UniFi's Awesome New PPSK Feature - But There's a Catch!
Вставка
- Опубліковано 11 чер 2024
- In this video we take a look at the new PPSK (Private Pre-Shared Key) feature that Ubiquiti have added to their UniFi access points. This feature was already available on several other brands of access point but is something that UniFi had always lacked until now. It allows multiple Pre-Shared Keys (passwords) to be associated with a single SSID and can connect your device to a different VLAN based on the PSK used. However, there's one big, little known, issue that impacts the use of PPSK on WiFi 6E networks!
Buy on Amazon (Affiliate):
- UniFi NanoHD Access Point - geni.us/OG5YPA3
- UniFi CloudKey Gen2 Plus - geni.us/TzLBQ
www.camerongray.me/
/ camerongray1515
Chapters:
00:00 - Introduction
01:02 - What is PPSK?
05:27 - Why not WPA-802.1X?
06:50 - My Test Setup
07:43 - UniFi PPSK Configuration
12:06 - Demonstration
13:54 - UniFi PPSK vs Ruckus DPSK
15:05 - The Catch!
20:16 - Potential Workarounds
22:30 - Conclusion
AFFILIATE LINKS NOTICE:
Product links under this video marked “(Affiliate)” are affiliate links where I may receive a small commission on qualifying sales. Affiliate programs that I am a member of include, but are not limited to: Amazon Associates, eBay Partner Network and AliExpress Affiliates.
As an Amazon Associate I earn from qualifying purchases.
Purchasing through these affiliate links will not cost you any more money, however the commission earned significantly helps fund the production of videos on my channel. - Наука та технологія
Buy on Amazon (Affiliate):
- UniFi NanoHD Access Point - geni.us/OG5YPA3
- UniFi CloudKey Gen2 Plus - geni.us/TzLBQ
Another benefit: no more people saying "don't you trust me?" when you put them on the guest network, 'cos they won't realize it's happening 😅
ah yes
Hahaha, good point. Especially good for neighbors pretending they need wifi for some days for Whatsapp.
My reply is always I trust you, just not your phone, computer etc.
“And in my next video I’ll be installing a brand new UniFi network in my flat” 🤣
Well done on turning this video around so quickly after our comment exchange last week! Thanks - it’s a great demo 😊
Had no idea they had introduced this. Tried it minutes after watching your video - works brilliantly. Thanks :)
Cool concept. Broadcast a single SSID and connect to various VLANs based on the password you use.
The problem for myself is that I'm constantly switching between SSIDs depending on what I need to do... if I use PPSK I'd have to 'forget' the network and enter a new password every time I want to switch to a different network. Personally, I will stick with one SSID per VLAN and hide all but the guest SSID.
This is probably the main disadvantage of PPSK, however it's not something I've found to be a major issue - I have my firewall configured to allow me to access anything I'd need to regularly access on other VLANs from my main trusted LAN, so I rarely need to actually switch to a different wireless network. Of course, multiple SSIDs are still a completely valid option for situations where they'd be more suitable, however just bear in mind that a hidden SSID still broadcasts beacons, they just don't contain the SSID, so hiding SSIDs doesn't help avoid congestion issues.
Very insightful video Cameron. Thats cool this is a new feature. Never heard of this before until this video. This is pretty cool! I will be sharing this video with IT team as a new feature set!
that was a great explanation on the configuration, benefits and limitations.
my UDM and AP's don't have 6ghz radios, so I was considering this, however if I did decide to upgrade in the future, I may forget these caveats and spend hours of my life wondering why things aren't working, so I'll hold off for now :)
but this is great to watch because I have 4 SSIDs broadcasting (Main, IOT, Guest, Kids) each with segmentations, firewall rules, and the kids network specifically is only scheduled to be on from 6am - 7:30pm) forcing a downtime
I wondered about this, too, with regards to the (well, ) future 6ghz radio implementation. Without testing, wouldn't it just mean that you'd then have 2 SSIDs; one for 2.4 & 5 radios and a separate SSID for 6 ghz? PPSK on the 2.4/5 SSID but not on the 6
Thank you for the UniFi update! I love your channel! Keep bringing new content like this!!
Nice infomation. All unifi say on the WPA3 issues is 'At the moment, this won't work on setups which use WPA3.' So maybe theres something in the pipeline for it, who knows!
I've been using this feature on my Cisco wireless networks for a while. Really useful for network isolation without it being too obvious.
