My Cloudkey G2+ is not active at the sitemanager. When I log into a computer at the site, I can't ping the ip of the cloudkey, but I can SSH into the router/USG.

Is it possible to restart the Cloudkey with SSH from another device, or any other remotely ways?? It is not responding when I try to SSH into the couldkey...

I have my UniFi devices now for approx 4-3 years. All fine until 2 months ago.

Now I have multiple outage of Wifi and on my ethernet network (PC, Printer, 4 TV boxes) connections.

In the beginning a little less, but now for a few weeks 7 to 8 to more times a day (30 seconds to a few minutes).

There is no set time when this happens, but it seems to occur more frequently in the evening than during the day, as that is when we are watching TV. We notice it because the TV connection drops out repeatedly.

I have changed 2 UTP cables (fiber optic unit, KPN Router), called provider KPN twice: both times they see no issues and tell me its my UniFi.

I have 1x USW Lite 16 PoE (7.5.15) below are all connected via UTP ethernet cables:

1x Cloud Key Gen2 Plus

3x AP U6 Lite (v6.7.57)

2x USW-Lite-8-PoE (7.5.15)

3x USW-Flex-Mini (v2.1.6)

All with the new version updates (automatic)

So is my USW Lite 16 PoE defective?

Someone (who has also Unifi) mentioned maybe this outage is because of the UniFi version release?

Tip from him:

• Stop Sevice auto update
• Do Revert option on your USW Lite 16 PoE. Will this not help do this on all your devices

So I did the Revert option on the USW Lite 16 PoE yesterday: back to v7.5.10 -> today still issues.

I'm now Reverting my 3x AP U6-Lite to v6.7.54 & my 2x USW-Lite-8-PoE to v 7.5.10.

My 3x USW-Flex-Mini are still on v2.1.6

See tomorrow if this helps?

Can someone tell me if this is the right way going forward of not getting any more Wifi and ethernet outages?

Or can you tell me how to fix this?

Normally I will do new updates as they fix things

I'm not a technical person to please keep it simple for me to understand so i can fix this myself ;-)

I have contacted UniFi support;

I have send the Log file.

Their advice do a ping test

·        192.168.178.1 — Fritz!Box

·        192.168.178.68 — Cloud Key

·        1.1.1.1 — internet test

when this ocourse.

I can't do (or i do something wrong) at the moment I have this outage -> I can't reach my KPN Router (Fritz!Box), neither my Cloud Key Gen2 Plus via my notebook or Iphone.

Hoping that someone had this same issue and knows how to fix this.

Thanks in advance!

Kind Rgds,

Markwin

SETUP

UDM Pro Max, 10 Gbit fiber (EPB, SFP+ DAC on WAN), 10GBase-T client. Workload: usenet download, ~330 concurrent TCP connections to 5 servers. No VLANs involved in the test. DPI/Traffic Identification off, IPS off, no Cybersecure.

SYMPTOM

The same box, same ISP, same client did 950-1,070 MB/s (7.6-8.5 Gbit/s) of this traffic in April 2026. Since the summer it caps at 530-690 MB/s (4.4-5.5 Gbit/s). During the download all four cores sit at 72-75% softirq, ~14% idle, and the WAN port emits pause frames. Each usenet provider alone runs 480-575 MB/s; together they hit the same wall.

WHY IT IS THE ROUTER, NOT THE LINE OR THE PROVIDERS

- Routed between two of the UDM's own VLANs (Mac -> UDM -> server), 8 flows: 9.66 Gbit/s, UDM softirq 49%

- Same, 128 flows: 9.79 Gbit/s, softirq 68%

- WAN download, 8 flows, iperf3 IPv4 (NAT): 6-8 Gbit/s at ~10% softirq per Gbit

- WAN download, 8 flows, iperf3 IPv6 (no NAT): same cost as IPv4

- WAN usenet, 330 flows: 4.4-4.8 Gbit/s at 15.5% softirq per Gbit -> caps around 6.4 Gbit

- Ookla through the router: 9.4 Gbit/s peak, every week since March

So the forwarding engine is fine (9.8 Gbit/s LAN-routed with 128 flows), the ISP line is fine, NAT is not the difference. The WAN ingress path costs about 2x per packet on real interleaved internet flows, and that cost was lower in April.

