Overview
Overview
The Ubiquiti UniFi Enterprise Fortress Gateway is a 1U rack-mount Cloud Gateway — combining enterprise-grade routing, a built-in UniFi Network controller, and comprehensive security in a single self-contained appliance. Unlike the UXG-Enterprise which requires a separate controller, the EFG runs the UniFi Network application natively, supporting 500+ managed UniFi devices and 5,000+ simultaneous clients without any additional server hardware or software licensing.
An 18-core ARM v8.2 processor at 2 GHz drives 12.5 Gbps IDS/IPS throughput, 1 million concurrent sessions, and 71,000 new sessions per second. Up to five WAN ports — including a 25G SFP28 primary WAN and a 2.5 GbE failover — support multi-WAN load balancing and LTE backup. Shadow Mode (VRRP) gateway failover and dual hot-swappable 150W PSUs provide the high availability required for mission-critical campus deployments. NDAA compliant, CE/FCC/IC/SRRC certified.
Key highlights
- Built-in UniFi Network controller — no separate server required
- 500+ managed UniFi devices, 5,000+ simultaneous clients
- 12.5 Gbps IDS/IPS throughput at full line rate
- 18-core ARM v8.2 processor at 2 GHz, no per-device licensing
- Up to 5 WAN ports with multi-WAN load balancing and failover
- 25G SFP28 primary WAN for high-bandwidth ISP connections
- Shadow Mode (VRRP) active-passive gateway failover
- Dual hot-swappable 150W PSUs for continuous uptime
- License-free SD-WAN, BGP, OSPF, and full VPN suite
- NDAA compliant, CE/FCC/IC/SRRC certified
Recommended for
- Large enterprise campuses — self-contained gateway and controller for networks with hundreds of APs and thousands of clients
- Multi-site organisations — license-free SD-WAN and Site Magic VPN with no recurring controller costs
- Security-focused deployments — 12.5 Gbps IPS, L7 firewall, SSL inspection, and VLAN-based traffic segmentation
- Government & regulated environments — NDAA compliant with RadSec, integrated RADIUS server, and zone-based firewall
Security
Security capabilities
The EFG provides enterprise-grade threat prevention and traffic inspection at 12.5 Gbps — enough to protect high-bandwidth campus networks without performance compromise. IDS/IPS signatures are updated automatically and can be expanded to 95,000+ with a CyberSecure Enterprise subscription.
Firewall & threat protection
- Stateful firewall
- Application-aware Layer 7 firewall
- SSL/TLS inspection & URL filtering
- DPI & traffic identification
- Zone-based firewall (regions, domains, apps)
- VLAN/subnet-based traffic segmentation
- Content filtering
- Intrusion prevention (IPS/IDS)
- Ad blocking
- 95,000+ IDS/IPS signatures (CyberSecure Enterprise)
Security performance
| IDS/IPS throughput | 12.5 Gbps |
| SSL/TLS inspection sessions | 10,000 concurrent |
| Concurrent sessions | 1,000,000 |
| New sessions per second | 71,000 |
VPN & SD-WAN
VPN & SD-WAN overview
The EFG includes a complete VPN suite and license-free SD-WAN with no recurring subscription required for core functionality. WireGuard, IPsec, OpenVPN, Teleport, and Site Magic are all available out of the box — with per-tunnel throughput figures below showing real-world performance on this hardware.
