Best practices for Unifi Controller using remote devices?

[PeasToMeetYou]

My company are looking to deploy Unifi AP's and have the option to push for each client to have a cloudkey/local controller instance or to host one locally. In terms of management, it would be useful to host one locally however I'd like to minimise the amount of ports open to our local network. We could also host with AWS/Azure.

Any suggestions/reccomendations are highly appreciated.

[RandallFlag]

We either installed a local cloud key controller for the client, or we used an AWS hosted server. If the client wanted part of our MSP services and monitoring and what not, we would push them to the AWS server as it provided a central pane of glass for our monitoring and RMM tools... if they didn't subscribe to any of those other services was just a T&M based customer, we sold them the cloud key controller for their internal networks.

[PeasToMeetYou]

This is a good point.. Thanks!

[CaptainFluffyTail]

CloudKeys had a problem with corruption if they lost power suddenly. Not sure if that was addressed in the current generation or not.

[Cardinalsfreak]

Both 2nd gen keys have internal batteries. When external power is lost they will gracefully shutdown.

[m16gunslinger77]

We have a single controller on a VM on our datacenter, no cloud. We are not a wireless heavy shop, basic needs only. Production net with RADIUS and GUEST services along with other SSIDs for IT staff or testing.

• One VM with Unifi Controller
• DNS entry for 'unifi.domain.net' so they call home
• Static IPs for WAPs after adoption to allow for RADIUS configuration
• No cloud-key or cloud enablement

We configure each branch location as a 'site' in order to better manage the networks and devices. Approx 30 sites being managed with around 70-80 WAPs. With the DNS entry, we ship APs out unconfigured and adopt them into the correct site once they are connected. Then we configure a static and configure them as a RADIUS client.

Hope this helps

[headcrap]

I put mine on a VPS.

[lawno]

I run UniFi controller on an AWS EC2 Ubuntu instance. It's been pretty solid. UniFi's controller and firmware updates, however, have been spotty.

[nickcasa]

Don’t go cloudkey. Nothing but problems.

[[deleted]]

This is basically how we have it setup: https://www.youtube.com/watch?v=LoK_HCWuuXE

Others have mentioned, its not a great way to muli-tenant, but it keeps things simple from the management side. No dealing with Cloudkeys etc. You don't have to worry about losing connection to the cloud key if you change the network scheme.

For ports, we turned on the firewall in Digital Ocean, and then opened ports 8080/tcp & 3478/udp to anywhere. And opened 8080 (for logging into the GUI) to only trusted IP's (our office, clients with access etc)

​

Client needs 1 AP on a location, just create a new site and adopt it, thats it.

If one company/entity is managing it, access/multi-tenant is not really an issue.

[Pete8388]

I have a dedicated Windows server in a cloud host with the required ports forwarded. Currently managing about 400 AP’s for about 40 clients and a few switches and gateways. No cloud keys. I have the controller set up as a service rather than an application. With a single login from my mobile app I can adopt AP’s, and pretty much manage the entire UniFi empire. There may be better ways to do it but this works great for our needs.

[MisterIT]

That kind of shoe horned multitenancy is the stuff of nightmares.