Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we solved our office Wi-Fi problems

triplebyte.com

Post reply on HN
Print view View original

171–180 of 252 posts

Re: How we solved our office Wi-Fi problems

#171

Post by Johnny555 »

gruez wrote: post #165
Johnny555 wrote: post #132

Earlier quoted context omitted.

Ubiquiti is not suitable for a business environment I'd say that Ubiquiti is perfectly suited for a small business environment -- definitely a big step up from discrete consumer Asus routers throughout the office with no central management (and probably haven't been patched since the day they were installed). Ubiquiti may not be suitable for a mid to large sized business, but for up to a ~100 person office or so, the…

Asus-Merlin firmware is regularly patched and is available on many models

But can you easily roll out that new firmware to 20 Wifi nodes spread over 3 offices in 3 different cities?

Just because patches are available, doesn't mean that someone's going to take the time to apply them. Having a central management console makes this much easier. Upgrade one node, make sure it works, then roll out to the rest of the nodes one by one with one click.

Re: How we solved our office Wi-Fi problems

#172

Post by azernik »

ufo wrote: post #154

> Multiple access points should share the same SSID. [...]. If you use separate SSIDs [...] it will often lead to laptop users remaining marginally connected to an AP they’re barely within range of. I constantly run into this issue in my home network. Is solving it really just a matter of reconfiguring the routers to share she same SSID or is there more to it?

One more thing is required - the different APs must all be on the same layer 2 network. 802.11 (WiFi) clients, by design, assume that all APs broadcasting the same SSID provide access to the same 802 (Ethernet & friends) network, and so assume their DHCP leases and TCP connections etc. will carry over. If you break that assumption then roaming will cause issues.

Re: How we solved our office Wi-Fi problems

#173

Post by jtl999 »

benjaminl wrote: post #162
Serow225 wrote: post #153

Earlier quoted context omitted.

Whats the better alternative to fit the needs of a shoestring startup (say 5-10devs)?

I have had good experience with MikroTik products. The are at a similar price point, but with a less refined interface but a lot more flexibility.

Mikrotik suffer from a gross amount of "Not invented here" reinventing existing open source protocols such as OpenVPN, a custom sshd and web server, and it shows with their amount of issues (how many years has it taken to add UDP to their OpenVPN server?). In some ways I think their no better then UBNT in some ways.

Tell you what. I used to have a Mikrotik CRS125 switch in my home office, and by default if you have a set of ports where one has no VLAN assigned, and the others have untagged VLAN assignmnets, any broadcast traffic on the untagged port(s) without a VLAN leaks to the ports with an untagged VLAN. This isn't well documented in the manual, and to fix it you either disable "Invalid VLAN Forwarding" (I think) and/or move said ports without a VLAN to a VLAN.

Re: How we solved our office Wi-Fi problems

#174

Post by vandot »

My startup purchased Meraki, and we don't have to deal with many of these issues. We also paid an electrician to do wiring and crimping. SDE time is expensive and we want the team focused on building our product, so we made the tradeoff to pay more for the network gear and installation. As a result our entire team, engineering and everyone else, has network access that "just works". This was true when the 35 person team showed up at our last office for the first time, and continues to be true.

The configuration is done through a hosted dashboard that also provides monitoring. We're in a heavily regulated field, and the Meraki dashboard provides a lot of evidence for compliance audits. It also enables us to remotely control devices (e.g. lock, wipe, locate) and ivestigate issues when integrated the Meraki MDM solution.

We did have to tune the bitrate for wireless.

We also cannot setup redundant VPN tunnels to AWS (Meraki only supports one tunnel for non Meraki VPNs), so we have to do manual faiilover. This is my biggest gripe with Meraki. We are investigating adding a Cisco ASA to handle site-to-site VPN to AWS with redundant tunnel support.

Re: How we solved our office Wi-Fi problems

#175

Post by triviatise »

inferiorhuman wrote: post #103
basch wrote: post #6

>Assign static IPs for infrastructure like access points. This makes them easy to reach when reconfiguration is needed Am I missing something, or did they buy consumer routers to use as access points? Triplebyte, I can save you a ton of management, troubleshooting, and learning time: switch to Ubiquiti Unifi or an equivelant now, youll have one pane of glass to reconfigure every device. The devices will talk to each…

Fine, I'll say it: Ubiquiti is not suitable for a business environment. They don't have a good track record of pushing out security fixes. They've blatantly violated the GPL (and introduced security vulns in the process). Their "enterprise" features don't work well (e.g. hardware acceleration, WPA+Radius). Depending on what you buy the PoE may be non-standard passive or it may not. Unfortunately because they're prima…

I loved the ubiquiti stuff for years. Then one day two years ago macs suddenly could no longer reliably connect to the outside world even with a strong wifi connection to the AP. I would send pings and have 40% packet loss. Weirdly I could ssh into any of the APs and ping with 0% packet loss.

We could never fix it and switched over to google appliances. We rarely have over 20 people in the office.

Re: How we solved our office Wi-Fi problems

#176

Post by spudlyo »

inferiorhuman wrote: post #103
basch wrote: post #6

>Assign static IPs for infrastructure like access points. This makes them easy to reach when reconfiguration is needed Am I missing something, or did they buy consumer routers to use as access points? Triplebyte, I can save you a ton of management, troubleshooting, and learning time: switch to Ubiquiti Unifi or an equivelant now, youll have one pane of glass to reconfigure every device. The devices will talk to each…

Fine, I'll say it: Ubiquiti is not suitable for a business environment. They don't have a good track record of pushing out security fixes. They've blatantly violated the GPL (and introduced security vulns in the process). Their "enterprise" features don't work well (e.g. hardware acceleration, WPA+Radius). Depending on what you buy the PoE may be non-standard passive or it may not. Unfortunately because they're prima…

I've heard great things about Ubiquiti's products, so I recently evaluated both their USG security gateway and EdgeRouter4 products using only wired gigabit ethernet.

