first two v8.5 EA releases (v8.5.1 and v8.5.5). We also discussed the death of the USG, how much we love ITDRC, Site Manager updates, and some other minor software releases.

I’ve been dreadfully slow with posting things this summer, and I’ve missed linking a few UI Chat shows since May. So don’t forget to check out our previous episodes, like in August when we had the great Jesse Nowlin (@MrJNowlin) from Tab Geeks and my cat on as guests.

See the links below for the podcast audio, and subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcastor you can email the show, info@theinterface.uk.

UI Chat Podcast Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @TechMcCann

• Guest Host: @crosstalksol from crosstalksolutions.com

• Recorded using @SquadCastFM and hosted with @CastosHQ

Originally Posted: August 28th, 2024

Gotta Catch ‘Em All: UniFi Cloud Gateway Pokémon Cards

I found Pokécardmaker.net the other day, and was inspired to make these for a bit of fun.

I imagined each UniFi Cloud Gateway as a Pokémon, and tried to think of their unique abilities and attacks. I spent a bit too much time putting in little Easter eggs and details. I posted them to Reddit, but those had a few small mistakes and changes I wanted to make. The slightly tweaked versions are below.

If you’re not familiar with UniFi or Pokémon, you might be confused or think I’m a huge nerd. You wouldn’t be wrong. For those that are familiar, hopefully these bring you a little joy.

View fullsize

View fullsize

View fullsize

View fullsize

View fullsize

View fullsize

View fullsize

View fullsize

View fullsize

View fullsize

Originally Posted: June 2nd, 2024

In case you missed it, the May 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

This month we recorded the day before Ubiquiti announced the U7 Pro Max, U7 Pro Wall, and U7 Outdoor. So of course, we started by talking about the Mobility Field Day talks and the vague details about the U7 Pro Max we did know at the time. We also talk about new hardware from May, the U6 Mesh Pro, Pro Max 16 switch, and the latest round of software updates.

At the end, we have a brief talk about Alex’s new website for The Interface, Webflow, and how we regret some of our early publishing decisions and hosting platforms choices.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat Podcast Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @TechMcCann

• Recorded using @SquadCastFM and hosted with @CastosHQ

Originally Posted: May 31st, 2024

Yesterday, Ubiquiti announced three new Wi-Fi 7 models:

• U7 Pro Max

• U7 Pro Wall

• U7 Outdoor

These three join the U7 Pro, for a total of four different Wi-Fi 7 APs in the UniFi lineup. Since they were just announced and I don’t have any of the hardware in hand, this preview will summarize the news and the specs that were released. All three of these models are interesting in their own way, but we’ll start with the biggest and most expensive, the U7 Pro Max.

U7 Pro Max

From Ubiquiti’s store page for the U7 Pro Max

Ceiling-mounted WiFi 7 AP with 8 spatial streams, 6 GHz support, and a dedicated spectral scanning engine for interference-free WiFi in demanding, large-scale environments.

- WiFi 7 with 6 GHz support
- 8 spatial streams
- Real-time spectral analysis for enhanced channel selection*
- 160 m² (1,750 ft²) coverage
- 500+ connected devices
- Powered using PoE+
- 2.5 GbE uplink
- $279 US MSRP
- Note. 6 GHz operation is supported in these countries.
- Multi-Link Operation (MLO) capability is coming soon and will be provided via software update.

The U7 Pro Max is another in the “flagship” category, which are the normal disc-shaped omnidirectional APs you typically mount to a wall or a ceiling. These offer broad coverage for an indoor space, and are the default options for homes, businesses, and general use.

U7 Pro Max Key Specs

• Networking interface: (1) 1/2.5 Gbps RJ45 port

• Management interface: Ethernet

• Power method: PoE+

• Power supply: UniFi PoE switch (read: no PoE injector included)

• Max. power consumption: 22W

• Max. TX power

  • 2.4 GHz: 23 dBm

  • 5 GHz: 29 dBm

  • 6 GHz: 23 dBm

• MIMO

  • 2.4 GHz: 2 x 2

  • 5 GHz: 4 x 4

  • 6 GHz: 2 x 2

• Throughput rate

  • 2.4 GHz: 688 Mbps

  • 5 GHz: 8648 Mbps

  • 6 GHz: 5765 Mbps

• Antenna gain

  • 2.4 GHz: 4 dBi

  • 5 GHz: 6 dBi

  • 6 GHz: 5.9 dBi

• Claimed coverage: 160 m² (1,750 ft²)

• Mounting: Wall, ceiling (Included)

• Ambient operating temperature: -30 to 60° C (-22 to 140° F)

• Environment: Indoor (no weatherproofing rating)

View fullsize

View fullsize

U7 Pro vs. U7 Pro Max

The U7 Pro Max is similar to the regular U7 Pro, with a few significant improvements.

• 5 GHz MIMO: 2x2 vs. 4x4

• 5 GHz Throughput: 2882 Mbps vs. 8648 Mbps

• 2.4 GHz TX power: 22 dBm vs. 23 dBm

• 5 GHz TX power: 26 dBm vs. 29 dBm

• Claimed coverage: 1,500 ft² vs. 1,750 ft² (140 m² vs. 160 m²)

• US MSRP: $189 vs. $279

• The U7 Pro Max adds the spectral analysis radio

Arguably the biggest difference with the the Pro Max is the inclusion of a radio dedicated to real-time spectral analysis. We don’t have a ton of details about the function of this, but Ubiquiti says that this will help with enhanced channel selection, continuous background packet, and spectrum capture. From their YouTube announcement video:

Dedicated spectral engine for continuous background packet and spectrum capture. The engine is capable of providing real-time spectral analysis with impressive NEXT AI continuous packet capture capabilities soon to follow.

Many other vendors have similar features on their high-end APs, but we’ll have to wait to see the details of what Ubiquiti has planned outside of those few sentences and video preview. It looks promising and more fleshed out than the AirView feature was on the AC-SHD, but the software isn’t here yet.

The AC-SHD is a good reminder that you should never buy a product based on a promise. I have faith that Ubiquiti will deliver on their promises this time, but it’s wise to wait until the software is finished and these features are delivered before investing in the hardware.

Outside of the spectrum analysis radio and the upcoming software features that will leverage it, the U7 Pro Max is a reasonable step up in price and performance from the U7 Pro. It also compares well to the U6 Enterprise, which is the same price.

We are going to see more models in the future to flesh out the Wi-Fi 7 lineup. We’ll likely see a U7 Enterprise above the Pro Max, and probably a Lite and Long Range model below. Those considering the U6 Enterprise or any of the other Wi-Fi 6 or Wi-Fi 6E models should consider these two Wi-Fi 7 options, and keep an eye out for more models coming soon.

While we’re waiting, here is a comparison of all the Wi-Fi 6/6E/7 flagship omnidirectional UniFi APs you can currently buy.

U7 Pro Wall

Next is the U7 Pro Wall, the first Wi-Fi 7 model meant to be mounted in a wall outlet.

From Ubiquiti’s store page for the U7 Pro Wall.

Wall-mounted WiFi 7 AP with 6 spatial streams and 6 GHz support tailored for home builders with seamless installation options.

- WiFi 7 with 6 GHz support
- 6 spatial streams
- 140 m² (1,500 ft²) coverage
- 300+ connected devices
- Powered using PoE+
- 2.5 GbE uplink
- Versatile deployment with optional Flush Mount and Table Stand accessories*

U7 Pro Wall Key Specs

• Networking interface: (1) 1/2.5 Gbps RJ45 port

• Management interface: Ethernet

• Power method: PoE+

• Power supply: UniFi PoE switch (read: no PoE injector included)

• Max. power consumption: 22W

• Max. TX power

  • 2.4 GHz: 22 dBm

  • 5 GHz: 26 dBm

  • 6 GHz: 23 dBm

• MIMO

  • 2.4 GHz: 2 x 2

  • 5 GHz: 2 x 2

  • 6 GHz: 2 x 2

• Throughput rate

  • 2.4 GHz: 688 Mbps

  • 5 GHz: 4324 Mbps

  • 6 GHz: 5764 Mbps

• Antenna gain

  • 2.4 GHz: 4 dBi

  • 5 GHz: 5 dBi

  • 6 GHz: 6 dBi

• LEDs: White/blue

• Claimed Coverage: 140 m² (1,500 ft²)

• Mounting:

  • Wall (Included)

  • Table stand, flush mount (Optional)

• Ambient operating temperature: -30 to 60° C (-22 to 140° F)

• Environment: Indoor (no weatherproofing rating)

View fullsize

View fullsize

View fullsize

View fullsize

U7 Pro Wall vs. other In-Wall models

UniFi offers many wall or in-wall APs, from the ancient AC-In-Wall to the U6-In-Wall and U6-Enterprise-In-Wall (Wi-Fi 6E) models. These have all come with built-in switch ports in the past, as well as PoE passthrough. You might see them in a bedroom or hotel room, or maybe behind an entertainment center with Ethernet running to a few bandwidth heavy devices. They’re a handy combination of switch and AP, but the U7 Pro Wall doesn’t include any switch ports.

Ubiquiti confirmed in the YouTube video comments that another wall model is coming that does, so keep waiting if that’s what you’re looking for.

A traditional In-Wall design with a built-in switch is in development for UniFi 7. The U7 Pro Wall is the first design in a series of UniFi 7 APs for wall-mount applications. It's tailored for seamless installation, especially with its Paintable Flush Mount accessory that enables near-invisible, recessed installation. Stay tuned for more UniFi 7 updates.

My assumption is that it is a size/cost/heat thing, and that's why they are splitting it into (at least) two models. Three radios generate a fair bit of heat, and you need room for all the required components and antennas.

Basically, it's tri-band, small/cheap, or built-in switch. Pick two.

• U6-In-Wall = small/cheap and built-in switch, but dual-band.

• U6-Enterprise-In-Wall = tri-band and built-in switch, but big and expensive.

• U7-Pro-Wall = tri-band and small/cheap, but no built-in switch.

• U7 Pro Max/Enterprise Wall = tri-band and built-in switch, but big and expensive.

Whatever it's called, the U7 Wall model with built-in switch ports is probably going to require a double-width enclosure like the U6-Enterprise-In-Wall. It'll probably require PoE++ for passthough, and be around $299 too.

If you’re OK without the extra ports, the U7 Pro Wall is similar to the U7 Pro from a radio and performance perspective. For $20 more than the U6-In-Wall and $100 less than the Enterprise version, you’ll have to consider what tradeoffs you want to make.

Below is a comparison of all of the wall and in-wall UniFi AP models. Note that the In-Wall HD isn’t listed in the store anymore, and the BeaconHD and U6-Extender don’t offer any Ethernet connections. The main models to compare against are the U6 In-Wall and U6 Enterprise In-Wall. The AC In-Wall is well past it’s expiration date. Even though it is still for sale, I wouldn’t recommend buying one new in 2024.

U7 Outdoor

Finally, we have the U7 Outdoor, which follows on the heels of the release of the U6 Mesh Pro. While the U6 Mesh Pro was a drop in replacement for the AC Mesh Pro with the same enclosure and some newer radios, the U7 Outdoor is something new.

From Ubiquiti’s store page for the U7 Outdoor:

All-weather WiFi 7 AP with 4 spatial streams, an integrated directional super antenna, and versatile mounting options.

- WiFi 7
- 4 spatial streams
- 465 m² (5,000 ft²) open space coverage with the integrated directional super antenna
- Software-adjustable antenna beamwidth for balanced coverage with the included omni antennas
- 200+ connected devices
- Powered using PoE+
- 2.5 GbE uplink
- Versatile wall and pole mounting
- Weatherproof (outdoor exposed)
- US MSRP: $199, available June 17th.

U7 Outdoor Key Specs

• Networking interface: (1) 1/2.5 Gbps RJ45 port

• Management interface: Ethernet

• Power method: PoE+

• Power supply: UniFi PoE switch (read: no PoE injector included)

• Max. power consumption: 19W

• Max. TX power

  • 2.4 GHz: 23 dBm

  • 5 GHz: 26 dBm

• MIMO

  • 2.4 GHz: 2 x 2

  • 5 GHz: 2 x 2

• Throughput rate

  • 2.4 GHz: 688 Mbps

  • 5 GHz: 4324 Mbps

• Antennas

  • (1) Directional internal antenna

  • (2) External omni antennas

  • (2) RP-SMA connectors for external antenna

• 2.4 GHz Antenna gain:

  • Directional internal: 8 dBi

  • External omni: 3 dBi

• 5 GHz Antenna gain:

  • Directional internal: 12.5 dBi

  • External omni: 4 dBi

• Internal antenna beamwidth (configurable)

  • 2.4 GHz: 90°

  • 5 GHz: 45°

• LEDs: White/blue, mesh signal

• Claimed Coverage: 465 m² (5,000 ft²) open space coverage with the integrated directional super antenna

• Mounting: Wall, ceiling, pole (Included)

• Ambient operating temperature: -30 to 60° C (-22 to 140° F)

• Environment: Outdoor

• Pole mount diameter: 25–60 mm (1–2.36") on pipe outer diameter

• Wind survivability: 74.6 N at 200 km/h (16.8 lbf at 125 mph)

• Weatherproofing: IPX6

View fullsize

View fullsize

View fullsize

View fullsize

Before we get into the asterisks and open questions, here is a comparison of all the outdoor UniFi AP models:

U7 Outdoor Initial Impressions

There’s a lot to discuss here, but we’ll start with the disappointing things. There is no 6 GHz radio.

My speculation is that outdoor 6 GHz operation is something a future model will have. Standard power and outdoor operation of 6 GHz is still a regulation headache, even if you only consider the US. The world is still working on adopting the specific rules. Outdoor 6 GHz operation and standard power APs also require using AFC and built-in GPS. We’ll get outdoor 6 GHz from UniFi eventually, but it’s not here yet. When it is here, it will probably cost more than $199. If 6 GHz is a deal breaker and you want to spend the extra money for it, you’ll need to wait.

Another odd thing is the recessed RP-SMA connectors at the top of the device. Since this is meant for outdoor use and is IPX5 rated, I assume those are waterproof. I’ve dealt with my fair share of rusted connectors and weathered APs though, so I’m curious what will happen to those connectors if you install it outdoors without antennas attached. It looks like there are little plastic caps, but that’s not easy to see in the product images. Do you need to install antennas or use the caps for it to be waterproof? What happens if you uninstall the antennas and lose those little plastic caps? Will it all hold up over time?

For reference, as described in UniFi Device IP and IK Ratings, IPX5 means that it is not rated for dust resistance, but it has “water jets” level liquid protection. It should hold up to heavy direct rain, and it matches the IPX5 rating of the U6 Mesh. The U6 Mesh Pro and Swiss Army Knife Ultra are both IPX6 rated, though.

Now on to the good stuff. The U7 Outdoor has unique internal antennas. They isn’t meant for broadcasting over a broad area, they are directional and configurable. The spec list shows a 90° beamwidth and 8 dBi for 2.4 GHz, and 45° beamwidth and 12 dBi for 5 GHz. Antennas and beam patterns are 3 dimension things though, and they don’t specify the vertical beamwidth.

They have not mentioned the specifics of how they are configurable, and they haven’t released their radiation patterns either. Add those to the list of details we’ll need to wait for.

Thankfully, they also include 3 dBi / 4 dBi omnidirectional antennas, which you can switch to in a drop down menu. If you don’t want the directional high gain coverage pattern, pop on the omnidirectional antennas or other standard RP-SMA antennas if you prefer.

Despite the limitation of dual-band and lacking 6 GHz, the powerful and unique antenna configuration makes it a great choice for covering a large outdoor space. I can see a lot of people mounting these on a wall to cover their backyard, or mounting on a pole to cover a big outdoor area.

Zooming Out: Three Exciting Releases

Stepping back and looking at these three new APs and Wi-Fi 7 as a whole, there is a lot to be excited about.

The U7 Pro Max is a nice step up from the regular Pro, and I’m excited to hear more about what software features are going to be enabled by the spectrum analysis tool. The history of the AC-SHD gives me some pause, but I’m optimistic.

The U7 Pro Wall is a nice compliment to the U6 In-Wall and U6-Enterprise-In-Wall, especially if you don’t plan to leverage any of the built-in switch ports for downstream devices. If you want Wi-Fi and built-in switch ports or PoE passthrough, keep waiting.

Despite the lack of 6 GHz, the U7 Outdoor is the AP I’m most excited about. I love outdoor wireless, and UniFi APs are the foundation of a ton of cost-effective outdoor, public, or event Wi-Fi. The U7 Outdoor offers a lot of value, and features that are not found on any of the other outdoor models. It is a welcome addition to the outdoor line.

Note: Defending 2.5 Gbps Uplinks

Oh, and one last thing — I have seen a lot of commenters disappointed that these “only” have 2.5 Gbps RJ45 connections. Yes, Wi-Fi 6/6E/7 APs like these can offer more than 2.5 Gbps of throughput, but I would argue that 2.5 Gbps is more than enough for a single access point. Reliability, airtime utilization, and aggregate performance are more important in large wireless networks.

I wrote a bit about the realities of Wi-Fi data rates vs. real-world speeds in Understanding Wi-Fi Speed and How 6 GHz Compares, but it boils down to this. Quoted data rates are a speed limit, and you only get silly specs like “9.3 Gbps over-the-air speed” by combining all radios into one number. You’ll only achieve a fraction of these aggregate throughput claims. Even then, you’ll only get those multi-gigabit numbers in ideal conditions. Wi-Fi is almost never ideal.

Optimizing for the best-case scenario, with modern clients using the widest possible channels and highest possible data rates is not good engineering. In a typical multi-AP environment, the limit is not the speed of the wire between your switch an AP. It’s airtime, and likely the source of the bandwidth you are downloading from or uploading to.

Yes, in extreme scenarios, if you have a multi-gigabit WAN or LAN, modern Wi-Fi clients, clear and wide channels, no other users, and a bandwidth-heavy application, you’ll be limited by the 2.5 Gbps uplink. If that’s the case though, that device should probably be plugged into the network.

For the foreseeable future, wires will always win for reliability and speed. Increasing the cost and power draw of every AP to include 10 Gbps interfaces for this corner case is a losing argument. You can blame Ubiquiti, or Qualcomm, or the networking industry at large, but that’s the unfortunate reality. I’d love to see 10 Gbps Ethernet be more common, and it’s a shame that gigabit has stuck around as the default option for so long. Sadly, in most cases, it still is good enough. Some may argue that 2.5 Gbps is a pointless half-step, and I can’t say I disagree. That doesn’t make 10 Gbps components cheaper or more common.

Instead of arguing, I choose to enjoy wireless for the convenience it offers, and view these specifications and limits through a real-world lens. Wi-Fi is an amazing technology, and Wi-Fi 7 offers a lot of significant improvements to be excited about. It’s a good time to be a fan of wireless.

In my opinion, Ubiquiti is firing on all cylinders lately. There has been a lot of progress in UniFi software, and they are releasing more hardware than I can keep up with. The jury is still out on how their push into enterprise will go, or if they will deliver on their own spectrum analysis hype. I don’t have any doubts that these U7 APs are great additions to their lineup, though.

