UniFi Buyer's Guide 2026: What to Buy for a Business Network

UniFi is Ubiquiti's line of business networking hardware: gateways, PoE switches, WiFi access points and security cameras managed from one console. This guide helps you decide what to buy for an office of roughly 1 to 50 people. It gives two worked builds with US prices, and it explains the four checks that most often change an order: the internet connection, the cable path, the PoE budget and the camera limits of the gateway.

In this guide: four checks before you order, small office build, growing business build, build order, gateways, switches, access points, and cameras.

Best for Small Office

Top Pick

Cloud Gateway Fiber

Desktop gateway with a 10G SFP+ link to your switch, 5 Gbps published IDS/IPS rating, and optional NVMe storage for Protect. Add separate access points for WiFi.

• Dual 10G SFP+ Ports
• 5 Gbps IDS/IPS Rating
• Optional NVMe Storage
• No Built-in WiFi

$279 | UI Store

*Price at time of publishing

Check Four Constraints Before You Order

Most ordering problems trace back to one of four checks. Each takes a few minutes to do before you buy.

Recommended camera capacity by console (Ubiquiti Help Center, "UniFi Protect - Supported Camera Limits", updated October 15, 2026). These are recommended limits, not hard limits:

The G6 Bullet, Turret and Dome are 4K cameras, so count them in the 4K column. The builds below follow these limits.

Small Office UniFi Build (1-10 People)

A starting configuration for a 1-10 person office or a larger home. The network total is $1,056 at US list price. The prices below cover the network only; camera, UPS, cabling and labor are covered in the quote checklist. A real 7-person installation with different choices (Dream Machine Pro Max, two U7 Pro XG access points, cameras and door access) is documented in our UniFi small office case study.

Complete Equipment List

What You Get

Gateway: The Cloud Gateway Fiber has two 10G SFP+ ports, allowing a 10G link to the switch, and a published 5 Gbps IDS/IPS rating. The two separate access points provide WiFi. Recording requires an added NVMe SSD.

WiFi 7 with 6 GHz: Two U7 Pro access points are a starting estimate for 2,500-3,000 sq ft. Confirm placement with a walk test.

Multi-gigabit PoE switching: The Pro Max 16 PoE's four 2.5 GbE PoE++ ports give both U7 Pro access points a full-speed uplink. Two access points (42W) plus one camera (9.9W) draw about 52W at manufacturer maximums from the 180W budget.

When the cheaper build is enough

Cloud Gateway Ultra ($129) + Lite 8 PoE ($109) + 2× U7 Lite ($99 each) is $436 at list price. It is enough when the internet connection is 1 Gbps or less (the Cloud Gateway Ultra is rated for 1 Gbps IDS/IPS), nobody plans to add cameras, no device needs more than gigabit, and headcount is stable. Check the access points' maximum power against the Lite 8 PoE's 52W budget before ordering.

Choose the build above instead if you expect cameras, a connection above 1 Gbps, or 6 GHz and 2.5 GbE access point uplinks. Those are the capabilities the extra $620 buys.

If you want these same access points and switch but do not need a 10G switch link, the $199 Cloud Gateway Max saves $80 at list price. It has 2.5 GbE LAN ports and a published 2.3 Gbps IDS/IPS rating; recording also requires storage.

Key Components

Small Office Setup

Gateway

Cloud Gateway Fiber

$279

Desktop gateway with a 10G link to the switch; add an NVMe SSD for recording.

2× 10G SFP+

5 Gbps IDS/IPS

NVMe Storage Option

UI Store

Switch

Pro Max 16 PoE

$399

16-port switch with 2.5G PoE++, 180W budget, and Etherlighting.

4× 2.5G PoE++

180W PoE Budget

10G SFP+ Uplinks

UI Store

Access Point

U7 Pro

MSRP $189

Tri-band WiFi 7 with 6 GHz support, rated for 300+ devices.

6 GHz Band

2.5 GbE Uplink

1,500 sq ft

Check price on Amazon

Not in these totals

A 10G direct attach cable, mounting hardware, an SSD or drives if the gateway will record, a UPS, patch cables, cabling labor, tax and shipping. Step 6 of the build order below lists what to include in a complete quote.

Choose this build if

• You have a small office (1-10 people) or a larger home
• You need 2,000-3,000 sq ft of coverage and 2.5G uplinks to the access points
• You may add cameras later and will budget for the SSD needed to record them

If this configuration fits, order the Cloud Gateway Fiber ($279), the Pro Max 16 PoE switch ($399), and two U7 Pro access points ($189 each), after you verify availability.

Need help validating this equipment list for your office layout? Our network design services include site assessment, coverage planning, and PoE budget verification before you buy.

Growing Business UniFi Build (10-50 People)

A starting configuration for a 10-50 person office with RAID-protected recording, multi-gigabit switching, and six cameras. The hardware total is $3,388 at US list price before storage drives.

Complete Equipment List

Drive prices vary by retailer and change often, so get a current quote for two matching surveillance-rated drives and add it to the total. The drive size comes from the storage worked example in the camera section below, not from a fixed retention promise.

What You Get

Camera capacity: Ubiquiti lists the Dream Machine Pro Max at 15 4K cameras as its recommended capacity, so six G6 Bullets fit with room to add more.

