TR Forums

I know this topic has been discussed many times over between here and other places. Myself having been apart of these conversations. Yet here we are again, trying to determine if the "Business Class" hardware really had not only the value, but reliability proposition to make.

I seems like the more and more popular these SOHO wireless routers get, the more powerful, full featured and attention they get from not only the market but the developers. Asus' RT series being a great example of what open source can do for a routers performance, security and longevity. Previously a manufacturer would drop a unit on the market and 6 months later there was no word on updates. Now it seems that these SOHO routers are getting monthly updates in addition to "Anti-Virus" definitions on a regular basis too.

So for a small business of say under 10 users/computers, does going the 500+ route for something like a SonicWall, really make any sense? I'm not talking about financial groups, or customers required to handle PHI in a HIPPA compliant office. I feel like I see very little benefit to these expensive units that also require expensive contracts to be kept running or getting updates like Cisco's equipment. Does something like the Asus RT-AC3200 with all of it's "Pro" features, integrated AV, VPN, ect really cut it for this type of environment? My feeling as of late is YES, absolutely, so long as you don't have any special networking requirements. Most of these networks are going to be using a 24+ port switch with MAC tables anyhow, so unless you're calling outside of the network it's wasted hardware.

Anyone else feel this way, or feel that I'm way of base? If so, how?

When you buy enterprise gear, you may not need all of the features, but typically you do want, and pay for, the reliability.

For the Guest/BYOD network, our local office is using mid-grade Asus RT-series routers as WiFi APs to replace the Cisco units that started failing at the five year mark. With roughly 30-40 personal phones and miscellaneous client/guest laptops roaming between three APs, the Asus units like to lock up every once in a while, which the Cisco enterprise-grade units almost never did until they started outright failing. The enterprise-grade Aerohive units serving the business WiFi network never do that, either.

At home, I'm about to migrate over to a Ubiquiti AP and an EdgeRouterX is likely to follow. Claimed by many to have near-enterprise reliability, but at price points that, for the entry-level models, start about halfway between SOHO and enterprise.

I've still got an Asus RT-N66u serving and office with 15 computers, a server and a handful of IP cameras. The wireless network will usually have about 20 wireless clients and we've never had issues. This was one of the first N66u I installed. I've got some enterprise gear around at different sites but always found it to not be magical or worth it. For instance the Cisco ASA 5501 I had at a site didn't even make it 2 years, in the end the configs were broken and stopped saving. We had to have Cisco's indian tech config the damn thing for VPN. Granted this was an ASA that sort of expects you to have your CCNA. When it failed, they said that the service agreement was up and we would need to pay for a year in order to get even the current firmware we had rights to :O. Yeah, forget that.

I've also messed with the cheaper TP-Link dual WAN "Enterprise" routers and had luck. But nothing better than I had with a well configed Asus RT sadly enough.

I'm more interested in the actual security differences. Of course the enterprise stuff will claim it is top notch, but is it really? Assuming quality is on-par or the same with these $200-300 consumer SOHO routers... what do the enterprise ones really offer anymore? Not to mention if you want to flash 3rd party firmware on there for those same features....

I am by no means an expert. However, since I installed Ubiquiti hardware I've never ever had to reconfigure or reboot it. You deploy and forget it exists. It never was like that with the consumer stuff I bought before. Ideal for parents or friends who risk calling you every week when things break.

The price difference is there but it is small and I find the reliability and configurability to be on a completely different scale.

ptsant wrote:

I am by no means an expert. However, since I installed Ubiquiti hardware I've never ever had to reconfigure or reboot it. You deploy and forget it exists. It never was like that with the consumer stuff I bought before. Ideal for parents or friends who risk calling you every week when things break.

The price difference is there but it is small and I find the reliability and configurability to be on a completely different scale.

Agree, the hassle factor, once you get it set up, is significantly lower with the Ubiquiti gear than the consumer stuff I've used in the past.

Welch wrote:

I've also messed with the cheaper TP-Link dual WAN "Enterprise" routers and had luck. But nothing better than I had with a well configed Asus RT sadly enough.

