Can not toggle UniFi Network switch entities: BlockUnifiDeviceForbidden

[Mariusthvdb]

The problem

as title, when trying to toggle any of the network switches on wifi Unifi cameras, this error is returned

What version of Home Assistant Core has the issue?

2022.10.4

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

UniFi Network

Link to integration documentation on our website

https://www.home-assistant.io/integrations/unifi/

Diagnostics information

please let me know if this is required, because the diagnostics seem to contain a lot of private info...

Example YAML snippet

No response

Anything in the logs that might be useful for us?

2022-10-19 11:28:19.198 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [140430232107808] api.err.BlockUnifiDeviceForbidden
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 202, in handle_call_service
    await hass.services.async_call(
  File "/usr/src/homeassistant/homeassistant/core.py", line 1738, in async_call
    task.result()
  File "/usr/src/homeassistant/homeassistant/core.py", line 1775, in _execute_service
    await cast(Callable[[ServiceCall], Awaitable[None]], handler.job.target)(
  File "/usr/src/homeassistant/homeassistant/helpers/entity_component.py", line 207, in handle_service
    await service.entity_service_call(
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 678, in entity_service_call
    future.result()  # pop exception if have
  File "/usr/src/homeassistant/homeassistant/helpers/entity.py", line 931, in async_request_call
    await coro
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 715, in _handle_entity_call
    await result
  File "/usr/src/homeassistant/homeassistant/components/unifi/switch.py", line 355, in async_turn_off
    await self.controller.api.request(
  File "/usr/local/lib/python3.10/site-packages/aiounifi/controller.py", line 211, in request
    response: list[dict[str, Any]] = await self._request(
  File "/usr/local/lib/python3.10/site-packages/aiounifi/controller.py", line 268, in _request
    _raise_on_error(response)
  File "/usr/local/lib/python3.10/site-packages/aiounifi/controller.py", line 286, in _raise_on_error
    raise_error(data["meta"]["msg"])
  File "/usr/local/lib/python3.10/site-packages/aiounifi/errors.py", line 61, in raise_error
    raise cls(error)
aiounifi.errors.AiounifiException: api.err.BlockUnifiDeviceForbidden
2022-10-19 11:28:33.707 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [140430232107808] api.err.BlockUnifiDeviceForbidden
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 202, in handle_call_service
    await hass.services.async_call(
  File "/usr/src/homeassistant/homeassistant/core.py", line 1738, in async_call
    task.result()
  File "/usr/src/homeassistant/homeassistant/core.py", line 1775, in _execute_service
    await cast(Callable[[ServiceCall], Awaitable[None]], handler.job.target)(
  File "/usr/src/homeassistant/homeassistant/helpers/entity_component.py", line 207, in handle_service
    await service.entity_service_call(
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 678, in entity_service_call
    future.result()  # pop exception if have
  File "/usr/src/homeassistant/homeassistant/helpers/entity.py", line 931, in async_request_call
    await coro
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 715, in _handle_entity_call
    await result
  File "/usr/src/homeassistant/homeassistant/components/unifi/switch.py", line 355, in async_turn_off
    await self.controller.api.request(
  File "/usr/local/lib/python3.10/site-packages/aiounifi/controller.py", line 211, in request
    response: list[dict[str, Any]] = await self._request(
  File "/usr/local/lib/python3.10/site-packages/aiounifi/controller.py", line 268, in _request
    _raise_on_error(response)
  File "/usr/local/lib/python3.10/site-packages/aiounifi/controller.py", line 286, in _raise_on_error
    raise_error(data["meta"]["msg"])
  File "/usr/local/lib/python3.10/site-packages/aiounifi/errors.py", line 61, in raise_error
    raise cls(error)
aiounifi.errors.AiounifiException: api.err.BlockUnifiDeviceForbidden

Additional information

[home-assistant[bot]]

Hey there @briis, @angellusmortis, @bdraco, mind taking a look at this issue as it has been labeled with an integration (unifiprotect) you are listed as a code owner for? Thanks! _{^{(message by CodeOwnersMention)}}

---

unifiprotect documentation unifiprotect source _{^{(message by IssueLinks)}}

[AngellusMortis]

As with the PoE switches, it related to Protect at all. The entities are coming from the UniFi integration.

[Mariusthvdb]

ok, I changed the title and the related integration. Issue remains the same..

could you please change the label, I can not do that.

(The entities all show up in the Protect Integration entity listing. Since there is no way of telling which integration generates which entity in those panels, its all bit confusing)

[home-assistant[bot]]

Hey there @kane610, mind taking a look at this issue as it has been labeled with an integration (unifi) you are listed as a code owner for? Thanks! _{^{(message by CodeOwnersMention)}}

---

unifi documentation unifi source _{^{(message by IssueLinks)}}

[AngellusMortis]

The entities all show up in the Protect Integration entity listing.

Make a bug ticket then. The related for the entity definetely does show both integrations, which it should not. Both integration add the same device, but they each have their own entities.

Also, you can tell the difference from Entities page if you filter on the config entry. The entity will only show up under the correct config entry filter.

