Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)

Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)

112 Reply
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
a week ago

Hi  @mbentley 

 

Thank you for sharing.

We had located the root cause and have fixed it in the subsequent release. Please stay tuned.

 

mbentley wrote

  @Vincent-TP 

 

I found out what is going on with random people seeing SSL cert errors.  Here is a summary that hopefully someone from the development team can help address as while it can be worked around, it could be a problem for random people:

 

The Problem

Three JARs contain tpKeyStore:

  • cloudsdk-1.2.3.jar (934 bytes) - NEW certificate (Feb 2025)
  • device-gateway-core-6.0.0.23.jar (846 bytes) - OLD certificate (2018)
  • omada-datatrack-6.0.0.23.jar (846 bytes) - OLD certificate (2018)

 

Non-deterministic JAR loading order: When using -cp /opt/tplink/EAPController/lib/*, the JVM loads JARs in filesystem order, which varies by:

  • Docker filesystem driver (overlay2, aufs, etc.)
  • Kernel version
  • Filesystem type
  • Whether files were extracted, copied, or created fresh

 

Wrong keystore loaded randomly: ClassLoader.getSystemResourceAsStream("tpKeyStore") returns the FIRST tpKeyStore it finds in the classpath:

  • If cloudsdk-1.2.3.jar loads first → Gets NEW cert (Feb 2025) → WORKS!
  • If device-gateway-core-6.0.0.23.jar or omada-datatrack-6.0.0.23.jar loads first → Gets OLD cert (2018) → FAILS!

 

TP-Link rotated their CA in February 2025: Their cloud servers now present certificates signed by the NEW CA, but some users get the OLD CA from the wrong JAR!

 

Why It's Machine-Specific

  • Same Docker image, but filesystem ordering varies
  • Persistent data doesn't matter (it's not stored there)
  • Copying to a new machine might change the JAR loading order

 

The Fix

TP-Link needs to:

  • Remove duplicate tpKeyStore files from device-gateway-core and omada-datatrack JARs
  • OR update all three keystores to contain the same certificate
  • OR change code to use CustomSSLContext.class.getResourceAsStream("/tpKeyStore") instead of ClassLoader.getSystemResourceAsStream()

 

User Workaround

Users can force the correct JAR order by modifying the startup command:

java -server -Xms128m -Xmx1024m ... \
  -cp /opt/tplink/EAPController/lib/cloudsdk-1.2.3.jar:/opt/tplink/EAPController/lib/*:/opt/tplink/EAPController/properties: \
  com.tplink.smb.omada.starter.OmadaLinuxMain
 
 

 

  0  
  0  
#104
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
a week ago

  @mackworth Yes. It is.

  0  
  0  
#105
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
a week ago

  @Vincent-TP 

 

Failing when configuring a 4-Port Active or Passive LAG on POE Switch TL-SG3428MP.

Tried with regular ethernet ports. Also tried SFP ethernet modules. Tried forgetting/resetting/re-adopting switch. No luck no matter what.


No issues setting up LAG on SG3428 however.

 

 

Succeeded

CONNECTED

SG3428 v2.30

2.30.9

 

Failed

CONNECTED

TL-SG3428MP v1.0

1.1.13

 

 

 

Device Name

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Device Management Hostname/IP

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Daylight Saving Time

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

IP Group (1)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

IPv6 Group (1)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Jumbo

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

LED

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Loopback Detection

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Management VLAN

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

LAN Networks (5)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Port/LAG Name

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

SNMP

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

SSH

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Spanning Tree

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

IP Settings

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Time Zone

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

Device Account

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

VLAN Interface (1)

Apply

Oct 17, 2025 08:50:44 am

Device failed to apply configurations. (ErrorCode: switch_100)

 

 

 

 

 

 

  0  
  0  
#106
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
a week ago - last edited a week ago

  @iansj7 

 

Interesting, i havent seen this at all on my SG3428X either Static or LACP LAGs, in fact it has 2 of them configured and have been running without issue.

 

What happens if you click "Apply Again" in the config failures ?

 

I get lots of Gateway config failures, generally hitting Apply Again sorts them out, sometimes i have to force provision the device.  Havent seen any failures on any of my switches at all though

  0  
  0  
#107
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
a week ago

  @GRL 

 

Unfortunately tried that multiple times. I've actually been troubleshooting this on my own for 1+ week now. Tried literally everything. Commands in Omada LXC console on Proxmox. ChatGPT/Gemini. SSH into switch (although limited when adopted). No matter what I do results in "Failed" until I delete the LAG config. Tried 1 port, 2 ports, 4 ports. SFP, non-SFP. Tried Auto Speed, 1000mbps speed, Full Duplex. Tried reducing settings in Site settings, Port Profile settings, switch settings. Enable POE, disable POE. Settings in Auto, Spanning Tree enabled/disabled. Tried Trunk, Admin, other VLANS. Tried force provisioning, re-apply settings. Tried bare minimum settings. Nothing I do seems to do the trick unfortunately. With my other regular switch no issues though - although some settings will throw an "incompatible" result but after doing some settings tweaks and a force provision, the regular switch is back to "succeeded". I even tried ways to get the regular switch to say "Failed" with no luck haha. Something buggy is hapenning with just the POE switch :(

  0  
  0  
#108
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Saturday - last edited Sunday

  @Vincent-TP 

 

Hi - I tried switching that off and the nag is still there along with these damn warning triangles.

 

It would be appreciated if this can be switched off as it appears when the page is refreshed.

 

As an aside, the three flagged devices appear to work flawlessly - not seen any issues even though they are "no longer supported".

 

Thanks

 

  0  
  0  
#109
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Monday

Hi  @iansj7 

 

Thanks for the feedback. Is this only happens after update the controller to the V6? If you don't mind, please install a V5 stable software cotroller and adopt the POE switch with the controller and see if the same situation persist. 

iansj7 wrote

  @GRL 

 

Tried 1 port, 2 ports, 4 ports. SFP, non-SFP. Tried Auto Speed, 1000mbps speed, Full Duplex. Tried reducing settings in Site settings, Port Profile settings, switch settings. Enable POE, disable POE. Settings in Auto, Spanning Tree enabled/disabled. Tried Trunk, Admin, other VLANS. Tried force provisioning, re-apply settings. Tried bare minimum settings. Nothing I do seems to do the trick unfortunately.

>>>>To verify, Will these configurations take effect? Only the LAG doesn't take effect, right?

 

  0  
  0  
#110
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Monday

  @Vincent-TP am I missing it or is the Deep Packet Inspection per device gone with the new Omada controller? 

Home: 1x ER8411, 1x SG3428X-M2, 2x ES205GP, 1x EAP772 EU, 2x EAP653 EU, 1x 650 Desktop EU Test setup: 1x ER7412-M2
  0  
  0  
#111
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Tuesday

  @Julian2111 

Are you saying OC220?

 

For hardware controllers, only OC400 support this feature.

 

Julian2111 wrote

  @Vincent-TP am I missing it or is the Deep Packet Inspection per device gone with the new Omada controller? 

 

  0  
  0  
#112
Options
Re:Omada SDN Controller_V6.0.0.x Pre-Release Firmware (Update on 28th Sep, 2025)
Wednesday

  @Vincent-TP Hold on now, I have about 20 OC300s in the field doing DPI. Are you talking about just in 6.0? And if that's the case why would they remove it from the OC300 if you have a compatible gateway? The gateway does the scanning and sends the info to the controller for display. Hence why you can see the CPU and memory loads in the gateway and switches and not the controller. The controller doesnt really need monitoring. 

  0  
  0  
#113
Options