I was wondering if anyone here has heard of or has experience with the company featured in the following video. Any tips, feedback, or thoughts are welcome.
I will also need advice on which level 3 switch manufacturer I should consider. Right now, I am considering Cisco level 3 switches, but the features I am thinking of will require an ongoing subscription. Since I just convinced work to dump Cisco, I no longer have access to the service contract. The feature I am most interested in is anti-VLAN-hopping.
Right now, I have a regular Ethernet connection to all my equipment. Right now, there isn’t any need for better network equipment; I was thinking about the future and considering connecting the computers in my lab with fiber connections. My next upgrade for the lab is repurposing three old computers as backup servers. I don’t have anything, so this goal is the priority. I really don’t need anything above 1Gb right now; I was thinking of creating a really nice virtualization lab, kind of what I have available at work. Wasn’t planning on a SAN or a local gaming server for many LAN users; all my friends are too busy raising their families and don’t have any kids. As for the type of equipment I have right now, I have an Unifi Dream Machine SE, a Unifi WiFi 6 Ap, and an old Unifi layer 2 switch. Right now, my threat model is very low, but it would be nice not worry about VLAN Hopping when I connect my Unifi Dream Machine directly to the internet. Right now, because I am double-nated, I cannot use the IPv6 address my ISP would be willing to give me. I should have mentioned that I prefer slightly used equipment over new if that is the only way to afford the features I want.
Since you have a UDM already you should probably just stick with the Unifi ecosystem to make things nice and easy (and not have to give Cisco a butt load of money for no good reason).
I would personally suggest you plan out why you would need to upgrade to 25Gb networking, and have a very concrete plan of systems and network needs before looking at any gear. If you don’t have anything currently that you are actively worried about Vlan-hopping to other areas of your network, then you don’t really need to worry about paying more money for a non issue.
A 25Gb network would need upgrades to each machine on it (network cards, etc.), plus you’d likely need an aggregation switch that could handle all the new fiber and SFP28 connections. That puts you in the enterprise line of Unifi. That aggregation switch alone is around $2.5K depending on which way the wind blows the tarrifs. Cheaper than Cisco sure, especially when you look at not having subscription fees, but still a large chunk of change to say the least. That doesn’t count the extra network cards for each machine, any other switches, or the fiber/DAC cables.
If you start to hit bottlenecks with speeds due to expanding storage arrays or a very large increase in traffic, that would be the time to start looking for upgrading to 10Gb networking (way cheaper and way more options).
I get wanting things to go fast for fast sake, but spending thousands of dollars to move data from one system to another and be limited by drive speeds rather than network speeds seems like a waste to me personally.
I havent used Cisco hardware in well over a decade now, is Anti-VLAN hopping a specific feature that is available on Cisco when you have one of their subscriptions? Im not sure what it actually does or is for exactly. I think im really just not understanding it, as any L3 router or switch should have the capability to not allow crossing VLANs right? Isnt this why you would set up ACL and firewall rules? And/or just set the switch port to “block all” except the assigned native VLAN?
Since you have a UDM Pro, Ubiquiti sells a Pro XG Aggregation switch that has thirty two 25gb SFP28 ports on it and is a good price. Beats out “the big companies” by a good margin on its price to port ratio.
Edit:
Alright so looking up Anti-VLAN Hopping I found this info about it. Looks like it is a specifically crafted packet traffic using multiple layers and hiding a second set of vlan tag behind the first one, so a rule wouldnt see this as it is looking at the first layer as the packet comes across: https://networklessons.com/cisco/ccnp-switch/vlan-hopping
So looks like you can mitigate this by changing a few settings on your switches. On Unifi the first part for configuring the natrive VLAN to one that isnt actually used seems relatively easy. Either set native VLAN to none, or make a new VLAN that isnt used by anything and set it to that.
The second part I am not so sure about though, configuring the switch to specifically tag all traffic coming through that is untagged to have the native VLAN tag. UniFi has some ambiguous wording on this. It says: “Configured vlans are automatically tagged on this port. Tagged traffic matching non-existent vlans are automatically dropped”. So, does that mean it automatically tags packets that are untagged? Or something else?
Your advice @anon94159786 is very sound,I my next upgrade for my computer lab/home office should be coming up with a backup plan make a list of the equipment I need to implement that plan. After I have a backup system the next upgrade should be a Raspberry Pi Cluster. Stin187 was right I was puting the cart before the horse.