RULED OUT BY A/B (each measured under load, each reverted)

- UniFi OS version: identical on 6.0.10 (EA) and after downgrading to 5.1.33 (Official). Network app 10.6.106 both times.

- Ethernet flow control off on the WAN NIC: pause frames go to 0, rate unchanged.

- Interrupt coalescing (ethtool -C rx-usecs 50): no change.

- Fast-path rule (conntrack ESTABLISHED -> ACCEPT at the top of mangle PREROUTING and filter FORWARD, 9.7 M packets bypassed every UBIOS chain): no change. The rule set is not the cost.

- UPnP off, second WAN disabled, custom firewall rules removed, monitoring pollers stopped: no change.

- NNTP on port 119, 563/TLS and 3128: same rate.

- RSS: NET_RX balanced across all 4 cores on both SFP+ ports; softnet_stat 0 drops / 0 time_squeeze; conntrack ~1.7k entries, 0 drops; CPU 67 C.

- Cable: 1 m passive DAC, 0 rx/tx errors, 0 flaps; 8 iperf streams pass 7-8 Gbit/s through it.

FIRMWARE HISTORY ON THIS UNIT

Official Network 10.5.67 until 2026-08-08, then the EA train (10.6.88, .94, .97, .101, .102, .106) with weekly UniFi OS EA builds Jul 15 to Sep 22. Now back on Official (5.1.33 / 10.6.106).

10-SECOND COUNTERS DURING THE 330-FLOW DOWNLOAD (per CPU)

NET_RX 229k / 197k / 215k / 210k; NET_TX 22k / 11k / 12k / 12k; user 5%, sys 4%, softirq 74%, idle 16%.

Same capture during 8-flow iperf at 6 Gbit/s: NET_RX 37k/s total vs 77k/s; average packet 1,500 bytes in both.

QUESTIONS

1. Any other Pro Max owner on a 10G WAN seeing many-flow throughput drop between the 10.4/10.5 and 10.6 era?

2. Engineering: what changed in the WAN ingress path between Network 10.4.x and 10.6.x? The LAN-routed path is unaffected, NAT is not it, the iptables chains are not it (fast-path bypass changes nothing), so it looks like something in the WAN-side driver/kernel path (GRO/NAPI behaviour, offload flags, or a per-packet hook outside netfilter).

Happy to run anything else; I have 10-second counter captures for both workloads.

I'm trying to migrate from Unifi Network to Unifi OS. All is good there no questions. What happened was, we currently have all ports open to access the controller via the web externally. I set informed the devices we have to get the custom domain for the inform. What i'm trying to do is close all of the open ports and only have local access. I would VPN into the network to make any network changes. That said, what do you think is the best way to do this without having to touch each device and ssh into them? I'm currently running network controller 10.4.57. I can't for the life of me in this version find where to set the hostname or the inform to in the GUI either. I appreciate any help!

The UDB Switch is a great product, but may I ask of you to consider adding an RP-SMA connector for external antenna, just like the UDB has? Having such would make the UDB Switch even more versatile, able to be adapted to a larger realm of capabilities in employment.

Most thanks

I am experiencing a recurring issue on a UDM Pro where the UniFi Network application fails to start on version 10.6.106.

My environment:

UDM Pro
UniFi OS: 5.1.33
Network: 10.6.106
Protect: 7.2.105
Access: 4.3.x
Talk: 5.3.2
Release Channel: Official

The issue first appeared after Network was upgraded from 10.6.101 to 10.6.106.

The Network application repeatedly failed during startup with:

java.lang.OutOfMemoryError:
Garbage-collected heap size exceeded

The normal Network Java configuration was:

-Xms128M
-Xmx512M

I initially tested increasing the heap to 640 MB, but the application still ran out of memory, so simply increasing the Java heap did not resolve the problem.

Database investigation

I inspected the UniFi MongoDB ace.device collection.

There were only 8 UniFi devices, but the device collection was around 21 MB.

Six devices had normal document sizes of only a few KB, but two U6 Enterprise APs were extremely large:

U6 Enterprise In-Wall
device document: ~10.7 MB

U6 Enterprise
device document: ~10.6 MB

Almost the entire size came from:

radio_table_stats

The two APs contained approximately:

U6 Enterprise In-Wall
radio_table_stats: 26,424 entries
~10.69 MB

U6 Enterprise
radio_table_stats: 26,282 entries
~10.63 MB

Other fields in the same device documents were only a few KB.

