Source
r/HomeNetworking•
eshultz

New home construction nearly complete, need advice please!

Hello r/HomeNetworking! For a TL;DR please scroll to the bottom of the post and rip apart my plans.

We are building a new home which is nearly complete, and I had a contractor run CAT6 throughout the house - 25 in-wall RJ45 jacks, 2 ceiling jacks for WAPs, and 6 to the exterior, with male ends for PoE cameras. All of this is terminated centrally at a patch panel, along with telephone and coax cable, and a couple cables going to the utility box outside. It's a 48-port panel so there's room for more cameras or whatever in the future.

So, it's time to plan out and buy some gear to support all this. Right off the bat I'll say I'm leaning towards Ubiquiti/Unifi, but not speaking from experience. I just see they are always very highly recommended. I am a programmer, so you don't have to totally dumb it down for me, but it's been like 7 years since I've done anything more advanced than your typical poking at settings on a consumer router.

But, I don't want to spend $3k on kit that is way overkill for my needs if I can get the same value out of $1k, for example (I made those numbers up). I am not entirely sure which pieces of the network are worth splurging on/future-proofing, and which would be foolish overkill to spend extra on. I know you guys will tell me to decide what's important and focus on that while still hitting the minimum requirements. I would like your help determining how best to do that. Read on.

At a minimum, my needs are as follows:

  • Put the security cameras/DVR on an isolated VLAN, based on my assumption that it would be wise to prevent that equipment phoning home to China
  • View DVR/cams both locally and remotely on our mobile devices
  • PoE for the cams and WAPs
  • WiFi, obviously.
  • Potent QoS/port prioritization

Nice to have:

  • Powerful parental controls/monitoring on a per-device basis (more for bandwidth usage and time limits than content filtering). With my current router I can go in and disconnect an individual device manually from the web interface. I would like much more detail and control/policy than that.
  • Single management interface

I'm going to post some rambling questions and assumptions now, please do correct me or ask for clarification on anything at all, and I apologize if this post is all over the place. My plan is to rack mount everything, btw, but that's not a hard requirement.

#1. I've never used PoE before

For PoE to work, I have to either use a managed switch that supports PoE, or use an unmanaged switch with PoE injectors? My understanding is unmanaged switches don't do PoE? And there are different protocols/variants of PoE which I understand is sometimes followed only loosely by both network equipment and device mfrs. So, checking device compatibility seems important but not something I know how to do. What do I look for in terms of specs on both the devices and on the switch?

#2. It has been nearly a decade since I've used a managed switch

I did a short stint as a sysadmin and started to learn the ropes on some Cisco gear before switching career paths. I don't even know where to start in terms of what features are important, other than obviously link speed and number of ports. SFP/SFP+, what's the difference? I know it's for fiber, and that's about it. Can I mix managed/unmanaged? Should I get a 48-port managed switch? If I patch my "normal" in-wall ethernet runs into an unmanaged 48-port switch, and plug that into say an 8-port managed switch, what do I lose in terms of functionality? How about doing the same for the cams?

What about for example this UniFi Switch 16 PoE - it doesn't appear to be a managed switch but then it says "Managed and configured by the UniFi Network Controller with UniFi mobile app support" - in that case, what functions as the "UniFi Network Controller"? Or is it just configured once and deployed?

#3. Dedicated firewall. Do I need one? If not, do I get any advantages by doing so (VPN etc.)? I understand this probably definitely depends on what I use for routing. Looking for discussion!

#4. Routing "UniFi Security Gateway" vs. "UniFi Security Gateway Pro 4": I understand Dual-WAN and that might be nice to have in the future, but what is "Dual-LAN", how is it different than using a VLAN? What about EdgeRouter? Other suggestions or bits of salient knowledge for me to chew on?

#5. WiFi Plan here is 1x Unifi AP-AC-Lite centrally located, and will add a second-floor WAP if needed. In a year or two will probably need a 3rd in the basement once we finish it. If you have compelling alternatives or reasons to step up to a premium/different model, please tell me!

#6. I should get a UPS right? Recommendations?

#Where I'm at now:

I know I need a switch, and I also know my current router (Netgear R6400) is probably not going to be able to keep up with the added devices and due to be replaced soon anyways. The cameras add a whole element of uncertainty around security and power. I am looking at Ubiquiti's offerings but utterly overwhelmed at the switching options. Looks to me like the Edge product line is more aimed at enterprise solutions, while the Unifi line is more "prosumer"...?

