Going back to Unifi

About three years ago I moved away from Unifi. I had been using a Brocade switch, a C1000 PoE switch, two Ruckus R610 and a H510 access point with a firewalla Gold as my outside firewall.

I decided recently to make the move back, except not with a UDM or other Unifi Firewall or router, but just on the switch and AP side of things. I swapped my R610s out with a pair of U7 Pro APs and the H510 with a similar form factor Wi-Fi 6 unit for my wife’s studio.

I’m liking it pretty well. One thing I can complain about is how long it takes to make WiFi configuration changes, where the changes actually result in the WiFi going down while the change happens. Ruckus didn’t seem to have that problem.

On the switch side of things I am very happy, except with the Flex minis. They seem to drop off the network every so often and sometimes seem like they get stuck in a unadoptable state. But I have a pro max switch, an Enterprise 8 port, a Pro (?) 8 port, and arriving soon is another PoE lite switch. If all goes well perhaps I can eliminate most, if not all, of the flex minis.

X1 credit card – Fraud

I really liked the X1 credit card until last Monday.

It had great features to protect against fraud, allowing you to create virtual credit card numbers to use with vendors, all right in your app. I had probably a dozen and a half or more virtual cards, so purchases for Apple, for example, could all use a single virtual card. If that was compromised, I would know which vendor had the issue, and my main credit card (and all my other virtual) could carry on without having to be replaced.

They provided two reward points for every dollar spent. If your purchases are from certain major merchants (like Apple), each point is worth a cent, otherwise each point is worth about 2/3rd of a cent. After spending $1000 in a month, you were upgraded to 3X points for every dollar spent, and they had promotions every week giving you chances to earn bonus points. All-in-all, it was a pretty generous reward system.

My admiration of this card changed last week. I got an email that they were closing my account. When clicking on the Learn More link, I found that it was closed for “suspected fraud”. They won’t even tell me what triggered that.

Essentially, they are judge, jury, and executioner and there’s no appeal. It seems that most any communication with them ends with them “considering the matter closed.” Which seems like their way of saying “Go away.”

Worst of all, the points that I had accrued were taken away. That makes me feel like there was some fraud that happened here, but not in my part.

I’ve reported my experience to the Consumer Financial Protection Bureau. (Consumer finance.gov). I encourage anyone else with similar experience to do the same.

I don’t know if it will do any good, but it’s worth a shot.

Easy Synology ESXi backup

I recently purchased a Synology NAS, my second one I believe. I briefly tried QNAP (about a year or so). Although the hardware is generally more powerful for the money, the software (though it looks nice) was lacking a bit.

So, I’m back to running a Synology DS1621+. I don’t have a need for huge quantities of storage, mostly I just want to have redundancy and a good place for backups, etc.

Enter Active Backup for Business – A software package included with the Synology that makes backup easy. In addition to having a great Windows backup client that you can manage centrally (after initially installing on each client), it has the ability to backup VMware ESXi and Hyper-V. I can’t speak to how well it works for Hyper-V, but it seems to work great for ESXi.

Note the tab is titled “VMware vSphere”, but don’t you believe it. I’m not using vSphere and it works fine. For this to work with ESXi alone, you need to have both SSH enabled and the ESXi shell enabled. Unfortunately, for security reasons, VMware doesn’t bring these up when you boot, even if you had turned them on in the GUI. There is an easy answer though:

After enabling SSH via the GUI, ssh in and:

Edit the /etc/rc.local.d/local.sh file, adding these lines before exit 0:
vim-cmd hostsvc/enable_ssh
vim-cmd hostsvc/start_ssh
vim-cmd hostsvc/enable_esx_shell
vim-cmd hostsvc/start_esx_shell

With the above in place, you should be able to reboot and still have your backups work without issue.

Credit to 33hops.com for the instructions on enabling SSH via this file:

https://33hops.com/how-to-keep-your-vmware-esxi-ssh-service-up.html

and to the kind Mark Hargreaves for the ESX shell part:

https://communities.vmware.com/t5/ESXi-Discussions/enable-esxi-shell-through-command-line/td-p/1384750

Credit to me for figuring out that in ESXi 7, enable_ssh alone isn’t enough, you also have to start_ssh.

