Ubiquiti USG-XG-8 Access Point Firmware 4.4.34

Significant fixes in load-balance functionality (multi-WAN):

- Fix circumstances where route metrics were not being properly updated, primarily experienced upon fail back.
- Fix problem that could cause one or both WANs to be marked down and get stuck in that state.
- Fix crash in ubnt-util when a WAN is down for an extended period. Wasn't causing any noticeable problems since it recovers on its own.

IDS/IPS fixes/improvements:

- utmdaemon high CPU usage fixed (cause of "heartbeat missed" a few reported). Note that cannot prevent "heartbeat missed" in all possible circumstances. Where under extreme load for extended periods, it's inevitable for userland to be starved of resources enough to miss informs.
- Added a couple missing signatures to those bundled in firmware so all are immediately available post-upgrade. Some noted spamhaus.rules was only available after signature update.
- Suricata version string corrected to reflect specific version.
- Patch for CVE-2018-18956 denial of service vulnerability in Suricata.
- Reduce frequency of lookups to ips1.unifi-ai.com for cloud connectivity.
- Adjust configuration for USG3 and USG Pro to decrease CPU and memory usage.

Other Changes:

- If no interface with "description WAN" is found (config.gateway.json overwriting the controller-generated config), assume the default interface assignment for that hardware platform, so config_network_wan is included in the inform. That prevents INFORM_ERROR status on controller versions prior to 5.9.28. In 5.9.28 and newer controllers, there is also a change controller-side to not end up in this condition regardless of whether this firmware-side change is available.
- Speed test updates to not get stuck on a non-responsive server.

USG-XG-8 specific:

- With UF-RJ45-1G SFPs, pass through the copper link state to the SFP+ port. Previously they always showed link up in the OS when plugged in regardless of copper link status (was SFP module to SFP slot link), which is problematic if using one for a dynamic IP WAN in some cases, as linkup actions are important.

Upgrade WARNING:

- If using a VLAN tag on WAN, and on a controller version including port remapping (5.8.7 and newer), you should not upgrade to this version until upgrading to controller 5.8.12, 5.9.3, or newer. For that circumstance, USG must be provisioned by the newer controller version (which will happen automatically post-controller upgrade) before upgrading to any firmware version including port remapping support. 
- If you have GeoIP enabled and are not yet on firmware 4.4.18 or newer, disable it first, then upgrade USG, then enable it again. The configuration has changed in a way that limited unstable controller and previous firmware version combinations could result in an invalid configuration on the new firmware versions. In that circumstance, if the upgrade is performed with GeoIP enabled, the system will have to be reset to factory defaults post-upgrade.

Downgrade WARNING: 

- If you upgrade to any version supporting DPI without offload, disable offload (or enable IDS/IPS) and enable DPI, you cannot downgrade to a version that does not support DPI without offload. Either disable DPI, or enable hardware offload (or disable IDS/IPS), before downgrading. Otherwise you'll have to reset to factory defaults post-downgrade and adopt again.   

About Access Point Firmware:

If you update the Access Point (AP) firmware, your device can benefit from changes that fix multiple issues encountered by wireless clients, correct different user interface problems, add various functionalities, and include support for newly developed protocols.

Before performing this task, we recommend that you read and understand all the installation steps, because there are many AP models and manufacturers available. Each producer strives to make the procedure as simple as possible, but there are cases when it's anything but that.

It is also advisable that you apply a new access point firmware in a steady power environment (UPS unit will satisfy this need), using an Ethernet cable rather than a wireless connection. The latter can be easily interrupted.

With this in mind, if you wish to apply this version, click the download button and install the package on your access point. Remember to check back with our website as often as possible so that you don't miss a single new release.