Recovery test

I backed up the full MongoDB documents for both APs and removed only the radio_table_stats field.

The document sizes immediately dropped to:

U6 Enterprise In-Wall:
~10.7 MB -> ~4.5 KB

U6 Enterprise:
~10.6 MB -> ~3.7 KB

No AP adoption data, MAC addresses, wireless configuration, authentication information, or radio configuration was removed.

After this cleanup, I rolled Network back to 10.6.101 and started it with the original 512 MB heap.

The Network application started successfully and reached:

Active: active (running)
controllerStatus: READY

GC behavior also improved significantly.

Before cleanup, startup heap usage climbed into approximately the 500–700 MB range before terminating with OOM.

After cleanup on 10.6.101, GC stabilized around:

~150 MB after GC

and Network remained operational.

Issue occurred again

Unfortunately, Application Auto-Update was still enabled.

The UDM Pro later automatically upgraded Network back to:

10.6.106

After this upgrade, Network stopped working again and showed only the Start option in UniFi OS.

I then used the built-in rollback option:

10.6.106 -> 10.6.101

and Network immediately recovered again.

Application Auto-Update is now disabled.

Current observations

At this point, the behavior is:

Network 10.6.101 -> working

Network 10.6.106 -> Network application fails/stops

U6 Enterprise radio_table_stats previously grew to ~26,000 entries per AP

Removing radio_table_stats drastically reduced startup memory usage

Rolling back to 10.6.101 restores service

So I suspect there may be an issue involving either:

• abnormal accumulation/retention of radio_table_stats on U6 Enterprise devices
• a regression in Network 10.6.106 when loading these device records
• or an interaction between both issues

Questions

Has anyone else seen radio_table_stats grow to tens of thousands of entries on U6 Enterprise / U6 Enterprise In-Wall devices?

Also, has anyone experienced Network 10.6.106 failing with:

Garbage-collected heap size exceeded

while 10.6.101 works correctly with the same controller/database?

I still have the original database backup and the affected AP documents, so I can provide additional logs or statistics if useful for debugging.

Thanks.

@UI-Team

I'm setting up a PPSK wireless network. I can manually create several codes that go to different VLANs. I can export those codes using the Setup-->WiFi interface when editing the wireless network with PPSK. But, no matter what I do, I can't import even the unmodified .CSV that I just downloaded from the interface. For all of the VLANs that are setup under settings-->network and are working fine, the import interface says: "No existing network with this VLAN ID found." and it won't import anything. I can import stuff for "Native Network" all day long but not for my VLANs that I've created and have tested as working. Thanks!

@UI-Team

However, I noticed that Traffic Identification provides application statistics (e.g. STUN, Google APIs, QUIC, SSL/TLS), but there seems to be no built-in view showing detailed permitted sessions.

For example, I would like to see:

- Source IP / Client

- Destination IP / FQDN

- Application

- Protocol and Port

- Session duration

- Bytes transferred

- Action (Allowed/Blocked)

Similar to what is commonly available in enterprise firewalls (Fortinet, Palo Alto, Check Point, Cisco).

Currently I can see:

- DPI statistics

- Security Events

- Ad Blocking events

- IPS/IDS events

- Client activity

But I cannot find a way to inspect normal allowed traffic flows directly within UniFi Network.

Questions:

1. Is detailed visibility for allowed sessions on the roadmap?

2. Are there plans to expose IPFIX/NetFlow data directly in the GUI?

3. Will future versions include flow-level analytics for normal traffic?

4. Is the recommended approach to export IPFIX/Syslog to an external SIEM instead?

I think this would be extremely valuable for troubleshooting application identification issues, such as:

- Webex traffic classified as STUN

- Video traffic grouped under generic categories like Google APIs, QUIC or SSL/TLS

Thanks.