It seems odd that they don't let you turn on client isolation per PPSK. A use of this would be great to have our guest LAN and main LAN to be the same SSID, but I don't think this is possible with Unifi at least in the current version
Yeah, this is similar on Ruckus - those settings are configured at the wireless network level and not the PPSK level - Not sure if it's a limitation they can easily fix or if it's something that isn't actually possible.
What would client isolation per PPSK do?
Client isolation is circumventable even with a different password per vlan, you'd need to have a single password per station for it to be effective.
@@abdullahX001 client isolation will isolate clients connected to the same SSID/WLAN. It's a layer-2 level of blocking since the clients will use the same subnet. I think what OP wants is to set client isolation per VLAN but using the same SSID with PPSK. With PPSK the clients using the same password will connect to the same VLAN within a single SSID, but he doesn't want those devices to communicate with each other. If you enable client isolation for the SSID itself then it will isolate all clients on VLANs.
@@---GOD--- thank you!
Excellent video and great points about keeping a separate 6 ghz SSID tha outside of PPSK.
Another issue is switching vlans on the device such as an iphone. You have to forget the wifi network and the connect again. Great video, very helpful.
That's true, although personally I just have my firewall configured to allow devices on my trusted LAN to access stuff on other VLANs, needing to regularly switch VLAN gets messy - on WiFi at least you can change to a different SSID but on a wired machine, you end up needing to constantly change the switch port configuration which isn't fun.
Its certainly a useful feature, mainly for guest networks etc. For corp we have a simple rule , support radius or f***k off and build your own network.
Thanks for this video, Cameron. I have literally just opened a support case to ask Ubiquiti how i handle this issue, so now i can close that request. Thanks, again!
For what its worth some Unifi staff in the EA channels on the unifi discord have said they are looking at ways of getting it to work on WPA3. Ruckus have a solution iirc but it's patented. Looks like the next best way is probably some (hidden behind the scenes) radius trickery probably!
We've had no end of issues with getting devices like Chromebooks. Androids and Google Pixels connecting to our WPS2/3 Enterprise setup. It seems to be so variable. Of course we have to use Enterprise so we can trace network activity to a user/device for safeguarding and filtering purposes.
One of these "new technologies" that exist since over a decade. I first recognised it as Aerohive's Private PSK feature back in 2014 but it is available since 2011 or earlier. Awesome that Ubiquiti now implements it too, providing great value for small networks where 802.1X is too heavy.
Damn, I'm thinking of upgrading to the Unifi U6 Enterprise for the 6GHz and this video had me very excited. It looks to me like Ruckus have "solved" this by having your 6E device join as a WiFi 6 WPA2 device first with the unique passphrase, storing its identifier in a table, then forcing it to reconnect as a 6E WPA3 device with the AP already knowing the correct passphrase. They've patented it, but it seems like a bad solution as you gain the forward secrecy of WPA3 but don't gain the offline cracking protection (you can still crack the WPA2 exchange I expect). Might try splitting my existing SSID into a WPA2 PPSK SSID and a WPA3 Enterprise SSID to see if that's useable. Thanks for the great info!
Imagine patenting ugh i hate the anti competition
@@iunstable0seems like the mosty hacky thing ever to patent, ugh 😂
Love PPSK. Just waiting for a fix though as when paired with a U6 Pro cant get throughput higher than 300mbps. Ive been told Ubiquiti are aware and planning a fix ....
Ask them for the GPL source code for the access point. See if they actually give you it (as they are legally obliged to do so) or if they first just say they'll get back to you, and then ignore you (like they did for me with the UniFi 6 LR).
On the point about too many SSIDs broadcasting, could you get around this with hidden SSIDs? I've honestly never messed with them, but i assume they wouldn't broadcast (but you'd then have to manually enter the SSID on the device). And i assume this wouldn't get around the 4-SSID limit
Unfortunately not, a hidden SSID will still beacon, the beacon messages just don't contain an SSID.
Whats the point of lunching features for WPA2 ? Unless this can be implemented in WPA3 is useless.
PPSK is around when WPA3 was not even a draft... Only UniFi took that long to implement it...
@@binarybear9711 And ? Already invested to upgrade all my home devices to WPA3 for better WIFI security, so whats good for me that PPSK is here for a long time? One thing for sure I will not downgrade to WPA2.
Excellent comprehensive video, Cameron - although at the start and end it wasn't the most exciting video-wise with an effectively static image of the cloud key and AP 😂 Might be worth either a wee animation or just some talking head showing you?
