Guys,
I know some of you have some experience installing Ubiquiti’s Unifi products. Since my old trusty Netgear R7000 was starting to give up the ghost I decided to invest in something more stable. So I bought a complete Ubiquiti Unifi setup, with a USG router, a POE 8-port 60W switch, a Cloud Key Gen2 Plus (which was cheaper than the non-plus version, oddly enough) and 3 NanoHD wireless AP’s. Finally great WiFi coverage throughout the entire house, yay!
Yesterday I set the whole thing up and even though it didn’t go as fast as a regular router (since Ubiquiti uses its own controller) the whole setup process was relatively painless.

I was surprised however at how hot the USG router, POE switch and Cloud Key ran. When I looked this up on the internet, temperatures more than 70°C (+/- 160 °F) are considered “within normal parameters” by Ubiquiti.

But somehow this doesn’t feel comfortable to me. I’m now in dubio whether I should only keep the Access Points and Cloud Key, return the router and switch and change them for something else (regular router with Tomato/dd-wrt or maybe even a PFSense box, and a POE switch from a different brand). But on the other hand, there’s something to be said for staying within the same ecosystem. Is it normal for POE switches to run very hot?

Is my concern justified or am I overreacting and should I best let things be as they are? I specifically chose a passively cooled switch because I don’t want any constant buzzing fan noise coming from my closet, but on the other hand this is the hottest I’ve ever known any passively cooled device to run.

What do you guys think?

It does sound like a rather wasteful use of power. Is that even compliant with modern EU regulations for home electronics?

I can only offer my experience as someone who runs five different Unifi sites from a cloud controller. One site is commercial with a USG Pro, and the other four are residential with 3-port USG.

I notice that the NanoHD and AC Mesh APs run warm to the touch. AP-AC-LR and original AP (green light, no 5GHz) run cool. I also have an AP-AC-Pro deployed at one site, but it's up on a loft I can't reach. None of the APs I have on my controller report temperature.

The USG-Pro is reporting CPU temp of 88ºC and board temp of 56ºC. The front panel is ever so slightly warm to the touch, but I modified the USG-Pro with quieter fans. This is the only site I have IDS/IPS enabled on.

I've had many different hardware revisions of 3-port USG over the years. It's my opinion that the newest ones feel noticeably lighter than the older ones and operate slightly cooler. This could be due changing what the case is made out of. I have an older one at my house and it doesn't feel very warm to me. Certainly nothing that would alarm me.

In an office down the hall, we have an 8 port 60W switch like you have. There is a PoE load on two ports. One is 4.74w and the other 6.90w. I would say this is the most warm item. My controller has a field for reporting temperature, but it says "No Sensor." I am not sure if there is a version of this switch with a sensor. The switch is definitely warm but again I would not be alarmed by it. It's a fanless managed PoE switch with a load on it. The case is metal and the heat seems appropriate.

In my house, I have the PoE passthru version of the 8-port Unifi switch with no PoE load on it. The case is basically the same as the 60w PoE version but missing (most of) the PoE status LEDs. This switch is not warm.

At another site I have a 150W 8-port PoE switch with only one 3.74w PoE load on it. This switch is much larger than the 60w and might contain a fan. The controller is reporting a temperature of 56ºC. This switch never feels warm.

I have a 16-port PoE 150w switch out in the warehouse meant to run PoE cameras that are not hooked up. So, no PoE load at this time. Controller says 61ºC and the case is just above body temperature. Barely noticeable warmth.

I also have a non-PoE 24 port in a rack. 69ºC according to the controller. Not at all warm to the touch on the face.

One thing I should mention is that one of these sites didn't have the space for a 16-port Unifi PoE swich so I ended up installing a Linksys 16-port (8 port PoE) fanless non-managed switch there. I believe 3 or 4 of the ports have a PoE load on them. This switch is not warm to the touch despite being fanless. So, it's possible the CPU in the Unifi 8-port 60W is simply inefficient. But, I've had managed switches in the past with fans that sound like a jet taking off.