I found it weird that the UniFi line of products and the EdgeMAX line of products while very similar in terms of specs and their target markets, use completely different remote management systems (UniFi vs. UMNS).

While some really folks like their management GUI, I found that once you wanted to do anything not bog standard with it, you were on your own. I had to SSH into both devices and enter EdgeOS (Vyatta) commands for even relatively simple things like disabling NAT on the ER4 or configuring mutual TLS with OpenVPN. With IpSec there are so many different possible parameters that the GUI just didn't have enough widgets to cover them all.

I found the USG security gateway too underpowered for my purposes. I wanted a device I could use for IDS/IDP as well as a dedicated VPN. With hardware offloading disabled (which you need for IDS/IDP) the throughput of the USG is limited to around 130 Mbps.

Using IpSec on the USG (ESP:AES-128-SHA1) I was able send (encrypt) data at 70 Mbps and 56 Mbps on receive (decrypt). Don't even think about using OpenVPN with this device, as it's single-threaded and can't take advantage of any crypto offload -- only managing around 14 Mbps of throughput.

If you are using the USG for a VPN you can get much better performance with WireGuard. I managed to get 90 Mbps encrypt, 111 Mbps decrypt with it, which is likely good enough for a lot of folks.

The EdgeRouter4 was faster, but it had a weird issue with IpSec. I was able to get it to encrypt at 631 Mbps, but only decrypt at 229 Mbps. On encrypt (send) I could see that the CPU was 376% utilized (it has 4 cores) with most of that spent dealing with software interrupts. On decrypt (receive) it only 167% utilized -- so something was wrong there.

The EdgeRouter4's OpenVPN single core performance was more than 3x faster than the USG, clocking in at 43 Mbps, and best with WireGuard at 636/597 Mbps encrypt/decrypt.

I used iperf3 on a remote host on my simulated WAN for measuring throughput like:

    iperf3 -c host_behind_router -P4 -t120 # decrypt
    iperf3 -c host_behind_router -P4 -R -t120 # encrypt
Ultimately I found the whole dance of having devices being adopted by the controller software and then being provisioned by it to be tedious and unnecessarily faffy -- especially considering how often I had to drop into EdgeOS to get things done.

Re: How we solved our office Wi-Fi problems

#178

Post by nodesocket »

I have gigabit internet at my house and a single WiFi access point. I am running dual SSID's one for 2.4GHz (don't use it), and one for 5Ghz (use it). The 2.4Ghz is set to auto-channel, but the 5Ghz I statically set to channel 161 (5Ghz, 80Mhz). It shows a Tx rate of 866Mbps, and on SpeedTest.net I get around 400ish Mbps up and down. Sometimes going further back into my apartment I have to connect and disconnect from WiFi in macOS.

Should I try using a lower 5Ghz channel such as 36 or 40? Won't that decrease overall throughput? My understanding was the higher the channel number on 5Ghz, the theoretically higher the throughput.

Re: How we solved our office Wi-Fi problems

#179

Post by jdiaz5513 »

inferiorhuman wrote: post #103
basch wrote: post #6

>Assign static IPs for infrastructure like access points. This makes them easy to reach when reconfiguration is needed Am I missing something, or did they buy consumer routers to use as access points? Triplebyte, I can save you a ton of management, troubleshooting, and learning time: switch to Ubiquiti Unifi or an equivelant now, youll have one pane of glass to reconfigure every device. The devices will talk to each…

Fine, I'll say it: Ubiquiti is not suitable for a business environment. They don't have a good track record of pushing out security fixes. They've blatantly violated the GPL (and introduced security vulns in the process). Their "enterprise" features don't work well (e.g. hardware acceleration, WPA+Radius). Depending on what you buy the PoE may be non-standard passive or it may not. Unfortunately because they're prima…

Yup. The network engineer in me would never recommend Ubiquiti for any scenario. Maybe it works for WISP because of the price point; I'd have to be convinced.

They run an embedded Mongo DB on their UniFi hardware that (at least in the deployment I've inherited) requires occasional direct interventions[1] to keep running. That's just one example of the many baffling/wrong things they do.

I know Mongo gets quite a bit of undeserved hate, but it really just doesn't seem suitable for this use case.

[1] https://help.ubnt.com/hc/en-us/articles/360006634094-UniFi-S...

Re: How we solved our office Wi-Fi problems

#180

Post by bscphil »

tnorthcutt wrote: post #163
petecooper wrote: post #130

Earlier quoted context omitted.

>And let's not speak of the chronically overheating stuff. Some-time wireless installer here, I bring a snippet of anecdata. A recent client had the full Unifi experience for an outdoor network, including 3x EdgeSwitch XP (formerly known as ToughSwitch) in a single IP65-rated, largely airtight enclosure. The network would go offline on summer afternoons. It was overheating, those models run hot and are not recommende…

143 Celsius ??? That's 289.4 Fahrenheit, which I find difficult to believe. Not impossible... just difficult. That's quite impressive.

In fact if it was actually reaching 143 C, I'd say that ironically I'm more positively impressed by the fact the hardware works at all at that temperature than I am negatively surprised by the fact that its thermal controls are that bad.
Post reply on HN