Not sure I would consider anything from TP-Link (or Netgear, to name another in that segment) to be enterprise; more of an attempt to target the "SO" in SOHO and snag a few novice enterprise admins along the way. Some of the physical hardware in those boxes is pretty good but the backend support and reliability simply aren't there. As for Cisco, they do have some good options but are notorious for exactly the sort of SaaS you experienced. Cisco doesn't want you supporting Cisco hardware, they want Cisco supporting Cisco hardware while you just keep signing the renewal PO's.

Never had to reconfigure or reboot even the Asus N66u in the office actually. The TP-Link is this model https://m.newegg.com/products/N82E16833704128, which I didn't purchase the previous IT guy did. I wanted to replace it, but in all actuality it has be excellent thus far. That network is an example of a network that could utilize more robust equipment. They had their more busy catching the resorts 20+ year history. The gateway to that network is via that router, but goes through some ubiquiti wireless AirFiber units that I setup shooting 46 miles away. They pretty much cap out their 100mbps down 10mbps up connection around the clock. You should see the monthly usage, measured in TB lol.

All of that said, what products exist similar to TP-Link but higher quality that don't require a special CLI to config? There is also in some cases UTM devices like Sophos to be considered... Thoughts?

Welch wrote:

All of that said, what products exist similar to TP-Link but higher quality that don't require a special CLI to config?

Can't speak to the Ubiquiti EdgeRouterX yet, since I haven't ordered one, but it has a typical web interface available. Check out this video and skip ahead to about 3:40 unless you enjoy unboxings and large butterfly knives:

https://www.youtube.com/watch?v=SianDqAQaR0

I bought an Netgear FVS338 over 10 years ago, they are still releasing new firmware for it. They also replaced it 3 times for free when I got bricked with bad firmware under the lifetime warranty. Probably the best router I ever used, but being stuck at 10/100 was becoming an issue, so finally moved it down to my older systems network.

What did you replace it with?

I'm seriously considering the Ubiquiti EdgeRouter X, just trying to determine what you DON'T get compared to some of the heavier UTM type devices like Barracuda, Sophos, Watchdog or the previously mentioned SonicWall.

Forgot to put that in there lol. I replaced it with an Asus RT-AC88U router.

My take on Ubiquiti is that it's a move-fast-break-things company that offers great value but lacks the professional grade 'ecosystem' of training/certs, resellers, major league support, etc. of the network titans. This is particularly true of their wired routers, which are based on an open source network OS and come with the requisite level of punk rock DIY ethos. The ERX itself is built around a new, cheaper processor compared to the ERL and it may not be fully baked yet. Should be more than enough for soho use, and the Ubiquiti setup process is far easier than it was in 2013. Just expect to spend a lot of time digging through 5 year old forum threads from when everything required the CLI or config file if you want to go past the basics.

I've said it before, and I'll say it again. I caution people on getting the ERX unless you know what you're getting into. It's cheaper because they severely reduced it's hardware capabilities. It literally has 1/8th the packet passing throughput. Ubiquiti is also already having issues with firmware updates due to the limited amount of storage in the device. This is in the release notes for the latest firmware:

Note: The ER-X/ER-X-SFP/EP-R6 has more limited storage, and in some cases upgrade may fail due to not enough space. If this happens, remove the old backup image first (using "delete system image" command, see here for more details) before doing upgrade.

I have an ERL at home. I've not had a single problem, save being able to have multiple Xboxes on Xbox Live at the same time without some configuration. One of the Ubiquiti devs actually went out and purchased several Xboxes to figure out the issue and provided a work around (there was already a forum thread about it by the time I hit that problem).

ludi wrote:

The enterprise-grade Aerohive units serving the business WiFi network never do that, either.

Why are the Aerohive AP's not serving the BYOD network as well? You can broadcast multiple SSID's from each AP, and you could use a VLAN to send them out of your network separate from your business traffic. With those consumer AP's in there you're likely causing issues with your WiFi performance. Here's a good article that explains how WiFi works and what I mean about causing problems:

https://arstechnica.com/information-tec ... -of-sucks/

Your Aerohive AP's know about each other and can automatically adjust their channels so they don't step on each other. Those consumer AP's don't do that.