Originally Posted: May 19th, 2024

Home Network Update: Goodnight, UniFi Dream Machine

It’s been a while since I wrote about my home network, in Zen and the Art of Home Networking. Not much has changed since then, until recently. I finally retired my UniFi Dream Machine and replaced it with the UniFi Cloud Gateway Ultra, Enterprise 8 PoE switch, and U7 Pro access point.

I figured it was time to provide an update and explain why I said goodnight to my trusty Dream Machine. I also want to cover the much-discussed backplane limitation of the Cloud Gateway Ultra, some issues I had with the U7 Pro, and why I already want to make more changes.

Over the past few months, Ubiquti have released a lot of UniFi equipment. Off the top of my head, we’ve seen:

• Gateways — Cloud Gateway Ultra, Express, Gateway Lite, and Gateway Max
• Switches — Pro 8 PoE, Pro Max 16/24/48, Pro Max 16/24/48 PoE, and three flavors of Ultra
• APs — Swiss Army Knife, U6-Mesh-Pro, and U7-Pro

I wrote about a few of them and bought a few of them as well. Over the past few years, I’ve amassed a horde of home networking equipment I don’t need. Some I’ve been able to repurpose, use for testing, or hand off to friends or family that need an upgrade. More than anything, they sit around.

Even with all of those options, I’ve mostly used the UniFi Dream Machine as the core of my home network. I’ve swapped it out to test new products, added switches and APs, ran Ethernet, and reconfigured it more times than I can count. No matter what I did, I always came back to the UDM as an easy option to keep my home network running. It allowed me to experiment off to the side without worrying about the network everyone else was using.

It’s a little beat up but it’s running fine, and it is still supported by current UniFi software. So why the Cloud Gateway Ultra, and why now? Before we cover those details, I want to start at a high level and talk about my layout and the hardware I chose.

Topology and Hardware Selection

Old network:

• Cable modem
• UDM

New network:

• Cable modem
• UCG-Ultra
• USW-Enterprise-8-PoE
• U7-Pro

My home network is small and has a simple layout. There are around a dozen or so client devices, and fairly light usage overall. The main requirement is reliable wireless for working from home, a few extra computers, and wireless security cameras. It’s not a very exciting network.

The WAN is provided by a coax cable modem, which provides Ethernet to the WAN of the Cloud Gateway Ultra. It is a (sadly typical in the US) asymmetric connection with gigabit download, but a tragic 20 Mbps upload.

The Cloud Gateway Ultra acts as the main gateway and UniFi Network controller. It is connected to an Enterprise 8 PoE switch, which powers my U7-Pro access point. When needed, the U7-Pro wirelessly connects to my UniFi Express acting as an AP. This allows me to get Ethernet in my office for test equipment. I also occasionally power up my Cloud Key Gen 2+ (Shown as "CloudKey+ in the Ubiquiti store) and G4 Instant camera for use as a pet camera.

This is the normal layout, but it often changes. While running speed tests for my UXG-Lite Review, I ran Ethernet and built my lab network off the USW-Enterprise-8-PoE. I have two computers with 2.5 Gbps NICs to break beyond the gigabit barrier on LAN-to-LAN connections. Ideally, the link between my switch and gateway would also be 2.5 Gbps, which brings me back to the Cloud Gateway Ultra and the newer UXG-Max.

I made my initial network changes and started writing this before the new Gateway Max (UXG-Max) was announced. The UXG-Max is the gateway I would use if I was building this from scratch, today. I would be able to use my CloudKey+ or self-host the controller if I wanted. I wouldn’t be able to use the Cloud Gateway Ultra for anything, due to the controller and gateway functions being tied together. Sadly, it would join my Gateway Lite in the pile of spare equipment.

Due to my gigabit WAN and light needs, the UCG-Ultra is not a limitation in day-to-day use. Switching to the UXG-Max would allow me to not worry about gigabit links becoming a bottleneck in my testing though, so it’s on my long list of equipment to purchase. I also just generally prefer the flexibility of a standalone gateway and standalone controller, even if I don’t strictly need multi-site support or the other benefits of a modular setup. There are advantages to both, and the UXG-Ultra is a convenient combination of gateway and controller, just like the UDM was.

If I wanted to expand my wireless coverage, the first thing I would do is look into running Ethernet cabling, and putting an AP on the 2nd floor, or one outside to ensure coverage on our back deck. The U7-Pro is close enough to make that not necessary though. As I said, my network is small and my needs are low.

Making The Change

The swap-out process was simple. UniFi networks are software-defined, and importing a backup makes swapping hardware a non-issue. If you change from one controller or gateway to another, you can just import a UniFi Network backup file. Your networks, clients, Wi-Fi settings, and everything else will be back to how they were.

I could have done that, but I chose to build it from scratch and start fresh. I’ve built up a lot of cruft over the years and changed a lot of settings in the process of experimenting and testing. The main things I cared about took maybe 10 minutes of clicking around to duplicate, so I did it that way.

Starting from a fresh slate, the first thing I did was modify the built-in “default” network. This is the 192.168.1.1/24 subnet you’ll see when you set up a new UniFi gateway. The default network can’t be removed, but you can rename and redefine it, or not use it. Network engineers like me tend to not like using the default untagged network, or VLAN 1 in most vendor’s terms. It’s a common basic practice to use tagged networks and leave the default untagged network as a dead end. This would prevent someone from connecting a cable and gaining access to your management network, for example. This isn’t a realistic concern in my home network, but old habits die hard.

My Dead-Simple VLAN and IPv4 Scheme

I have a very simple IPv4 scheme for my home network. I allocate the whole 10.250.0.0/16 subnet, split it into /24s, and match my VLAN ID with the 3rd octet of the subnet. My untagged default network, AKA VLAN 1, is 10.250.1.0/24. My main LAN is VLAN 10, which is 10.250.10.0/24. My usual testing or lab network is VLAN 99, 10.250.99.0/24. The numbers are arbitrary, but this simple scheme is easy to remember.

If I only have a dozen or two devices on the network, why would I even bother with an overkill /16 subnet assignment and 65,536 IP addresses? Well, mainly for testing and segmentation. It’s helpful to be able to leave the main LAN network alone when testing new equipment or labbing something up to play around with. Separating your networks at layer 2 (VLANs) and layer 3 (subnets) allows for segmentation, access control, firewall policy, and routing decisions to be made. This is mainly relevant in larger networks or networks where security matters more than my basic home network. I’m mainly interested in experimenting with the latest controls and features of the UniFi Network application.

View fullsize

View fullsize

Limiting my whole home network to the 10.250.0.0/16 subnet makes lab network routing dead simple. When I’m running additional gateways or testing site-to-site VPNs like I did in my UXG-Lite Review, I’ll usually use 10.249.0.0/16 for the test network. Then, I’ll add two static routes, each pointing to the other /16. It’s simple, and it works.

For more complex setups that require dynamic routing, transit networks, routed links, or VPN subnets, sometimes I get a little creative. My default is to pick something in the 172.16.0.0/12 space, to make it obvious that it’s separate, and keep it unaffected by my broad static routes. There are many ways to do it, but this works for me and my purposes.

U7-Pro: Wi-Fi 5 to Wi-Fi 7

Now for the fun part. After completing the basic setup on the Cloud Gateway Ultra, I reset and re-adopted my Enterprise 8 PoE switch and U7-Pro access point.

Like most nerds, I’m guilty of over-emphasizing spec differences, or theoretical improvements in newer equipment. Wi-Fi 6 has 25% higher data rates! You need to have 6 GHz to get away from the congested 2.4 GHz and 5 GHz bands! 2x2 MIMO isn’t enough! Multi-link operation with Wi-Fi 7 is a game changer!

In reality, my home network isn’t used for anything extreme. We have a dozen or two devices, and most of them just need to be capable of streaming some video and downloading the occasional software update. Besides some Phillips Hue lightbulbs and some wireless security cameras, there is nothing particularly “smart” about it. Outside of large game downloads from Steam, our bandwidth needs are low. Stability and availability are more important than high data rates, wide channels, new 802.11 wireless standards, and maximum performance. I’m sorry to disappoint you, but that’s the truth.

Before I dive into the details, I just want to be clear. The Wi-Fi 5 wireless AP built-in to the UDM wasn’t a significant limitation. Wi-Fi 5 is more than capable of delivering a good experience for most people. Wi-Fi 6 is better and Wi-Fi 7 is better yet, but don’t let anyone tell you that you need it. If your setup works for you, enjoy it and save your money for a bigger upgrade later.

That said, this was the most fun part of the upgrade because wireless is my favorite aspect of networking. Home networking and testing the limits is a fun hobby. I’ve used almost every model UniFi offers and tried many other vendors. I’ve built or worked on countless networks, including large ones filled with expensive enterprise gear. I work with Cisco for my day job, but in my home, the UDM was good enough.

In my real-world use, the U7-Pro doesn’t do anything massively better than the UDM. Adding 6 GHz coverage for a few Wi-Fi 6E devices was the most noticeable change. The best parts of the 802.11be standard are lost on me because I don’t have any clients that support it. You probably don’t either, yet. I want to learn and write about Wi-Fi 7 more, but first I need to find a compatible PCIe card that works with my AMD Ryzen PC, or a decent USB solution. It’s early days, and there are always issues and costs that come from being an early adopter.

Speaking of early adopter pains, after I switched to the U7-Pro, I started having audio quality issues on Microsoft Teams video and audio calls. I was able to hear everyone just fine, but everyone I talked to said that my audio sounded awful, and was cutting out every second or two. This issue was only with Teams and only with my work laptop, so I believe it was a client-side issue. Switching to Ethernet fixed it, as did switching the U7-Pro out for a U6-Enterprise.

I haven’t dug any deeper into what caused that, but that is one more data point to show that sometimes the latest isn’t always the greatest, and changes aren’t always for the better. I assume this is a small issue with the firmware on the U7-Pro or some driver on my Windows machine, but that is just an assumption. I’ll provide an update if I’m able to troubleshoot that more, or if newer firmware addresses the issue I was running into. For now, I’ll stick with the U6-Enterprise and what works.

Open Question: UDM Future Support?

This is a silly issue, and it shouldn’t matter to most people. It matters to me though.

Ubiquiti isn’t listing or promoting the base UDM on their store, even though it’s still for sale. They removed most mentions of it on their website, and don’t list it under any of their product categories. You have to search for it, just like you had to search for the USG and USG-Pro while they were waiting on their official end-of-life announcement. The UDM isn’t end-of-life and it still receives software updates, but the writing is on the wall.

Rather than announcing something is end-of-life as they did for some APs years ago, Ubiquiti has moved to a strategy of removing references to old products, delisting them, and leaving them in a kind of zombie state. They’re not alive, they’re not dead, but they’re not the best choice for a new purchase. This was the state the USG and USG-Pro were in until they were recently listed as legacy or vintage products.

The UDM is in this zombie state now, with no mentions of it on their home page or in the ui.com store. It doesn’t have a “vintage” or “legacy” status officially, but the writing is on the wall and we know how this script ends. Over time, the UDM will fall behind. It will continue to be updated for a while, but it may be excluded from new features. Some features may not make their way to the UDM, or they won’t be complete, just like the USG and USG-Pro. The UDM should get security updates and be safe to use for several more years, but there is no guarantee.

This gentle neglect was welcomed for the USGs, because they were ancient hardware with significant performance limits. It’s trickier to justify with the UDM because it is still a very capable device and it’s very similar to the UDM-Pro, UDM-SE, and UDW internally. They all have the same Annapurna Labs ARM chipset with a quad-core ARM A57 CPU at their heart. Ubiquiti can’t claim the UDM doesn’t have the CPU power, or that it would take a lot of custom work to make new features available on the UDM. It actually has more computational power than newer devices like the UDR, Express, and UXG-Lite.

Even if the UDM does stay current with all the other features, I think the UDM is going to be in this zombie state for a while. It’s no longer a first-class citizen in the UniFi world. Rather than wait for the inevitable, I chose to take the leap.

Cloud Gateway Ultra: Backplane Pain

Network performance is a tricky topic to discuss, with a lot of common misconceptions. I just want to focus on a few small areas here: backplanes, throughput, and wireless. There was a lot of discussion about the 2.5 Gbps WAN port and the backplane limitation of the Cloud Gateway Ultra. For our purposes, the “backplane” refers to the connections between internal components of the device. The speed of the backplane determines the speed at which data can move between the LAN, the CPU, and the WAN.

The underlying architecture of all recent UniFi Gateways and Cloud Gateways are similar. Start with a chipset featuring an ARM CPU and hardware for common networking functions, connect some interfaces to it, and leverage the UniFi Network software to configure it. Ubiquiti buys components from Qualcomm, MediaTek, and others, and designs their hardware around them. This is how most consumer-grade networking equipment is built.

For interfaces, the UDM has one gigabit WAN, and four gigabit LAN. The Cloud Gateway Ultra has one 2.5 Gbps WAN, and four gigabit LAN. On the surface, it looks like the UCG-Ultra is a straightforward upgrade. A faster WAN port should be faster, right? More LAN ports should allow for more total throughput, right? It should, but that is where the limitation comes in.

These unofficial block diagrams are from the Ubiquiti Community Wiki, and they’re a helpful reference point when talking about backplanes. On the UDM, you can see the 4 gigabit LAN ports all connect to a switch chip, and that switch chip has a 1 Gbps connection to the CPU. Traffic between LAN port 1 to LAN port 2 is handled by the switch chip, but traffic between the LAN and WAN needs to go to the CPU, which handles routing, NAT, and other network tasks.

Since the UDM’s WAN is a gigabit interface connected with a gigabit backplane, the design is balanced. Any of the four LAN ports can fully utilize the 1 Gbps WAN port. A single port can send or receive 1 Gbps of data, or all 4 ports can share that bandwidth. You wouldn’t be able to send 1 Gbps of data from all four LAN ports at once, but you could send 250 Mbps from each. Even if that connection was faster, the 1 Gbps WAN port would be the limit. This is a typical setup for a gigabit home router.

With the UDM-Pro, the backplane limitation is more obvious. The UDM-Pro has two 10 Gbps SFP+ interfaces, a gigabit WAN, and an 8-port gigabit LAN switch. Those eight switch ports are connected to a switch chip, and that switch chip has a single gigabit connection to the CPU.

That means that collectively, all eight of those LAN ports share a single gigabit connection to the CPU, and in turn, the 10 Gbps WAN or LAN interfaces. This limitation means the 8-port switch is best used for low-bandwidth devices, like maybe a smart home bridge or a small server handling light tasks. You wouldn’t want to connect something like your NAS or an access point to those ports. If you had eight data-hungry devices you might hit the 1 Gbps limit and not fully utilize your multi-gig WAN or 10 Gbps LAN connections. With the UDM-Pro, you should use the 10 Gbps SFP+ interface to connect to a switch capable of handling 10 Gbps of bandwidth.

With all of these limits, the direction and type of traffic matters. Local traffic from LAN to LAN is handled by the switch chip and doesn’t need to go to the CPU. As an example, 1 Gbps of traffic coming in LAN 1 and going to LAN 2 would be no issue. At the same time, you could also have 1 Gbps of traffic coming in LAN 3 and going to LAN 4, LAN 5 to LAN 6, etc. Those links are full-duplex, line-rate, and non-blocking. In a typical Ethernet switch, all interfaces can be used at line rate simultaneously. In this diagram, the traffic would only be going down to the switch chip, and then back to the destination interface.

The backplane limitation comes in when traffic is bound for other interfaces or other networks. This is mainly LAN to WAN, but traffic passing between VLANs also has to go through the CPU for processing and routing. All the non-local traffic from those 8 LAN ports uses the shared gigabit link to the CPU. This limits throughput on each LAN interface to whatever capacity is not in use by the other 7 interfaces. It’s like going from an 8-lane highway down to 1.

UniFi Cloud Gateway is similar to the UDM. It upgrades the WAN port to 2.5 Gbps, but nothing else has changed. This results in an imbalance, where only the WAN port can go beyond gigabit speed. Putting this all together, we can make a theoretical block diagram for the Cloud Gateway Ultra, and use it to illustrate when the backplane is a limitation, and when it isn’t.

This same principle applies to other UniFi gateways like the UDM, and the UCG-Ultra. The Cloud Gateway Ultra is a little more egregious of an example, due to it having a 2.5 Gbps WAN interface but no realistic way to fully utilize it.

The four gigabit LAN ports can pass 1 Gbps in and out of their ports with no issue, as gigabit switch ports typically do. If you want to go between VLANs or out to the Internet through your WAN port, there is a single gigabit link that all four need to share. You’ll never see more than 1 Gbps download and 1 Gbps upload speeds through your WAN port. Yes, there is a 2.5 Gbps WAN port, but you have no realistic way to use it. I’m not sure why they included the 2.5 Gbps interface and their justification for it is silly.

I assume this limitation comes back to cost and a choice that Qualcomm or some underlying component manufacturer made. The components within the UCG-Ultra are commodity parts, picked for one reason over any other: their cost. What we’re left with is a cheap product that delivers a lot for the price, with the big asterisk of the backplane and a 1 Gbps throughput limitation. It can deliver 1 Gbps with IPS/IDS on or off, but nothing more. It has a 2.5 Gbps WAN, technically, but you can’t use it in any meaningful sense.

The UXG-Max takes a very similar base and makes other tradeoffs. If you’re looking for a small 2.5 Gbps gateway, that’s the one to buy. If you want a built-in controller and are fine with gigabit throughput, the UCG-Ultra is a good value. We have more choices than ever, but each one has a tradeoff or limitation to consider. I chose the convenience of the UCG-Ultra, but you probably have different priorities. I just wish Ubiquiti made fewer compromises in their low-end products.

Wrapping Up

The further I get in my career as a network engineer, the less willing I am to take on those early adopter penalties or experiment on the bleeding edge. I prefer one thing over everything else: stability. I don’t want to spend my weekends fixing broken networks, I spend enough of my time doing that already. It’s hard to have something be your everyday job and your source of weekend fun.

I’ve followed UniFi closely for many years now, but it’s still fun to see what’s new and what’s next. In the future, I’d love to have a complex homelab and a bunch of rackmount equipment to work on and test with. That could be useful for my Cisco-focused day job, where the networking issues are more complex and I can’t just click a checkbox to make a change. I think that’s the main thing I enjoy about UniFi. Simplicity is good, and Ubiquiti balances simplicity and power about as well as anyone.

If you’re limping along with older equipment, you may want to consider an upgrade. Ubiquiti has tons of new hardware to pick from, and new software features to explore. Before you do that though, have a realistic look at what you use your home network for, and what you’re looking to get out of the upgrade. Hopefully, that answer is something important, and you’re looking to address a specific shortcoming of your current setup. Maybe you’re looking to expand wireless coverage, take advantage of your new fast Internet connection, or keep up with your demanding tasks and throughput needs. If you’re like me and just want to justify an upgrade, that’s OK too.

I think it helps to look at this with a clear perspective and be realistic. I didn’t need to buy any of this gear, my UDM was fine. Home networking is a hobby for me, and maintaining this website encourages me to keep up with the latest changes and releases. Maybe that’s the case for you, or maybe you just feel like it’s time for something better. I think that’s a good enough reason to upgrade, and hopefully, it ends up being worth it.

For me, the main thing I’m looking to get out of this new equipment is a couple more years of hassle-free use. If something fails or becomes an issue, I’ll still have my trusty UDM.

