UniFi Network 11: what to check before you upgrade

UniFi Network 11 is the biggest change to the UniFi controller in a long while. It brings useful new features, but it also wipes your statistics history, drops some older hardware and moves every site to the Zone-Based Firewall. Here's what I'd check before pressing the upgrade button.

Where the release is up to

Network 11 spent the first half of October as a release candidate. Release notes for version 11.0.94 on 20 October were still labelled as a release candidate with a gradual rollout. Version 11.0.97 followed on 23 October with stability, security and certificate fixes, and it requires UniFi OS 6.0 or newer. If your console hasn't offered it yet, that's likely the gradual rollout, not a fault.

My advice is the same as for any major controller release: try it on a home lab or a quiet site first. One reviewer who tested the release candidate said exactly that, and recommended waiting for the official release before touching client or business networks.

What's actually new

Live traffic view. Insights gets a live tab that refreshes every 10 to 60 seconds, with filters by source, destination, MAC or IP. You can end a flow from there. One review notes this is only available on gateways without built-in Wi-Fi.
Wi-Fi as a WAN. A gateway can use another Wi-Fi network, such as a phone hotspot, as its internet connection, either as backup or as the main link. It only works on gateways with a built-in Wi-Fi radio: the UDR7, UDR5G Max, UniFi Express 7 and UCG Industrial. The UCG Max, UCG Ultra and UDM Pro can't do it.
Dynamic network lists. Firewall lists can pull from an external URL and refresh every 24, 48 or 72 hours. Very large lists may go over what the gateway can handle.
SD-WAN policies in Site Manager, with performance-based routing and custom failover for multi-site setups. These need Site Manager 5.10.2 or newer.
Matter awareness. UniFi can show Matter and Thread device details like battery, firmware and signal. It observes them only and doesn't replace a Matter controller.
Smaller wins: bulk client editing, client connect and disconnect alerts, more VLANs, subnet overlap detection in the system log and packet capture on individual radios.

The things that can catch you out

Your statistics history goes

The statistics engine has been rebuilt, and the application database has moved to PostgreSQL. All existing statistics history is cleared after the upgrade. If anyone relies on traffic history, for a monthly report or to settle an argument about bandwidth, export or screenshot what you need first.

Every site moves to the Zone-Based Firewall

All sites are migrated to the Zone-Based Firewall automatically. On a simple network that's painless. On a site with years of hand-built firewall rules, guest isolation and VLAN restrictions, I'd want a record of the old rules before the upgrade and a proper test afterwards. The 11.0.94 notes add a dashboard banner for sites that have been migrated, which is a useful reminder to go and check.

USG support has ended

Network 11 drops the UniFi Security Gateway. Network 10.6 is the last version that supports it. If a site still has a USG, either replace it before you upgrade the controller, or leave that controller on 10.6 for now. Ubiquiti released a 10.6 update on 23 October, so it's still getting fixes.

The standalone Network Server is now legacy

If you self-host the controller with the standalone Network Server, Network 11 isn't coming to the old standalone application. Ubiquiti now points self-hosted users to UniFi OS Server, which runs under Podman on Linux. Existing Network 10 installs keep working, but they won't get Network 11 or later releases. Moving across means taking a .unf backup, restoring it on UniFi OS Server, and, if the server's IP address changes, pointing each device at the new controller with set-inform over SSH.

My upgrade checklist

Take a fresh console backup and download it. If the upgrade goes wrong, this is your way back.
Write down or screenshot the current firewall rules, port forwards and any traffic rules.
Check for USGs and any self-hosted controllers. Plan those separately.
Update UniFi OS to version 6 first, as Network 11.0.97 requires it.
Upgrade outside working hours. One reviewer's console took close to 10 minutes.
Afterwards, test guest isolation, inter-VLAN access, VPNs and port forwards from a client device, not just the dashboard.

Network 11 is a good release, and the live traffic view alone will save time when someone says "the internet is slow". Just treat it as a proper change, not a routine update.

Sources

← All posts