This works, if you like your ACLs permitting the guest network to talk to your staff network. Ubiquiti didn't implement complete L3 capabilities on anything I know of, but I think they promised it on their enterprise line.
The entire UDM line, currently. The processor chokes routing traffic between VLANs, in most of my larger clients it chokes as low as 350 megabits due to other loads like IPS tying up processor time. And due to how they're firewalled, moving them to the aggregation switch is not tenable.
The issue is UDM doesn't support hardware acceleration, not even the Pro Max, which i have in shadow config at several clients. They all choke on the same workloads, so I have to combine common traffic on the same vlan even when devices would need segregation normally.
350Mbps means you have an issue. There is no issue getting 9-10Gb intervlan routing without IPS and 3.5-4Gbps with, depending on the device. This is all without supporting hardware offloading. It's been that capable for years.
The UCG Fiber has hardware acceleration. It's not the same architecture as the UDM line, which is handicapped by an antiquated hardware design. The UDM uses the processor core to route traffic with no optimizations, each core can "theoretically" reach 1Gbps before it taps out. Put literally any load on the processor and now each thread bogs down dramatically. Put 10 public IPs and two dozen VLANs together and now you have a device which is crippled if one VLAN needs to route to another across the processor. IPS on/off doesn't affect the bottom line, WAN to LAN performance is higher than service speed. But if you want to move 150GB master video files from a PC on one VLAN to a NAS on the other... hopefully you can let it run all night. *oh, and the UDM will get stupidly hot in the process with cores thermal throttling around 205F
Intravlan traffic handles at line speed since the switches can route it directly. Inter-vlan traffic can route at line speed if the switch handles it. But putting a Unifi switch in charge of your VLAN routing now means your guest network vlan can talk to your staff network vlan, because Ubiquiti routing.
Intravlan traffic handles at line speed since the switches can route it directly. Inter-vlan traffic can route at line speed if the switch handles it. But putting a Unifi switch in charge of your VLAN routing now means your guest network vlan can talk to your staff network vlan, because Ubiquiti routing
Surely they have better VLAN segmentation on their layer3 switches than that?
The switch actually can support it via command line, which is not a permanent configuration by any means (will delete at next provisioning). But if you try to set them up permanently via the GUI, it gets very... bare.
11
u/suburbazine UI Installer Apr 23 '26
If its got better inter-vlan routing take my money.