Originally Posted: April 10th, 2024

TL;DR:

• The UniFi Gateway Max (UXG-Max) is the latest gateway from Ubiquiti, offering 2.5 Gbps WAN and LAN interfaces, with more power than the UXG-Lite

• The UXG-Max is just a gateway — it does not act as a UniFi Network controller or Wi-Fi access point.

• The Gateway Max is for sale for $199 in the US and Canada, with availability in other regions coming soon.

Last week, Ubiquiti released the Gateway Max (UXG-Max). Like the Gateway Lite (UXG-Lite) and Gateway Pro (UXG-Pro), it doesn’t run any software, and it doesn’t act as a UniFi controller. You need to pair all UXG models with a Cloud Key, Official UniFi Hosting, or a cloud/self-hosted UniFi Network application for management. They are the modern equivalents of the old USG and USG-Pro.

This preview will cover the specs, my initial impressions, and where the UXG-Max fits in the increasingly crowded UniFi gateway lineup. Before we dig into those details, we’ll cover the information Ubiquiti provided. See my UXG-Lite Preview and full UXG-Lite Review for more background and context on UXGs as a whole.

From the Ubiquiti store page for the Gateway Max:

Compact, multi-WAN UniFi gateway with full 2.5 GbE support for high-performance networking at small-to-medium sites.
- Managed with a CloudKey, Official UniFi Hosting, or UniFi Network Server
- Up to 1.5 Gbps routing with IDS/IPS
- (1) 2.5 GbE WAN port
- (4) 2.5 GbE LAN ports, including (1) remappable to WAN
- USB-C powered (adapter included)
- Managed with UniFi Network 8.1.113 and later

Gateway Max (UXG-Max) Specs

• Name: Gateway Max

• SKU: UXG-Max

• US MSRP: $199

Mechanical and Physical

• Dimensions: 141.8 x 127.6 x 30 mm (5.6 x 5 x 1.2")

• Weight: 520 g (1.1 lb)

• Enclosure materials: Polycarbonate

• Resistance: IK04

• Ambient operating temperature: -10 to 40° C (14 to 104° F)

• Ambient operating humidity: 5 to 95% noncondensing

• Certifications: CE, FCC, IC

• LED: Ethernet, White: link/activity

• Button: (1) Factory reset

Hardware and Power

• Networking interfaces:

  • (1) 2.5 Gbps RJ45 WAN port

  • (4) 2.5 Gbps RJ45 LAN port — (1) remappable as 2nd WAN

• Management interface: Ethernet, Bluetooth

• Power method: USB type C (5V DC/3A)

• Max. power consumption: 9.6W

• Supported voltage range: 100–240V

• Processor: Quad-core ARM A53 @ 1.5 GHz

• SoC/Chipset: Qualcomm IPQ5322

• Memory information: 2 GB DDR4

Gateway Features

Performance

• WiFi QoS with UniFi APs

• Application, domain, and country-based QoS

• Application and device type identification

• Internet quality and outage reporting

Next-generation security

• Application-aware firewall rules

• Signature-based IPS/IDS threat detection

• Content, country, domain, and ad filtering

• VLAN/subnet-based traffic segmentation

• Full stateful firewall

Advanced networking

• License-free SD-WAN* (Site Magic)

• WireGuard, L2TP and OpenVPN server

• OpenVPN client

• OpenVPN and IPsec site-to-site VPN

• One-click Teleport* and Identity Enterprise VPN**

• Policy-based WAN and VPN routing

• DHCP relay

• Customizable DHCP server

• IPv6 ISP support

*When paired with a Cloud Key or Official UniFi Hosting.
**When paired with a Cloud Key.

View fullsize

View fullsize

View fullsize

Gateway Choice Paralysis

When the UXG-Max was announced, I was happy to see a model between the UXG-Lite and UXG-Pro. There is a big gap between those. For some the UXG-Lite is too limited, but the Pro is too big, too much, and too expensive. The UXG-Max fits in the middle, and it addresses the biggest limitaitons of the UXG-Lite.

I’m always happy to see more devices with 2.5 Gbps ports, and more options for self-hosted or modular UniFi networks. Most people don’t seem to have the same opinion as me, though. Reading through various threads, comments, and discussions on the UXG-Max, one of the main themes was confusion, and occasionally anger.

I saw many variations of:

• I’m confused, which gateway should I buy?

• Why wasn’t this released with the UXG-Lite? I would have bought this instead!

• 2.5 Gbps interfaces, but only 1.5 Gbps of IDS/IPS throughput?! 😮

Those are fair questions, and I’ll try to answer them. Unless you’re a nerd like I am and study these products, it is hard to know what hardware you need, or which model you should choose. Additional choices are good, but too many can lead to confusion. With UniFi gateways, we seem to be well into confusion territory.

Unfortunately, you can’t just discuss the UXG-Max in a vacuum. It isn’t a standalone device, and it is only one part of a UniFi network. It handles routing, VPN, and firewall functions, while other devices are needed to run the UniFi Network application or handle switching and wireless duties. If that isn’t clear enough, refer to my UniFi Gateways Explained as Simply as Possible post for a more complete explanation.

Before you consider the UXG-Max, you have to answer a few questions. Do you want to self-host? Do you have or want a Cloud Key? Do you want a gateway with a built-in controller? Do you care about UniFi Protect, Talk, Access, or Connect? Do you care about centralized management for multiple sites?

The hardest part of discussing the UXG-Max is that you can’t put that context aside and just focus on the specs. You have to keep it in mind when considering a purchase, or comparing the UXG-Max to alternative UniFi gateways. I tried building a UniFi Gateway decision tree for this article but I gave up. It’s hard, even for someone who knows these products well.

Years ago we had a simple choice: USG or USG-Pro. Now there are 10 additional models with overlapping uses and features. To start, I’m going to put the Cloud Gateways aside and focus on just the UXG Lite, Max, and Pro.

UXG-Lite vs. UXG-Max vs. UXG-Pro

What is the Gateway Max and where does it fit? The easy answer is between the Gateway Lite and Gateway Pro. It’s between those two in price and capability, but closer to the Lite. It’s a desktop enclosure, powered by USB-C, and small enough to fit on shelf or slide under your cable modem.

As the name implies though, the Max offers a few advantages. In a way, Max = Lite + 3 LAN + all interfaces upgraded to 2.5 Gbps + Dual-WAN + more CPU power and throughput. It’s a little bigger and a little more expensive, but it addresses the biggest limitations of the UXG-Lite.

This is the way I see these models and what they are meant for:

• The Lite ($129) is for small networks with a single WAN below 1 Gbps.

• The Max ($199) is for small to medium networks, or enthusiasts. It adds 2.5 Gbps RJ45, dual-WAN, more power, and more ports. It is a big step up from the Lite for $70 more.

• The Pro ($499) is for medium to large networks, or those with a network rack. It offers 10 Gbps SFP+ WAN and LAN, up to 3.5 Gbps IDS/IPS, and the most power you can currently get on a standalone UniFi gateway.

As always, consider your current and future needs, the size of your network, your Internet connection speed, and what you’re going to be using the network for. You should also try to leave headroom for growth or changes if you can. If your needs or budget are low, the UXG-Lite may be enough. If you can spare the extra $70 for the UXG-Max, I think that would be money well spent.

Sometimes it helps to just see all of the specs in one view.

UXG-Max vs. Cloud Gateways

Stepping back and adding all of the Cloud Gateways makes things much less clear. To quickly review, from low to high in price:

• Cloud Gateway Ultra (UCG-UItra) - $129

• Express (UX) - $149

• Dream Router (UDR) - $199

• Dream Machine (UDM) - $299, but not listed in store

• Dream Machine Pro (UDM-Pro) - $379

• Dream Machine SE (UDM-SE) - $499

• Dream Wall (UDW) - $999

The newest and cheapest options are the easiest to compare, so we’ll start there. They aren’t exactly the same, but if you squint both the UXG-Lite and UXG-Max have silbings, which make different tradeoffs.

Siblings: UXG-Lite and UX

The Gateway Lite and UniFi Express have similar hardware. They are the same size, with a low power, dual-core ARM-A53 base and two gigabit RJ45 ports. Neither of them support dual-WAN, and the Express doesn’t support IPS/IDS. These are the lowest power and lowest performance options.

They are different, though. The UXG-Lite is just a gateway for a self-hosted and Cloud Key network. The Express can be everything all-in-one: controller, gateway, and Wi-Fi AP. It can also be used as a normal wired or wireless mesh AP in any UniFi Network.

For $149, the Express can be everything you need for a very small and limited setup. You can only add up to 4 additional UniFi switches and APs to it. If you outgrow the Express, you can repurpose it as an access point. If you’re starting from scratch and planning to expand beyond 5 total devices, you might want to look elsewhere. If you want to start small though, the Express is a flexible and easy way to do that.

For $129, the Gateway Lite requires a CloudKey+ ($199), Official UniFi Hosting server ($29+/month), or a self-hosted installation of the UniFi Network software. It can handle gigabit speeds, but only has one WAN and one LAN port. You can use just one, or deploy them at multiple locations, and control them all centrally.

With a CloudKey+ you’ll have access to all the other UniFi Applications, and a few network features which require Ubiquiti hardware. For cloud or self-hosted networks, you can scale this setup to cover hundreds or thousands of devices over multiple sites. You can also swap out the UXG-Lite for a larger model if needed, without changing your controller.

Siblings: UXG-Max and UCG-Ultra

The Gateway Max and Cloud Gateway Ultra have similar hardware. Compared to the Lite and Express, these offer more CPU power, more interfaces, and higher limits. The UXG-Max offers full 2.5 Gbps connectivity for WAN and LAN. It is capable of 1.5 Gbps with IDS/IPS, or near line rate with it turned off. One of the four LAN ports can be remapped as a 2nd WAN, which isn’t possible on the UXG-Lite.

The Cloud Gateway Ultra can manage over 30 UniFi devices - significantly more than the Express. It’s comprimised in other ways though. It doesn’t have Wi-Fi built-in, and it’s slow internal backplane limits it to 1 Gbps of throughput, despite the 2.5 Gbps WAN port. It also doesn’t run all of the other UniFi applications, so you’d need a Cloud Key, NVR, or other hardware depending on which you want to use.

Of course, you can also consider a Dream Router, or a Dream Machine Pro, or… if you’re confused and overwhelmed, you’re not alone. Hopefully a spec comparison of all Cloud Gateway models, and all current gateways will help.

In general, the biggest deciding factor between a UXG gateway and a Cloud Gateway is the controller. Do you want to have your controller built into your gateway, or on a separate device? There are advanatages and disadvantages to both.

Notes on Components

Both the Gateway Max and Cloud Gateway Ultra are built around the Qualcomm IPQ5322. The U7-Pro is built around the IPQ5332. In fact, most UniFi devices are built around a system-on-a-chip (SoC) from Qualcomm or MediaTek.

The IPQ5322 features many components, including a general-purpose CPU, PCIe and USB connections, and a 12-thread Network Processing Unit (NPU). The NPU offloads networking functions like routing and QoS from the CPU. Qualcomm leverages the NPU so that a faster (and more expensive) general-purpose CPU isn’t required.

While the four CPU cores within this SoC — ARM A53, clocked at 1.5 GHz — aren’t cutting-edge, this hardware isn’t old. The IPQ5322 is part of Qualcomm’s new Immersive Home 326 platform made for Wi-Fi 7 devices.

From Qualcomm’s product brief:

The Qualcomm Immersive Home 326 Platform’s specialized Packet Processing Engine offloads WAN networking and QoS traffic management, thereby freeing up powerful Quad-core Cortex-A53 Arm CPU compute to support differentiating services and applications, such as device management and control, content filters, and security features.

Powerful Quad-core CPU and specialized Packet Processing Engine provides powerful networking acceleration and QoS traffic management while offloading CPU

Dedicated Security Processing Engine ensures secure network transactions with embedded networking crypto engine, Secure Boot with root-of-trust transfer and TrustZone

Another concern I’ve seen is the 2 GB of RAM in the UXG-Max, vs. the 3 GB of RAM in the Cloud Gateway Ultra. I personally wouldn’t worry about that, since the UXG-Pro also has 2 GB, and the Cloud Gateway Ultra uses some of that extra RAM to run the UniFi Network Application. Routing and firewalling don’t require a ton of RAM.

Notes on UXG-Max… imum Throughput

The specs show up to 1.5 Gbps of IPS/IDS throughput, but how much should we expect when IDS/IPS is turned off? What is the maximum throughput of the UXG-Max?

To review, these are the advertised IDS/IPS throughput limits:

• UX: IDS/IPS not supported

• USG: 85 Mbps

• USG-Pro: 250 Mbps

• UDR: 300 Mbps

• UXG-Lite and UCG-Ultra: 1 Gbps

• UXG-Max: 1.5 Gbps

• UXG-Pro, UDM-Pro, UDM-SE, and UDW: 3.5 Gbps

For the UXG-Max, according to some initial iPerf testing by arthurdent on the Community forums:

• With DHCP, DPI, DNS Shield and Ad Blocker enabled = 2.1 to 2.3 Gbps

• Adding IPS/IDS turned to high = 1.7 Gbps

• Adding PPPoE = 1.4 to 1.6 Gbps

• With PPPoE and IDS/IPS turned to high = 1.0 to 1.3 Gbps

Most features — DHCP, DPI/traffic inspection, DNS Shield for encrypted DNS, ad blocking, maybe some custom firewwall rules — can be enabled without significantly limiting throughput. PPPoE is still a significant drag on maximum throughput, as is enabling the Suricata intrusion detection and prevention “Suspicious Activity” settings. Without those, over 2 Gbps should be achievable, and multi-gigabit inter-VLAN traffic is possible as well.

Notes on Branding and Naming

I’m exhausted. Trying to explain any new UniFi product these days feels like an excercise in comparisons, contrasts, exceptions, and asterisks. Sometimes it feel like you need a cork board and some red yarn, but we all know that there is no Pepe Silvia.

I believe UniFi products themselves are not that confusing. They are easy to use. The hardware is good, the software is good, and their documentation is getting better. It’s just hard to talk about the products because the naming is inconsisent and can change over time.

Ubiquiti’s institutional love of Apple extends to their sometimes non-sensical marketing names. Why did UniFi OS Console become Cloud Gateway? Are the UXG models “next-generation” or current? Why is UXG-Max below UXG-Pro, doesn’t max stand for maximum? And what does “Ultra” mean, exactly? You can drive yourself mad trying to find answers to these questions, or you can focus on what matters.

The UXG-Max is the right gateway choice for those who:

• Self-host the UniFi Network application or use a Cloud Key

• Want 2.5 Gbps Ethernet and Dual-WAN

• Don’t want or need 10 Gbps SFP+

If those don’t apply, consider the alternatives:

• If you don’t want to self-host or use a Cloud Key — consider a Cloud Gateway

• If you don’t want 2.5 Gbps Ethernet or dual-WAN — consider the UXG-Lite

• If you want 10 Gbps SFP+ — consider the UXG-Pro and a full network rack installation

And some universal product purchasing advice — buy something if it is worth the price you pay for the benefits you get at the time of purchase. New and better things will always be coming. If you felt the UXG-Lite was worth $129 four months ago, but now you’re disappointed that this is available for only $70 more, I understand. I have a UXG-Lite sitting in a box right next to me as I type this. I have some other equipment too, but that’s a story for another time.

Unfortunately for those of us on the outside, we can’t read Ubiquiti’s mind. They control how they release information about current and upcoming products, and when everything happens. It would have been nice to know this was coming, but the UXG-Max is yet another gateway option. For some, it’s the right one. For now, at least.

In case you missed it, the March 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti. This was recorded just before the UXG-Max was released, so we’ll be discussing that on the next show.

We cover the little bit of news we got from the UniFi World Congress conference in Chicago, some recent leaks, and the pricing update for the Professional Site Support. We also cover the new Ubiquiti Portal application, some new cameras and accessories, and the notable software releases we saw in March.

Most importantly, we cover the very serious issue of the Cloud Gateway Ultra screens being slightly misaligned — Screengate. Thankfully, Ubiquiti is replacing them under warranty.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat Podcast Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @TechMcCann

• Recorded using @SquadCastFM and hosted with @CastosHQ

In case you missed it, the February 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti. This was (sorry if you’ve heard this before) yet another packed month for Ubiquiti news.

We briefly cover the EdgeRouter malware attack that was handled by the FBI, and the UniFi World Congress conference tour announcement. We also cover the new Ubiquiti hardware, including the UniFi Cloud Gateway Ultra and Ultra switches, UISP Wave Pico, Precision Rackmount Kit, and the really odd AmpliFi USB-C Charge Cable. As well as the UniFi Network 8.1.104 and 8.1.107 early access software updates, along with some Protect and techspecs.ui.com changes.

Also, there is a very special guest appearance from my cat.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

UI Chat Podcast Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @TechMcCann

• Recorded using @SquadCastFM and hosted with @CastosHQ

In case you missed it, the January 2024 edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

This was yet another packed month for Ubiquiti news. Ubiquiti have continued their nonstop stream of new hardware, with the U7-Pro, UK-Ultra, and UISP Switch Plus. We also talk about the 2FA changes, SolarPoint’s glorious return, the Enterprise Fortress Gateway and other upcoming hardware, UniFi Talk finally coming to the UK, and the latest software releases.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

We love to hear from our listeners! Get in touch about what you thought about this new episode. Reach out on X, @uichatpodcast or you can email the show, info@theinterface.uk.

Guest Appearance on Crossed Wires

Also, Alex and I were guests on the UniFi Appreciation Show episode of the Crossed Wires podcast. That was a fun discussion, recorded back in December 2023. We spent a lot of time talking about the UXG-Lite and UniFi Express, and how to understand UniFi’s many options and settings. Thanks for having us on, James and Jae!

UI Chat Podcast Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @TechMcCann

• Recorded using @SquadCastFM and hosted with @CastosHQ

Originally Posted: January 8th, 2023

Today, Ubiquiti announced their first Wi-Fi 7 access point, the U7-Pro:

After years of development, we are proud to introduce UniFi 7 — a massively scalable WiFi 7 platform capable of delivering wired-like user experiences. For the first time in history, exceptional WiFi speeds and predictability can be achieved simultaneously thanks to UniFi 7’s interference-resilient radio technologies combined with an ocean of newly supported 6 GHz spectrum.

Designed specifically for professional and enterprise deployments, the U7 Pro is ideal for applications requiring flawless WiFi service within demanding large-scale environments.

In this preview we’ll take a quick look at the specs of the U7-Pro and how it compares with the U6-Enterprise and other Wi-Fi 6 models. We’ll also briefly cover what Wi-Fi 7 is, and the big features that are included in the new standard.

View fullsize

View fullsize

U7-Pro Key Specs

• WiFi 7 (802.11be) with 6 GHz support

• Tri-band, two spatial streams in each band

• Single 2.5 GbE uplink

• Powered using PoE+ (802.3at)

• Claimed 140 m² (1,500 ft²) coverage and 300+ connected devices

• The U7-Pro is now available on the Ubiquiti Store for $189 USD

Notes:

• 6 GHz operation is supported in these countries

• Multi-Link Operation (MLO) capability to be provided via a software update in February 2024

Here are the specs of the U7-Pro compared with other Wi-Fi 6, 6E, and 7 UniFi APs. See my UniFi Comparison Charts for more spec comparisons.