It's definitely not particularly engaging and I'd have loved to do some nice animated diagrams but this video was a bit of a time constrained nightmare. Wanted to get it out this week while the technology was still "current news" - first had the time to film it on Thursday, had a migraine so couldn't then after filming on Friday, right as I was about to edit, managed to badly cut my finger with a stanley knife while cutting up a cardboard box so ended up editing this late at night shortly after getting back from hospital! 🤦♂️. Talking head is an interesting one, I've done it a couple of times in the past, and it's definitely more engaging, although I'm not particularly well versed at sitting in front of and talking to a camera. It's maybe something I'd consider doing longer term although I'd need to get a lot more comfortable with it first.
@@camerongray1515 yikes that sounds like a total nightmare! Impressed you got a video out at all, esp after having to go to hospital! Hope it's all healing up now. Talking head would hopefully be quicker than an animation but appreciate you might not want to do when not feeling 100%! Just wanted to flag up as an idea anyway, as I say the actual content was great, esp the WPA3 stuff which really took me by surprise as this PPSK setup sounds eminently sensible!
@@camerongray1515Migraines suck
On another note entirely, where did you get your desk/worktop from?
It's this: houseofworktops.co.uk/wooden-worktops/iroko-worktop - got it from them cut to size (also opted to keep the offcut which I'm using as the bit that stands up at the back) It's pretty good and looks great on camera although definitely a lot easier to dent/scratch than laminate so I have to be relatively careful with it - I have some wooden boards that I put things like servers on top of to protect it from the sharp metal. One thing I'd definitely do differently is I'd get them to profile the edges to a curve. I just got the regular square edges and they're really easy to dent.
Is this available on the dream router too? I cant find the option
Oh, thank you. I can actually use this
20:45
Quick question, can we have PPSK using this scenario
[1ST SSID]=2.4+5Ghz
[2ND SSID]=5ghz ONLY
you could enable PPSK for both of your mentioned SSID-band combinations.
Great vid thanks
I have 2 SSIDs I would like to combine but 1 is 5G and the other is 2.4G. I need to keep them separate (so you would only be able to join 5G or 2.4G). Is this possible ?
I haven't tested this but I imagine it would be fine, you'd just create the separate SSIDs as normal and restrict each to its respective radio, then set up the same PPSK keys on both. At the very least, the option to select the radios to use for each SSID is still available when PPSK is enabled.
Looks like I'll be doing some Wifi management on my setup this weekend, lol. Right now I'm broadcasting 4 total SSID's with the Ubiqiti gear, plus a 5th OG G-based network for a couple devices that just won't connect to the Ubiqiti correctly for some reason...
Ugg, posted that before 'the catch', I'm currently using U6 devices.. Still, I think adding an old WIfi-5 device (AC Pro maybe?) might be in order, and going down to two total SSID's....
You wouldn't necessarily need new devices - you can just configure your PPSK SSIDs to use the 2.4 and 5GHz bands while the others can also include the 6GHz band broadcasting from the same APs. Also bear in mind that if by "U6 devices" you are referring to regular WIFi 6, these are only 2.4/5GHz APs anyway, to get the 6GHz band you'd need WiFi 6E APs. The "6" in "WiFi 6" is essentially a version number, not a frequency.
@@camerongray1515 you, sir, are absolutely correct, lol. I'd forgotten the Lite was 2.4/5ghz only (we use the enterprise models at work, I use Lite at home). I'm still going to be putting in another AP here (probably a AC-Pro long range model) since I have some dead spots on the property that my U6 isn't covering.
Just to follow up, I went through the setup, and it works a treat.. Going ahead and reconfiguring everything this afternoon, going to be doing a bunch of esphome firmware compiles & uploads now, lol.
I think the light UI theme is better for instructional videos. The dark is really hard to see. Also consider increasing the zoom level of the browser and/or using a smaller window.
Ppsk I'd buggy half the device I attempt to connect won't connect
It took me 15 minutes to figure out you were saying "ruckus" not "rocket".
For me at least this also worked if I just used multiple WIFI configs on the same SSID with different passwords, Not even checking the PPSK checkbox. I'm sure on the backend it builds out the same. Can be useful if you want to use different WiFi settings and still keep the PPSK functionality.
I think you'll still run into the issue of increased beacon traffic.
@@OrianIglesias You shouldn't as it's the same exact SSID.