Or from your stacktrace:

  File "/usr/src/homeassistant/homeassistant/components/**unifi**/switch.py", line 355, in async_turn_off

Mislabeling issues causes delays to your issue getting addressed as it notifies the wrong people.

[Kane610]

Is it possible to block those cameras from the unifi network app?

[Mariusthvdb]

Don't think so, there is no settings page for these, just a 'show in protect' link that takes one to the Protect app.

Unless I am missing the obvious ofc

Btw, this goes for both Poe and WiFi cameras.

Also, mysteriously, these network switches show even when the POE is switched off...

[Kane610]

Don't think so, there is no settings page for these, just a 'show in protect' link that takes one to the Protect app.

Unless I am missing the obvious ofc

Btw, this goes for both Poe and WiFi cameras.

Also, mysteriously, these network switches show even when the POE is switched off...

I'm trying to refactor the unifi library and integration to remove some magic and logical leaps :)

Then Ubi doesn't want their cameras controlled in the network app. I would need some solid data on how to identify these devices so as not to create block entities for those.

[Mariusthvdb]

I would hope to keep being able to power down the cams though.... I only want them online in alarmed mode ;-)

[Kane610]

Youre talking about two different things now. This issue is about network access control right?

The new PoE control implementation has been merged to dev, you can try it out now, the new PoE switch entities are disabled by default.

[Kane610]

Don't think so, there is no settings page for these, just a 'show in protect' link that takes one to the Protect app.

Unless I am missing the obvious ofc

Btw, this goes for both Poe and WiFi cameras.

Also, mysteriously, these network switches show even when the POE is switched off...

This is expected, there can only be one "primary" integration linked to the device, as these cameras are clients in UniFi network (I assume) the integration will only add "secondary" information that can be overridden by the primary integration.

[Mariusthvdb]

but arent both the Network switch And the Poe switch created by the Unifi network integration?

seems odd that when a cam is switched off from power, it would still be connected to the network

maybe it has to do with the device models, see this:

to the left the Network app, and note they all are online except for 'Oprit' the G4 Bullet. To the right the Protect app showing disconnected for 4 of the POE cams, the G4 Bullet and all 3 G3 flex cams.

HA showing:

[Mariusthvdb]

@AngellusMortis

The entities all show up in the Protect Integration entity listing.

Make a bug ticket then. The related for the entity definetely does show both integrations, which it should not.

you also said in https://github.com/home-assistant/core/issues/75977#issuecomment-1221315485

The only thing Protect provides is a restart functionality (exposed as a button, disabled by default).

given the fact that inside the Protect integration (note the number of entities....):

we see:

Which is exactly what we are seeing in the Ubiquiti Network integration, that should be reported as a bug? If yes, would that be a Frontend bug?

[AngellusMortis]

given the fact that inside the Protect integration (note the number of entities....):

Taken completely out of context. That was in reference to controlling the powered-on status of the device. Obviously the Protect integration adds other entities (like cameras).

You literally went right back to the devices page and show that Network and Protect add the same device with each with their own entities. I said if you go to the filtered entities page for an integration it will show you which is which.

The bug is that if you open the details modal on a Protect or Network entity and then you click on "Related", it shows both integrations because the device is added by both integrations. It probably should only show the integration that added the entity.

https://user-images.githubusercontent.com/490848/196967552-9c114f51-2cae-43af-906f-625872999113.mp4

[Kane610]

seems odd that when a cam is switched off from power, it would still be connected to the network

Possibly a bug.

The bug is that if you open the details modal on a Protect or Network entity and then you click on "Related", it shows both integrations because the device is added by both integrations. It probably should only show the integration that added the entity.

No this is how it is expected to work.

Anyhow too many parallell discussions going on here, please keep to one topic, you can decide which one @Mariusthvdb but keep to one...

[Mariusthvdb]

hi, before closing an issue, please let me ask what we see now (in beta with the new poe port switches). on my 48 port switch, I see switches for all POE 32 ports on the device (being unavailable still) and the existing (renamed ones) are still active.

Will I have to delete those and use the new switches? how come they both exist, for the same port.? (never mind the 'network' switches, I am referring to the poe switches here)

update

I enabled these ports, and this is what's happening now, we have 2 switches for the single port:

and for the cams:

there is a different response though. when toggling the new port switches change state quicker than my existing port switches.

[Kane610]

I left the old implementation intact to not break current systems. The will be removed later on.

You can disable poe control in unifi options and the old implementation will disappear.

All new poe ports are disabled by default so you can decide which ones you want to use.

The state changes quicker now because it reacts on the port state rather than the client state now

[Mariusthvdb]

cool!

so, if I disable POE control in the options, that will only take out my existing (named) switches, not the new POE switches?

[Kane610]

cool!

so, if I disable POE control in the options, that will only take out my existing (named) switches, not the new POE switches?

Yes

[Mariusthvdb]

Robert, suppose I can close this. thanks to your continued efforts, the error hasn't come back after updating to 2022.11 (might have been earlier, not 100% sure).

Thanks!

[Kane610]

Great! Thanks for the feedback