Ubiquiti’s U7-Pro FAQ

As part of the announcement post, they answered some frequently asked questions:

Can I install U7 Pro using an existing AP mounting plate?

U7 Pro uses the AP Professional Mounting System. It can be installed using the same metal mounting plate as the following AP models:

• U6-Enterprise

• U6-Pro

• U6-LR

• UAP-AC-Pro

• UAP-AC-HD

• UAP-AC-SHD

• UAP-AC-XG

What do I need to run U7 Pro?

• U7 Pro is managed with UniFi Network 8.0.26 and later.

• U7 Pro is powered by PoE+ with a 2.5 GbE uplink. We recommend pairing U7 Pro with a UniFi PoE switch that features 2.5 GbE performance and PoE+ output, such as Pro Max and Enterprise PoE switches.

• U7 Pro is fully backward compatible with WiFi 6E and earlier client devices. A WiFi 6E or WiFi 7 client device is required to utilize the 6 GHz band.

Can I customize the appearance of my U7 Pro?

Yes, a fully customizable cover will be available in the second quarter of 2024 for U7 Pro.

View fullsize

View fullsize

View fullsize

View fullsize

What is Wi-Fi 7?

Wi-Fi 7 is the latest generation of Wi-Fi. As with most technologies, a bigger number = better. Wi-Fi 7 isn’t that simple though.

The underlying standard is known as 802.11be, and work on Wi-Fi 7 officially started back in May 2019. The main goal of Wi-Fi 7 is to increase throughput, reduce latency, and leverage all of the available spectrum, ranging from 1 GHz up to 7.25 GHz.

The initial draft of the Wi-Fi 7 standard landed in March 2021, and the final version is due sometime in 2024. Manufacturers started producing their first products years ago, based on those early draft versions of the standard, just like what happened with Wi-Fi 6 and other major revisions. Qualcomm, Broadcom, and TP-Link have been aggressive with rolling out early hardware, and now Ubiquiti has joined them.

Key Wi-Fi 7 features

• 320 MHz bandwidth and more efficient utilization of non-contiguous spectrum
• Increase maximum modulation to 4096-QAM (4K-QAM)
• Multi-band/multi-channel aggregation and operation, including contiguous and non-contiguous 320/160+160 MHz and 240/160+80 MHz bandwidth
• 16 spatial streams and Multiple Input Multiple Output (MIMO) protocol enhancements
• Multi-Access Point (AP) Coordination (e.g. coordinated and joint transmission)
• Enhanced link adaptation and retransmission protocol (e.g. Hybrid Automatic Repeat Request (HARQ))
• Frame formats with improved forward compatibility
• Enhanced resource allocation in OFDMA
• Reducing airtime consumption with optimized and implicit channel sounding, and a more flexible preamble puncturing scheme
• Support direct links, managed by an access point.
• Integrating Time-Sensitive Networking (TSN) IEEE 802.1Q extensions for low-latency real-time traffic

The Goals of Wi-Fi 7

One of the big themes of Wi-Fi 7 is the same as most new generations of Wi-Fi: how can we make it faster and more reliable?

Until now, Wi-Fi has increased speed and capacity by:

• More complicated modulation to send more data at once
• Wider channels to use more spectrum
• MIMO to use multiple antennas at once

Unfortunately, we are reaching to point of diminishing returns with increases in modulation, channel width, and MIMO. Despite this, Wi-Fi 7 still pushes those forward, increasing maximum modulation to 4096-QAM, channel width to 320 MHz, and MIMO up to 16 spatial streams. The numbers are bigger than ever but that’s not enough.

4096-QAM offers at most a 20% increase over 1024-QAM, but both of them only work over short distances, in ideal conditions. They require such a high signal-to-noise (SNR) that they are only attainable within a few feet of an AP.

Wide channels have been a big topic since the introduction of Wi-Fi 6E and the addition of 1200 MHz of spectrum in the 6 GHz band. Wi-Fi 7 increases the maximum channel size to 320 MHz, compared to 160 MHz in Wi-Fi 5, 6, and 6E. Double the spectrum equals double the data rates and double the potential throughput. It also means double the noise and chance for interference, making them challenging to use in real-world networks, particularly those with a lot of clients or density. 320 MHz channels aren’t supported in many countries yet either, but availability will continue to expand.

Wi-Fi 7 will permit up to 16 spatial streams, but those will require large antenna arrays, more expensive internals, and a ton of power. MIMO beyond 2 or 4 spatial streams are unlikely to be found in anything beyond high-end access points.

With these increases costing more and delivering less, new techniques are needed to see big gains in performance. Wi-Fi 7 does this in several ways, but one of the biggest is with Multi-Link Operation.

The Promise of Multi-Link

Multi-Link Operation (MLO) is an aggregation of multiple bands or channels. With MLO, Multi-Link Devices (MLDs) can simultaneously use the 2.4GHz, 5GHz, and 6GHz bands. This can be in the form of load balancing, or aggregation. This allows for higher overall speeds, and reduced latency and congestion for all connected clients.

In previous Wi-Fi standards, clients connect to one band at a time and can switch between them. This introduces overhead when changing frequencies, leading to delays and precious milliseconds being wasted. With an aggregated connection, latency can be as low as 1 ms when switching between bands. This should improve performance in any real-time audio, video, or gaming application.

There are several different types of MLO, including:

• Multi-link single radio (MLSR) which can transmit and receive over one radio at a time
• Enhanced MLSR (eMLSR) which enhances MLSR with a reduced function radio to choose the best link
• Nonsimultaneous TX and RX multi-link multi-radio (Non-STR MLMR), which can transmit and receive over 2 or more radios, but with time and frequency separation constraints
• STR MLMR, which can simultaneously transmit and receive over 2 or more radios

A Splash of Cold Water

There are many other details about MLO that I didn't cover here, and many other features of Wi-FI 7 that address issues and increase performance. The new features in Wi-Fi 7 are exciting, but for now, they are mostly a technical curiosity. I am excited to watch the continued development and rollout of Wi-Fi 7, and get my hands on a U7-Pro to do some testing.

While Wi-Fi 7 is in its early adopter phase, we are going to see a lot of hype and marketing designed to make us think we need it, and we need it right now. I’ll never agree with that mindset, especially when it comes to Wi-Fi standard revisions.

For the vast majority of users, Wi-Fi 5 and Wi-Fi 6 offer more than enough speed and reliability. For the applications most of us use on the devices most of us have, we’re not going to see a massive jump in experience. What excites me the most is projecting into the future, when multi-link and Wi-Fi 7 become common.

Progress is good, but with all things Wi-Fi, patience is rewarded. Don’t rush out and get the first Wi-Fi 7 equipment you see, let the standard come down to you. That being said, it’s always fun to look out to the edge of the wireless frontier. Welcome to Wi-Fi 7.

References and Further Reading

• IEEE Explore: Multi-Link Channel Access in IEEE 802.11be Networks
• Intel: Wi-Fi 7 and Beyond PDF
• MediaTek Wi-Fi 7 whitepaper detailing key advantages of Wi-Fi 7
• MediaTek: Discover why MLO is a key driver of Wi-Fi 7 performance

Originally Posted: January 6th, 2024

TL;DR:

• The UXG-Lite is a new USG-style gateway for a Cloud Key or self-hosted UniFi network

• One gigabit WAN, one gigabit LAN, and all the IPS/IDS you want for $129 US

• VPN performance is limited, usually to under 100 Mbps

• Seriously, TL;DR: this review is long. Don’t say I didn’t warn you.

Table of Contents

• Specs and Components ↩︎
• Defining UniFi Terms ↩︎
• First Impressions ↩︎
• Unboxing and Setup ↩︎
• UniFi Gateway Features ↩︎
• USG and UXG Differences ↩︎
• Routing and VPN Speed ↩︎
• OpenSSL Speed Benchmarking ↩︎
• Dual-Core Drama and Crypto Offloading ↩︎
• Monkey's Paw Gateway ↩︎

UXG Lite Spec Review

As I covered in my UXG-Lite Preview, Ubiquiti describes the Gateway Lite (UXG-Lite) as a compact and powerful UniFi gateway with a full suite of advanced routing and security features, ideal for smaller networks.

Hardware

• SoC/Chipset: Qualcomm IPQ5018

• CPU: Dual-core ARM Cortex A53 at 1 GHz

• RAM: 1 GB DDR3L

• Management interfaces: Ethernet, Bluetooth 5.1

• Networking interfaces

  • (1) 1 Gbps RJ45 WAN

  • (1) 1 Gbps RJ45 LAN

• Power Input: USB type C (5V/3A), power adapter included in box

• Max consumption: 3.83W

• Dimensions: 98 x 98 x 30 mm (3.9 x 3.9 x 1.2")

Context and Components

The main component of the UXG-Lite and its sibling the UniFi Express is the Qualcomm IPQ5018, from their Immersive Home 216 platform. It is the chipset or system-on-chip (SoC) that both are built around. It combines multiple parts into a single board designed for networking devices.

The IPQ5018 in the UXG-Lite features a dual-core 1 GHz ARM Cortex A53 CPU, 1 GB DDR3L RAM, and a single-core, 12-thread network processing unit (NPU) for offloading functions such as NAT. If you added some interfaces, radios, and a case, you could sell it on AliExpress, or do what many companies have done, and build a consumer networking product around it.

The Cortex-A53 is a relatively old ARM core design. It launched in 2012, and has been used in everything from budget smartphones to the Nintendo Switch and the Raspberry Pi 3B. Old CPU core designs aren’t the whole story though. The Qualcomm NPU handles networking functions like NAT. Also, ARM hardware acceleration helps process crypto operations for VPNs.

Altogether, the components inside the UXG-Lite are just enough for gigabit routing, but VPN throughput is weak. I’ll cover the performance impact more in the speed testing section below.

Defining UniFi Terms

Before we go any further, we need establish our marketing to English translation. I already attempted to simply explain UniFi Gateways, so I’ll keep this short.

• UniFi networks are “software-defined” meaning the hardware and software are separate.

• A UniFi “gateway” is a router AKA firewall AKA layer 3 network appliance. Whatever you call it, it acts as the traffic cop between local networks and the Internet.

• Switches expand a wired network, and wireless access points (APs) convert wires into Wi-Fi.

• A UniFi “controller” is a general term for anything that runs the UniFi Network application, the software that manages everything.

The UXG-Lite is a “UniFi Gateway” and it is… just a gateway. It doesn’t have built-in Wi-Fi or additional switch ports, and it doesn’t host any UniFi applications. You need a separate controller to manage a UXG-Lite. You can use a hardware Cloud Key or download the software for free and run it on your computer, server, or cloud service.

The alternative is a UniFi OS Console or Cloud Gateway. The Dream Router (UDR) is a UniFi Cloud Gateway because it acts as a gateway and a controller. All Cloud Gateways are controllers, run UniFi software, and manage themselves. Cloud Gateways can’t be used together with a Cloud Key, self-hosted controller, or a UXG-Lite.

The important thing to remember from this marketing madness is that a UXG can’t stand alone. It needs a separate UniFi Network controller. Use your own hardware, buy a Cloud Key, or rent one from Ubiquiti starting at $29/month.

It is also worth noting that Ubiquiti has confirmed more UXG models are coming.

To be clear: UniFi Express is not a direct successor to the USG. For that, consider the UXG Lite - which is an independent gateway similar to the USG. There will be additional products in the UXG series available in the future to complement the currently available Lite and Pro models

That could mean a new top-of-the-line UXG Enterprise, or something in the middle of the Lite and Pro. It could mean both, eventually. For now, we’ll focus on the hardware options we currently have.

UXG-Lite First Impressions

First, the ugly: The UXG-Lite has only two gigabit Ethernet interfaces. One WAN, one LAN. The old USG has a 3rd interface which can be assigned as a 2nd WAN or a 2nd LAN. The new UXG-Lite doesn’t. If you need more than two interfaces or more than gigabit speeds, consider the $499 rackmount UXG-Pro, a Cloud Gateway, or another vendor.

The Gateway Lite does technically support the LTE Backup or LTE Backup Pro as a secondary Internet connection. These attach to a LAN switch port, and the UniFi Network software automatically tunnels and configures them to act as a backup cellular WAN. In the US these are locked to AT&T, and require a $15/month for 1 GB of data plan, plus $10 for each additional GB. This may be an option for some, but the lack of 3rd port is limiting.

The UXG-Lite lives up to its “Lite” status, but it’s not all bad. The actual hardware is small, silent, and pretty nice. It has a white, soft-touch plastic enclosure and an LED on the front for status. It supports all of the latest UniFi features, and claims to support gigabit routing, including with Suricata IDS/IPS enabled. More on that later.

USB-C input for power is a welcome change, but the lack of mounting holes is not. Ubiquiti will happily sell you a magnetic Floating Mount for $29. You can also 3D print one, get creative, or just find something flat to place it on top of.

Moving beyond hardware, there are many software features on a UXG that are not present on the USG. Most of the routing and security features added to UniFi gateways over the past few years are on the UXG-Lite, and very few are on the USG. It’s time to boot them up and compare them.

Initial Setup

As with other UniFi devices, you can use the mobile app or desktop web interface for setup. For devices like the UXG-Lite that have Bluetooth, initial setup with the UniFi mobile app is usually the easiest. If you have an existing network running on a Cloud Key or self-hosted controller, it might be easier to use the desktop interface.

This is a quick look at the setup process, with UniFi Network version 8.0.26 and UXG Lite firmware 3.1.16. It will help you connect to your ISP and guide you through the first time setup process. If you have multiple controllers or UniFi sites, select the approriate one, hit next a few times, and that is about it.

There is a similar process in the desktop web interface. One way to use that is to plug a computer into the LAN port of the UXG-Lite, and naviagte to the default IP of 192.168.1.1 in a web browser. You’ll see a few options for manually connecting to a controller, signing into your ui.com account, and changing WAN settings to get connected.

After it’s adopted, you’ll need to use the Network application for everything else. The UXG-Lite doesn’t have the barebones post-adoption web interface the USG has, only a “Setup Complete!” message and link to unifi.ui.com.

View fullsize

View fullsize

Setup is less straightforward if you have an existing UniFi network and gateway. UniFi Network sites can only have one gateway at a time. Before doing anything, take a backup, and see if you need to install any updates.

For those migrating from a USG or USG-Pro, you have to remove them first. Then you’ll be able to adopt the new UXG-Lite to take it’s place.

For those migrating from a Dream Machine or Cloud Gateway, you’ll want to setup your new controller first. Import your UniFi Network backup, remove the old, offline gateway if needed, then adopt the UXG-Lite. If you get stuck, try using the UXG’s initial setup web interface to point it in the right direction.

After the gateway shuffle is complete all of your network, security, and firewall settings will be applied. Anything custom you’ve changed in the config.gateway.json file on your USG will not carry over. None of the current UniFi gateways support that backdoor for custom configuration tweaks, everything lives in the GUI.

UniFi Gateway Features

There are a couple of ways to look at the features of the UXG-Lite. The spec sheet lists them out if you just want a quick overview. For those looking at migrating to a UXG from an EdgeRouter or another vendor, it’s worth looking at the current state of networking features for UniFi gateways as a whole. This is a (mostly) complete list of what you’ll get with UniFi at layer 3. As always, asterisks apply.

WAN Networking Features

• IPv4 - DHCP, PPPoE, DS-Lite, or static

• IPv6 - SLAAC, DHCPv6, or static

• DHCP client options and Class-of-Service (CoS)

• VLAN ID

• MAC address clone, for dealing with MAC address authentication from your ISP

• Smart Queues, for automated QoS on connections under 300 Mbps

• UPnP

• Dynamic DNS

LAN Networking Features

• Virtual networks (VLANs) for segmenting traffic, up to 255 on most devices

• DHCP server, relay, snooping, and guarding

• IPv6

• Multicast DNS

• Content filtering (Work or Family) for restricting explicit or malicious content

• Spanning Tree (STP, RSTP) and Ubiquiti’s proprietary Loop Prevention

• Network Isolation

• IGMP Snooping and IGMP Proxy

• Jumbo Frames, Flow Control, and 802.1X control

• VLAN Viewer, Radio and Port Manager, which are new ways to visually configure VLANs, ports, and assess Wi-Fi performance.

Security

• Device and traffic identification for clients on your network

• Country restrictions to block public IPs or web traffic by region

• Ad blocking and DNS Shield - encrypted DNS over HTTPS (DoH)

• Internal Honeypot to help detect malicious devices

• Suspicious Activity (Suricata) — previously known as Intrusion Detection or Prevention (IDS/IPS)

• Port forwarding

• Traffic Rules for policy-based routing. They allow you to block, allow, or speed limit applications, domains, IP addresses, or regions on a per-device or per-network basis.

• Manual firewall rules

Routing

• Static routes

• Traffic Routes, another newer feature that allows you to route specific traffic to a VPN or WAN interface. This can be for a single device or an entire LAN network. Together with Traffic Rules, it’s UniFi’s solution for policy-based routing.

VPN Options, generally:

• VPN Servers: Wireguard, OpenVPN, L2TP

• VPN Clients: Wireguard, OpenVPN

• Site-to-site VPNs: OpenVPN, IPsec

VPNs Options with Asterisks*

• *These aren’t supported when using a UXG Lite/Pro with a self-hosted controller. They require either Ubiquiti’s $29/month-and-up official UniFi Hosting service or a hardware Cloud Key.

• Site Magic, an automatic site-to-site option available on unifi.ui.com for those with multiple UniFi sites and multiple Cloud Keys or Cloud Gateways

• Teleport, which is Wireguard with a QR code scanning setup process

• Identity one-click VPN, which is part of the new UniFi Identity application and subscription service. This is not supported on official UniFi Hosting, only Cloud Keys and Cloud Gateways.

USG and UXG Feature Differences

They are old, but the USG and USG-Pro are still supported by current UniFi software. They continue to get occasional firmware updates, mostly for security flaws and small component updates. The last one was v4.4.57 in January 2023, for reference.

Even with the latest Network application version, USGs don’t support most of the new features like Wireguard, Traffic Rules, or Traffic Routes. You’ll only find those on a UXG or Cloud Gateway. Some features that are supported on both USGs and UXGs can have differences, so lets go through all of them.

The USG doesn’t have:

• Wireguard server or client, OpenVPN client, Teleport, Site Magic, or Identity VPN options

• Content Filtering

• WAN MAC Address clone and WAN DHCP Client Options

• Device Identification

• Ad blocking

• Internal Honeypot

• Traffic Rules and Traffic Routes

• WiFiman

• The new port and VLAN viewer, as well as port insights

• IGMP Proxy

You can also look at the same thing in reverse. There are some older features or things you can do with a USG that you can’t with a UXG-Lite. Besides the obvious limitation of a single WAN port, these are mostly older options that have been replaced or made obsolete.

The few others that are missing, like SNMP monitoring, will hopefully be added in upcoming firmware updates. It’s possible they never will be though, and you should never buy a product based on the hope that a missing feature will be added.