Anothe big limitation of the Unify implimentation of PPSK is the fact that the Advanced Settings for the networks are done singally, one for all on the root Wi-Fi network configuration. So if like me for instance you have a seperate SSID for LAN, Guest IoT and CCTV, you want Wireless Client isolation on Guest and IoT you cannot achieve this with Unify as the Wireless Client isolation would be on or off for all PPSK's.
also there is an error in your video stating that a Unify AP can only have 4 SSIS's on it. This is only true if you have Wireless Access Point meshing enabled. If you dont have any AP's that Mesh (dont have a wired connection back to the main network) then you can turn off AP Meshing and have more than 4, I think the new top limit becomes 8.
The SSID limit depends on how pedantic you want to be. If you start disabling features like meshing, then lets put the SSID limit in proper terms and call it 8 SSIDs per radio/band, which would give you 16 SSIDs on a dual-band (2.4+5GHz) AP.
Whether that makes sense to have up to 8 2.4G-only SSIDs and up to 8 additional 5G only SSIDs (or even 8 additional SSIDs on APs with a secondary 5GHz or also 6GHz radio) or not is up to the user to decide, same with the disabled meshing.
Fact is, you could indeed get more SSIDs than just the mentioned 4, at the loss of functionality.
I have six SSIDs on a single access point. So, I don't think the limit of 4 is accurate.
AltaLabs did a way better job at this. Unifi is just copying them now !! Sad ! BUT good video !
It definitely seems as though Alta Labs heavily pushing PPSK made it much more well known and probably pushed UniFi to finally implement it - that's where I found out about it, but until they release a local controller and demonstrate an ongoing commitment to supporting it long term, they aren't even a consideration for me.
The Controller is coming :) don't worry. & it will be 900x better then Unifi too ! @@camerongray1515
@@JasonsLabVideos Once I see it and they demonstrate that it's something that they'd actually care about supporting long term I'd be slightly more interested. I'm aware they are "planning on releasing a local controller" but it's been several months now with nothing. For me, it's a bit of a red flag when a company's clear priority is a cloud controller since the last thing I want to do is invest in a given ecosystem only to find the support gets pulled at a later date or they begin to slack on releasing updates for the local controller in favour of the cloud one. Seems like a strange business decision to release cloud only at first and then promise a local controller at a later date - now almost all reviews of their products heavily focus on the fact that there's no local controller.
LOL you run unifi thats a Eco CRAP system ! @@camerongray1515
You consistently hate on UniFi but have never cited any actual issues. Sure they're not perfect and have made some stupid decisions in the past, but no platform is. Personally I'd rather use a system that doesn't rely on a cloud service that can be pulled/charged for at any time - look at what happened to Open Mesh!
I also don't currently use UniFi at home, my home network uses a Ruckus Unleashed AP, OPNSense firewall and Cisco Business switches. That said, I use their APs with self hosted controllers in several other environments and they've been rock solid for years.
Maybe they're just connecting using WPA2, deauthing, allowing the device to reconnect using WPA3? (Using MAC to persist the device.) Which, btw, would be very insecure. If someone knew this, they could quickly imitate the MAC address maybe?
Wow that linked video is absurd. The whole point of the patent system is that you _can_ see the magic, you just can't use it without licensing or waiting until the patent expires. A company actually saying "you can't see this because it's patented" is either lying or incompetent (or maybe both).
"you are limited to 4 SSIDs per acces point" wtf? I suppose my APs did not get the memo as they are quite happy broadcasting over 10 SSIDs each... where did you get this info from?
I think my information was possibly outdated, UniFi historically had a limit of 4 SSIDs per radio however it looks like this is now up to 8 SSIDs per radio on *most* APs where wireless uplink is disabled. So you could technically have up to 8x 2.4GHz SSIDs and 8x 5GHz SSIDs or 8x dual band SSIDs per AP. That said, I'd never recommend creating that many SSIDs from an airtime usage perspective which is why PPSK is such a useful feature.
This is a great update... My only problem is all my IoT stuff is on a WiFi network that only broadcasts on the 2.5gHz range due to some of the devices needing to be set up on a 2.5 frequency only. Having said this I suppose I could always just utilize 2 SSID's, One specifically for IOT 2.5 and the rest on the secons SSID rather than the 6 I currently use.
I don't think PPSK is for everyone. In fact, I don't think it benefits most people.
Better to create one SSID per VLAN and have it configured specifically for that VLAN.
They could've just implemented a radius server in their controller to increase security with EAP instead of some half baked solutions
An integrated RADIUS server would be nice, however 802.1X using RADIUS isn't really the same thing as using PPSK. 802.1x/WPA-Enterprise is only supported by certain clients (and not many embedded devices such as IoT devices, games consoles, TVs.etc) whereas PPSK works with any device that supports WPA2-PSK.