NovusBogus wrote:

My take on Ubiquiti is that it's a move-fast-break-things company that offers great value but lacks the professional grade 'ecosystem' of training/certs, resellers, major league support, etc. of the network titans. This is particularly true of their wired routers, which are based on an open source network OS and come with the requisite level of punk rock DIY ethos. The ERX itself is built around a new, cheaper processor compared to the ERL and it may not be fully baked yet. Should be more than enough for soho use, and the Ubiquiti setup process is far easier than it was in 2013. Just expect to spend a lot of time digging through 5 year old forum threads from when everything required the CLI or config file if you want to go past the basics.

I'm completely fine with that. Close to commercial-grade stuff for half the price. And a notch above the standard consumer-grade stuff in features, usability, and stability. Seems like a winning combo, to me.

curtisb wrote:

ludi wrote:

The enterprise-grade Aerohive units serving the business WiFi network never do that, either.

Why are the Aerohive AP's not serving the BYOD network as well? You can broadcast multiple SSID's from each AP, and you could use a VLAN to send them out of your network separate from your business traffic.

Not my network, not my architecture. In an ideal world it would probably be set up the way you're thinking, but in this world, the company has changed owners a couple times and some non-critical infrastructure has been coasting in a legacy/maintenance mode because the current head of IT is spread too thin. Last I knew, the BYOD network was still physically outside the VPN firewall that manages the corporate network, and for now it's easier to just leave it there.

Also, this is a ten-story office building surrounded by three hotels and a few other 1-2 story restaurants. The level of WiFi pollution is well out of our control.

I hear ya...I wouldn't know the first thing about IT Directors being spread waaaaay too thin.

Yes, I'm one. Yes, I'm spread waaaay too thin. I love when I got to vendor demos and they say "well just get your network person to talk to your storage person, who may need to talk to your server person." All the while I'm thinking how funny it's going to look when I'm having a full-blown conversation with myself...

curtisb wrote:

I hear ya...I wouldn't know the first thing about IT Directors being spread waaaaay too thin.

Yes, I'm one. Yes, I'm spread waaaay too thin. I love when I got to vendor demos and they say "well just get your network person to talk to your storage person, who may need to talk to your server person." All the while I'm thinking how funny it's going to look when I'm having a full-blown conversation with myself...

Yeeeep, this is how I feel... "Who should we contact for billing... who is the decision maker". No one told me when I got into all of this I was going to be a Swiss army knife lol.

Well... Guess who has Ubiquiti EdgeRouter X sitting on his desk........... THIS GUY. I forgot I have a home customer who is in his 70's who LOVES technology and tries to do everything himself. He bought one and then I had to break it to him that it was a horrible solution to his network setup. I then got him a more suitable wireless router as he needed that and he said "well hell, you want this thing". I took it figuring it would be good for something down the road and here we find ourselves.

I'll take it out of box and start playing around with it for a bit, I'm sure it will be many firmware versions behind.

Welch wrote:

No one told me when I got into all of this I was going to be a Swiss army knife lol.

Like this one...

https://www.amazon.com/Wenger-16999-Swi ... B001DZTJRQ

Welch wrote:

I'll take it out of box and start playing around with it for a bit, I'm sure it will be many firmware versions behind.

In the meantime, mine just arrived, along with a UniFi AP (the basic a/g/n model) and based on preliminary fiddling I'm duly impressed.

-- EdgeRouterX: If you need console, the web interface can launch one for you, but the wizard interface will get you a basic 1-WAN or 2-WAN network running.
-- UniFi AP: You need to download and install the UniFi application first, but after that it will run everything from a browser interface. The only possible downside is that it seems to be Java-based.
-- Both: You probably need to know just a bit more than the average home user about network stuffs in order to navigate the menus, but everything is there and most basic and intermediate monitoring can be done via GUI.

Now thinks a web interface run on the hardware right? NOT like the Open Mesh units I've setup where you go to their website, change configs and then wait for the settings to update once it calls back home right?