The UXG doesn’t have (at least not yet):

• SNMP monitoring

• DNS Shield (DNS Shield added in v3.2.11)

• Loop Prevention (Loop Prevention added in v3.2.11)

• LLDP

• The legacy PPTP VPN option

• Hardware offloading settings

• The “Traffic Restrictions” system from USG became Traffic Rules

• IPv6 RA Valid Lifetime and Preferred Lifetime

• Firewall Options: broadcast ping, receive redirects, send redirects, SYN cookies

• The ability to edit the config.gateway.json file for custom configuration changes

Routing and VPN Speed Tests

One of the most common complaints about the USG and USG-Pro are the performance limitations. The USG has a weak CPU with optional hardware offloading, which moves some cryptographic and networking tasks onto dedicated hardware. With offloading enabled, gigabit performance is possible. The downside is that you can’t enable offloading and Suricata IDS/IPS at the same time.

For IDS/IPS, you have to disable the USG’s hardware offloading, dropping performance below gigabit. Performance drops even further with IDS/IPS enabled, usually below 100 Mbps on the USG, and maybe 2 or 3 times that on the USG-Pro. This also affects inter-VLAN routing and VPN traffic. This is one of the main reasons people have been asking for an updated model for so long.

There's good news there. The UXG-Lite can handle gigabit IDS/IPS.

Routing vs. Switching

It’s worth briefly covering what routing is versus switching. Let’s look at a hypothetical example of a UXG-Lite connected to a 2.5 Gbps switch with two PCs connected.

If they’re in the same VLAN or network, traffic from PC1 to PC2 just passes into and out of the switch. The UXG-Lite doesn’t have any work to do at layer 3. That traffic is being switched, and forwarded directly. Traffic from PC1 goes directly to PC2. TCP throughput should be around 2.3 or 2.4 Gbps, due to normal TCP and Ethernet overhead.

If you moved PC2 to another VLAN or network, the traffic has to be routed. Packets from PC1 will go to the switch, then to the UXG-Lite, then back to the switch, and then PC2. PC1 has to rely on it’s gateway to escape the network it is on, and reach PC2.

Even though PC1 and PC2 are connected to the same physical switch, if they’re on separate networks, you need a router to be involved. Traffic from PC1 can’t go directly to PC2. The UXG-lite has to coordinate the dance of electrons, and the routing performance of the UXG-Lite comes into play. All devices on the switch will share a single full-duplex gigabit link to their gateway. TCP throughput should be around 940 Mbps, due to normal TCP and Ethernet overhead.

With that out of the way, onto the numbers!

iPerf Speed Test Results

iPerf is an open-source tool that allows you to synthetically test the performance of a network. For these results, I ran three tests in each direction and averaged out the results. This isn’t a guarantee of performance in your network, this is what I got with my test devices, on a mostly idle USG, UDM, and UXG-Lite. Real-world results will vary.

After spending too much time trying different iPerf versions and options, I settled on using iPerf3 with the following settings for all of my tests:

iperf3 -c -i 10 -O 10 -t 90 -P 10 -w 2M -R

This means I’m using iPerf3, as a client, with interim reports shown every ten seconds. I’m omitting the first 10 seconds of the test to account for TCP windowing and slow starts, and then running the test for 80 seconds. There are 10 parallel TCP streams on a single thread. I added the -R option on half of my tests to reverse the direction and choose if my iPerf server would be either sending or receiving.

Routing Speed

UXG-Lite

• Same LAN (switching): 940 Mbps

• InterVLAN routing: 927 Mbps

USG with hardware offload enabled

• Same LAN (switching): 939 Mbps

• InterVLAN routing: 924 Mbps

USG with hardware offload disabled

• Same LAN (switching): 937 Mbps

• InterVLAN routing: 107 Mbps

UDM

• Same LAN (switching): 941 Mbps

• InterVLAN routing: 936 Mbps

As expected, the USG with offloading disabled struggles, but they’re all capable of line-rate performance otherwise. Next, we’ll enable “Suspicious Activity” and see how much Suricata slows them down.

Routing Speed with Suspicious Activity Enabled

UXG-Lite

• IPS/IDS off: 941 Mbps

• IPS/IDS on auto: 942 Mbps

• IPS/IDS on high: 941 Mbps

USG

• Offload on, IPS/IDS off: 937 Mbps

• Offload off, IPS/IDS off: 107 Mbps

• Offload off, IPS/IDS on (low): 87 Mbps

• Offload off, IPS/IDS on (high): 83 Mbps

UDM

• IPS/IDS off: 941 Mbps

• IPS/IDS on auto: 942 Mbps

• IPS/IDS on high: 941 Mbps

As promised, the UXG-Lite can achieve gigabit IDS/IPS. Judging by how much CPU and RAM usage goes up, that might not always be the case. Real-world networks can get messy, and the hardware seems to be just barely pulling it off. Performance will vary based on sender and receiver, other clients, TCP, and a bunch of other factors.

Generally speaking though, for those with gigabit WANs, enabling the suspicious activty setting won’t slow you down.

VPN Throughput Results

The last set of testing was the most disappointing, and required the most research and explanation. I am not an expert on Linux, cryptography, and low-level hardware. Focusing on what matters: this is where you see the limitations of the UXG-Lite hardware.

Also worth noting:

• IPsec is a complex kernel-layer protocol suite with many encryption and hashing options in UniFi. I tested with AES-128 and SHA1.

• AES and other common cryptographic functions can be offloaded onto dedicated hardware, but high performance usually requires high-end components or custom ASICs. You won’t find either of those in UniFi devices.

• OpenVPN is a TUN/TAP solution using TLS. It’s easier to administer, but with OpenVPN packets must be copied between kernel and user space, reducing performance.

• Wireguard is the simplest, and doesn’t rely on hardware acceleration. It relies on the good performance of vector math on just about any modern CPU.

iPerf is one way to benchmark, but it’s not always representative of real-world results. I like how Netgates markets their similar SG1100 ($189, dual-core A53) appliance using iPerf3 and IMIX, which is meant to represent complex voice, data, and video traffic.

OpenSSL Speed Benchmarking

I can’t test every hardware configuration, and I don’t have multiple units of every model for true site-to-site results. A standardized, repeatable way to measure cryptography performance from model to model would be useful. Thankfully, the OpenSSL Speed command is one way to do that, and test the raw cryptography power of a system.

These results do not represent what you can expect in a real-world network, but it is a level playing field for comparisons. This also let me gather data from some helpful folks that have hardware I don’t have. It also let me put in some silly data points, like my U6-Pro, and some comparisons to higher-end components, like the M1 Pro inside my MacBook, and the Ryzen 7800X3D in my gaming PC. You can also compare them against other public results, like these Raspberry Pi OpenSSL benchmarks from pmdn.org.

For UniFi routers, we can condense the results a bit. The UXG-Pro, UDM-Pro, UDM-SE, and UDW all share the same heart: an Annapurna Labs AL-324 CPU. The UXG-Pro has half the RAM and there are other small differences, but the results I gathered are within margin of error from each other. I’ll just be showing the UXG-Pro from this group.

I didn’t test every cipher, I focused on MD5, SHA-1, SHA-256 and 512, and AES-128 and 256. Lastly, I included ChaCha20-Poly1305. Besides having a delightfully quirky name, it’s the encryption protocol Wireguard uses.

With these numbers you can make the UXG-Lite look really powerful. You can also make it look underwhelming.

View fullsize

View fullsize

More importantly, since we’re talking about routing and VPNs, you can see the stark difference between the ARM models and the non-ARM models in MD5 and SHA, and in AES and Wireguard.

View fullsize

View fullsize

Dual-Core Drama and Crypto Offloading

Let’s pull back to what we’re hear to talk about: VPNs, networking, and routing performance. The UDM and UXG-Pro are more capable than the UXG-Lite, and that comes down to two things. The UDM has four ARM A57 cores at 1.7 GHz, the UXG-Lite has two ARM A53 cores at 1.0 GHz. Just based on core count, speed, and power consumption alone, the UXG-Lite has a lot less power for cryptography. This results in much lower VPN throughput.

The Cortex A53 has ARMv8 crypto extensions to allow hardware offload, but they to be licensed. On low-end components without a license like in the Raspberry Pi, encryption is done in software by the CPU. Judging by the performance and the output of the lscpu command, I’m assuming the UXG-Lite has these licsensed and enabled. There’s just only so much you can do with less than 4W of power available.

WireGuard is an efficient software-only protocol that can't be hardware-offloaded by design. Unlike OpenVPN, Wireguard supports multi-threading. With only 2 cores and other services to run, the UXG-Lite still struggles with it, but it’s better than IPsec and OpenVPN. For those looking to have a simple remote or site-to-site VPN, the UXG-Lite is good for that. Just don’t expect it to go beyond 100 Mbps or support a lot of simultaneous users.

The older processor, small case, and low-power design keep the UXG-Lite from being a VPN powerhouse. You’re not going to get great VPN performance from something this small, or this cheap. Set your expectations accordingly.

UniFi Gateway Lineup Overview

Now that we’ve covered specs, setup, and performance, it’s time for a broader view. Where does the UXG-Lite fit in?

As I covered before, there are two types of UniFi gateway firewalls. There are standalone, independent USGs and UXGs, and then there are Cloud Gateways. Gateways like the UXG-Lite require something else to run the UniFi Network application, whereas the Cloud Gateways like the UniFi Dream Machine run the application and manage themselves.

UXG-Lite: Our Monkey’s Paw Gateway

As a whole, I think the UXG-Lite is a good product. I’m glad we finally have a good entry-level gateway option again. That said, the UXG-Lite isn’t without limits or problems. A few can be addressed in software updates, but a software update can’t add an interface or increase hardware power. If the UXG-Lite sticks around as long as the USG did, it might look just as embarrassing as the performance of the USG does now.

In 2019, the Dream Machines (UDM and UDM-Pro) were introduced. They were new and exciting all-in-one options with some rough software edges. The biggest negative was that they couldn’t be adopted by a self-hosted controller or Cloud Key. They couldn’t be used in centralized multi-site deployments, which is how a lot of people used UniFi. The Dream Machines represented a change of direction, and the future of multi-site support and self-hosted controllers wasn’t always clear.

What users have wanted since then was simple: a new USG. Something that can be a drop-in replacement, without forcing them into an all-in-one. Over four years later, here it is. The UXG-Lite is the new USG we’ve been waiting for, but it’s not everything we’ve hoped it could be. It feels like the result of a monkey’s paw wish.

“Be careful what you wish for, you may receive it." -Anonymous

For those specifically upset about Suricata IDS/IPS limiting throughput, they got what they wanted. The UXG-Lite has just enough hardware to satisfy that need for gigabit networks. Performance can dip below gigabit speeds with complicated rulesets and other factors, and there isn’t much overhead. It’s as if they made the cheapest and smallest box to satisfy that specific need, and to their credit, they achieved that.

What they didn’t achieve is a bit more subjective. Every product requires compromise. It can’t have every feature and a low price. The smallest and cheapest models always require tradoffs, and they have to lack some things that more expensive models have.

For the Gateway Lite, Ubiquiti chose to compromise on VPN throughput and the quantity and speed of the networking interfaces. They prioritized low cost, low power, and a small size. It does deliver more performance than the USG, and includes most of the modern UniFi features though. This tier is never going to be a VPN or firewall workhorse though, because those require better hardware, more power, and more money.

For many, the UXG Lite is a glass of ice water in hell. Many bought it as soon as they could, thankful for anything that was able to replace their USG or allow them to build the style of the network they wanted with a self-hosted or Cloud Key controller. Now that we’ve had some time to test, digest, and reflect, I’m still mostly positive about the UXG-Lite. I’ve harped on the limitations and downsides enough.

It’s easy to see something about the UXG-Lite you’d want to change. Maybe it’s adding a 3rd interface to use as a WAN or LAN. Some might begrudge the lack of 2.5 Gbps Ethernet. Some might wish VPN performance was higher. Some might wish they could still make custom configurations changes. Some are rightfully annoyed you need to buy a $29 accessory to mount it on a wall.

Maybe it’s the fact that the UXG-Lite could be so much more if just a few things were different. If you’re like me, you can hold on to hope that a no-adjective UXG, UXG-Plus, or some other future model is coming with more features, higher performance, and however much more cost that will require. I bet we’ll still need an accessory to wall-mount it though.

Originally Posted: April 24th, 2021
Last Edited: December 16th, 2023

UniFi Network Comparison Charts

These charts compare all available UniFi Network devices — Gateways, Consoles, Switches, and Wireless Access Points. They are available as images and in other mobile-friendly formats on Google Drive.

Other Ubiquiti Comparison Charts:

• UniFi Protect Comparison Charts
• PtP and PtMP Radio Comparison Charts
• EdgeMAX and UISP Wired Comparison Charts
• For all of my other posts about Ubiquiti, see my Ubiquiti Guide.

Table of Contents

• UniFi Gateways and Consoles  ↩︎
• UniFi Wireless Access Points  ↩︎
• UniFi Switches — By Generation  ↩︎
• UniFi Switches — By Type  ↩︎
• UniFi Switches — By Port Count  ↩︎
• UniFi Switches — By PoE  ↩︎

UniFi Gateways and Consoles

All UniFi Gateways, Cloud Gateways, and UniFi OS Consoles, as of December 2023. See my UniFi Router Comparison for more details. For clarity I've separated them into categories based on their role.

The branding and naming of these products has changed overtime, from Security Gateways to Routing Offload, and from UniFi OS Consoles to Console Gateways to Cloud Gateways. Not matter the term, these gateways are the devices that route packets and act as a firewall for a UniFi network.

Cloud Keys and the new Cloud Console are handled separately below. They only run UniFi software and do not route packets or act as a gateway.

We'll start by looking at all of the current options for UniFi gateways, including some older ones that Ubiquiti no longer lists on their official store.

Current Gateways

• UniFi Express (UX)
• UniFi Dream Router (UDR)
• UniFi Dream Machine Pro (UDM-Pro)
• UniFi Dream Machine SE (UDM-SE)
• UniFi Dream Wall (UDW)
• UniFi Gateway Lite (UXG-Lite)
• UniFi Gateway Pro (UXG-Pro)

Unlisted Gateways

These may still be for sale, but are not promoted on the Ubiquiti website or listed in their respective categories in the Ubiquiti store.

• UniFi Security Gateway (USG)
• UniFi Security Gateway Pro (USG-Pro)
• UniFi Dream Machine (UDM)

View fullsize

View fullsize

UniFi Standalone Gateways — USG and UXG

All UniFi standalone gateways, as of December 2023. Standalone is my term, but these gateways require the UniFi Network application to be run on another piece of hardware such as a Cloud Key, local PC/server, or cloud service. The USG models are nearing the end of their useful life, while the UXG models are current.

• UniFi Security Gateway (USG)

• UniFi Security Gateway Pro (USG-Pro)

• UniFi Gateway Lite (UXG-Lite) — Available starting November 20th, 2023

• UniFi Gateway Pro (UXG-Pro)

UniFi Cloud Gateways (UniFi OS Consoles)

All UniFi Cloud Gateways, as of December 2023. These models are newer, and they all run UniFi OS. They have been called UniFi OS Consoles, Gateway Consoles, and now Cloud Gateways. They act as routers or firewalls, and also run the UniFi software applications like Network and Protect. These can’t be used with Cloud Keys, cloud services, or a self-hosted UniFi Network application.

The Express (UX) is the newest option here, offering a simple way to get started with a new UniFi network. It is a gateway, wireless access point, and can be the UniFi Network controller for up to 4 additional devices. It can also be used as an access point in any other UniFi network.

The Dream Machine (UDM) is a router, 4-port switch, and AC Wave 2 Wi-Fi access point. It can only run the Network application, and UniFi Identity. It’s an older model currently not listed on the Ubiquiti store pages, but available via search.

The Dream Router (UDR) is in some ways an upgraded UDM, with Wi-Fi 6 on 5 GHz, UniFi Protect support for video security cameras, PoE out, and curiously, a slower dual-core CPU. The UDR can also run UniFi Talk, or UniFi Access, but only one at a time.

The Dream Machine Pro (UDM-Pro) and Dream Machine Special Edition (UDM-SE) are 10 Gbps rackmount gateways that can run all UniFi OS applications — Network, Protect, Access, Talk, and UID. They also have built-in 8-port Ethernet switches, but don’t provide Wi-Fi.

The Dream Wall (UDW) is meant to be installed on a wall rather than a typical network rack or shelf. It runs all UniFi OS applications, and includes a built-in router, switch, and Wi-Fi access point.

• UniFi Express (UX)

• UniFi Dream Router (UDR)

• UniFi Dream Machine (UDM) — Not listed on store.ui.com, available via search

• UniFi Dream Machine Pro (UDM-Pro)

• UniFi Dream Machine SE (UDM-SE)

• UniFi Dream Wall (UDW)

UniFi Cloud Keys

The Cloud Keys are different. They are not gateways or routers, they only run UniFi OS applications. I’m including them to make comparing which models run which UniFi OS applications easier. Cloud Keys require the use of the USG, USG-Pro, UXG-Lite, UXG-Pro, or some 3rd party router or firewall.

The base 2nd generation (UCK-G2) model only runs the Network application, but the G2+ model can also act as an NVR for UniFi Protect, and it also supports UniFi Talk, UniFi Access, and some features of UniFi Identity. The Cloud Console or UniFi Cloud is a new official cloud option for hosting the UniFi Network application, and requires a monthly subscription.

• Cloud Key (UC-CK) — Discontinued

• Cloud Key Gen 2 (UCK-G2) — Not a router, only runs UniFi Network application

• Cloud Key Gen 2 Plus (UCK-G2-Plus) — Not a router, runs all UniFi OS applications

• Cloud Key Enterprise (CK-Enterprise) — Not a router, only runs UniFi Network application

• UniFi Cloud (Official UniFi Hosting) — Ubiquiti's official cloud service for running the UniFi Network application

UniFi Wi-Fi Access Points

All UniFi APs, as of December 2023. See my UniFi Wi-Fi Access Point Buyers Guide for more details.

Wi-Fi 5 UniFi APs

The older Wi-Fi 5 models are broken up into two tiers. The AC Wave 1 models are the oldest UniFi APs still for sale. The slightly newer AC Wave 2 models mostly have “HD” in their name, and the additional features that AC Wave 2 added to the 802.11ac standard.

AC Wave 1

• AC Lite (UAP-AC-Lite)

• AC Long-Range (UAP-AC-LR)

• AC Professional (UAP-AC-Pro)

• AC Mesh (UAP-AC-M)

• AC Mesh Professional (UAP-AC-M-Pro)

• AC In-Wall (UAP-AC-IW)

AC Wave 2

• UniFi Dream Machine (UDM) — All-in-one Router/Controller/Switch/AP

• nanoHD (nanoHD)

• FlexHD (FlexHD)

• AC HD (AC-HD)

• AC SHD (AC-SHD)

• BeaconHD (BeaconHD) — No Ethernet ports, wireless backhaul only

• In-Wall HD (In-Wall-HD)

View fullsize

View fullsize

Wi-Fi 6 and Wi-Fi 6E

Wi-Fi 6

• UniFi Dream Router (UDR) — All-in-one UniFi OS Console/Firewall/Switch/AP

• U6 Lite (U6-Lite)

• U6+ (U6-Plus)

• U6 Long-Range (U6-LR)

• U6 Professional (U6-Pro)

• U6 Mesh (U6-Mesh)

• U6 Extender (U6-Extender) — No Ethernet ports, wireless backhaul only

• U6 In-Wall (U6-IW)

XG, Wi-Fi 6E, and 60 GHz Bridge

The U6-Enterprise and U6-Enterprise In-Wall are the only two Wi-Fi 6E models we’ve seen so far. Until we see more Wi-Fi 6 E models, is a bit of a catch-all category.

