Skip to content

Nuface Blog

隨意隨手記 Casual Notes

Menu
  • Home
  • About
  • Services
  • Blog
  • Contact
  • Privacy Policy
  • Login
Menu

UniFi Switch Auto-DHCP Issue: Root Cause and Stable Solution

Posted on 2025-11-052025-11-05 by Rico

Environment: USW-Lite-8-PoE (v7.2.123 / v8.x tested) | UniFi Network Controller 9.5.21


📌 1. Background

In an enterprise network, a switch should operate purely at Layer 2 and never assign IP addresses.
However, after upgrading UniFi Switch firmware to 8.x, the following issues appeared:

  1. The switch occasionally enables its built-in DHCP server after being adopted by the controller.
  2. This rogue DHCP server starts handing out IPs (usually 192.168.1.x/24), causing address conflicts and user disconnections.
  3. Once the controller detects the conflict or loses communication, the switch enters fallback mode, resets itself, and the loop repeats.

This behavior is particularly common on USW-Lite 8 PoE and USW-Flex Mini models running firmware 8.x.


🔍 2. Root-Cause Analysis

1️⃣ Version Differences

FeatureUniFi 7.xUniFi 8.x and later
Provisioning logicLegacy inform-basedNew UDAPI Provisioning
DHCP modeEnabled only in StandaloneMay start incorrectly if Provisioning fails
SSH accountubnt/ubnt (default)Overwritten by controller during Provision

When a v8.x switch times out or fails during provisioning, it wrongly assumes a stand-alone role and starts its DHCP daemon, disrupting the LAN.


2️⃣ SSH Behavior Change

  • Factory state (before adoption):
    Default login → ubnt / ubnt.
  • After adoption:
    SSH credentials are replaced by those defined in the controller.
  • After forget or provision failure:
    The switch is semi-managed, yet still locked out — controller credentials lost, ubnt disabled.

⚠️ That’s why you can log in with ubnt/ubnt immediately after a hardware reset,
but lose access as soon as the controller re-adopts the device.


🧰 3. Troubleshooting & Verification Steps

(1) Stop the Built-in DHCP Process

ssh <controller_ssh_username>@<switch_ip>
ps | grep udhcpd
killall udhcpd
pgrep udhcpd   # confirm none remain

If no udhcpd process exists, DHCP is already stopped.


(2) Confirm Controller DHCP Settings

In Settings → Networks, if each VLAN lists Third-party Gateway,
the controller itself is not running any DHCP service.
Thus, any active DHCP must originate from the switch.


(3) Verify No More DHCP Traffic

On your management host:

sudo tcpdump -n -i eth0 port 67 or port 68

If no DHCP replies appear within 20 seconds, the rogue DHCP is gone.


🧩 4. Stable Firmware and Operational Strategy

Firmware VersionStatusNotes
7.2.123✅ Stable – no DHCP issueRecommended production version
8.0 – 8.1❌ Contains DHCP fallback bugAvoid deployment
9.3 +⚠️ Partially fixedTest before mass upgrade

The 7.x firmware remains fully compatible with UniFi Network Controller versions 7.x through 9.x and operates reliably in production.


⚙️ 5. Recommended Configuration

1️⃣ Lock Firmware Version

  • Disable automatic updates:
    Settings → System → Updates → Disable automatic firmware updates
  • Or per-device:
    Devices → Switch → Config → Firmware → Lock Version 7.2.123

2️⃣ Maintain SSH Credential Control

Settings → System → Device SSH Authentication → Custom per device
Use a custom admin account (e.g., nufaceadmin) to prevent credential overwrites.

3️⃣ Enable Rogue DHCP Detection

Settings → Networks → Global Switch Settings → ☑ Rogue DHCP Server Detection
The controller will alert you if any new DHCP server appears on the LAN.

4️⃣ Regular Backups

Export or schedule automatic backups from
/opt/unifi/config/data/backup/autobackup.


🧭 6. Long-Term Guidelines

  1. Keep switches on 7.x until 9.x DHCP fixes are proven stable.
  2. Use version groups if multiple models exist (e.g., Lite = 7.x, Pro = 9.x).
  3. Test new firmware in a lab before enterprise-wide rollout.
  4. Employ upgrade white-lists or YAML policies to define which models auto-update.

✅ 7. Summary

ItemStatusComment
Root causeProvisioning bug in 8.x enabling DHCPConfirmed
Stable fixStay on 7.2.123 firmwareProven solution
Long-termUpgrade to ≥ 9.6 after validationPlanned
SSH behaviorCredentials managed by controllerNormal
Best practiceDisable auto-update + Enable Rogue DHCP DetectionSecure

💬 Author’s Note

In enterprise networks, stability always outweighs new features.
After extensive field testing, UniFi Switch firmware 7.2.123 delivers full VLAN, PoE, STP, and Rogue DHCP Detection capabilities without unexpected DHCP activation.
Locking firmware versions and controlling upgrade timing remain the most reliable operational approach.


Recent Posts

  • Postfix + Let’s Encrypt + BIND9 + DANE Fully Automated TLSA Update Guide
  • Postfix + Let’s Encrypt + BIND9 + DANE TLSA 指紋自動更新完整教學
  • Deploying DANE in Postfix
  • 如何在 Postfix 中部署 DANE
  • DANE: DNSSEC-Based TLS Protection

Recent Comments

  1. Building a Complete Enterprise-Grade Mail System (Overview) - Nuface Blog on High Availability Architecture, Failover, GeoDNS, Monitoring, and Email Abuse Automation (SOAR)
  2. Building a Complete Enterprise-Grade Mail System (Overview) - Nuface Blog on MariaDB + PostfixAdmin: The Core of Virtual Domain & Mailbox Management
  3. Building a Complete Enterprise-Grade Mail System (Overview) - Nuface Blog on Daily Operations, Monitoring, and Performance Tuning for an Enterprise Mail System
  4. Building a Complete Enterprise-Grade Mail System (Overview) - Nuface Blog on Final Chapter: Complete Troubleshooting Guide & Frequently Asked Questions (FAQ)
  5. Building a Complete Enterprise-Grade Mail System (Overview) - Nuface Blog on Network Architecture, DNS Configuration, TLS Design, and Postfix/Dovecot SNI Explained

Archives

  • December 2025
  • November 2025
  • October 2025

Categories

  • AI
  • Apache
  • Cybersecurity
  • Database
  • DNS
  • Docker
  • Fail2Ban
  • FileSystem
  • Firewall
  • Linux
  • LLM
  • Mail
  • N8N
  • OpenLdap
  • OPNsense
  • PHP
  • QoS
  • Samba
  • Switch
  • Virtualization
  • VPN
  • WordPress
© 2025 Nuface Blog | Powered by Superbs Personal Blog theme