Since I make sure all the bills for my department at work get paid, I know how much Cisco subscriptions cost. ( You don’t want to know) The reason I was asking about other equipment providers was that I was wondering if there was another provider that would offer services similar to Cisco’s for a lower cost. Thanks for the link and the suggestion @EniGmA1987.
I have heard about MikroTik infact at work I have replaced some of our Cisco equipment with some Mikrotik switches, but we had to keep our Cisco gateways because there are some feature we need Mikrotik couldn’t provide.
I love mikrotik for switching and am currently using two for them for 25g/100g switching. I have not even begun to configure the layer 3 features but on layer 2, they have done everything I have wanted, with only a few quirks. They can even do VXLAN, nested VLAN tagging on purpose to expand the available configuration options. Preventing VLAN leaks seems like a configuration problem, and not one that you are forced to throw money at to solve.
cisco and paloalto are two vendors that i would always try to circumvent. cisco as supplier for a lot of governments is a typical candidate for attacks. keep in mind that these are professionals, investing a lot of time and money to infiltrate them and cisco is imho the no.1 target. i feel a lot safer to use something that isn’t at the focus of this “bad boys” and mikrotik is a very good choice for it. the router-os from mikrotik is very complex and it takes time to get used with it but i’m impressed that it is provided in all their products, even the “cheap” ones and the price-tags of their products is fair, the software-support is great and perfect for people using home-labs.
It isn’t my intention to insult or start a flame war, but what I am about to talk about might upset some people. I agree with @CharlieBrown when you have a choise it makes perfect sense to avoid Cisco and Paloalto equipment for the exact reason he memtions. I would add to what he said by adding the following statement: you should also avoid Chinese and former Eastern European vendors for a different reason. It has been proven that Chinese vendors have installed backdoors in their networking equipment. I wouldn’t be surprised if, in the future, it is proven that the Eastern European vendors had followed the example of the Chinese vendors.
I hope I haven’t insulted or hurt anyone’s feelings by expressing my opinion.
I have decided since my wife and I are in the middle of negotiating the purchase of my mother’s home, and since my wife wants a new home instead of remodeling my mother’s home. We have decided to build a new home in the backyard of my mother’s house. That way, I will still be close to my mother when she needs help, and my wife will be happy we aren’t living with her.
Since we are building a new home, the question I had about fiber is no longer relevant. I will have a few fiber lines installed in the wall of our future home, but only where it makes sense. Thanks again, @anon94159786, for convincing me that I would get more use out of a Pi cluster or purchasing a backup system than adding fiber at this time.
Now I need to figure out which vendor to go with, Synology or TrueNAS Scale. From the little research I have done, both systems seem to be good. Synology seems to require a smaller up-front investment than TrueNAS Scale. But when you have more than eight drives per system, TrueNAS has the smallest up-front cost. What do the forum members think? What has been your experience with either backup system? I am very interested.
Since you have a UniFi network already, I can offer some experience with 25G.
I have a mostly 25G network centered around the USW XG Pro aggregation which has 32 25G sfp ports.
I use that as the core of the network, with the UDMSE and a USW Pro XG 48 PoE attached.
I run a few VLANs but the trick is to avoid connecting anything directly to the UDMSE Ethernet ports. You want to avoid any switching functions going through the backplane on that unit.
I wouldn’t worry as much about L3. Most of the things that are going to occur on the network with VLANs are handled on the L2 level.
My main need for speed is video editing, sometimes with multiple people in my home studio and ingesting large amounts of raw video into the system while editing is going on.
I have Macs connected to the core aggregation switch with a variety of different types of thunderbolt 5 and thunderbolt 3 expansion boxes using Mellanox and ATTO NICs. When I’ve got multiple machines working at the same time, the network easily handles 50-60Gb/sec flows.
Honestly, to even justify these network speeds, you have to have a lot of NVME storage in NAS or servers with multi-port cards that handle SMB multichannel.
Other than the video editing related traffic, there’s nothing that comes close to saturating even the 10Gb ports on the network.
Happy to provide any real world lessons gained through a lot of trial and error with UniFi gear. Some of the switches I have are really expensive, but I decided the “buy once, cry once” approach was a better way to go than patchwork upgrades.