Moving away from UniFi

I moved toward UniFi in a big way last year. I bought a UDM Pro, two Nano HD access points, and three (eventually buying a fourth) Flex Mini switches. The Flex Mini seemed like a very good buy, $29 for a 5 port managed ethernet switch. My home network was such that switches were daisy chained together, so this small managed gig switch seemed like a good fit.

I think part of me wanted an all-in-one solution, and UniFi delivers that. It’s nice to be able to run enterprise auth for Wifi without needing a separate authentication server, for example. The single view for all your devices is very, very nice.

But, as time went on, I discovered that everything isn’t as rosy as it first appears.

I had been having something of a bit of a performance issue, and ran across something that was a fairly major issue with the UDM Pro… The 8 LAN ports on it? Apparently, they share a 1 gig switching fabric. For eight gig ports. Why would they put out a “Pro” level device, meant for businesses and pro-sumers with such a glaring flaw?

I’ve seen pictures of other peoples gear, where they ran a single cable from one of those ports (or from the 10G LAN interface) to another switch, leaving the rest empty. Why have a device like a UDM Pro if one of the main “features” of it is so hobbled that the fix is to basically not use that feature?

So, do I have anything else good thing to say about UniFi? Absolutely. Their gear held value pretty well over the approximately 7 months I owned it. I shipped the UDM Pro out to that buyer today, and, so far, I’m much happier with my new network.

Catalyst 1000 Switches – What they don’t tell you

Not too long ago, I saw this video by Network Chuck about Cisco Catalyst switches. About the coolest part of these switches is the ability to stack them, so you can manage them from a single IP address. This means you can configure things once like VLANs and other management functions in one place, and assign port configurations through the same interface to multiple switches.

I also saw this video by Lawrence Systems, which makes them sound not quite as nice, but still pretty good.

On the plus side, you get real Cisco switches. And, you don’t have ongoing license fees. They aren’t the cheapest, but they are pretty inexpensive, considering the company who made them, and run Classic IOS, something I’m familiar with from my former job.

So, I bought a C1000 switch, 8 port, PoE. I didn’t have much trouble getting the basic config on it. Pressing the button for the 3-4 seconds resulted in me getting to the WebGUI pretty quickly. So far, so good.

I had a bit of trouble getting the new code downloaded from Cisco’s site, but it didn’t delay me very long. I had a bit of trouble with updating with the WebGUI, but the “archive download-sw” command worked fine.

Ultimately, I got everything working fine with the first switch.

So, I picked up a 2nd switch. I also bought a pair of used Cisco SFP’s from eBay, since they would be required for the single IP management.

With the 2nd switch, I had lots of issues. The process to use the button to do easy setup did not seem to work. I don’t know how many times I tried, but I couldn’t get it to work.

So, Console cable, right? Well, neither of the models I bought came with one and I couldn’t locate one. (I have one on order)

So, I fired up wireshark. At some point, I had this hooked up to the rest of the network, and spotted that the switch had picked up an IP address via DHCP. Great, right? Put that in the browser, and it – well, I got prompted for credentials, but the default credentials don’t seem to work.

I believe while looking at the wireshark trace, I saw that it was attempting to download a config file. AHA!

I ended up downloading Transfer for my Mac, a nice looking TFTP server. Download it from their site and you get a free trial period, but after I was done with it, I ended up buying it. That way, if I need one in the future, I have it. Plus, I was thankful that I didn’t have to wait until my serial cable arrives in a couple of days.

Anyhow, I downloaded the config from my other switch, changed the IP address in the config, plus probably another minor change or two, and dropped it into the directory that Transfer uses, renaming it appropriately to one of the filenames it was trying to grab.

Bingo! After that loaded, I was able to login and updated the firmware to match the other switch, then went to bed.

I did have problems with it the next day, but after struggling with it a while, I was able to get into it. I saw it pull the file via TFTP again, after which it rebooted, so I renamed my config file so future attempts would fail. After that, I think all was good.

What I discovered that I don’t recall seeing anywhere, was related to management via a single switch IP. So, Lawrence System’s video mentioned you had to use SFP ports for this functionality. No problem. They are on eBay at reasonable prices (about $13 each). Unfortunately, once you change the port to a Stack port, it loses the ability to carry data traffic – It’s not seen as a switch port anymore.