RAID-protected gateway: The Dream Machine Pro Max's two HDD bays in RAID 1 protect locally stored recordings against a single-drive failure. RAID is not a backup, so set up drive-failure alerts and keep regular UniFi configuration backups. The 5 Gbps IDS/IPS rating is a manufacturer figure, so check your ISP's connection type and the PPPoE section later in this guide before assuming it applies to your circuit.

Etherlighting management: Select a device in the UniFi mobile app and the matching Pro Max 24 PoE port lights up, which shortens physical patching and troubleshooting.

Multi-gigabit WiFi 7: The four U7 Pro XG access points connect at 2.5 GbE on the Pro Max 24 PoE and can use their 10 GbE interfaces after a future switch upgrade. Four units are a starting estimate for 5,000-6,000 sq ft, to be confirmed with a site survey.

PoE: Four U7 Pro XG (22W each, 88W) plus six G6 Bullet (9.9W each, about 59W) draw about 147W at manufacturer maximums from the 400W budget.

When the cheaper build is enough

If you do not need RAID or Shadow Mode HA, a Dream Machine Pro ($379) or a Cloud Gateway Fiber ($279) with an NVMe SSD can record up to 8 or 5 4K cameras respectively, per Ubiquiti's recommended capacity. The Pro Max gateway earns its price when you want RAID 1 recording, more cameras, or heavier VPN use.

Alternative: Higher-Density WiFi

Swapping the four U7 Pro XG for U7 Pro XGS ($299 each) adds a dedicated spectral scanning radio. Four XGS cost $1,196 against $796 for the XG, bringing the hardware total to $3,788 at list price. It is worth considering in dense urban buildings, multi-tenant buildings with many neighboring networks, and sites where wireless reliability is especially important.

Key Components

Growing Business Setup

Gateway

Dream Machine Pro Max

$599

Enterprise gateway with 5 Gbps IDS/IPS and dual RAID HDDs.

5 Gbps IDS/IPS

Dual RAID HDDs

HA Support

UI Store

Switch

Pro Max 24 PoE

$799

24-port switch with 400W PoE and Etherlighting.

400W PoE Budget

Etherlighting

8× 2.5G Ports

UI StoreAmazon

Access Point

U7 Pro XG

MSRP $199

WiFi 7 with 10G uplink and fanless design.

10 GbE Uplink

6 GHz Band

Fanless

Check price on Amazon

Not in these totals

Drives, a UPS, 10G direct attach cables, mounting hardware, cabling labor, tax and shipping. See Step 6 of the build order below.

Choose this build if

• You have a medium business (10-50 people) or a large residential property
• You need RAID-protected local recording for several 4K cameras
• You want a 10G-ready backbone and 2.5G access point uplinks

To grow later: add a Pro Max 48 PoE for more ports, a UNVR Pro for more camera storage, or a second Dream Machine Pro Max for Shadow Mode HA.

Planning a multi-site deployment or need RAID configuration assistance? Our professional installation services handle procurement, cabling, configuration, and staff training throughout South Florida.

Build Order: Buy and Install in Dependency Order

A parts list is only part of a plan. Each UniFi device depends on something that has to exist before it can work, so buying and installing in dependency order reduces rework. The worked example is a 10 to 15 person office with a meeting room, two planned access point positions, and a possible later four-camera addition. These counts are an exercise, not a rule.

Example build (US store, checked October 16, 2026): Cloud Gateway Fiber + Pro Max 16 PoE + 2× U7 Pro.

• Cloud Gateway Fiber: $279 list
• Pro Max 16 PoE: $399 list
• 2× U7 Pro: $378 list
• Four boxes: $1,056 list. Check the cart for any surcharge, tax and shipping.

The Cloud Gateway Fiber suits this example because it has two 10G SFP+ ports (one connects straight to the switch), a 5 Gbps IDS/IPS manufacturer rating, and can manage up to five 4K cameras once you add an NVMe SSD. That rating is a manufacturer figure, not a measured result. For a compact site covered by one built-in WiFi radio, the Dream Router 7 is a simpler all-in-one alternative.

1. Requirements and cable routes first

Write down the internet handoff and where it enters the building, the rooms that need dependable service, the number of wired devices, the equipment location (shelf or wall rack), and how much downtime the business can accept. Then check the physical path before you order anything. Cat5e that is in good condition carries 2.5 Gbps up to 100 m under the IEEE 802.3bz standard, so many existing drops are fine for a U7 Pro. A 10G access point on a full-length run wants Cat6A. Test each drop that you plan to reuse, and plan new runs to the access point positions and any future camera positions at the same time, because retrofitting cable later costs more.

2. Gateway

Match the gateway to the internet connection and the services it will host, not to the fastest socket. Check IDS/IPS throughput, check whether your provider uses PPPoE (see the PPPoE section below), and decide now whether the gateway will also record cameras. If it will, the storage is an extra purchase.

3. Switch ports and the port map

The Pro Max 16 PoE has twelve 1 GbE PoE+ ports (up to 32 W each), four 2.5 GbE PoE++ ports (up to 60 W each), and two 10G SFP+ ports. Put the access points on the 2.5 GbE ports so each gets its full uplink, connect the gateway to an SFP+ port with a 10G direct attach cable, and put cameras on the 1 GbE PoE+ ports: the G6 Bullet has a 10/100 network port, so a 2.5 GbE port gains it nothing. Write the actual port numbers on the plan and leave spare ports.