Horacio

Argentina

U7-Pro-Max (2nd floor hallway ceiling)

U7-Pro-Wall (basement)

U7-Pro-Outdoor (backyard attached to side of house)

the Outdoor unit’s performance has never been right. Lots of Tx Retries, rebooting helps sometimes. I see it way over in the “yellow” spectrum with a note saying that my AP density on this AP needs to be corrected. My Pro-Max is 20-25 ft away inside. Density is not the issue. I have WiFi 6 disabled because it pissed off my Apple Home Pods. Running on the supplied antenna, but not sure if I need to point them. I’m only running WPA2/3.

this is a really beefy unit but in all honesty a LR AP would perform better. There has got to be something that I have to do to get this Outdoor AP dialed in that I’m amply not aware of.

can anyone help?

We would like to dynamically assign multiple VLANs to a switch port based on the RADIUS response.

Example use case:

• Native/Untagged VLAN: 100
• Tagged VLANs: 200, 201, 202
• VLAN selection should be controlled dynamically by RADIUS attributes

This would allow centrally managed dynamic port profiles based on device/user authentication instead of requiring static VLAN configuration on each switch port.

Ideally, UniFi switches should support RADIUS attributes that dynamically define both the native VLAN and the set of permitted tagged VLANs.

Is it possible to get support for this?

Example:

• VLAN 100: Internet (500/500 Mbps)
• VLAN 200: Alarm/management service (1/1 Mbps)

Both services are delivered on the same physical ONT port.

I was disappointed to learn that UniFi gateways currently require each WAN service to be presented on a separate physical WAN interface and do not support multiple independent WAN services/EVCs on a single WAN interface using VLAN tags.

This is a common deployment scenario in the Netherlands and is supported by many other router vendors. From a technical perspective, it would seem that this could be implemented through a firmware enhancement, especially since UniFi gateways already support multiple WAN connections when presented on separate physical interfaces.

I would like to request that this be considered as a feature request for future UniFi releases.

If possible, I would also appreciate being kept informed regarding any progress, roadmap plans, or future support for this functionality.

Thank you for your time and consideration.

As I understand it, there should never be BPDUs from APs therefore this should be enabled.

But if you ask the Unifi LLM Assistant thing on the help pages it suggests to not enable it and just leave STP on lol.

Can someone from the @UI-Team please help confirm this and make sure documentation is updated?

But if you have 2 Unifi EFGs and enable LACP on the 25GbE ports (for 50 gigabit downlink to switches, and more so doing this for reliability not for the actual speed), does this properly pass over to the backup EFG in the Shadow Mode setup?

I couldn't find confirmation of this and wanted to be sure since I'm doing it at a site now.

I presume not here but wanted to be sure, obviously default gateway is Layer 3 but if ARP is blocked to the uplink I'm not sure how that'd work?

Feel like something should be more clear in the documentation about this TBH.

We bought another u6+ - with the intent to remove the other gear - and have standalone access point. However.

Apparently - there is no QR code in the box. He's got the unifi app - but it cannot find the new U6+ AP.

Please - how do I hook this up without a QR code? The new U6+ is powered up - and displaying a white ring. This one doesn't have bluetooth - apparently it's the only one. The unifi app doesn't find it.

SMTP Server: smtp-relay.gmail.com

Port: 587

SSL: Disabled

Authentication: Enabled

SMTP Username: REDACTED

SMTP Password: REDACTED

Specify Send Address: Enabled

Sender Email: REDACTED

Unfortunately, test emails do not go through with this setup.

I've done some digging and can see in my errors.log that I'm getting back a 421 -4.7.0 right after the opening EHLO. I've noticed that UniFi is sending "EHLO [127.0.0.1]" and I believe this is the culprit; if I manually perform an SMTP transaction from the UDM Pro's machine with a proper domain for EHLO then it works.

Is there any way to define what EHLO domain should be used? @UI-Team are there any roadmap plans to add this capability?

Hopefully I'm missing something obvious here but I fear not...

Been using unifi gear for years and years. I have on numerous occasions before setup captive portal through the unifi controller as well as requiring a PSK / Password to connect to the SSID.

There are situations where a Password is not good enough (easy to find the password and share it) so using vouchers is desirable but I often need to connect different flavours of PDQ / Card Terminals and many of those refuse to connect to an SSID that has no password.

So, to solve this, I have always used a simple password to satisfy the card machines but then required either manual authorisation or voucher code.

That doesn't seem to be a thing any more.

Anyone got any idea how to resolve this?

Running on a self hosted server on Network 9.3.45