I have such a love hate relationship with Ubiquiti right now. When it works it works, when it doesn't it really breaks hard.
So I recently replaced my aging Edgerouter Lite 3 with a USG 4 Pro. I spent a ridiculous amount of time trying to adopt the USG into my existing environment. Apparently you can't simply adopt a USG like you might an AP and need to manually configure it onto the same subnet as your UniFi controller.
Once that struggle was over I started firing some firmware updates. APs, Switch, USG all updated without issue. Then I update the Cloudkey Gen 2 Plus... Big mistake.
I neglected to see the update was 1.x to 2.x and although this shouldn't have mattered I should have probably considered whether such a major update to what I now know to be Unity OS was wise.
The update bricked my Cloudkey by getting it stuck in a permanent 'Preparing to Setup' phase. I couldn't work around it at all which left me staring down a factory defaults black hole. Cue the dreaded SSH command and the erasure of all my G3 Pro camera footage I can finally move forward.
I manually applied the 2.x firmware via SSH wget and fwpdate. Turns out automatic backups for my Cloudkey didn't exist but fortunately I had just done manual backups of Network and Protect so could restore them.
Some many hours after what I thought would be a simple USG install my environment is up and running.
Turns out that my Protect is broken though. Unifi OS handles additional user access to Network / Protect differently. As the owner I can remotely access my controller via web and mobile app fine. No other users can though. It also turns out any newly created users can't either!
It seems its a fairly common issue on the UniFi Community forums and a range of 'so called' fixes have worked for some, but not me. One of the issues people face is typing a new user email in anything other than all lower case causes the invite / user addition to fail. How amateur is that! Another fix for the some is to disable and re-enable Remote Access, delete ALL users that are not the owner and any custom roles, reboot, then add new users.
I am now waiting for Tier 2 support to give some idea of what's broken in my case! I'm not hopeful.
As a final note - I don't appreciate having to inspect an element of the Radius Server config page and to run manual console commands to enable Site Wide Client config to get my L2TP VPN working. A setting which doesn't even show in the new settings and is only visible, but disabled to toggle, in classic view!