I'm running the Unify 8-port switch (150W) with 3 PoE APs connected to the switch (1x AP-AC-PRO and 2x AC-AP-Lite). The switch reports 67 degrees C at this moment. So in line with the 70 degrees you see reported on the internet.
In my case, no Cloudkey or USG router, just the PC as controller and the provider-supplied modem/router (Fritzbox 7581).

I've got three of the AC Unifi APs, which I've very happy with, they seem to run pretty cool (one of them lives in an uninsulated loft space and copes fine).

I don't have any Unifi switches, two of my APs are plugged into a TP-Link POE managed switch (they draw about 7W each). That switch runs completely cool and doesn't have a fan. It is a very unexciting managed switch though, very old school and probably has a very wimpy CPU.

Thanks for the replies guys! I've now found out that the mentioned temperatures are CPU temperatures, not enclosure temperatures. Today I've checked with one of those IR guns, and found out the switch and cloud key run at about 37°C, the USG at about 41°C and the AP's at about 44°C. Still pretty hot, but they function fine. I guess I'll just trust the tech and leave it as it is.

So far everything's ok.

Just got one problem though. I can't seem to access my Loxone home automation from outside the LAN anymore. With the old router I had set "port forwarding" up like below, and that has always worked fine. (first image)

With Unifi, I set it up like in the second image, but it doesn't work. It looks the same to me? Anybody got any ideas?

edit : those screenshots look pretty small, but I can't seem to make them bigger. I hope you can read them (you can if you zoom in on your screen).

Do you have your source and destination ports reversed?

-jk

I tried that, but that didn't work. The ip address in the unifi controller also said "192.168.1.200:80" then too, so I figured that couldn't be right.

It certainly looks like you have the ports back to front, unless one of the UIs is badly labelled.

You're right. They were back to front. But then it still did't work.

Then I tried setting it to port 80 in the setup menu of the Loxone server, and then it worked.  But I don't want to use that port for security reasons.  So I then reset the port back to 7777 and guess what? It kept working!!

Very strange, but I guess I'll  just be happy it works and not worry about it.

Thanks for the help!

The first time you tried it you did give the controller enough time to provision the USG? Changes in the unifi world are not realtime, you have to wait until the controller decides to provision the changes on the device you've modified and then wait enough time for that device to update and reload it's new configuration. Normally this doesn't take very long, but as I said, it's not a realtime change.

That is one of the few things about Unifi that annoys me, there are far too many config changes that require the access points to "reprovision" (which basically involves the AP rebooting), that really don't seem like they should need it.

It does probably make testing easier for their dev team though.

Mind you, the cheap managed hubs I've used also need to reboot to change pretty much any setting (the difference being they reboot in a few seconds).

Yes, I did wait until the provisioning was done and the unit back to "online" status. But it didn't make any difference, not until I changed the port setting into the Loxone server. (after which the Loxone server also rebooted, so maybe that was the reason it ended up working)

I've been working with Unifi equipment for about 6 years now, and haven't had many heat issues. I will say that the hottest Unifi devices I've interacted with are the NanoHD's that are out now. Personally, I'm not much of a fan. I have a client who asked to install those instead of the AC Pro models I'd proposed, and they're pretty darn hot. They also appear to be causing him some roaming problems I haven't seen with other AP models.

I just checked out my own home's Unifi equipment:
USG - ever so slightly warm (barely)
8 port POE switch - what I can only describe as pleasantly warm
Cloud key - probably the warmest of the bunch but I don't have a problem with it

I haven't checked the AP (AC LR) but will tomorrow. The POE switch has two POE devices (CK and AP), and four other active ports. All of this is in a plastic structured media enclosure with vents but only passive cooling. But the only other stuff in the enclosure are the power bricks for the USG and switch, a splitter for the coax, and a small patch block for the ethernet.