I added the XG and BaseStation XG, which are high-end 802.11ac models that haven’t been updated to support Wi-Fi 6 yet. They can be used for very high density networks and other specialty needs. The Building Bridges can be used to to bridge your network to another location a couple hundred feet or meters away.

• XG (UAP-XG)

• WiFi BaseStation XG (UWB-XG)

• U6 Enterprise (U6-Enterprise)

• U6 Enterprise In-Wall (U6-Enterprise-IW)

• Building Bridge (UBB)

• Building Bridge XG (UBB-XG)

View fullsize

View fullsize

Omnidirectional UniFi APs

Omnidirectional APs are defined by their antennas which broadcast in all directions. These are typically mounted to a ceiling, but can also be mounted to a wall or placed on a desk or shelf. These are good general purpose APs for covering a broad area.

Omnidirectional Wi-Fi 4 and 5

• AC Lite (UAP-AC-Lite)

• AC Long-Range (UAP-AC-LR)

• AC Professional (UAP-AC-Pro)

• nanoHD (nanoHD)

• AC HD (UAP-AC-HD)

• AC SHD (UAP-AC-SHD)

• XG (UAP-XG)

Omnidirectional Wi-Fi 6 and 6E

• U6 Lite (U6-Lite)

• U6+ (U6-Plus)

• U6 Long-Range (U6-LR)

• U6 Professional (U6-Pro)

• U6 Enterprise (U6-Enterprise)

View fullsize

View fullsize

Mesh and Flex UniFi APs

• AC Mesh (UAP-AC-M)

• AC Mesh Pro (UAP-AC-M-Pro)

• FlexHD (UAP-FlexHD)

• BeaconHD (UAP-BeaconHD) — No Ethernet ports, wireless backhaul only

• U6 Mesh (U6-Mesh)

• U6 Extender (U6-Extender) — No Ethernet ports, wireless backhaul only

UniFi APs - In-Wall

• AC In-Wall (UAP-AC-IW)

• AC In-Wall HD (UAP-IW-HD)

• U6 In-Wall (U6-IW)

• U6 Enterprise In-Wall (U6-Enterprise-IW)

UniFi Switches — Grouped By Generation

There are a lot of UniFi switches. There are over 32 of them surrently on the Ubiquiti store, too many to fit into one chart.

To make them easier to digest, I group them in multiple ways. We'll start with the 1st generation and basic 2nd generation switches, then add in the professional and enterprise, and other special models. Last, we'll look at them by port count and by PoE or non-PoE.

This is every model of UniFi Switch, as of December 2023. See UniFi Switches Explained and my UniFi Switches Buyers Guide for more details.

1st Generation UniFi Switches

These are what’s left of the 1st generation models, which were released from 2014 to 2017. They lack the 2nd generation features like the small touchscreen and UniFi AR and can have loud fans. They are still supported and fine to use. The PoE models offer lots of PoE budget for their price, making them suitable for some networks despite being older.

• 8 (Gen1) (US-8)

• 8 PoE (Gen1) (US-8-60W)

• 8 PoE, SFP (Gen1) (US-8-150W)

• Standard 16 PoE (Gen1) (US-16-150W)

• Standard 24 (Gen1) (US-24) — No longer listed in US store

• Standard 24 PoE (Gen1) (US-24-250W)

• Standard 48 (Gen1) (US-48) — No longer listed in US store

• Standard 48 PoE (Gen1) (US-48-500W)

• XG 6 PoE (Gen1) (US-XG-6PoE)

• XG 16 / 16X 10GbE (Gen1) (US-16-XG)

2nd Generation (Non-Pro, Non-Enterprise) UniFi Switches

These are the basic Flex, Lite, and Standard 2nd generation UniFi switches which started appearing in 2019. The rest of the 2nd generation models are grouped by their type below.

• Flex Mini (USW-Flex-Mini)

• Flex (USW-Flex)

• Industrial (USW-Industrial)

• Lite 8 PoE (USW-Lite-8-PoE)

• Lite 16 PoE (USW-Lite-16-PoE)

• Standard 16 PoE (USW-16-PoE)

• Standard 24 (USW-24)

• Standard 24 PoE (USW-24-PoE)

• Standard 48 (USW-48)

• Standard 48 PoE (USW-48-PoE)

UniFi Switches — Grouped By Type

All 1st generation and 2nd generation UniFi switches, grouped by type, or model line.

Standard UniFi Switches

"Standard" is a new term for the normal, full rack-width rackmountable switches. Most of them are from the 2nd generation, but the first generation US-16, US-24, and US-48 models also were renamed. This is a chart comparing all standard models.

• Standard 16 PoE (Gen1) (US-16-150W)

• Standard 24 PoE (Gen1) (US-24-250W)

• Standard 48 PoE (Gen1) (US-48-500W)

• Standard 16 PoE (USW-16-PoE)

• Standard 24 (USW-24)

• Standard 24 PoE (USW-24-PoE)

• Standard 48 (USW-48)

• Standard 48 PoE (USW-48-PoE)

Pro and Pro Max UniFi Switches

The professional models feature UniFi’s Layer 2+/L3 switching features, high PoE budgets, and 10 Gbps SFP+ or 25 Gbps SFP28 ports. The USP-RPS can be used for redundant power on all models that support it.

The Pro Max models were announced in December 2023. The first two models that are available now at the Pro Max 24 PoE and Pro Max 48 PoE. There will be additional models in the future. The most notable features for the Pro Max models are PoE++ and 2.5 Gbps RJ45 interfaces, making them good for networks with lots of U6-Enterprise access points, Wi-Fi 6E, and other high-power and high-bandwidth needs. They also have RGB lighting that can help identify ports and works with UniFi AR. Ubiquiti has branded this as Etherlighting™️ and so far only the Pro Max models have that feature.

• Professional 8 PoE (USW-Pro-8-PoE) — New model similar to Enterprise-8-PoE

• Professional 24 (USW-Pro-24)

• Professional 24 PoE (USW-Pro-24-PoE)

• Professional 48 (USW-Pro-48)

• Professional 48 PoE (USW-Pro-48-PoE)

• Pro Max 24 PoE (USW-Pro-Max-24-PoE)

• Pro Max 48 PoE (USW-Pro-Max-48-PoE)

Aggregation and Enterprise UniFi Switches

Enterprise is a level above professional, featuring 2.5 or 10 Gbps RJ45 ports, and 10 Gbps SFP+ or 25 Gbps SFP28 ports.

• Aggregation (USW-Aggregation)

• High-Capacity Aggregation (USW-Pro-Aggregation)

• Enterprise 8 PoE (USW-Enterprise-8-PoE)

• Enterprise 24 PoE (USW-Enterprise-24-PoE)

• Enterprise XG 24 (USW-EnterpriseXG-24)

• Enterprise 48 PoE (USW-Enterprise-48-PoE)

UniFi Switches — Utility Models

“Utility” is another new category on the UniFi store. These models are specialized in some way, either by being small desktop models with PoE, or by being more flexible in where they can be used. The Flex switch has the optional outdoor Flex Utility enclosure, and the Industrial is plenum-rated and hardened for harsh environments, as examples. For readability, I’ve split them into two groups.

Utility switches under 8 ports:

• XG 6 PoE (Gen1) (US-XG-6PoE)

• Flex Mini (USW-Flex-Mini)

• Flex (USW-Flex)

• Flex XG / Flex 10 GbE (USW-Flex-XG)

Utility switches 8 ports and up:

• 8 PoE (Gen1) (US-8-60W)

• 8 PoE, SFP (Gen1) (US-8-150W)

• Lite 8 PoE (USW-Lite-8-PoE)

• Lite 16 PoE (USW-Lite-16-PoE)

• Industrial (USW-Industrial)

• Enterprise 8 PoE (USW-Enterprise-8-PoE)

View fullsize

View fullsize

XG and Flex UniFi Switches

XG Models

XG models typically feature 10 Gbps SFP+ or 25 Gbps SFP28 ports.

• XG 6 PoE (Gen1) (US-XG-6PoE)

• XG 16 / 16X 10GbE (Gen1) (US-16-XG)

• Flex XG / Flex 10 GbE (USW-Flex-XG)

• Enterprise XG 24 (USW-EnterpriseXG-24)

Flex Models

Flex models are able to be powered by PoE input, USB-C, or a power adapter.

• Flex Mini (USW-Flex-Mini)

• Flex (USW-Flex)

• Flex XG / Flex 10 GbE (USW-Flex-XG)

View fullsize

View fullsize

Power Tech

This is a new category, including all the of the power backup and PDU models. The Mission Critical is a switch for core infrastructure that needs to stay up during a power outage. The RPS and PDU models are for supplying redundant power to UniFi routers and switches that support RPS input.

• Mission Critical (USW-Mission-Critical)

• Redundant Power System / Power Backup (USP-RPS)

• Power Distribution Professional (USP-PDU-Pro)

Data Center

This is another new category, meant for high-end networks which need multiple 25, 40, or 100 Gbps links, and VxLAN capabilities. These are not part of the normal UniFi Network Application, and are managed by the new, separate UniFi Data Center Application. These models have been removed from the early access store, but I’m leaving this here in case they return.

• Data Center Leaf (UDC-Leaf-100G) — Early Access Only

• Data Center Spine (UDC-Spine-100G) — Early Access Only

View fullsize

View fullsize

UniFi Switches — Grouped By Port Count

All UniFi Switches, grouped by port count.

UniFi Switches — Under 8 Ports

• XG 6 PoE (Gen1) (US-XG-6PoE)

• Flex Mini (USW-Flex-Mini)

• Flex (USW-Flex)

• Flex XG / Flex 10 GbE (USW-Flex-XG)

UniFi Switches — 8 to 10 Port Models

• 8 (Gen1) (US-8)

• 8 PoE (Gen1) (US-8-60W)

• 8 PoE, SFP (Gen1) (US-8-150W)

• Lite 8 PoE (USW-Lite-8-PoE)

• Industrial (USW-Industrial)

• Aggregation (USW-Aggregation)

• Pro 8 PoE (USW-Pro-8-PoE) — New model, similar to Enterprise-8-PoE

• Enterprise 8 PoE (USW-Enterprise-8-PoE)

• Mission Critical (USW-Mission-Critical)

UniFi Switches — 16 Port Models

• Standard 16 PoE (Gen1) (US-16-150W)

• XG 16 / 16X 10GbE (Gen1) (US-16-XG)

• Lite 16 PoE (USW-Lite-16-PoE)

• Standard 16 PoE (USW-16-PoE)

UniFi Switches — 24 to 32 Port Models

• Standard 24 (Gen1) (US-24) — No longer listed in US store

• Standard 24 PoE (Gen1) (US-24-250W)

• Standard 24 (USW-24)

• Standard 24 PoE (USW-24-PoE)

• Professional 24 (USW-Pro-24)

• Professional 24 PoE (USW-Pro-24-PoE)

• Pro Max 24 PoE (USW-Pro-Max-24-PoE)

• High-Capacity Aggregation (USW-Pro-Aggregation)

• Enterprise 24 PoE (USW-Enterprise-24-PoE)

• Enterprise XG 24 (USW-EnterpriseXG-24)

UniFi Switches — 33 Ports and Up

• Standard 48 (Gen1) (US-48) — No longer listed in US store

• Standard 48 PoE (Gen1) (US-48-500W)

• Standard 48 (USW-48)

• Standard 48 PoE (USW-48-PoE)

• Pro 48 (USW-Pro-48)

• Pro 48 PoE (USW-Pro-48-PoE)

• Pro Max 48 PoE (USW-Pro-Max-48-PoE)

• Enterprise 48 PoE (USW-Enterprise-48-PoE)

UniFi Switches — Grouped By PoE

All UniFi Switches, grouped by PoE and port count.

PoE UniFi Switches — Under 16 Ports

• 8 PoE (Gen1) (US-8-60W)

• 8 PoE, SFP (Gen1) (US-8-150W)

• XG 6 PoE (Gen1) (US-XG-6PoE)

• Flex (USW-Flex)

• Lite 8 PoE (USW-Lite-8-PoE)

• Industrial (USW-Industrial)

• Professional 8 PoE (USW-Pro-8-PoE) — New model, similar to Enterprise-8-PoE

• Enterprise 8 PoE (USW-Enterprise-8-PoE)

• Mission Critical (USW-Mission-Critical)

PoE UniFi Switches — 16 to 24 Ports

• Standard 16 PoE (Gen1) (US-16-150W)

• Standard 24 PoE (Gen1) (US-24-250W)

• Lite 16 PoE (USW-Lite-16-PoE)

• Standard 16 PoE (USW-16-PoE)

• Standard 24 PoE (USW-24-PoE)

• Pro 24 PoE (USW-Pro-24-PoE)

• Pro Max 24 PoE (USW-Pro-Max-24-PoE)

• Enterprise 24 PoE (USW-Enterprise-24-PoE)

PoE UniFi Switches — Over 24 Ports

• Standard 48 PoE (Gen1) (US-48-500W)

• Standard 48 PoE (USW-48-PoE)

• Pro 48 PoE (USW-Pro-48-PoE)

• Pro Max 48 PoE (USW-Pro-Max-48-PoE)

• Enterprise 48 PoE (USW-Enterprise-48-PoE)

Non-PoE UniFi Switches — Gen 1 and Standard

• 8 (Gen1) (US-8)

• Standard 24 (Gen1) (US-24) — No longer listed in US store

• Standard 48 (Gen1) (US-48) — No longer listed in US store

• XG 16 / 16X 10GbE (Gen1) (US-16-XG)

• Flex Mini (USW-Flex-Mini)

• Standard 24 (USW-24)

• Standard 48 (USW-48)

Non-PoE UniFi Switches — Pro, XG, and Enterprise

• Aggregation (USW-Aggregation)

• Professional 24 (USW-Pro-24)

• Professional 48 (USW-Pro-48)

• High-Capacity Aggregation (USW-Pro-Aggregation)

• Flex XG / Flex 10 GbE (USW-Flex-XG)

• Enterprise XG 24 (USW-EnterpriseXG-24)

Originally Posted: December 5th, 2023

TL;DR:

• The UniFi Express (UX) is another new gateway from Ubiquiti, and the cheapest and easiest way to start a UniFi Network.

• The UX is a Cloud Gateway — it acts as a UniFi Network controller, gateway, and Wi-Fi 6 access point. You can add up to 4 more for a mesh-style network, or repurpose them as access points in any UniFi network.

• The Express is for sale for $149 in the US, and availability in other regions is coming soon.

UniFi Express Preview: Flexible and Mesh-able

UniFi Express Tech Specs

From the Ubiquiti store page for the UniFi Express:

Powerfully compact UniFi Cloud Gateway and WiFi 6 access point that runs UniFi Network. Powers an entire network or simply meshes as an access point.

• Built-in WiF6 (2x2 MIMO)

• 140 m² (1,500 ft²) single-unit coverage

• 60+ connected WiFi devices

• (1) GbE RJ45 WAN port

• (1) GbE RJ45 LAN port to extend network

• 0.96" LCM status display

Mechanical and Physical

• Dimensions: 98 x 98 x 30 mm (3.9 x 3.9 x 1.2")

• Weight: 302 g (10.7 oz)

• Enclosure materials: Polycarbonate

• Operating temperature: -10 to 45° C (14 to 113° F)

• Operating humidity: 5 to 95% noncondensing

• Certifications: CE, FCC, IC

Hardware and Power

• Networking interfaces

  • (1) 1 Gbps RJ45 WAN port

  • (1) 1 Gbps RJ45 LAN port

• Management interface: Ethernet, Bluetooth

• Power method: USB type C (5V DC/3A)

• Max. power consumption: 10W

• LCM display: 0.96" status display

• Processor: Qualcomm IPQ5018 — Dual core ARM A53 @ 1 GHz

• Memory information: 1 GB DDR3L

Wi-Fi Specifications

• 2.4 GHz Radio

  • Max TX power: 22 dBm

  • Antenna gain: 4 dBi

  • MIMO: 2x2 (DL/UL MU-MIMO)

  • Max channel width: 40 MHz

  • Maximum PHY (Throughput rate): 574 Mbps

• 5 GHz Radio

  • Max TX power: 25 dBm

  • Antenna gain: 5.15 dBi

  • MIMO: 2x2 (DL/UL MU-MIMO)

  • Max channel width: 160 MHz

  • Max PHY (throughput) rate: 2400 Mbps

• Wireless security: WPA-PSK, WPA-Enterprise (WPA/WPA2/WPA3)

• Max BSSID: 8 per radio

• VLAN: 802.1Q

• Advanced QoS: Per-user rate limiting

• Guest traffic isolation: Supported

• Concurrent clients: 60+

• Zero wait DFS: Yes

UniFi Express Comparison Charts

For more comparisons, see the rest of my UniFi Network Comparison Charts.

A New Kind of Flexibility

The UniFi Express is as small, cheap, and simple as a UniFi Network can be. There is a lot of details to discuss, but I can’t get over one thing in particular. The Express can do what no other UniFi Cloud Gateway can do: turn into a normal Wi-Fi access point.

The Express can either manage your UniFi network or be managed by another UniFi controller. It can be managed by a Cloud Key, Dream Machine, or self-hosted controller if that fits your needs. The other low-end options such as the Dream Router and Dream Machine can’t do that. In fact, no other UniFi device can do that. It makes the UX more flexible and more useful, and worth considering for both new and advanced users.

The UX can be everything you need for a small network, like the Apple AirPort Express used to be, and like most consumer all-in-one routers are now. You don’t need a Cloud Key or any other parts, but you can add up to 4 UniFi switches or APs if you want. You can also repurpose the Express as an AP if you outgrow it, making it arguably the best entry-level option to get started with.

Goodbye AmpliFi?

This all makes me wonder about the future of Ubiquiti’s other easy-to-use products, AmpliFi. Reading the tea leaves, it seems to point to AmpliFi going away and the UniFi ecosystem extending down to uses that are usually covered by mesh Wi-Fi and basic all-in-one Wi-Fi routers.

Traditionally, Ubiquiti’s option in that area has been AmpliFi. It’s a separate brand with different software and more limited features. AmpliFi software updates have been slow and steady over the past few years, but there hasn’t been any new AmpliFi hardware since the Alien in 2019. We’ll have to wait and see about the future of AmpliFi, but UniFi is clearly their priority.

UniFi Express FAQ and Asterisks

With the UXG-Lite and UX, we now have a lot of options for an entry level UniFi router. The UXG-Lite and UXG-Pro are for people with a Cloud Key or self-hosted network controller. The Cloud Gateways like the UDM-Pro and UDM-SE can only be managed by themselves.

The Express is different, and choosing between all of these options can get confusing. I’ve seen a lot of people ask the same questions. Thankfully, Ubiquiti has a FAQ on their website that clears up most of them:

What is UniFi Express?