Here's a tentative list of equipment from someone who has no real idea what they really need:

Device TypeModelPriceNotes/Questions/Concerns
^(Cable Modem)^(TECHNICOLOR CGM4140COM)^($0)^(Renting all-in-one from Xfinity [it's a wash since they then discount my bill by more than the rental cost], latest and greatest whiz-bang, capable of gigabit, can do fiber as well I think? Running in bridge mode at the moment, but also does firewall/routing/switching/WiFi in normal operation.)
RouterUbiquiti UniFi Security Gateway (USG)$139Would the Pro model (USG-PRO-4) be worth the $200 increase in price? And what about the EdgeRouter product line? I see some of those offer PoE, what is the use case there? Would it be silly to mix Edge and Unifi products from an integration standpoint? And then I see the "Dream Machine". So lost right now.
Network SwitchUbiquiti UniFi Switch 48 PoE Gen2 (USW-48-POE)$589Damn, that's a lot of money. Can I instead use unmanaged switches to segragate devices (cameras vs. home office vs. other) and then a smaller managed switch in front of them to implement VLANs and policies? Drawbacks? Does the PoE requirement negate that possibility?
Remote AccessUnifi Cloud Key (UC‑CK)$106Is this going to do what I think it will? Expose an endpoint for me to connect to remotely? I.e. I'm out of town and can connect to my cloud key over cell data and access to my LAN?
WiFiUniFi ac Lite Access Point (UAP-AC-LITE-US)$89I plan to power via PoE since the AP will be installed on the ceiling
CamerasDahua 4MP Network Security System (N484E62)~$700, price variesConcerns? Will be locked down, no internet access. I was planning on going with Lorex (Costco) but my ethernet installer urged me not to due to concerns about support, build quality and night vision.
UPSUndecided~$500?Probably going to get a rack-mount UPS to keep it classy and safe, TBD
RackUndecidedNo ideaNo idea

Please pick apart my post, I'm not in over my head yet but getting close, I can feel it...

Thanks!

Posted May 31, 2020, 2:29 PM UTC

314
washu_k•

You might want to consider the UDM Pro instead of the USG, Cloud key and part of the camera system. The UDM is far more powerful then the USG or USG Pro. If you want to run QoS at any decent speed you'll need the extra horsepower. It has the cloud key built in so you don't need that separately. It also has a DVR built in once you add a hard drive which covers part of the camera system cost.

You don't need all your 48 ports to have PoE. Get a small PoE switch like the US-8-60W or US-8-150W depending on how many cameras you will need to power. Then a non-PoE switch for other devices.

6
eshultzOP•

Thanks for the tip, that would also alleviate some of my security concerns with Dahua. I assume then that you don't have to use UniFi cameras to take advantage of the DVR?

It's 6 cams + up to 3 APs needing PoE for now, so probably a 16 port managed switch would do well. Thanks.

1
[deleted]•

The UDM-Pro runs UniFi Protect which requires UniFi cameras.

1
nwngunner•

I can't help you with all of it, how ever I have a Netgear unmanaged 8port Poe switch, and I know they come in 16 and 24 port varieties.

You could put that behind a smaller managed switch, if you can't find a managed with the poe you need.

For your security cameras I would suggest running blue iris as it's much more robust then your normal DVRs. I run blue iris on a core i5 8400 with 16gb of ram and a GTX 1500. Blue iris currently records all cameras all the time to a 4tb wd purple drive. It keeps files for 14 days before being deleted.

You have done well planning out on your new home build. You done your future proofing by putting in cat 6.

1
Ben28282•

How fast will your Internet connection be

1
eshultzOP•

500Mbps

1
dmxwidget•

I have a Unifi system in my house. Very easy to use and configure.

If you need VLANS, then you are looking at managed switches.

Do you have a brand in mind for cameras/NVR?

What’s your internet connection speed going to be? Depending on your internet speed, QoS may not be needed.

Parental controls will likely want to be a separate device (like a circle) on an isolated VLAN for devices that need the parental controls.

Based on a rough guess for VLANS: -Management -Main Wireless -Kids/Controlled internet -guests -IoT

If you go Unifi, you’d have a single management interface for all Ubiquiti Unifi devices.