VPN & SD-WAN features
- License-free SD-WAN
- Site Magic (site-to-site VPN)
- IPsec
- OpenVPN server & client
- WireGuard server & client
- Teleport zero-configuration VPN
- Identity Endpoint one-click VPN
- L2TP VPN server
- Policy-based WAN & VPN routing
VPN throughput
| VPN type | Single tunnel throughput |
|---|---|
| WireGuard (server) | 1.2 Gbps |
| Teleport | 1.2 Gbps |
| Identity Endpoint VPN | 1.2 Gbps |
| L2TP (server) | 280 Mbps |
| OpenVPN (server) | 210 Mbps |
| Site Magic (site-to-site) | 1.1 Gbps |
| IPsec (site-to-site) | 580 Mbps |
| WireGuard (client) | 980 Mbps |
| OpenVPN (client) | 180 Mbps |
Networking
WAN & routing
- Multi-WAN load balancing
- Shadow Mode (VRRP) gateway failover
- LACP port aggregation
- Dynamic routing — OSPF
- Dynamic routing — BGP
- Advanced QoS
- Multicast DNS (mDNS)
- Advanced NAT (SNAT/DNAT/1-to-1)
- Policy-based WAN & VPN routing
- LTE backup (UniFi LTE)
- Internet quality & outage reporting
- IPv6 ISP support
- IGMP proxy
Access & segmentation
- Integrated RADIUS server
- RADIUS over TLS (RadSec)
- Customisable DHCP server
- VLAN/subnet-based traffic segmentation
Port layout
| 2.5 GbE RJ45 | 2 ports — 2.5G/1G/100M/10M |
| 10G SFP+ | 2 ports — 10G/1G |
| 25G SFP28 | 2 ports — 25G/10G/1G |
| Max WAN ports | 5 (default: 1 × 25G SFP28 + 1 × 2.5 GbE RJ45) |
Hardware
Physical
| Dimensions | 442.4 × 43.7 × 325 mm (17.4 × 1.7 × 12.8″) |
| Form factor | 1U rack mount |
| Weight | 6.5 kg (14.3 lb) |
| Enclosure | Aluminium CNC, SGCC steel |
| LCM display | 1.3″ touchscreen |
| Management | Ethernet, Bluetooth |
| LEDs | Ethernet, SFP+ |
| Button | Factory reset |
| ESD/EMP protection | Air: ±8kV, Contact: ±4kV |
Processor & memory
| Processor | 18-core ARM v8.2 at 2 GHz |
| UniFi devices supported | 500+ |
| Simultaneous clients | 5,000+ |
Power & redundancy
| Power supply | (2) Hot-swappable 150W CRPS modules |
| Power input | 100–240V AC, 50/60 Hz, 7A max |
| Max power consumption | 82W |
| Heat dissipation | 280 BTU/hr |
| Gateway failover | Shadow Mode (VRRP) |
Environmental & compliance
| Operating temperature | 0 to 40°C (32 to 104°F) |
| Operating humidity | 5–95% non-condensing |
| NDAA compliant | Yes |
| Certifications | CE, FCC, IC, Anatel: 06375-24-08356, SRRC |
In the box
UniFi Enterprise Fortress Gateway with rack mount brackets and two hot-swappable 150W CRPS PSU modules. SFP28 and SFP+ transceivers are sold separately.
Software
Built-in UniFi Network controller
Unlike gateway-only products that require a separate UniFi controller, the EFG runs the UniFi Network application natively — acting as both the gateway and the controller for your entire UniFi deployment. This means no additional server hardware, no virtual machine, and no separate licensing. Simply connect the EFG, configure it via the mobile app or Ethernet, and it manages all connected UniFi switches, access points, and cameras from a single appliance.
Core management capabilities
- Built-in controller — manages 500+ UniFi devices and 5,000+ clients natively without a separate server or cloud subscription.
- Firewall & security management — configure zone-based firewall rules, IPS/IDS policies, content filtering, and SSL inspection from the UniFi dashboard.
- VPN configuration — set up WireGuard, IPsec, OpenVPN, and Teleport VPN tunnels with no additional licensing.
- SD-WAN & WAN management — multi-WAN load balancing, failover rules, and policy-based routing for up to 5 WAN connections.
- Network segmentation — create VLANs, inter-VLAN routing policies, and VLAN/subnet-based traffic isolation rules.
- Remote monitoring — real-time internet quality monitoring, session tracking, and outage reporting via the mobile app or web interface from anywhere.
- Firmware updates — push updates to the gateway and all managed UniFi devices remotely.
Application requirements
| UniFi iOS app | Version 10.16.2 or later |
| UniFi Android app | Version 10.17.2 or later |
| Controller | Built-in — no separate controller required |
| Licensing | None — free with no per-device fees |
Documentation
Downloads & resources
Download the Ubiquiti UniFi Enterprise Fortress Gateway installation guide covering rack mounting, port configuration, WAN setup, and first-time setup via the UniFi mobile app.