4. PoE: check the port and the total

Two checks, not one. First, each port must supply the standard the device needs: the U7 Pro is PoE+ with a 21 W maximum, the G6 Bullet draws 9.9 W maximum. Second, the total must fit the 180 W budget. Two U7 Pro (42 W) plus four G6 Bullet (39.6 W) is 81.6 W at the listed maximums, about 45 percent of the budget, which leaves the 15 to 20 percent headroom this guide recommends with room to spare. These are manufacturer maximums, not typical draw: our field measurements of the U7 Pro sit at 17 to 19 W sustained.

5. Power protection

Size the UPS to the equipment that must stay up, measured in watts rather than VA. Ubiquiti lists the Pro Max 16 PoE at 25 W excluding PoE output and 210 W including it at full load, so the access points and cameras are already inside the switch's figure: do not add them again. At the example load that is roughly 107 W for the switch (25 W plus 81.6 W of PoE output) plus up to 29.4 W for the gateway, about 136 W before conversion losses and before the internet handoff equipment. A UPS that protects only the gateway will not keep the PoE access points running if the switch loses power. See our best UPS for UniFi guide for model choices and runtime figures.

6. A complete quote

Count the four boxes, then the items that are easy to leave out: a 10G direct attach cable (from $13), mounting hardware (for example the $49 rack mount for the switch), an M.2 SSD tray ($19) plus an SSD if the gateway will record cameras, the UPS, patch cables, cabling labor, tax and shipping. Compare the same scope between suppliers. A UI Care plan is optional and priced separately. Before you order, check Ubiquiti's official store for newer models.

7. Acceptance test

Stage the equipment where you can reach it. Bring up the gateway first, then the switch, then adopt the access points, and record what changed at each step. On UniFi Network 10.5 and later, use Test & Confirm for risky changes so a bad setting rolls back automatically. Test a wired client before troubleshooting Wi-Fi, check the negotiated link speed on the access point ports, confirm the guest network cannot reach business resources (our guest Wi-Fi VLAN guide covers the setup), and run a real call in the meeting room rather than a speed test beside the access point. Finish with a configuration backup and a written note of who owns the account and how to recover it.

Want to run these numbers for your own floor plan? The free UniFi Network Configurator applies our sizing rules, and the sizing guide explains them.

Compare UniFi Products by Tier (2026)

For a small office using separate access points, the Cloud Gateway Fiber ($279), Pro Max 16 PoE switch ($399), and U7 Pro access points ($189 each) form our preferred baseline.

*Trade-offs: Lite 8 PoE offers 52W PoE budget (suitable for 2-3 devices), U7 Lite operates on 2.4/5 GHz bands without 6 GHz support.

As of October 2026, the lineup includes the Dream Router 7 and Cloud Gateway Fiber for desktop deployments, the Cloud Gateway Industrial for harsh environments, the U7 Pro XGS for high-density WiFi 7, and the UNAS 2 for entry-level Network Attached Storage (NAS) — all covered below.

Understanding the UniFi Ecosystem

UniFi OS provides one console for the wider ecosystem. The Network application manages gateways, switches, and access points, while Protect manages cameras and recordings. Unlike traditional multi-vendor environments requiring separate management consoles, UniFi consolidates network infrastructure, security, and surveillance under a single login.

What Makes UniFi Different: Licensing and Architecture

UniFi requires no mandatory licensing to operate, though optional third-party integrations exist. Core functionality—routing, switching, WiFi, and basic security—works without recurring subscriptions. The optional CyberSecure subscription — powered by Proofpoint and incorporating Cloudflare capabilities — adds advanced threat intelligence. Ubiquiti has published prices of $99/year for Standard and $499/year for Enterprise; confirm the current subscription price before ordering. Neither tier is required for operation, and availability varies by gateway model. Our UniFi network security walkthrough shows how CyberSecure and the built-in VPN fit together.

The UniFi Network application (cloud-hosted or self-hosted) discovers, provisions, and manages gateways, switches, and access points from one dashboard. Add a new access point, and it appears automatically. Configure VLANs once, and they propagate across your switching infrastructure. UniFi's product family spans small offices through large multi-site networks, although gateways and switches must be upgraded as capacity, redundancy, and performance requirements increase.

UniFi occupies the space between consumer gear (Eero, Google WiFi) and traditional enterprise solutions (Meraki, Aruba), offering business features such as VLANs, Intrusion Detection and Prevention System (IDS/IPS) inspection, and centralized management without a mandatory management license. If you are weighing UniFi directly against consumer mesh, our UniFi vs eero comparison covers the pricing and subscription differences in detail. For the closest competing multi-gig business line, see UniFi vs TP-Link Omada WiFi 7.

UniFi vs. Meraki cost structure: The total cost of ownership differs significantly between UniFi's one-time hardware model and subscription-based platforms like Cisco Meraki:

Important context: Meraki offers multiple licensing tiers with different feature sets and pricing. Direct dollar-for-dollar comparisons depend heavily on the specific license tier, partner pricing, security subscriptions, and support level. UniFi eliminates recurring management fees for core functionality; Meraki bundles support, updates, and cloud management into ongoing costs. Organizations should request current quotes for both platforms based on their specific requirements. For a detailed migration perspective, see our Meraki to UniFi migration guide. For the cost side, our UniFi vs Meraki cost comparison works through a small-business example.