Which means that if you have a single cable running between two areas where you want switches, and you want to use a single management IP, like I have, well… You can either run management across that link, or run data traffic across it. To do what I wanted, I would need two cables between the areas – one for management, and one for traffic.

I did try a workaround… I created a VLAN for”single IP management”… I plugged the Stack ports on each switch into an access port on this new VLAN, with the idea that it would trunk across the data connection that ran between the two switches… This didn’t seem to work, though. I didn’t play around with it very long, so perhaps this concept will work, but I was not successful.

At any rate, I’ve got a pair of Cisco switches now that I don’t expect to have trouble with for years. I can’t quite manage them as easily as I expected, but it is good enough for my use.

eero Wifi – Likely my final post about it

I’ve been using eero for my wifi needs for probably a few years now.  They were among the first of the Mesh Wifi systems that came out.  For me, it was down to the eero or the Luma wifi system.  Luma seemed to have more advanced features, but early reports on the functionality of it were not encouraging.  I may have even had a pre-order in place for it at one point.  One interesting thing was that Amazon was backing them (to some degree).

Anyhow, I got my eero system and was pretty happy with it.  It was a very simple system, in terms of daily operation.  It seemed to work well, with little input from me.  Perhaps a bit too well, as I recall one time (I think I posted about it here) where my network was segmented from my the eero that was connected to the Internet, and it was routing the traffic from the entire rest of my home across the Wifi to the eero that was connected to the Internet.  As I recall, I noticed there was only one cable hooked to the back of the eero that goes to the Internet, and I realized – Wait!  That’s not supposed to be that way.  But everything still worked.

That said, the eero does lack customization and some features.  One in particular is the ability to run a second SSID (other than the Guest SSID).  To make a long story short, I ended up with 4 eeros for my main Wifi network, and two for my secondary Wifi network. Ok, I really didn’t need 4 for my main network – Three did the job well, but I added a beacon that I didn’t absolutely need.

The eero does a very good job for a simple home.  It has visibility into what devices are on your network, but not much in the way of visibility into what those devices are doing.  The do offer a subscription service to block malware and a limited number of additional categories of sites, but you don’t get that full device-level log of activity directly from the eero.

I think part of the problem for me came when Amazon bought eero.  There was apprehension around what Amazon might do with the deep data that is potentially available to them, being the gateway out of my network to the Internet  I understand that the eero privacy policy did not change as a result of that purchase, so as long as that holds true, we shouldn’t have any privacy issues (at least, from the assurance of an eero developer that often posts on the eero sub-reddit).  It’s entirely possible that Amazon just bought them to have a simple-to-use, but very reliable brand they could sell to customers of their product line of tablets, streaming boxes, assistants, etc.

But, the simple fact is that the eero sees all of your port 53 DNS requests in clear text.  Looking at the MAC address of individual devices can reveal the maker of the device.  If you put that info together with the DNS names of where the individual devices are communicating, you can get a pretty good idea of what devices a customer has.

Now again, I say this is “part” of the problem.  I don’t have any reason to believe Amazon is doing this, or planning to do so any time soon.  This potential privacy issue, along with the lack of some features has recently led me to move away from the eero product line.

I will still say that it’s a great line of wifi devices for a non-technical person that just wants Wifi that works with minimal headaches.

My Tesla Ordering Experience

I’ve wanted a Tesla for years.  The Model S has been arguably the best looking EV since they started producing them.  I still can’t afford one, but I think I can afford a Model 3, now that the Standard Range ($35,000) version is finally out.

Since the Federal rebate on Telsa vehicles halved on Jan 1, and it is set to halve again soon, and they’ve recently released these new, lower cost versions, I realized that now may be about my best time to get one.  So, last Monday, I ordered a Standard range Model 3.  The expected delivery date was 6 – 8 weeks.

Since my order, I’ve learned that the SR and the SR Plus versions do not include floor mats.  Fortunately, they can be purchased on Tesla’s website for a bit over $100 after tax.  They also have a nice looking all weather frunk mat for about $70 before tax.

Another thing that did bother me about the interior of the SR was that it didn’t appear to include covers for the storage section (in front of the cup holders).  I looked for 3rd party products to fill that gap, but didn’t find any.  So, I looked on eBay, and found the center console section (perhaps taken from a wrecked Model 3?) for sale.  The entire section (including the armrest) was listed for a little under $1000 in at least one entry, and a separate listing for the front section was over $300.  If I were very handy (or maybe just more confident in my automotive abilities), that would have been a viable option.  Additionally, I like the look of the phone holder that doesn’t come with the SR.