@@camerongray1515 Sure sure, it hasn't seen nearly the popularity it deserves. But in my experience in most embedded devices it only comes down to the developer not caring. Eg. everything based on an ESP8266 can do EAP-TTLS and even certificate base EAP-TLS. Could just be you need to flash your device first (maybe not such a bad idea as it probably won't get updated to WPA3 anyway)
It's true that most devices *should* really support it, but sadly many don't and while flashing is possible on some very specific devices (such as those that can run Tasmota), it doesn't really work for devices such as TVs, games consoles, IP cameras, or things like my Nest thermostat which can't just be flashed with different firmware. In a business environment you can probably get away with it, but in a home setting, even if all of your devices support 802.1x now, it's likely that you'll end up in a situation where you'll want to use a new device that doesn't at which point you're stuck!
@@camerongray1515 At which point this device will get its own 2.4G AP if it stops bothering the rest... People using proprietary closed cloud environments will not care about splitting their network. They don't even use the default guest network their router puts up.
It's nice these manufacturers have conjured up a temporary stopgap measure, but still nobody (except eduroam) is incentivising manufacturers to support safe solutions.
Ladies, watch out for players who tell you their wi-fi password is your name...
Is there an easy way to migrate IoT equipment?
You'd ultimately need to reconnect everything to the network although there's nothing stopping you keeping the old SSID/Password that the IoT devices are currently connected to active and then also setting up PPSK on a new SSID allowing you to move devices over one by one without much downtime.
This is great for hotels, every room get their own vlan
Its cool in theory but not in practice at all and tbh I hope it never will get rolled out in enterprise at all.
since if you have to hop network for management then you are out of luck completely, since you cant save two profiles
It's not perfect although I haven't really had any major issues in practice. I think the only issue I've had was connecting my washing machine where the app would insist on grabbing the saved credentials from my phone without prompting me because I was picking the same SSID so "surely the saved credentials that the phone is connected using are the correct ones" but even this was a relatively simple case of joining my phone using the IoT PSK, connecting the washing machine and then reverting the phone back to my main LAN's PSK. Network hopping is slightly inconvenient but it's not something I need to do particularly regularly so forgetting and rejoining the network isn't a huge deal. Pretty sure you'd have the same issue with 802.1x WPA2-Enterprise.
If i had to *guess* 🤔it sounds like this 'Magic' Ruckus is using is some kind of MAC address based VLAN association that happens in the AP; basically use the PPSK to authenticate on the 2.4/5G Bands, then once associated, it negotiates the device to WPA3 6G and performs some kind of Layer 2 switching internally to switch that MAC Source/Dest traffic to the designated VLAN or something over the new wireless link by manually tagging the packets as they pass through the bridge based on the MAC address table (Which APs do anyway?). i'm sure the patent they claim to have is either a white lie, or just to cover whatever software daemon they run to orchestrate the switching/packet tagging out of spec, since packet switching and vlan tagging is industry standard stuff that happens in all network switches from all brands.
Does Unifi even have WiFi 6e or any WAP with 6Ghz?
The U6 Enterprise and U6 Enterprise In-Wall are both WiFi 6E so they do offer it, only at the high end, but it's only a matter of time until they release lower end 6E APs.
Are they really IoT devices if they don’t require internet access. They’re just things 😜
This is true, you've now got me thinking of the term "LoT" (LAN of Things) to refer to this sort of stuff, nicer terminology for the VLAN names vs my current "iot_lan" and "iot_wan"
Useless feature because too limited. I like my normal wifi to be the best it can (5Ghz, WPA3 etc) and my IoT needs to be as basic as it can so that every little cheap device works. Better to have one 2.4Gz IoT SSID for those than to drag the main wifi down in regards to specs.
Fair point on WPA3 but other than that, you can still use PPSK with separate 2.4GHz and 5GHz SSIDs, although personally I prefer just to keep all SSIDs both 2.4GHz and 5GHz and use band steering type technology to direct 5GHz capable clients to that band while allowing legacy clients (or those with a weak signal) to connect on 2.4GHz. That said, PPSK could still be useful in a situation like yours if you wanted to separate out your 2.4GHz IoT network to isolate different types of devices from each other (e.g. one VLAN for cameras, one for super sketchy untrusted devices, one for devices that need to access a NAS for media streaming.etc)