The Four Core Categories

Gateways: The central network controller. Handles routing, firewall, IDS/IPS, VPN, and network management. Choose based on IDS/IPS throughput (how much security inspection you can run at full speed), device capacity, and whether you need integrated WiFi or rackmount form factor.

Switches: Power and connectivity distribution. PoE (Power over Ethernet) switches eliminate separate power supplies for access points and cameras. Key decisions: port count, PoE budget (total watts available), and uplink speed (1G, 2.5G, or 10G).

Access Points: WiFi coverage. WiFi 7 with 6 GHz support is our preferred baseline for new deployments, offering less congested spectrum and higher throughput. Coverage planning depends on square footage, client density, and building construction.

Cameras (UniFi Protect): Video surveillance with no cloud subscriptions. Storage lives locally on gateway hard drives or dedicated NVRs. AI-powered detection (people, vehicles, license plates) runs on-device.

UniFi Network Application Overview

UniFi Network 10.5 and later include Test & Confirm, which rolls a configuration change back automatically if devices lose connectivity after it is applied. This introduction to UniFi Network 11 shows the newer interface and management features:

Managing Multiple Locations with UniFi Site Manager

Organizations operating multiple branch offices, retail locations, or distributed campuses can centralize management through UniFi Site Manager—a cloud portal that aggregates all sites into a single dashboard. Each location runs its own UniFi gateway and controller, while Site Manager provides organization-wide visibility, firmware management, and configuration templates. This architecture allows IT teams to monitor network health, push updates, and troubleshoot issues across dozens of locations without traveling to each site. For businesses planning multi-site expansion, UniFi Site Manager scales from 2 to 100+ locations under unified oversight. To link two sites privately, see our UniFi Site Magic guide.

Which UniFi Gateway Should You Choose?

Select a UniFi gateway based on your required IDS/IPS throughput, total device capacity, and preferred form factor (rackmount versus desktop).

A UniFi gateway acts as your network's router, firewall, and management controller. You need a UniFi controller to adopt and manage switches and access points, but that controller does not have to be a gateway — a CloudKey, self-hosted Network Server, or hosted controller also works. A Cloud Gateway is the simplest option because it combines routing and management in one device. When planning a deployment, match the gateway's IDS/IPS throughput to your internet connection's maximum speed to avoid bottlenecking when security features are enabled.

Understanding IDS/IPS Throughput

IDS/IPS throughput determines how much traffic your gateway can inspect at full speed. A gateway rated for 1.5 Gbps IDS/IPS may limit throughput on a 2 Gbps fiber connection when security features are enabled. Most deployments benefit from some IDS/IPS headroom.

The PPPoE Throughput Penalty

PPPoE (Point-to-Point Protocol over Ethernet) processing is largely single-threaded on UniFi gateways, which caps real-world throughput well below the published routing and IDS/IPS specifications. On gigabit PPPoE circuits most current gateways should be close to line speed, but confirm with your ISP and firmware because results vary by gateway and load. Above 1 Gbps, the penalty becomes significant: in our testing of a Dream Machine Pro Max (UniFi OS 4.1, Network 10.4) on a 2 Gbps CenturyLink/Quantum Fiber PPPoE circuit with IDS/IPS enabled, we measured roughly 1.1–1.4 Gbps across multiple iPerf3 runs from a wired client.

If your provider delivers multi-gigabit fiber over PPPoE (common with CenturyLink/Quantum Fiber and many international ISPs), PPPoE performance can remain substantially below headline IDS/IPS ratings on some UniFi gateways, particularly UDM-class appliances. Network 10.5 introduced PPPoE improvements including 1500-MTU support, but verify current firmware performance before purchasing for a multi-gigabit PPPoE circuit. The practical fixes: ask the ISP whether DHCP/IPoE provisioning is available for your circuit, or choose the Dream Machine Pro Max or Enterprise Fortress Gateway, which post the best PPPoE numbers in the lineup. Published IDS/IPS specs are measured without PPPoE overhead.

Cloud Gateway Ultra vs. Dream Router 7: Feature Comparison

The Cloud Gateway Ultra ($129) offers 1 Gbps IDS/IPS throughput and four gigabit Ethernet ports in a compact desktop form factor. This capacity works well for home offices and small deployments with standard internet connections.

The Dream Router 7 ($279) increases IDS/IPS capacity to 2.3 Gbps, adds a 10G SFP+ WAN port for fiber upgrades, and includes integrated WiFi 7. These additional capabilities provide more headroom for growing networks and multi-gigabit internet connections.

For businesses planning to scale or expecting fiber upgrades, the Dream Router 7's additional features may justify the $150 price difference. For smaller, stable deployments with standard internet speeds, the Cloud Gateway Ultra provides adequate gateway functionality.

Gateway Recommendations by Office Size

Small Office (1-10 People): Cloud Gateway Fiber ($279) or Cloud Gateway Max ($199)

For an office with separate access points and a PoE switch, choose Cloud Gateway Fiber when you want a 10G link to the switch and more IDS/IPS headroom. Its two 10G SFP+ ports and 5 Gbps IDS/IPS rating are published specifications. Cloud Gateway Max saves $80 when 2.5 GbE is sufficient. Neither has built-in WiFi; both need added storage to record cameras.

