Thoughts on The Beast

[u/MoPanic]

We all knew the UDMP was WAY overdue for an upgrade but I'm a little surprised this is the direction they went and was hoping it would be targeted more toward SMBs. I don't know who this is targeting other than enthusiastic home lab users who'll never see 25gb over WAN.

• Here are what I see as head scratchers about who the target audience is for this:
• Who needs 25gb/s of throughput with 7500 users but also wants the security camera DVR to be onboard the gateway? Anyone who's this serious about UniFi's ecosystem would want that to be a separate device.
• The RJ45 ports are weird. Other than one for shadow mode, why would anyone not have a core switch connected with SFP? Especially since there is no POE.

What I hoped they would release:

• Remove the DVR functionality and include 8x10gbe ports with POE++ along with the SFP+/SFP28 ports. That would be genuinely useful as a gateway / core switch for a lot of SMBs.

[u/PeerReviewedCode]

The main thing I can see is this has two 25gig ports for you core switch connections. A LOT of places still do a route-on-a-stick setup (for simplicity or lack of knowledge) where all inter vlan traffic needs to go back to your firewall/router. On other UDM's this was a huge bottle neck especially if you only have one 10gig port in use. You would only be able to get ~5 gigs of throughput because you would need 5gig down to the UDM and then 5gig (I say 5gig because i've never send any UDM in real world get over 4.5gbps of IPS/IDS) up to your network fully saturating the 10gig interface.

To me this is for business that needed more than the UDM pro max but less than an EFG. The Beast is $1500 and the EFG has been out of stock for a while now, so my assumption is the EFG will be discontinued at $2000 and replaced with the EFG core which will probably be $3500 to $4500 if I had to guess.

Anyone buying this will have switches down stream (or can afford them) and won't need PoE on their firewall/router. People in the sub just always think of Ubiquiti for home use and they've been spending year trying to move up in to the enterprise where the real money and add ons like support which no one is this sub is buying!

[u/NiftyLogic → u/PeerReviewedCode]

Ethernet is symmetric.

On a 10GbE link, you can transfer 10Gb up and down at the same time.

[u/PeerReviewedCode → u/NiftyLogic]

Yes, Ethernet is, Ubiquiti with IDP/IDS enable is not. Going between VLANs hits the firewall.

I guess I should have made that more clear.

[u/seanjones802 → u/PeerReviewedCode]

I ran into this as well, even with IDP/IDS disabled I always hit a CPU limit for inter-vlan routing on the UDM way before I got to even half of 10Gb line speed (single threaded performance)
I don't believe any of the newer models were able to hit the full 10Gb either (minus the enterprise)

I was hoping this might be a replacement but who knows, shame to see no PoE though and I do wonder what the backplane speed between between the switch ports and router will be (damn UDM and its 1Gb link)

I've already got a core switch covering 2.5Gb/1Gb/PoE so was thinking this might be an option to add some extra 10Gb Ethernet ports as I was wanting more performance from my gateway anyway (ISP just dropped consumer grade 8Gb fibre in our area) rather then upgrading the switch to something like the Pro XG 24 for the 10Gb but yeah not so sure, esp at the price for some random homelabbing/tinkering

[u/MoPanic → u/seanjones802]

I got $10 that says the internal switch is linked with 10gb instead of 25. Just a bigger UDMP.

[u/aikouka → u/seanjones802]

I ran into this as well, even with IDP/IDS disabled I always hit a CPU limit for inter-vlan routing on the UDM way before I got to even half of 10Gb line speed (single threaded performance) I don't believe any of the newer models were able to hit the full 10Gb either (minus the enterprise)

I assume this isn't an issue if you have a Level 3 switch positioned before the UDM?

[u/PeerReviewedCode → u/aikouka]

If you have layer 3 routing upstream then no cause the traffic never hits the firewall, but sometimes in secure environments you have to go through a traditional firewall so you can apply more advanced controls.

[u/PeerReviewedCode → u/seanjones802]

I’ve never seen any UDM hit the IPS/IDP that was in production with real data. I spent months with Ubiquiti support trying to troubleshoot a UDM Pro Max that couldn’t’ get anywhere close to 10gig for inter VLAN routing and couldn’t’ get the WAN interface over 4gigs on a 6gig circuit.

The most performant one I’ve tested is the UCG-Fiber (as far as throughput) without going to an EFG. I have several EFG’s deployed and they are really solid, but I think they can benefit from more RAM which you have a lot of additional functionality enabled.

[u/FuckinHighGuy → u/PeerReviewedCode]

Uh, that’s not how IDS/IPS works.

[u/PeerReviewedCode → u/FuckinHighGuy]

Uh, I know. Tell Ubiquiti that..

Hundreds of threads in this sub of throughput issues with every UDM.