I do want to give a shout out to their In-Wall access points. These are useful in places where you need one or two hardwire drops and wifi coverage, eg a media room or office. The is what I plan on doing - but for past 10 months the two In-Wall APs and an AC Lite have done a Good Enough job blasting wifi around the house from the basement.

Which USG? I've got a 3P and it runs hot, you wouldn't want to put your hand on it for long.

I've got a mixture of switches USW-8-60W, USW-8-150W, USW-16-150W and a Mesh Pro, a few AC-Pros and a Nano pro, from my MBP I get 600Mbit to the nano.

I stuck the Mesh Pro outside in the garden so that during the summer we get decent wifi, the wifi was patchy in the garden due to the age of the house and locations of the AP's internally.

Gotta say that I'm in love with the Unifi equipment, it's not the cheapest and it's never going to be the best but I think the whole system is very slick and it works very well for me in my home environment, since I switched everything to it I've no longer had any complaints about the WiFi in the house.

Only thing I want is an updated USG which can handle IPS turned on at 1G, seeing as the XG is now deprecated and was ridiculously priced, hopefully they'll come out with something reasonable to fill the gap.

I've switched to using a Cloudkey Gen 2+ for my controller as I have a couple of G3 Pro cams (caught somebody trying to break into our car!) so they play nicely with the Protect system which is getting better with every release. I also bought the rackmount kit for it and had it drop shipped from the US to the UK, I don't think there are many of them in the UK!

Having just purchased a NanoHD myself, I agree it seems to run unreasonably warm. I'm just using the supplied PoE injector so at some point I'll measure how much power it's using.

Guys,

I seem to have another problem. Might be Ubiquiti related, but I'm not sure.

Eversince changing to Ubiquiti, my Lexmark CX417de color laser AIO printer doesn't do "scan to network" anymore. It says it can't find the path. I'm 100% sure it's correct though. This used to work fine with my Netgear router.

Funny thing is it DOES work fine with my laptop, but not with my desktop! I have no idea why, both machines run the same OS and are setup almost exactly the same. I can access the network share \scans on the desktop via the laptop. So the share is accessible. I have no idea why the Lexmark refuses to connect to it.

It's also not the SMB 1 vs. SMB 2 or 3 thing, because SMB 1 has been disabled on my desktop for months now and it has always worked fine with the Lexmark.

This is probably not Ubiquiti's fault since this does work with the laptop (which is on the same network obviously), but I do find it strange this has begun when I swapped routers.

Could anybody tell me which troubleshooting steps I can still take? I've done all I can think of.

Edit: forgot to mention : scanning via a program on the desktop over the network DOES work, but I'd much rather just be able to do scanning to PDF from the AIO to a folder on my desktop over the network. It's just easier.

I also already tried simply disabling the firewall of my desktop computer, simply to rule out if that was the problem. It wasn't. Same problem.

Thx!

Clarifying... Is this the problem you're encountering?

- On the control panel of the Lexmark scanner, you have selected the option to save the scanned image to a shared folder on the network.

- When you scan to a shared folder on the desktop computer, it fails with a "can't find the path" error.

- When you scan to a similar shared folder on the laptop computer, it succeeds.


If that's the case, my guesses are:

- DNS resolution might not be working the same for the desktop as it is working for the laptop. If you have any sort of access or visibility into the way that the DNS entries on the DNS server look like for those computers, see if you can investigate that. To narrow this down, try doing the same "scan to network" attempt, but enter the desktop computer's IP address instead of its name on the scanner's front panel. If the IP address works but the name does not, then there's your issue.

- If neither IP address nor name work for the desktop, then it could be security related. Perhaps an OS-level firewall setting, or permission settings on the SMB share, or permissions settings on the actual folder or files being shared.

Yes, it's exactly as you describe.

Excellent idea with the DNS Tony!! I'm using a PiHole DNS server on a Raspberry Pi, but the DNS of the AIO was still set to 192.168.1.1 (which is the IP of the gateway). I changed it to 192.168.1.105 (= the IP of the PiHole).