All-in-one alternative: Dream Router 7. The Dream Router 7 combines gateway, WiFi 7 access point, and PoE switch in a compact desktop form factor. Its 10G SFP+ WAN port provides upgrade capacity for multi-gigabit fiber, while its 2.3 Gbps IDS/IPS rating (a manufacturer figure, measured without PPPoE overhead) suits a small site that can use its built-in radio.

Key specs:

• 2.3 Gbps IDS/IPS throughput
• 10G SFP+ WAN + 2.5 GbE WAN (dual-WAN capable)
• 3× 2.5 GbE LAN ports (one with PoE)
• Integrated WiFi 7 tri-band (5.7 Gbps maximum link rate; real throughput is lower)
• 64GB microSD for UniFi Protect (up to 5 HD, 2 2K, or 1 4K camera; retention varies by settings)
• Rated for 30+ managed UniFi devices and 300+ simultaneous users

Alternative: UniFi Express 7 ($199): Fanless all-in-one with the same WiFi 7 radios and the same 2.3 Gbps IDS/IPS throughput as the Dream Router 7, plus a 10G RJ45 WAN port. The trade-offs: a single 2.5 GbE LAN port (no built-in PoE switch), no SFP+ WAN, and no UniFi Protect camera support. Works well for wireless-first home offices and very small businesses—see our Express 7 vs Dream Router 7 comparison for the full breakdown.

Alternative: Dream Router 5G Max ($499, now available): Combines Dream Router 7 capabilities with integrated 5G cellular modem (up to 3.4 Gbps downlink). Supports dual SIM/eSIM for carrier flexibility and automatic failover. Best for pop-up offices, remote locations without wired internet, or businesses requiring cellular backup connectivity. See our 5G failover setup guide for configuration details.

Dream Router 7 is best for: Very small offices, branch locations, or homes where its integrated WiFi 7 radio covers the usable area. Ubiquiti rates that radio for about 1,750 sq ft under good conditions; check coverage on site.

Read our complete Dream Router 7 review for real-world deployment insights.

Medium Business (10-50 People): Dream Machine Pro ($379), Cloud Gateway Max ($199), or Cloud Gateway Fiber ($279)

For 10-50 people, choose based on rack space, uplink speed and recording needs. These gateways may also suit smaller offices with separate access points.

Dream Machine Pro ($379): 1U rackmount gateway with 3.5 Gbps IDS/IPS, 8-port gigabit switch, 10G SFP+ ports, and a 3.5" HDD bay for UniFi Protect storage. A common choice for rack-based installations.

Cloud Gateway Max ($199, or $279 with 512GB NVMe storage): Compact desktop gateway with 2.3 Gbps IDS/IPS, four 2.5 GbE LAN ports, and USB-C power. The storage version supports UniFi Protect camera recording; choose it if cameras are part of your plan. Choose this when rack space isn't available and a 2.5G switch link is enough. Our Cloud Gateway Max review covers its Protect limits. For a step-by-step build using the UCG-Max, see our budget 2.5 Gbps network guide. Not sure whether to start with the UCG-Ultra or go straight to the Max? See our Cloud Gateway Ultra vs Max comparison for a full breakdown.

Cloud Gateway Fiber ($279): Desktop gateway with two 10G SFP+ ports, including one you can use to connect this guide's Pro Max 16 PoE switch at 10G, and a published 5 Gbps IDS/IPS rating. UniFi Protect recording requires an added NVMe SSD. It is useful when you want a 10G switch link even if your internet connection is slower.

Only weighing the compact, non-rackmount options — Dream Router 7, Express 7, and Cloud Gateway Fiber? Our three-way compact gateway comparison lines them up side by side.

Key decision: Rackmount infrastructure? Choose Dream Machine Pro. Desktop deployment with a 2.5G switch link? Choose Cloud Gateway Max. Need a 10G switch link or greater published IDS/IPS headroom? Choose Cloud Gateway Fiber. Weighing the Dream Machine Pro against the Pro Max? Our UDM Pro vs Pro Max comparison covers the decision in detail.

Large Business (50+ People): Dream Machine Pro Max ($599)

The Dream Machine Pro Max is our standard recommendation for larger business deployments. It combines 5 Gbps IDS/IPS throughput, dual RAID-protected HDD bays, and Shadow Mode High Availability support in a single 1U appliance.

Key specs:

• 5 Gbps IDS/IPS throughput
• Supports 200+ UniFi devices, 2,000+ clients
• Dual 3.5" HDD bays with RAID 1 protection
• 10G SFP+ port + 2.5 GbE WAN
• 8× GbE LAN ports
• Built-in 128GB SSD for OS and applications
• Shadow Mode High Availability (HA) failover support (see below)

Why RAID matters: RAID 1 mirroring protects locally stored UniFi Protect recordings against a single-drive failure. A single-drive failure does not by itself stop recording, but RAID is not a backup: set up failure alerts and test the replacement procedure. Network configuration should also be protected through regular UniFi configuration backups, which are separate from the HDD storage.

See our UDM Pro Max review for detailed performance analysis and deployment scenarios.

Require 10G networking, 150+ managed devices, or an all-in-one NVR for 20+ cameras? See our Dream Machine Beast vs Pro Max comparison — the Beast ($1,499) is the top of the Dream Machine lineup and sits between the Pro Max and the EFG. For a hands-on look, see our Dream Machine Beast review.