Yeah Java... Uhhh. I've been happy to start uninstalling Java now that Chrome and Firefox don't support it. Most locally installed programs that my customers use seem to have removed Java from their software. Ohhh the landscape feels changed, and in a good way.

Welch wrote:

Now thinks a web interface run on the hardware right? NOT like the Open Mesh units I've setup where you go to their website, change configs and then wait for the settings to update once it calls back home right?

Router's interface is an internally generated webpage. The AP requires downloading and running the Unifi Application first, which I think is Java-based, but it then launches a browser which is agnostic, it just displays what the application is feeding to it.

ludi wrote:

The AP requires downloading and running the Unifi Application first, which I think is Java-based, but it then launches a browser which is agnostic, it just displays what the application is feeding to it.

Yeah, it's java-based.

You don't need to leave it on after the device is configured though, unless you want some of the more advanced features like traffic logging IIRC.

Honestly, I'm not even sure what you get if you leave it on. I basically did it all at once, wrote what I did down somewhere, and the computer I had it installed on is in storage at the moment.

So, for adept users, it's not much of a hassle.

They also have an App which you can configure the AP from instead of having to install Java if you want.
You can also configure some of the basic settings from the App and update firmware (very helpful).

Welch wrote:

Yeah Java... Uhhh. I've been happy to start uninstalling Java now that Chrome and Firefox don't support it.

Unfortunately, a lot of network management interfaces are in either Java or Flash, and the equipment is old enough that no more time is being spent on development. The web interface that Motorola created for their WiNG Wi-Fi solution started life as Java based in 4.x and then went to entirely Flash based in 5.x. This is no longer owned by Motorola, and is now in the hands of Extreme Networks so I expect that will change for newer equipment, but not for older equipment still in use. Quite a number of NMS'es are Java applets, but that's slowly changing. Java applets don't run inside of the browser, but you do usually have to get to them by going through a browser.

And then there a metric ton of server-side web apps based on Tomcat, which is Java. It acts as both the web server and the command processor. I realize that doesn't have anything to do with the browser, per se, though, other than the content is served to the browser. The resulting content can still be native HTML/JavaScript/CSS/etc. I'm personally not a fan of Tomcat. It's a huge resource hog. I'd much rather have a native PHP- or C#-based site.

Back on topic...I like the management interface Ubiquiti has created for their EdgeRouter products. You don't usually have to get into the CLI too much. I think it could be better, but I've definitely used much worse. And they've just started marketing their Amplifi product. Looks like a neat idea, except that it requires the use of a smart device app to manage it. I'm also not sold on mesh Wi-Fi. Seems to me it would add latency, where Wi-Fi already has plenty of latency to begin with.

I've been using Open Mesh for years and really dig their setup. Their web interface does rely on the Internet but you can choose to manage the units locally if you'd like. Latency isn't bad at all actually and they are fairly smart about a wireless client moving between ones reception to another. Very smart and seemless. Their MR1750 really rock.

Finally got the EdgeRouterX swapped in as our router and added a Netgear GS108Ev2 gigE switch for extra ports, still with the Unifi AP for WiFi. Perceived latency is completely gone and Speedtest.net now benches our nominal 25/5 cable connection at 30/6 from a hardwire port, and about 16/5 over WiFi. Was using a Netgear FVS318G as the router (yeah, I know, it's old kit) and was getting 15/5 over hardwire before. Good stuff.

ludi wrote:

Finally got the EdgeRouterX swapped in as our router and added a Netgear GS108Ev2 gigE switch for extra ports, still with the Unifi AP for WiFi. Perceived latency is completely gone and Speedtest.net now benches our nominal 25/5 cable connection at 30/6 from a hardwire port, and about 16/5 over WiFi. Was using a Netgear FVS318G as the router (yeah, I know, it's old kit) and was getting 15/5 over hardwire before. Good stuff.

Good stuff! Keep us posted if you start doing some advanced firewalling or VLANing or interesting with it.

I'm migrating a tiny non-profit to an Edgerouter X. They literally only need it for 3 devices. There current solution consistently has problems, and obviously old enough that it was vulnerable to hacks from 10yrs ago. It should serve them just fine, set it and forget it is what I am looking for.