  1. PoE is fairly easy to deal with. Do yourself a favor and skip the injectors. It gets messy. 802.3 af and at are the main standards. Ubiquiti was using passive 24v PoE for devices, but that’s slowly going away.

  2. Do you have any needs for links beyond 1Gbps? Sfp is 1Gbps, sfp+ is 10Gbps. All Unifi switches are managed. They do not have a direct access GUI (you can’t go to the IP of the switch to confirm it). You use a Unifi controller instance via a Cloudkey, cloud install, or other local machine. Again, any plans for VLANS will require managed switches. An unmanned switch will work, but strips VLAN tags. Ubiquiti makes some small 8 port PoE powered switches as well. Easy to deploy for a media center.

  3. Firewall and router are usually one in the same. At least in the Ubiquiti ecosystem.

  4. Edge series are directly managed via a GUI or CLI. They are compatible with any network. You just lose the central management pane. Some reporting and such will not be available in the Unifi controller without a Unifi series router. Depending on internet speed, a USG might not be the right choice. There’s a chart here that helps: https://dl.ubnt.com/ds/udm-pro

  5. I would go with a NanoHD or FlexHD for your AP. They’re wave2 AC access points and going to have better performance. Depending on house size and construction, it’s easy to add more

  6. You should. Depending on all connected devices, that will determine the size. A small network would be fine with a 500va UPS. I personally use a 750vA for mine.

1
eshultzOP•

Do you have a brand in mind for cameras/NVR?

Dahua, at my installer's suggestion. If he hadn't been as persuasive, I would be getting a Lorex kit from Costco. Someone else mentioned I could get the UDM Pro which includes NVR and Cloud functionality, which sounds appealing.

Internet speed will be 500 down, I think. I've run Cat6 and not sure I'd ever saturate 1Gbps on the LAN, but in the interest of future proofing... Might be worth it.

For parental controls, not sure I'd want a separate VLAN because we all have and share several PCs and laptops, plus game consoles serving double duty as media center. It seems to me like it'd be tough to segregate the kids' devices on their own VLAN without doing a ton of configuration, but idk. It's more monitoring per-device and auditing that I'm after.

Please persuade me though; my opinion is likely uninformed.

And that's a second vote for the NanoHD AP... Greatly appreciated!

1
dmxwidget•

UDM pro is an option to consider. Just note that the Protect server only works with Ubiquiti cameras. You don’t have to run it, so this could be a good option as your router/firewall.

No Cloudkey needed it going the UDMP route as well, since that’s internal. Note that the UDMP Cannot be adopted by another controller. It can only run on the internal one.

A regular UDM might be another option.

The separate VLAN is actually quite easy to accomplish. If you all had separate users on a laptop, you’d just connect to the various networks as required. As they get mobile devices, this might be more important for the separation.

It really deepens how specific the reporting/auditing needs to be.

You can also do WLAN schedules via the Unifi controller if you just want specific networks off for certain times of the day.

1
eshultzOP•

Since many are asking, the internet speed at the new place is 500Mbps as far as I know. I'll also reply to your comments. Busy day today!

And sorry, I see now that the table at the end of my post gets mega nasty formatting on mobile. I'll try to fix that.

1
haykong•

How big is your place? And I Agee with the other poster skip the Unifi AC lite go directly with Nano HD better area coverage by far.

1
bsc8180•

And what’s the building made out of? Strategic placement of ap’s will assist in providing good coverage. Run more drops than you think with conduit where needed even if you don’t use it all, cable is cheap.

1
mox8201•

PoE comes in two forms:

  • Standard Active PoE (802.3af) which is what you'll get from a switch
  • Passive PoE which is what you'll get from a PoE injector.

Devices which only support passive PoE can't be powered from the switch, only from the injectors (that are invariably bundled with the device).

PoE and managed features are orthogonal. You can easily find un-managed switches with PoE and managed switches with PoE.

SFP, SFP+, SFP28 and SFP56 are standards for pluggable transceiver modules. The main use case being fibre optical transceiver modules although there are others.

The difference is the rate supported by the standard: 1, 10, 28 and 56 Gbit/s.

Yes, you can mix managed and unmanaged switches in the same network. Of course unmanaged switches don't' support VLANs so they can only handle regular (untagged) packets.

1
haykong•

As for cameras have you considered getting ultra low light hikvision cameras ... I recommend these

https://www.nellyssecurity.com/video-surveillance/security-cameras/ip/solutions/ultra-low-light.html

1