Harsh Environments / No IT Closet: Cloud Gateway Industrial ($579)

For warehouses, retail back-of-house, manufacturing floors, and satellite locations without rack space or climate control, the Cloud Gateway Industrial combines routing, WiFi 7, and up to a 270W PoE budget (powered through its included 350W DC supply) in a single fanless wall-mount unit rated -30 to 50°C. It can replace a separate gateway, PoE switch and access point, which may lower total deployment cost when there is no existing infrastructure.

Enterprise (100+ People): Enterprise Fortress Gateway ($1,999)

For organizations that need the highest throughput in the lineup and 25G connectivity, the Enterprise Fortress Gateway delivers 12.5 Gbps IDS/IPS routing with support for 500+ UniFi devices.

Key specs:

• 12.5 Gbps IDS/IPS throughput
• 2× 25G SFP28 ports + 2× 10G SFP+ ports
• Redundant hot-swappable power supplies
• Shadow Mode High Availability
• NeXT AI Inspection / Deep Inspection (SSL/TLS decryption; needs a trusted certificate on each inspected client)
• 90 days of professional phone support (for US, Canada, Europe and UK UI Store purchases)

NeXT AI Inspection: The Enterprise Fortress Gateway supports Deep Inspection, which decrypts SSL/TLS traffic so the gateway can analyze it for security monitoring or filtering. Per Ubiquiti's help article (checked October 16, 2026), it runs on the EFG, EF Core and UXG-Enterprise, uses a gateway-issued certificate that must be installed on each client to avoid browser warnings, and supports up to 10,000 concurrent sessions (Ubiquiti recommends staying at or below 5,000). It has privacy implications. Ubiquiti recommends inspecting specific categories rather than everything, excluding health care, government and financial sites if you do inspect all traffic, and limiting it to a VLAN of managed employee devices rather than guest devices. Decide the policy, and tell users about it, before you enable it.

Best for: Campus networks, multi-building deployments, organizations with 10G/25G backbone infrastructure, and organizations that have a policy and a legal basis for SSL/TLS inspection.

Shadow Mode: What UniFi "High Availability" Actually Means

Shadow Mode is UniFi's automatic gateway failover: two identical gateways run in an active/standby pair using VRRP (Virtual Router Redundancy Protocol), and the standby takes over without manual intervention if the primary fails.

As of mid-2026, Shadow Mode is supported on the Dream Machine Pro, Dream Machine SE, Dream Machine Pro Max, Dream Machine Beast, and Enterprise Fortress Gateway. The practical requirements and limits enterprise buyers should understand:

• Identical hardware required. A Dream Machine Pro Max pairs only with a second Pro Max ($599), connected through a dedicated direct link (port 7 to port 7 on the UDM Pro Max).
• Configuration syncs automatically. The standby ("shadow") gateway mirrors the primary's UniFi OS version and configuration; initial sync takes up to fifteen minutes.
• Failover synchronizes state. Shadow Mode synchronizes firewall and connection-state tables between the primary and standby gateway. Automatic failover normally completes within seconds, and established connections are designed to survive the transition. VoIP calls and VPN tunnels may briefly pause but generally remain connected. This is automatic failover, but test it with your own VPN, voice and application workflows before treating it as equivalent to a fully redundant firewall cluster.

For most SMB deployments, seconds of cutover during a hardware failure is an acceptable trade for a $599 redundancy path.

Real-World VPN Throughput (WireGuard)

IDS/IPS ratings describe firewall inspection, not remote-access performance. WireGuard VPN processing is CPU-bound and largely single-threaded per tunnel, so VPN capacity scales differently than the headline specs suggest:

Methodology note: Our field measurements use iPerf3 over WireGuard from a single wired client unless noted as site-to-site. Per-tunnel throughput is not directly comparable to aggregate VPN capacity. Results reflect specific firmware versions and IDS/IPS enabled; your results may differ depending on tunnel count, TCP vs UDP, and whether testing is internet-limited or LAN-to-LAN. Test dates and firmware versions for these runs are not recorded in this article, so treat them as relative guidance until retested.

If you support 10+ remote workers on always-on VPN, size the gateway one tier above what IDS/IPS throughput alone suggests. Desktop gateways handle a handful of remote users well; sustained multi-user VPN load belongs on the Dream Machine Pro Max or above.

Gateway Comparison Table

Specs	10G Small Office Cloud Gateway Fiber $279 | UI Store	Lower Cost Cloud Gateway Max $199 | UI Store	50+ People Dream Machine Pro Max $599 | UI Store
IDS/IPS	5 Gbps	2.3 Gbps	5 Gbps
Max Devices	50+	30+	200+
Form Factor	Desktop	Desktop	1U Rackmount
WiFi	None	None	None
WAN	10G SFP+	2.5 GbE	-
Switch Link	10G SFP+	-	-
WireGuard VPN	-	~500 Mbps/tunnel	2.5+ Gbps site-to-site
Storage	-	-	Dual RAID HDDs
	$279 | UI Store	$199 | UI Store	$599 | UI Store

For a complete comparison of all UniFi gateways including technical specifications and upgrade thresholds, see our UniFi Gateway Comparison Guide.

Which UniFi Switch Is Best for WiFi 7?

WiFi 7 access points benefit from multi-gigabit UniFi switches, which prevent a gigabit uplink from limiting available throughput. PoE budget matters just as much.