UniFi Express is a complete UniFi Networking stack in an ultra-compact, plug-and-play form factor. It runs UniFi Network and features a powerful gateway engine and built-in WiFi 6 with seamless meshing.

Which UniFi Applications run natively on UniFi Express?

UniFi Express runs UniFi Network. For expanded application support, add an additional UniFi Console. For example, a Cloud Key or Network Video Recorder can be added to a UniFi Express network to run UniFi Protect for camera security.

How can UniFi Express be deployed?

UniFi Express can power an entire network as an all-in-one gateway, firewall, and WiFi 6 access point. Need more WiFi coverage? No problem - simply power on another UniFi Express and seamlessly mesh it to the gateway UniFi Express for effortless coverage expansion.

UniFi Express can also be deployed as a WiFi access point in existing UniFi Networks with a wired or wireless uplink.

How many UniFi Network devices does UniFi Express support?

When operated as a gateway, UniFi Express manages up to four additional UniFi Network devices such as other UniFi Express units, switches, and WiFi access points.

How many connected client devices does UniFi Express support?

Each UniFi Express can support 60+ connected client devices.

What is the routing performance of UniFi Express?

UniFi Express can route traffic at speeds up to 1 Gbps. Security features such as Device Identification, Traffic Identification, Country Restrictions, and Ad Blocking can all be enabled without impacting routing performance.

Are there any gateway feature limitations for UniFi Express, compared to other UniFi Gateways?

UniFi Express largely offers the same experience as all other UniFi Gateways, with powerful network segmentation, application-aware firewall, VPN, and license-free Site Magic SD-WAN capabilities.

The only exceptions are Suspicious Activity features (also known as IDS/IPS), which are not available on UniFi Express.

How can UniFi Express be mounted?

UniFi Express is designed to be flexibly placed on any flat surface, such as a desk.

A magnetic wall mount accessory will be available soon for expanded mounting versatility.

Those questions and answers clear up most of the confusion, but there are a few things worth calling out. The spec sheet doesn’t specify the CPU, RAM, or storage. Now that it’s released, we can confirm those for ourselves.

The Express has a Qualcomm IPQ5018 chipset, with a dual-core ARM A53 CPU running at 1 GHz. It has 1 GB DDR3L RAM and 4 GB of storage. It’s very similar to the UXG Lite externally and internally.

The ARM A53 core design was launched in 2012, so it’s not exactly cutting-edge tech. With such a low cost and low power budget, it makes sense, even if it is a little disappointing. That puts the Express firmly in the low-end of the gateway lineup. For many reasons, it won’t be competing with the UDM-Pro, UXG-Pro, or even the UDM.

Missing Features: IDS/IPS

Another thing worth examining are the limitations of the UX compared to other UniFi Gateways. Those mostly come down to hardware, software, and device managment limits.

As a result of the limited hardware power, Ubiquiti chose to not enable Suspicious Activity (read: Suricata IDS/IPS) on the Express. In my opinion, that is probably the right decision. The USG and USG-Pro were similarly under-powered, and we’ve never heard the end of people complaining about throughput limitations. Search for “USG slow” or “USG IPS/IDS” and see for yourself. Enabling those features would lead to low throughput and frustrated users.

In the places where the UX will be used, and for most people most of the time, I don’t see that as a deal-breaker. The modern Internet is mostly encrypted by default. HTTPS, modern browsers and operating systems, and good browsing habits makes Suricata a nice-to-have rather than a strict need. Inspecting encrypted traffic and TLS is possible, but it’s complicated and expensive. It’s also of limited utility in a typical home network with no publicly exposed ports or services outside of maybe a VPN server.

If you’re concerned about the lack of Suricata, consider a more expensive UniFi gateway that has enough hardware power to support it. You can also consider wrapping your traffic in another layer of encryption by using a VPN. You could set up a Pi-hole DNS server or enable UniFi Ad Blocking or DNS Shield to control and protect your DNS traffic. You could also utilize the other security features that UniFi and your devices offer.

Limitations and Alternatives

Another result of the hardware limits is the low number of UniFi devices you can manage. You can manage up to 5 total UniFi devices, and the main gateway UX counts as one of them. That means you can add up to 4 UX, UniFi switches, or APs. There is an error message when you try to add a 6th. The client device limit — the phones, laptops, tablets, TVs, etc that you connect to the network — is around 60. That’s not a hard cap though, just a general guideline.

The 5 UniFi device limit is low, but it also helps put guardrails on who should consider this. If you need a big network, multi-gig throughput, a lot of devices and clients, or IDS/IPS, the UX can’t be your gateway, but it can be an AP in that kind of setup. You might be better served by a purpose-built AP, like the U6-Mesh or U6-Pro.

If you want to build your network around the Express as your gateway and controller, keep the limits in mind. If you want more details about the other gateway and access point options, see my other posts about them in my Ubiquiti Guide:

• UniFi Gateways Explained as Simply as Possible

• UniFi Gateway Comparison: USG vs UDM vs UXG

• UniFi Network Comparison Charts

• UniFi Wi-Fi Access Point Buyers Guide

• UniFi Switch Comparison and Buyers Guide

UniFi’s Strengths and Weaknesses

With the UX seemingly competing with AmpliFi and the mesh Wi-Fi market, it’s worth comparing them. Why would you chose it over the many other options out there? The differences mostly come down to software.

Most of the mesh systems I’ve tested have a nice mobile app that makes setup easy, but only offer the bare minimum of settings and features. Some of them are better in that area, like ASUS ZenWiFi. Some of them want you to pay a subscription for extra features, like eero Plus or Netgear Armor. UniFi doesn’t do that, offering free software that is regularly updated with new features.

Rather than basic phone-app-only management with a few settings, the Express has the full UniFi desktop web interface. The UniFi mobile app has common settings, and it is one of the better ones out there.

With that software the Express can do things other consumer equipment can’t, like be a Wireguard or OpenVPN server, or control managed switches. You can create additional VLANs and SSIDs. It can act as a Wireguard or OpenVPN client, and you can control and direct specific traffic with UniFi Traffic Routes, Traffic Rules, and firewall rules.

Another strength of UniFi are the expansion options you have. Rather than settling for another router in bridge mode or a Wi-Fi extender, the UX can be the center of a small, but full-fledged UniFi network. Mesh Wi-Fi systems make this kind of multiple AP setup simple, but UniFi is more controllable and customizable. UniFi can also become your solution for video security cameras, access control, VoIP phones, and identity management if you want to go all in.

UniFi isn’t perfect though, and it isn’t always the best option for a non-technical user. Sometimes it feels like the design and look of the software are more important than how it works. It aspires to be enterprise-grade, but fails to deliver that in some areas. Finding good documentation or support can be tough. Ubiquiti’s support has been hit or miss over the years, even though that’s starting to change.

Despite those and many other asterisks, in a lot of areas UniFi delivers more than other consumer equipment does.

Full Circle: Round Rects Are Everywhere!

I was tempted to put the Apple AirPort Express in the title image for this post. I too, am amazed at my restraint.

If you didn’t know, Ubiquiti’s founder and CEO Robert Pera worked in Apple’s AirPort division before he left in 2005 to start Ubiquiti. The 1st generation AirPort Express resembles a modern MacBook power brick and was released in 2004, and it’s reasonable to think he worked on that product. The 2nd generation took on the familiar rounded rectangle shape that we’ve seen in other products like the Apple TV. The UniFi Express not only has the same product name, it also has a suspiciously similar design.

Despite a few patents, Apple doesn’t own the shape of a rounded rectangle. Apple also chose to stop making Wi-Fi and networking equipment in 2018, leaving a hole that Ubiquiti and other mesh Wi-Fi companies have filled. Ubiquiti has always had a bit of Apple’s DNA in their design, from the products themselves to their packaging and marketing. This is just taking that to the next level, where you might not be able to tell which is which if you placed them side-by-side. We’ve come full circle.

Lastly, I just want to point you to this delightful story from Andy Hertzfeld’s folklore.org. The whole website is a fun read, as it has a lot of anecdotes from the early days of the Mac at Apple. This one in particular seems relevant: Round Rects Are Everywhere!

In case you missed it, the November edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

November was yet another packed month for news, but it also marked the start of UXG season. We recorded this just before the news about the UniFi Express came out. In this episode we talk about the UXG Lite, the new Ubiquiti paid phone support (Site Support), UniFi Talk in the UK, UniFi Network 8.0, and other recent software releases.

Almost immediately, I stuck my foot in my mouth by forgetting the UXG Lite comes with a power supply. I was too busy taking pictures to finish my unboxing, and talking is hard. I prefer writing for a reason — it’s so much easier to edit out your mistakes.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if that’s your thing. We also have a YouTube playlist of all episodes.

Episode Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @WillieHowe

• Guest Host: @MrEvanMcCann from @TechMcCann

• Recorded using @SquadCastFM and hosted with @CastosHQ

Originally Posted: November 29th, 2023

UniFi Gateways Explained as Simply as Possible

Categories

There are two categories: Gateways and Cloud Gateways.

Gateways are just routers and nothing else. These are managed by a Cloud Key or self-hosted UniFi Network application. They don't run any software, and don't do anything besides act as a firewall/gateway/router.

Cloud Gateways are routers that run software. At a minimum they run the UniFi Network application. They manage themselves and other UniFi switches and APs. They can't be managed by a Cloud Key or self-hosted controller*.

• These have been called "UniFi OS Consoles" or "Gateway Consoles" and other terms, but Cloud Gateway™ is the current branding.

• Some of these run other UniFi software like Protect, Talk, Access, or Identity.

• *Besides the new UniFi Express (UX), which can be used as an access point. There is always an asterisk on everything.

"Controller" is a general term for a device that runs the UniFi Network application — it can be self-hosted on your own hardware, a Cloud Key, a cloud server, or a UniFi Cloud Gateway™ like the Dream Machine Pro.

UniFi Gateways

Security Gateway (USG) = Old and slow

• Three gigabit RJ45, so you can have a 2nd LAN or a 2nd WAN.

• Missing most new security, routing, and VPN features

• Very slow for VPN or IPS/IDS

Security Gateway Pro (USG-Pro) = Rackmount USG

• Two gigabit SFP/RJ45, two gigabit RJ45.

• Missing most new security, routing, and VPN features

• A bit more speed, but still old and slow.

Next-gen Gateway Lite (UXG-Lite) = New USG

• Single gigabit WAN and single gigabit LAN

• Much faster and supports most of the latest security, routing, and VPN features.

Next-gen Gateway Pro (UXG-Pro) = New USG-Pro

• Rackmount, dual WAN, dual LAN.

• Two gigabit RJ45 and two 10 Gbps SFP+

UniFi Cloud Gateways

Express (UX) = Controller + Gateway + Wi-Fi

• Single gigabit WAN and single gigabit LAN

• Does not support IPS/IDS, and some security features aren't in current firmware

• Multiple UX can join together for a wired or wireless mesh network

• Can also be used as an access point in an existing UniFi network

Dream Router (UDR) = Controller + Gateway + 4-port switch (2 PoE out) + Wi-Fi

• Single gigabit WAN, 4 gigabit LAN with two PoE out.

• Can also run Protect, Talk, Access, and Connect -- but only one at a time

• Protect video storage = internal 128 GB SSD and SD card slot

Dream Machine (UDM) = Controller + Gateway + 4-port switch + Wi-Fi

• Single gigabit WAN, 4 gigabit LAN.

• No PoE. No other UniFi applications.

• Not listed in the Cloud Gateway category of Ubiquiti's store. Still for sale and supported, but may be discontinued soon.

Dream Machine Pro (UDM-Pro) = Controller + Gateway + 8-port switch

• Dual-WAN, rackmount, with two 10 Gbps SFP+

• Runs all UniFi applications and can be NVR for UniFi Protect

• Protect video storage = single 3.5" HDD bay

Dream Machine SE (UDM-SE) = Controller + Gateway + 8-port PoE switch

• Essentially, UDM-SE = UDM-Pro + PoE, 128 GB SSD, and one RJ45 upgraded to 2.5 Gbps

• Dual-WAN, rackmount, with two 10 Gbps SFP+

• Runs all UniFi applications and can be NVR for UniFi Protect

• Protect video storage = single 3.5" HDD bay + internal 128 GB SSD

Dream Wall (UDW) = Controller + Gateway + 16-port PoE switch + Wi-Fi

• Unique wallmount enclosure with touchscreen for status/management

• Lots of PoE (4 PoE, 4 PoE+, 4 PoE++, 420W budget) and dual power supplies

• Protect video storage = internal 128 GB SSD + SD card slot with 512 GB card pre-installed

UniFi Gateway Comparison Charts

For those that prefer more detail, I’ve made some more in-depth comparisons. See the rest of my latest UniFi Network Comparison Charts, and my UniFi Gateway Comparison for more details.

Standalone just-a-router Gateways

Cloud Gateways and the UDM

All Current Gateways

Unlisted Gateways — USG, USG-Pro, and UDM

Originally Posted: November 17th, 2023

TL;DR:

• The Gateway Lite (UXG-Lite) is a new gigabit UniFi gateway for a Cloud Key, self-hosted, or cloud-hosted UniFi network

• The UXG-Lite is available in the US starting November 20th for $129, and coming to other regions soon

• This is the UniFi Security Gateway (USG) replacement we’ve all been waiting for

UXG-Lite Preview: A Proper USG Replacement

UXG-Lite Tech Specs

From the UXG-Lite page on store.ui.com:

A compact and powerful UniFi gateway with a full suite of advanced routing and security features

- Up to 10x routing performance increase over USG (tested with IPS/IDS, QoS, and Smart Queues)
- Managed with a Cloud Key, Official UniFi Hosting, or UniFi Network Server
- (1) 1 Gbps WAN port
- (1) 1 Gbps LAN port
- Compact footprint
- USB-C powered (adapter included)

Technical Specifications — Mechanical

• Dimensions: 98 x 98 x 30 mm (3.9 x 3.9 x 1.2")

• Weight: 320 g (11.3 oz)

• Enclosure materials: Polycarbonate

Hardware Specifications

• Processor: Dual-core ARM® Cortex®-A53 at 1 GHz

• Memory information: 1 GB DDR3L

• Management interface: Ethernet, Bluetooth 5.1

• Networking interfaces

  • (1) 1 Gbps RJ45 WAN port

  • (1) 1 Gbps RJ45 LAN port

• Power method: USB type C (5V/3A)

• Supported voltage range: 100–240V

• Max. power consumption: 3.83W

• Operating temperature: -10 to 40° C (14 to 104° F)

• Operating humidity: 5 to 95% noncondensing

• Certifications: CE, FCC, IC

Gateway Features — Performance

• WiFi QoS with UniFi APs

• Application, domain, and country-based QoS

• Application and device type identification

• Additional internet failover with LTE Backup

• Internet quality and outage reporting

• Next-generation security

• Application-aware firewall rules

• Signature-based IPS/IDS threat detection

• Content, country, domain, and ad filtering

• VLAN/subnet-based traffic segmentation

• Full stateful firewall

Advanced networking

• License-free SD-WAN*

• WireGuard, L2TP and OpenVPN server

• OpenVPN client

• OpenVPN and IPsec site-to-site VPN

• One-click Teleport* and Identity VPN**

• Policy-based WAN and VPN routing

• DHCP relay

• Customizable DHCP server

• IGMP proxy

• IPv6 ISP support

*When paired with a Cloud Key or Official UniFi Hosting.
**When paired with a Cloud Key.

View fullsize

View fullsize

My Thoughts on the UXG-Lite

Finally.

The UXG-Lite is the long-awaited UniFi Security Gateway (USG) replacement. It fits into the same style of deployments, and the same budget as the ancient USG. For $129, it fills a big hole in the UniFi gateway lineup.

The UXG-Lite is made for those who host their own UniFi Network application server, or rely on Cloud Keys or cloud services. These are usually managed service providers, network installers, or businesses, but a lot of home users prefer this kind of setup as well. This is usually the best way to handle multiple network sites, but keeping your components separate has other advantages. Not everyone wants the integrated all-in-one solution Dream Machines provide.

The USG and USG-Pro have been in an awkward position since the introduction of the Dream Machines in late 2019. They were the only standalone gateway options, but their weak performance and low IPS/IDS and VPN throughput held them back. The Dream Machines were more powerful but less flexible, and can’t be managed by another UniFi Network controller. There was a lot of confusion about the differences and if the USG + Cloud Key or self-hosted option was going away.

Since then and until now, the UXG-Pro was the only modern option. USG-Pro owners looking to upgrade might have been happy, but not everyone has a network rack or $499 to spend. Those with a smaller budget or smaller space had to look to 3rd party options, or opt for a Dream Machine.

The release of the UXG-Pro felt both rushed and reactionary, but drawn out due to the long time it spent in early access. It is a poor value compared to the $379 UDM-Pro or $499 UDM-SE, but that was the cost for flexibility. The wait for a cheaper non-pro version felt even longer, but we finally have it.

View fullsize

View fullsize

View fullsize

View fullsize

UXG-Lite Limitations

The most obvious limitation of the UXG-Lite is the low port count and lack of a 2nd WAN interface. There are only two RJ45 ports, and they’re both limited to 1 Gbps. 2.5 Gbps would have great, but Ubiquiti is continuing to keep that as a premium feature for higher-end models.

Having only two gigabit ports will become a much bigger limitation if the UXG-Lite sticks around as long as the USG did. For $129 in 2023 it’s somewhat understandable, just disappointing. On the bright side, it could open the door to another hardware option in the middle of the UXG-Lite and UXG-Pro.

The lack of a 2nd wired WAN is another limitation. With the USG, there were three interfaces, and the 3rd interface could be used as a 2nd WAN or a 2nd LAN port. The UXG-Lite is significantly more capable for routing throughput, but is stuck with a single gigabit WAN and single gigabit LAN.

The only way to get a 2nd WAN connection is to opt for one of the UniFi LTE accessories. The LTE Backup or LTE Backup Pro allow you to automatically fail over to a cellular connection during an Internet outage. It requires the UniFi LTE hardware and — in the US at least — an expensive AT&T cellular plan.

As far as other limitations go, we’ll have to wait until this product is released and put through it’s paces to really know. It’s a simple device, the most exciting part is the role it fulfills in the gateway lineup and how that affects the entire UniFi ecosystem.

Also, USB-C power input is a welcome upgrade from a DC barrel plug in my opinion. It would have been nice to see a PoE input option for power though.

Asterisks

One of the most interesting aspects of the spec list are the asterisks. Those are worth examining a bit closer.

• License-free SD-WAN — when paired with a Cloud Key or Official UniFi Hosting

• One-click Teleport VPN — when paired with a Cloud Key or Official UniFi Hosting.

• Identity VPN — when paired with a Cloud Key

For reference, Cloud Keys are hardware appliances that run UniFi software, like the UniFi Network application or UniFi Protect for security cameras. This software monitors and configures other UniFi hardware, like the UXG-Lite.

The UniFi Cloud Console is a subscription service for hosting the UniFi Network application. Those currently cost $29/month for 100 UniFi Network devices, or $99/month for 1,000 devices in the US.

As far as I can tell, “license-free SD-WAN” is referring to the new Site Magic feature. Site Magic is built into the unifi.ui.com site manager and remote access portal. It lets you automatically create site-to-site VPN connections for multiple UniFi networks. This is a way for Ubiquiti’s marketing department to flex their lack of software licenses or subscriptions. You can still manually create site-to-site or remote access VPNs with the UXG-Lite.

