



UniFi Cloud Gateway | 1U Rack Mount
Ubiquiti UniFi Enterprise Firewall (EFG)
A 25G Cloud Gateway in a 1U rack-mount chassis that runs UniFi Network for 500+ UniFi devices and 5,000+ clients. Ubiquiti rates IDS/IPS throughput at 12.5 Gbps and lists 10 million concurrent sessions, SSL inspection and URL filtering. Two 25G SFP28, two 10G SFP+ and two 2.5 GbE RJ45 ports, up to 5 WAN ports, and high availability through Shadow Mode (VRRP) gateway failover and two hot-swappable power supplies.
Quick Glance
Key Features
12.5 Gbps IDS/IPS with SSL inspection
Ubiquiti rates IDS/IPS throughput at 12.5 Gbps, with 95,000+ IDS/IPS signatures with CyberSecure Enterprise. It adds SSL inspection and URL filtering (10,000 concurrent SSL/TLS inspection sessions), a stateful and application-aware Layer 7 firewall, DPI, zone-based filtering by region, domain and app, content filtering and ad blocking.
25G ports, multi-WAN and high availability
Two 25G SFP28, two 10G SFP+ and two 2.5 GbE RJ45 ports, with one 25G SFP28 and one 2.5 GbE RJ45 as the default WAN ports and up to 5 WAN ports in total. Shadow Mode (VRRP) gateway failover, LACP port aggregation, multi-WAN load balancing and two hot-swappable 150W CRPS power supplies.
Site-to-site VPN, SD-WAN and session capacity
License-free SD-WAN, Site Magic, IPsec and OpenVPN site-to-site links, and WireGuard, OpenVPN, L2TP, Teleport and Identity Endpoint VPN servers, with up to 1.2 Gbps single-user VPN throughput. Ubiquiti lists 10 million concurrent sessions, 71,000 new sessions per second and OSPF and BGP dynamic routing.
Detailed Specifications
Specifications are from Ubiquiti's official technical specifications for the UniFi Enterprise Firewall (EFG). Device, client, session and throughput figures are Ubiquiti's figures; real performance depends on the traffic and features in use.
Need-to-Know
- Shadow Mode high availability with automatic failover (VRRP) requires UniFi OS 4.0 and later, and the EFG must be paired with another EFG. A single unit does not fail over on its own.
- Ubiquiti quotes 5,000+ simultaneous users and notes that performance may be degraded with advanced gateway features such as Traffic Identification.
- The 95,000+ IDS/IPS signature figure is Ubiquiti's figure with CyberSecure Enterprise. Additional internet failover uses a separate UniFi LTE Backup device.
- Ubiquiti's specification lists no built-in wireless radio and no PoE output for this gateway. SFP28 and SFP+ modules or cables are not listed as included.
- Power is universal AC input, 100–240V AC, through two hot-swappable 150W CRPS power supplies. Ubiquiti does not state the mains plug or power cord type.
- The UniFi mobile app needs UniFi iOS 10.16.2 or later, or UniFi Android 10.17.2 or later.
Best For / Customer Benefits
Customer Benefits
- One 1U unit combines the firewall, IDS/IPS, VPN server, SD-WAN and UniFi Network controller.
- No licence needed for SD-WAN, site-to-site VPN or the VPN servers Ubiquiti lists.
- Two hot-swappable power supplies and Shadow Mode (VRRP) failover keep the gateway available.
- Status and setup on the 1.3" touchscreen, with management over Ethernet or Bluetooth.
Best For
Frequently Asked Questions
Ubiquiti rates the EFG for 500+ managed UniFi devices and 5,000+ simultaneously connected users, and notes that performance may be degraded with advanced gateway features such as Traffic Identification. It lists 10 million concurrent sessions and 71,000 new sessions per second.
Ubiquiti lists IDS/IPS throughput of 12.5 Gbps. The default WAN ports are one 25G SFP28 and one 2.5 GbE RJ45, and the maximum WAN port count is 5.
Yes, through Shadow Mode (VRRP) high availability. Ubiquiti states that Shadow Mode with automatic failover requires UniFi OS 4.0 and later and that the EFG must be paired with another EFG. The unit also has two hot-swappable 150W CRPS power supplies.
Site-to-site VPN with Site Magic, IPsec and OpenVPN; VPN servers for Identity Endpoint one-click VPN, Teleport, WireGuard, OpenVPN and L2TP; and OpenVPN and WireGuard VPN clients. Ubiquiti lists 1.2 Gbps single-user throughput for WireGuard, Teleport and Identity Endpoint, and 1.1 Gbps for a single Site Magic tunnel.
No wireless radio appears in Ubiquiti's specification for the EFG. It is a wired rack-mount gateway; add UniFi access points for wireless and manage them from the same UniFi Network application.
Sizing a gateway for a large UniFi site?
Tell us your device count, users, internet lines and uplink speeds and we will confirm whether the Enterprise Firewall fits, or suggest the right UniFi gateway.