UniFi switches distribute network connectivity and Power over Ethernet (PoE) to access points, cameras, and VoIP phones through a single cable. Switch selection comes down to three factors: total PoE wattage budget, uplink speed (1G, 2.5G, or 10G), and port count. Size switch PoE capacity using each device's maximum specified consumption, then retain approximately 15–20% headroom. For example, a U7 Pro is rated at 21W maximum. Measured sustained draw (17–19W in our deployments) is useful for estimating typical operating load and UPS runtime, but should not replace the maximum figure when sizing switch capacity. For a detailed breakdown of every switch line with PoE sizing guidance, see our Best UniFi Switches guide.

UniFi Network Switches Overview

This video provides a comprehensive overview of UniFi network switches, covering PoE capabilities, port configurations, and deployment scenarios:

Why 2.5G and 10G Matter for WiFi 7

WiFi 7 access points can deliver aggregate throughput exceeding 2.5 Gbps when multiple clients connect simultaneously. A traditional gigabit switch limits each access point to 1 Gbps, reducing the benefit of WiFi 7's wider channels. Deployments seeking full WiFi 7 throughput benefit from 2.5G or 10G uplinks to access points. For the cost and cabling trade-offs, see 2.5 GbE vs 10 GbE and whether 10GbE is worth it.

The PoE Budget Problem: Each WiFi 7 access point draws 15–29W depending on the model. Size your switch using the maximum specification for each device, then add 15–20% headroom. Field-measured sustained draw runs lower and is useful for UPS runtime estimates:

Six U7 Pro XGS access points at 29W max each = 174W. Adding 20% headroom requires a switch with at least a 209W PoE budget — a 120W switch would fall well short.

Understanding Lite vs. Pro Switch Differences

UniFi's Lite switch line (Lite 8 PoE at $109, Lite 16 PoE at $199) provides basic PoE switching at accessible price points. These switches work well for small deployments with limited PoE requirements.

The Pro switch line adds capabilities that benefit larger deployments:

• Higher PoE budgets (120W+ vs. 45-52W) support more access points and cameras
• 2.5G and 10G uplinks prevent bottlenecks with WiFi 7 access points
• Etherlighting visual port management simplifies troubleshooting

For deployments with multiple WiFi 7 access points or extensive camera coverage, Pro-tier switches provide the PoE capacity and uplink bandwidth to support these devices more effectively.

Switch Recommendations by Office Size

Small Office (1-10 People): Pro Max 16 PoE ($399)

The Pro Max 16 PoE delivers multi-gigabit capabilities that match WiFi 7 access points. Its four 2.5 GbE PoE++ ports provide full-bandwidth uplinks for U7 Pro access points, avoiding the gigabit bottleneck that limits WiFi 7 performance on GbE-only switches.

Key specs:

• 12× 1 GbE PoE+ ports
• 4× 2.5 GbE PoE++ ports
• 2× 10G SFP+ uplink ports
• 180W total PoE budget
• Etherlighting™ visual port management
• Layer 3 switching
• Rack mount, desktop, or wall mount

PoE budget planning: Two U7 Pro access points (21W each on 2.5G ports) + one G6 Bullet camera (9.9W) = about 52W at manufacturer maximums, leaving about 128W of the 180W budget for additional devices.

Why not the Pro 8 PoE? The Pro 8 PoE ($349) has 10G SFP+ uplinks but only gigabit access ports. WiFi 7 access points like the U7 Pro support 2.5 GbE uplinks — connecting them to a gigabit port caps throughput at 1 Gbps per AP. The Pro Max 16 PoE costs $50 more but provides four 2.5G ports, Etherlighting, 60W more PoE budget, and flexible mounting options. The Pro 8 PoE remains a reasonable compact alternative where gigabit AP uplinks are acceptable.

Medium Business (10-50 People): Pro Max 24 PoE ($799)

The Pro Max 24 PoE adds Etherlighting™, which visually identifies switch ports via the UniFi app, reducing diagnostic time during physical patching and installations.

Key specs:

• 24 ports: 8× 2.5 GbE PoE++, 8× GbE PoE+, 8× GbE PoE++
• 2× 10G SFP+ uplink ports
• 400W total PoE budget
• Etherlighting™ visual port management
• Layer 3 switching

The 2.5G advantage: Eight 2.5 GbE ports provide full uplink capacity for U7 Pro access points and allow U7 Pro XG units to operate at 2.5 GbE. The XG models retain a future upgrade path to a 10 GbE PoE switch when higher per-AP throughput is needed.

Real-world capacity: 400W PoE budget supports 8× U7 Pro XGS access points (29W each = 232W) plus 10× G6 Bullet cameras (10W each = 100W) with 68W headroom.

For detailed insights on Etherlighting and Pro Max features, see our Pro Max Etherlighting guide.

Large Business (50+ People): Pro Max 48 PoE ($1,299)

The Pro Max 48 PoE offers the highest port count in the Pro Max line with a 720W PoE budget, enough for a large WiFi 7 and camera deployment on one switch.

Key specs:

• 32× 1 GbE (24 PoE+, 8 PoE++)
• 16× 2.5 GbE (8 PoE+, 8 PoE++)
• 4× 10G SFP+ uplink ports
• 720W total PoE budget
• Etherlighting™ across all ports
• Layer 3 switching

Capacity example: Using maximum specifications, 16 U7 Pro XGS access points consume up to 464W and 15 G6 Bullet cameras consume about 149W, leaving approximately 107W of the 720W budget for operating headroom and additional devices. The four 10G SFP+ uplinks provide flexible backbone connectivity.