The SR Plus also is a bit faster than the SR, though that doesn’t matter much to me.  The additional 20 miles of range is a bit more cushion for trips, which would be useful.

The power drivers seat on the SR Plus and the “vegan” leather seats would just be a bonus, as a manual cloth covered seat would have been fine as far as I’m concerned.

Ultimately, on the Friday after I ordered, I called and changed my order to a SR Plus.  I did make another change to my order, to drop the cost a bit, to make up for going to the SR Plus.

After the order was registered in their system, my estimated delivery was changed to 2 – 4 weeks.

Late on Friday evening, I took another look at my Model 3 page, and found that a VIN number had been assigned, as well as a delivery date…. Monday!

So, I ordered on a Monday, and after changing the order on a Friday, my car will be on Monday around noon.

Amazon Subscribe and Save – Why I quit…

This is really more feedback for Amazon than anything else.  I’m posting it here as I could not find any way of getting this feedback to Amazon without bothering a customer service person for a chat or a phone call.  And chances are probably just as good of my post being seen by someone who cares at Amazon here as if I went through a Chat or Phone call with a customer service person.  Perhaps greater even.

I’ve used Subscribe & Save for many years.  I used to really like the service, but I’ve just cancelled all of the orders I had.  Here’s my list of reasons:

1. Items I was subscribed to kept getting pulled out of the Subscribe & Save program.  Over the years, this has happened numerous times and it’s pretty annoying to have made a commitment to buy a product on a schedule, only to find they they aren’t going to live up to their end of the deal anymore.  Fewer items that I am interested in available for Subscribe & Save makes it hard to maximize any savings through the program, since you save a larger percentage by getting more items delivered in a month.

2. I don’t know exactly when it happened, but I think somewhere in the last 5 years, they changed the way you control when subscriptions get delivered.  I seem to remember it being easier to put off a delivery, setting it to deliver in a specific month, than it is now.

3. With a recent order coming up, I tried to skip the delivery, as I didn’t need any more tea just yet.  I thought I had successfully done it, but it showed up anyhow.  I still have two unopened boxes from the last order, and now I have another six.  We’ll use them eventually, but we’ve probably got enough tea for all of 2019 now.

4. Even with an item has not been pulled from the eligible items, you are not guaranteed to get the item.  I had a subscription in place for an item that I only needed about once every 6 months, as it was a bulk purchase.  I had been running low on this item, and finally ran out.  I wasn’t concerned though, as I had a subscription.  About a week before it should have shipped, I got an Out of Stock email, but “We’ll keep trying”.  Not long after it should have arrived, I got a “Delivery Delayed” email.  I get it, things happen, so you’ll ship it when it’s ready.  Five days later, I got a “Delivery Cancelled” email.  So, they just gave up?

This last point really bugs me.  Perhaps I’m being idealistic here, but it would seem that part of the advantage of the Subscribe & Save program is that Amazon has a pretty good idea of the amount of stock they need to have on-hand for everything customers are subscribing to.  Sure, people delay items, add more items, and remove some items, but there should be a baseline of predictability that a massive data oriented company like Amazon can take advantage of, to make sure they have the bulk of items people want in stock when they want them.  They are scheduled orders.  It shouldn’t be that hard.

Anyhow, I’ve decided that I’m done with Subscribe & Save.  I guess issue #4 was the last straw.

Adventures in Mac Data Recovery

A few days ago, I attempted to update my wife’s aging iMac (2009 era) to High Sierra.  I ended up at a screen telling me something about a disk error.  After that, it seemed to be in a boot cycle, where it simply returned to a similar screen with a slightly different message.

I found some CLI commands to make my own USB installer.  Ultimately, when I booted from it, I ended up with a message saying it could not install.  Thinking that perhaps the hard drive was going, I think I attached an external drive and tried to install to it, ending with the same failure.  At some point throughout this process I made the colossal mistake of formatting the internal hard drive.  We can get back to that later.

I knew I needed to get my wife a new machine, as this one is quite old and the next release of Mac OS X won’t support this hardware.  Fortunately, Best Buy had a sale on the higher end iMac with the smaller screen, which is just what I thought she needed.