Problem immediately fixed! Yay!
Thanks so much! Still wonder why it did work on the laptop though. After all, both computers are connected to the same gateway...

According to my dashboard I have the 3P as well. Not sure why mine is so much cooler than yours. I would imagine I'm not pushing as much through it. Sounds like your network is more complex than mine. I'm pretty simple with one switch and AP. I have the older cloud key but would like the newer one.

I'm glad to hear you're liking the cameras! What do you think of the resolution? It seems a little low for what you get on cameras at similar price points. Hikvision has 3-5MP cameras for the same cost. But I hate their DVRs.

Note that Hikvision is apparently at some risk of becoming the next Huawei, with potential US market banishment and corporate pariah status.

Choose your big brother camera supplier carefully.

Is the gateway, or something above it, also configured for DNS capabilities?

You may have been running two separate DNS servers on your network this whole time, and sometimes resolution works on both, and sometimes resolution works on only one of them.

Not that I know of. Probably the DNS of my internet provider, yes. But I don't think I can turn that one off?

Right. Indeed, I meant local LAN DNS. I mean, it's always a chain, right?

For instance in my home network, I've got:

Local LAN devices
|
192.168.0.1 - WiFi router, DHCP server for wired and wireless LAN, DNS server for wired and wireless LAN.
|
10.0.0.1 - Cable modem which also has DHCP and DNS server.
|
X.X.X.X - Upstream servers from the cable company, and then on to the internet.

For me, each of those items are physically chained so that the local LAN devices can only see 192.168.0.1 when they're plugged in and connected. The cable modem is chained into the "upstream" port on the WiFi router, so you have to go through that WiFi router to get to it. The cable modem has only one device connected to it: The WiFi router, and it serves DNS and DHCP requests to that single device only.

The WiFi router is configured so that its DNS is obtained automatically from whatever is upstream, but it's supposed to handle any local LAN DNS requests first, before forwarding the remaining requests upstream.

Some ways that a second DNS server could possibly get involved in this scheme, that I can think of off the top of my head is:

- Another unknown device, inside the 192.168.0.1 network, fires up a DNS process and works as a rogue DNS server inside my network.
- The DNS/DHCP server at 192.168.0.1 malfunctions, and fails to resolve a local LAN address, forwarding the request upstream to 10.0.0.1.
- Some of my local LAN devices might accidentally get configured to point their DNS to 10.0.0.1, or even some other DNS server, to get their DNS resolution. In theory this shouldn't happen, because they should all be set to DHCP, which should automatically deliver all of them my local intended DNS server address (which should always be 192.168.0.1).
- Some device on my network tries to be clever, and somehow figures out that it can talk to 10.0.0.1 once it's connected to the router, and configures itself to get DNS from that location.
- If I accidentally plugged in network cables wrong, so that local LAN devices have a path to reach the cable modem directly.
- If someone logs into the cable modem's built-in WiFi (which I have disabled though).
- Something maybe weird happens with UPNP if that's enabled on either of the routers? Not sure if that's possible, but UPNP sometimes causes funky stuff to happen.

Thanks for the explanation Tony, very informative!

Your setup resembles mine, with one exception: because of my specific request, my ISP didn't install a modem/router docsis 3 cable modem, but just a 'dumb' docsis 3 modem. That way I'm sure there isn't any double NAT'ing going on. Took some convincing since isp's don't like to install those (because they can't support them remotely), but I managed to get one in the end.

No idea why it runs hot! Here's my topology.



I have 5 switches (4 x 8 port, 1 x 16 port), 4 access points, cloudkey Gen2 +, USG 3P and two G3 Pro cameras.

With the cameras I know you can get better for the money, but I like the integration, we already caught somebody trying to break into our car...literally 2 days after putting the camera up!

I would probably go for integration over the higher res too.

I honestly don't know if the topology makes any difference. I wish I had a similar topology as there are several places where I have a dumb switch right now that I'd like a Unifi switch. I wish they made some inexpensive 5-port models but that's not the market they're in.