The same goes for Teleport and UniFi Identity VPNs. Teleport is an easy-to-setup Wireguard VPN, and UniFi Identity is an optional identity management subscription. Those won’t be available on a UXG-Lite or UXG-Pro unless you use a Cloud Key. Self-hosted networks won’t support those, but they still have Wireguard, OpenVPN, IPsec, and L2TP.

It’s interesting these features are not supported on self-hosted UniFi Network application installs. It seems like an indication of where they are guiding their customers. The UniFi Network software has always been available for free, but this are the first time a feature line has been drawn between self-hosted and “officially” hosted. It’s possible that more features like this are added over time.

Essentially, for a few of the newest and fanciest features, self-hosted controllers aren’t included. These limitations make some sense, but calling it out on the spec sheet makes it feel like a purposeful design choice and business decision. Maybe there is a technical challenge I’m not seeing, but it feels like a subtle way to encourage hardware sales. At best, it is disappointing. At worst, it’s a sign that self-hosted controllers are becoming second class citizens.

A Question of Priorities

Judging by Ubiquiti’s actions and the hardware and software they’ve released, creating a new standalone gateway for USG customers wasn’t a priority.

The Dream Machines launched in late 2019, and there were several signs that Ubiquiti preferred everyone just buy one of those. The UXG-Pro got stuck in early access purgatory, advertisements for the Dream Machines were placed in self-hosted controllers, and multi-site support was in question. Existing UniFi customers were right to be upset.

Now, finally, USG owners have some new hardware they can buy. That is, if they haven’t upgraded to a Dream Machine, UXG-Pro, or found another vendor.

I’m genuinely happy to see the UXG-Lite released. I’m also a little worried that it took this long, and that self-hosted controllers are starting to be viewed in a separate category. Ubiquiti is giving us what we’ve wanted for four years, while also drawing a line in the sand to prop up their hardware and their services. That could be a wise business decision if done correctly, or a brand-damaging path to go down. Time will tell which it is. I’m excited to examine these topics in more depth, and see which path they choose.

In case you missed it, the October edition of the UI Chat podcast from The Interface is out. The podcast is monthly, and covers news from Ubiquiti.

October was another packed month for news. In this episode we talk about the upcoming UniFi gateways shown off at WISPAPALOOZA, the new Professional 8 PoE UniFi switch, the renaming of the US-XG-6PoE, a 10.0 CVE for UniFi OS Consoles, UniFi Network version 8, and other recent software releases.

See the links below for the podcast audio, and to subscribe to UI Chat wherever you find your podcasts. It’s also available as a video on YouTube, if you want to see my ugly mug. We also have a YouTube playlist of all episodes.

Episode Links

• Apple Podcasts

• Stitcher

• Pocket Casts

• Podchaser

• Amazon Music

• Castro

• Goodpods

• Spotify

• YouTube Podcasts

X (née Twitter) Links

• @uichatpodcast from @the_interface_

• Hosts: @alexlowe30 and @WillieHowe

• Guest Host: @MrEvanMcCann from @TechMcCann

• Recorded using @SquadCastFM and hosted with @CastosHQ

Originally Posted: October 11th, 2023

TL;DR: If you want a $349 layer 3 UniFi switch with 8 gigabit PoE+/PoE++ ports, two SFP+, and a small desktop enclosure, you’re in luck.

Seemingly out of nowhere, Ubiquiti recently announced a new UniFi switch: the Professional 8 PoE. It is a desktop model with a similar enclosure to the existing Enterprise 8 PoE. It has most of the same features, too: layer 3 support, 120W of PoE budget, two 10 Gbps SFP+ slots, and a small touchscreen.

Looking at the differences, there aren’t many. The new Pro 8 PoE drops from 2.5 Gbps to 1 Gbps on the eight RJ45 ports, drops $130 off the MSRP, and two of the RJ45 ports are upgraded from 30W PoE+ to 60W PoE++. Besides a few asterisks, that is about it. The Prol 8 PoE is yet another option in the crowded UniFi switch lineup.

How does the Pro 8 PoE compare with other UniFi switches? What about options from other vendors? In this overview, we’ll cover the specs, alternatives, and where this new model fits. We’ll start with the specs.

Table of Contents

• Professional 8 PoE Specs ↩︎
• Comparison Charts ↩︎
• Alternative UniFi Switches ↩︎
• Alternatives From Other Vendors ↩︎
• Filling a Small Hole in a Big Lineup ↩︎

Professional 8 PoE Switch Specs

An 8-port, Layer 3 switch with PoE+ and PoE++ output.

• (6) GbE PoE+ ports

• (2) GbE PoE++ ports

• (2) 10G SFP+ ports

• 120W total PoE availability

USw-Pro-8-PoE Technical Specifications

Mechanical

• Dimensions: 200 x 248 x 44 mm (7.9 x 9.8 x 1.7")

• Weight: 2.1 kg (4.6 lb)

• Enclosure materials: Plastic, metal

• Mount material: Plastic

Hardware

• Management interface: Ethernet In-Band

• Networking interface:

  • (8) GbE RJ45 ports

  • (2) 10 Gbps SFP+ ports

• PoE interface:

  • (6) PoE/PoE+ (Pins 1, 2+; 3, 6-),

  • (2) 60W PoE++ (Pair A 1, 2+; 3, 6-) (Pair B 4, 5+; 7, 8-)

• Total non-blocking throughput: 28 Gbps

• Switching capacity: 56 Gbps

• Power method: Universal input, 100—240V AC, max. 2APower supplyAC/DC, internal

• Supported voltage range: 100—240V AC

• Max. power consumption: 30W (Excluding PoE output)

• Total available PoE: 120W Max

• PoE wattage per port by PSE

  • PoE: 15W

  • PoE+: 30W

  • PoE++: 60W

• Voltage range PoE mode

  • PoE: 44—57V

  • PoE+: 50—57V

  • PoE++: 50—57V

• LCM display: (1) 1.3" touchscreen

• LEDs: RJ45 ports — link/activity

• Button: Factory reset

• Operating temperature: -5 to 45° C (23 to 113° F)

• Operating humidity: 10 to 90% noncondensing

• Certifications: CE, FCC, IC

Application Requirements

• UniFi NetworkVersion 7.5.176 and later

Professional 8 PoE Comparison Charts

Context always helps when trying to decipher specifications and how a model compares with similar options. Here are two comparison charts, showing the Pro 8 PoE and Enterprise 8 PoE with similar and slightly larger alternatives.

Pro 8 PoE and similar UniFi switches

Pro 8 PoE and some larger UniFi switches

Comparing to Alternative UniFi Switches

If the Professional 8 PoE doesn’t match your needs, look at these alternatives If you want:

• 2.5 Gbps RJ45 Ethernet: Enterprise 8 PoE

• Lower cost: Lite 8 PoE, Lite 16 PoE, or first-generation models

• More than two PoE++: XG 6 PoE (Gen1) (4), Mission Critical (4), Industrial (8 ), or Pro 24 PoE (8)

• More rugged enclosure: Industrial

• More 10 Gbps SFP+: Aggregation

• Multi-gig with no PoE: Flex XG, XG 16 (Gen1), Aggregation, Enterprise XG 24

• Rackmount: Standard switches, or a rack shelf

If that list seems a little overwhelming or confusing, it helps to look at them one at a time. We’ll start with the most similar and cheapest, and deal with the larger and more expensive models last.

Enterprise 8 PoE

This is a simple comparison. The two 60W 802.3bt PoE++ ports become 30W 802.3at PoE+, but all eight Ethernet ports move from 1 Gbps to 2.5 Gbps. The Pro 8 PoE mentions metal as part of its enclosure, the Enterprise 8 PoE does not. The Enterprise 8 PoE is slightly heavier and hotter, but they are mostly the same otherwise.

I've had an Enterprise 8 PoE for a while, and it does get warm in normal use. The fan whirs up when the switch is booting up, but is mostly silent during normal operation. I would expect the Pro 8 PoE to be similar, even with minor differences in port speed and the addition of some metal to the enclosure.

Lite 8 PoE and Lite 16 PoE

The 2nd-generation Lite switches are available with 8 or 16 ports. They are handy little switches for expanding your network or supporting a few cameras, access points, or other PoE+ devices. They have limited power budgets, so carefully consider how many PoE devices will rely on them. If you just need gigabit Ethernet, a small bit of PoE, and don’t need layer 3 support, the Lite 8 PoE and Lite 16 PoE are significantly cheaper and worth considering.

First generation

• 8 Gen1 (US-8) — $99

• 8 PoE Gen1 (US-8-60W) — $109

• 8 PoE, SFP Gen1 (US-8-150W) — $199

Speaking of cheaper, these first-generation models are older than the Lite models but offer some advantages. The US-8 only supports PoE passthrough on one port, but the two PoE models both have 4 PoE+ ports. The US-8-150W also has SFP support for fiber backhaul. They are old and likely will be discontinued and unsupported before any 2nd-generation model. That said, they are still viable, especially if you can find them used or at a discount.

Miscellaneous Small UniFi Switches

• Flex mini (USW-Flex-mini) — $29

• Flex (USW-Flex) — $99

• Flex XG (USW-Flex-XG) — $299

• XG 6 PoE Gen1 (US-XG-6PoE) — $599

The Flex models get their name from being flexible, and supporting PoE input for power. The basic Flex mini is the cheapest and smallest UniFi switch, offering 5 gigabit Ethernet ports powered by PoE or USB-C. This can even act as a small unmanaged switch if you just need a basic port multiplier.

The Flex is a 5-port switch with PoE in, and up to 4 PoE out for $99. You can also get the $99 Flex Utility enclosure if you need it to be weatherproof. These are great for outdoor setups, or areas without a power source nearby.

The Flex XG is the cheapest way to get 10 Gbps RJ45 Ethernet in UniFi, with four of those high-speed ports available for $299. It also has a single gigabit RJ45 port that supports PoE+ in. You won’t be able to power any PoE devices, but if you want 10 Gbps Ethernet, this is the cheapest option.

The XG 6 PoE (Gen1) is another small switch, released toward the end of the 1st generation. It has four 10 Gbps RJ45 interfaces with PoE+, and two 10 Gbps SFP+ interfaces. With a high PoE budget and six high-speed interfaces, the XG 6 PoE (Gen1) may be older, but it can be a better fit than any alternatives depending on your network needs.

Specialty: Industrial and Mission Critical

The Industrial and Mission Critical switches are both what I consider specialty models. The Industrial features a rugged fanless enclosure, designed for dirty, hot, or other challenging environments. It also has 8 PoE++ and 430W of power budget, so it is great for powering a lot of high-power PoE equipment too.

The Mission Critical ties into the UniFi Smart Power products, and is marketed as a battery-backed core switch option. It has an internal battery, ports for battery expansion, and a nano-SIM slot for out-of-band management. The Mission Critical has four PoE+ out, four PoE++ out, and two AC outlets. It can be used to power your gateway, ISP equipment like a modem, and important PoE devices like door locks, cameras, or access points.

Standard Rackmount Models

• Standard 16 PoE (USW-16-PoE) — $299

• Standard 24 (USW-24) — $225

• Standard 24 PoE (USW-24-PoE) — $379

• Standard 48 (USW-48) — $489

• Standard 48 PoE (USW-48-PoE) — $589

The standard 2nd-generation UniFi switches come in a variety of port counts and PoE options, but deliver the same basic idea. These are the default option for switches you would put in a network rack. Look at these if you have a rack but don’t need multi-gig, 10 Gbps SFP+, high PoE budgets, layer 3 features, or anything fancy.

Larger Professional Models

• Professional 24 (USW-Pro-24) — $399

• Professional 24 PoE (USW-Pro-24-PoE) — $699

• Professional 48 (USW-Pro-48) — $599

• Professional 48 PoE (USW-Pro-48-PoE) — $1099

These are the big siblings to the Professional 8 PoE, requiring a network rack for mounting. Besides the size, port counts, PoE support, and cost, the differences are minimal. It’s easier to show in a comparison chart.

Enterprise 24 PoE and EnterpriseXG 24

If you wish the Professional 8 PoE had more ports, more PoE, or more high-bandwidth interfaces, the Enterprise line is where you should look. Well beyond the smaller or cheaper options covered above, these are the top-of-the-line.

The Enterprise 24 PoE ($799) offers 24 PoE+ RJ45 Ethernet ports. Twelve of them are 2.5 Gbps, and the other twelve are 1 Gbps. It also has two 10 Gbps SFP+ interfaces, layer 3 support, a small touchscreen for UniFi AR, and all the other features from the Professional 8 PoE. It may be rackmount and more than double the price, but you get over double the ports and much higher throughput and PoE.

The EnterpriseXG 24 ($1299) skips PoE and focuses on speed. All 24 of the RJ45 interfaces are 10 Gbps, and it is one of the few UniFi devices to have two 25 Gbps SFP28. This is the biggest, baddest, fastest switch UniFi currently offers.

Ubiquiti UISP and EdgeMAX

On the other side of Ubiquiti’s business is the UISP Switch ($139) and UISP Switch Pro ($479), and the older EdgeSwitch models. These are not UniFi devices and instead live within the UISP ecosystem. They are controlled by the UISP software or their standalone web interfaces or command line interfaces.

If you’re building a UniFi network, you are likely better off with a UniFi switch. If you need to integrate other UISP equipment like point-to-point or point-to-multipoint radios, the UISP models make more sense. See my UISP Switch Review for more details.

Alternatives From Other Vendors

TP-Link Omada

TP-Link Omada is essentially a budget copy of UniFi. TP-Link has done its best to replicate the UniFi ecosystem, down to some similar designs and feature limitations. Omada is generally cheaper and more flexible but has fewer options, less polish, and a lower market share.

The Omada switches all have gibberish names with seemingly random letters and numbers, but the closest models would be the SG3210 or SG2210MP. If you want to go beyond 1 Gbps, the SX3206HPP or SG3210X-M2 may be the closest.

See my other posts on TP-Link Omada for more details.

Aruba Instant On

Aruba Instant On is another UniFi competitor, with a lineup of cloud-managed switches and access points. Aruba’s enterprise equipment is some of the best in the industry, but Instant On is a simpler, cheaper option that fits within the same price and feature area as UniFi. If you bring your own firewall/gateway and are OK with relying on Aruba’s cloud software, there is a lot to like. The software is simple to use and the hardware is well-engineered.

The Instant On switches are split into four lines: 1430, 1830, 1930, and 1960. The 1430 models are unmanaged, competing more with Netgear or the Flex mini than the Professional 8 PoE. The 1830 8G PoE (JL811A, $199), 1930 8G 2SFP PoE (JL681A, $249) are the two closest, but there are a wide variety of options with higher port counts or higher speed interfaces. Most of these are rackmount, with 24 or more ports.

The only other semi-similar option is the top-of-line S0F35A, which packs a lot of PoE and high-bandwidth ports into a rackmount enclosure. It also has by far the wildest name of any model here — Aruba Instant On 1960 8p 1G Class 4 4p SR1G/2.5G Class 6 PoE 2p 10GBASE-T 2p SFP+ 480W Switch

There are a lot of Instant On switch options, but no high-end desktop model quite like the Pro 8 PoE. See my other posts on Aruba Instant On for more details.

MikroTik

MikroTik is another common option for home and small business networks. MikroTik specializes in low-cost, high-performance switches, routers, and wireless equipment. They make a lot of similar equipment to Ubiquiti, without the UI polish or big marketing budget.

The CSS610-8P-2S+IN is very similar to the Pro 8 PoE but costs $229. The CRS112-8P-4S-IN costs even less than that, at $209. They are both small desktop models with 8 gigabit RJ45, PoE out, and SFP or SFP+ interfaces.

If you can live without PoE, the new CRS310-8G+2S+IN competes with the Enterprise 8 PoE, matching the eight 2.5 Gbps and two 10 Gbps interfaces. For $219, it’s a much better value. Eventually there should be a PoE version, which could be the ultimate lower-cost alternative.

UniFi Pro 8 PoE versus TP-Link Omada

UniFi Pro 8 PoE versus Aruba Instant On

UniFi Pro 8 PoE versus MikroTik

UniFi Pro 8 PoE versus Cisco Small Business similar models

UniFi Pro 8 PoE versus Cisco Small Business higher-end models

Meraki

For those using UniFi for business or more professional uses, Meraki is often thought of as a competitor. Meraki is made by Cisco, offering well-designed software and hardware with centralized cloud management. Unfortunately, Meraki equipment requires licensing, greatly increasing the overall cost.

If your budget is a bit higher and your needs align with Meraki’s offering, there is no desktop-sized switch with layer 3 support. If you can give up on layer 3, the MS120-8FP and MS130-8P and their various submodels are the closest alternatives. The MS130-12X is closer to the Enterprise 8 PoE, offering 2.5 Gbps RJ45 and 10 Gbps SFP+ with PoE support.

Cisco Small Business

This is the most interesting comparison in my mind. Cisco is known for its enterprise equipment, which comes with a ton of features and a ton of cost. Unless you shop used/refurbished, or pick something up off the e-waste pile at your office, you're not likely to see high-end Cisco gear in the same kind of networks that UniFi is used in.

The Cisco Small Business line is much closer to UniFi's target market. The CBS350-8FP-2G is the closest, but there are a literal ton of models above and below it in their product stack.

There is still some Cisco-ness to the small business switches, but they are significantly cheaper and simpler than their Catalyst 9000 models. The Small Business 220 and 250 offer very competitive pricing for similar hardware, and the 350 and Catalyst 1000 line are a step up in price, but a big step up in many other areas as well. If you want a layer 3 switch, the features you'll find on even a cut-down Small Business model will be significantly more complete, more documented, and more likely to do what you want to do.

UniFi's layer 3 features have come a long way, but are still more akin to what some vendors call layer 2+. If you want more than static routing, look at Cisco's offering. If you just need a basic layer 2 PoE switch, they have those too. It won't tie into your UniFi single pane of glass and it won't be as integrated or simple to set up, so consider your needs and make the right tradeoff.

Filling a Small Hole in a Big Lineup

If you want to drive yourself mad, focus on small spec differences and compare the Professional 8 PoE to every alternative out there. I prefer to zoom out and look at the new Professional 8 PoE for what it is: something to fill a small hole in a big lineup.

Other UniFi switches around the same price offer different size, PoE, or speed trade-offs. You can get faster or more interfaces for a couple of hundred dollars more. You can also get most of the features for a couple hundred dollars less.

If you look at other vendors, you can get more ports, faster ports, more PoE, less PoE, or more licensing fees. You won’t find the unique combination of features UniFi and Professional 8 PoE offer though.

For $349, you get eight gigabit RJ45 ports (6 PoE, 2 PoE++) and two 10 Gbps SFP+ interfaces. You get the layer 3 features from UniFi, a nice desktop enclosure, an integrated power supply with a locking power cable, and a wall mount. You also get things like a little status touchscreen, AR mode, a pretty web interface, a good mobile application, free controller software you can run yourself, and optional integrated gateway appliances you can control it with.

With everything related to UniFi, there isn’t one straightforward option. You have 5 or 6 to choose from, and other vendors to consider. If the Professional 8 PoE is just right, you’ll have trouble finding something better.