Got it home, booted it up and connected to my NAS to restore her TimeMachine backup.

Uh oh.  It saw her backup there, but it said something about No Volumes.  I tried booting from the same USB stick to reinstall her new iMac, and ended up with the same sort of generic failure reasons I had been getting since after the original disk error on the first iMac.

Apparently, my installer was bad.

I moved her old iMac to my desk and was running a variety of tools to scan the hard drive, trying to recover whatever data I could.  The one that seemed to get the best results was Disk Drill, which seemed to have been able to recover the HFS directory structure and everything.  About $80 later, I could try restoring it.  Unfortunately, it was unclear if it was possible to simply have it restore the files to their original locations, so I tried having it restore to an external drive.  About 30 GB into the copy, it seemed to hang.  The iMac was still working, but no more data seemed to get moved.  I thought that perhaps I should try another method.

While researching my problem, I had previously found a link that talked about fixing Time Machine backups.  This involved running some CLI commands that seemed likely to potentially break things, so I took a few minutes to figure out how to backup my Time Machine sparsedisk bundle.  After looking around a bit, I found a page recommending SuperDuper for the task.  Using SuperDuper, I created a new sparsedisk bundle as the destination, and let it copy.  I think somewhere north of 19 hours later, it was done.

I followed the steps found on this blog entry on my copy of the data, leaving the original unaltered.

Everything went well for the repair portion, but the final steps involved editing a .plist file that should have been sitting in the root of the sparsedisk, but it was missing for some reason.

So, I tried running the repair steps on the original TimeMachine backup.  It failed.

In a last ditch effort to get TimeMachine working, I copied the com.* files from the original TM backup over to my SuperDuper copy.  I figured since the repair worked on it, perhaps I can just take the files that didn’t seem to get copied, and move them over as well, and finish the process.

I built a new Mac OS X installer (using this great little tool that I sorta wish I had found originally), reinstalled OS X on the new iMac, then tried the TM restore.  I pointed to the new TM backup I had made, and was happy to see that it saw it, and that it saw backup data there.  I started the restore process, which, probably around 3 hours later, completed successfully.

I rebooted, and it came up and worked.  I was able to login to my wife’s account and her data seemed to be in-tact.

I have since set up SuperDuper to clone her drive on a schedule to an external drive.  I’ll probably start the Time Machine backup process as well in a few days or so, once we feel secure that her files are fine, so she’ll have a few backups just in case.

Channels DVR

Many years ago, I used SageTV for my DVR.  After it was sold to Google, I tried MythTV with some success.  I’ve since used Plex briefly, and the HD Homerun DVR for several months.  Recently I tried SageTV again, the open source version.  It’s still very much like it was years ago, with the AndroidTV app working very well now.  Controlling the app with the ShieldTV remote could be better, though.  There’s also the lack of a IOS version, and I don’t think it plays well with other apps sharing HD Homerun tuners, though this may have been addressed.

Plex has a few issues.  No grid guide is a big one.  Another is you can’t watch a show while it’s recording.  Commercials are removed from recordings, not just marked.

While looking at a Plex forum, I read about Channels, an IOS app for watching TV with an HD Homerun tuner which has a DVR component.  I had seen this app before but didn’t try it due to the cost.  After reading more about the app, I found that it gets rids of all my complaints about Plex.  It also allows for remote connections, so you could even stream TV from it remotely, like Plex.

The cost is a bit steep, being $24.99 for the AppleTV app, another $14.99 for the iPhone/iPad app.  I think there are similar prices for AndroidTV, Amazon FireTV, and other versions.  The DVR feature is $8 per month after your first month…  So, it’s a bit expensive, but it’s very good (I think Android versions have various states of support for the DVR feature.).

Regardless of the price, I can say this is about the best DVR experience I’ve run across yet on AppleTV.  The user interface is very  intuitive.  It integrates well with the AppleTV, including support for adding shows to the top bar on the AppleTV home screen.

The DVR component runs on just about anything, even the ShieldTV.  It can use the hardware acceleration on the ShieldTV for transcoding, and if your processor supports Quick Sync, it is supported as well.

I’ve chosen to run mine under docker in UnRAID.  It works very well, even when transcoding.

It still early days of my trying it, but I’m pretty happy with it so far.