High-Performance: Pro XG 24 PoE ($1,799)

For organizations requiring a high concentration of 10 GbE PoE ports, the Pro XG 24 PoE provides sixteen 10 GbE PoE+++ ports, eight 2.5 GbE PoE+++ ports, and dual 25G SFP28 uplinks.

Key specs:

• 16× 10 GbE PoE+++ ports
• 8× 2.5 GbE PoE+++ ports
• 2× 25G SFP28 uplink ports
• Up to 90W per port PoE capability
• 720W total PoE availability
• Layer 3 switching

Best for: Video production studios, architecture firms, organizations with NAS-heavy workflows, or deployments using E7 Enterprise access points that benefit from 10G uplinks.

Important note: The 10 GbE ports require Cat6A cabling for standards-compliant 100-metre runs. Cat6 may work over shorter distances (up to approximately 55 metres depending on installation quality). Budget for cabling upgrades if your infrastructure uses Cat5e or Cat6.

Switch Comparison Table

Thermal Management for Network Closets

Pro Max switches generate significant heat under full PoE load. In our South Florida deployments, we recorded the following in typical network closets. These are observations from specific closets, not a thermal specification, so check Ubiquiti's published operating range for your model:

Pro Max 24 PoE (400W load): Exhaust air reaches 45-50°C (113-122°F) in enclosed racks without ventilation. Ambient closet temperature should not exceed 30°C (86°F) for reliable operation.

Pro Max 48 PoE (720W load): Requires minimum 6 inches clearance above and below for proper airflow. In cramped, unventilated closets, consider adding a rack-mount fan panel or upgrading to forced ventilation.

Field recommendation: For network closets without HVAC, install temperature monitoring and set alerts at 35°C (95°F) ambient. Switches will throttle PoE output or shut down ports to protect components if internal temperatures exceed safe thresholds.

Cabling Considerations

Cat6A is the standard choice for 10GBASE-T installations, supporting full 10 Gbps over standards-compliant 100-metre runs. Cat6 may support 10GBASE-T over shorter distances — commonly up to approximately 55 metres depending on installation quality and alien crosstalk — but is not guaranteed for full-distance 10G. Cat5e is not a recommended specification for new 10G installations. For 2.5 and 5 GbE (used by most WiFi 7 access points), qualifying Cat5e or better cabling supports full speed up to 100 metres. Fiber and DAC cables are alternatives to copper for 10G backbone runs. When deploying Pro XG switches or planning 10G infrastructure, budget for Cat6A cabling throughout. For specific bulk cable picks and jacket ratings by install type, see our ethernet cable guide. If Cat6 or Cat6A is already installed, what to keep and what to upgrade covers the decision.

For detailed guidance on fiber optic cables, SFP modules, and multi-gigabit cabling, see our UniFi Fiber Cable & SFP Selection Guide.

Which UniFi WiFi 7 Access Point Do You Need?

Select a UniFi WiFi 7 access point based on total coverage area, concurrent client density, and whether your network switches support 10G uplinks.

Our preferred baseline for 2026 deployments uses the 6 GHz band, which offers 1,200 MHz of less congested spectrum compared to the 2.4 GHz and 5 GHz bands. Use one access point per 1,500 square feet in standard commercial construction as a starting estimate, then validate it with a site survey.

UniFi U7 Pro XG WiFi 7 Access Point Overview

This detailed walkthrough covers the U7 Pro XG's 10G capabilities, WiFi 7 performance, and deployment considerations:

Why 6 GHz Matters

In the United States and other regions that make the full allocation available, the 6 GHz band offers up to 1,200 MHz of additional spectrum — more than 2.4 GHz and 5 GHz combined. It is generally less congested and free from legacy WiFi clients, Bluetooth, and typical 2.4 GHz microwave interference. Other WiFi 6E and WiFi 7 networks can still share the band, particularly in dense buildings, but the wider channel availability and absence of legacy devices provide more consistent performance than the older bands.

U7 Lite vs. U7 Pro feature comparison: The U7 Lite ($99) operates on 2.4 GHz and 5 GHz bands, providing dual-band WiFi 7 coverage. The U7 Pro ($189) adds the 6 GHz band for tri-band operation, offering access to cleaner spectrum with less interference.

For environments with many competing WiFi networks or high client density, the 6 GHz band provides performance benefits. For smaller deployments with fewer interference sources, dual-band operation may be sufficient.

Coverage Planning Fundamentals

Square footage: Ubiquiti rates one U7 Pro for 1,500 sq ft. Treat that as a starting estimate for typical offices, not a guarantee. A 3,000 sq ft office needs 2-3 access points. A 10,000 sq ft space requires 6-8 units.

Client density: High-density areas (conference rooms, open offices, training rooms) benefit from additional access points even when coverage is adequate. More access points = fewer clients per AP = better per-client performance.

Building construction: Concrete walls, metal studs, and elevator shafts attenuate WiFi signals. Older buildings with plaster-and-lath construction require more access points than modern drywall construction. For glass-heavy spaces, see access point density in glass offices.

For the complete sizing methodology — including how we estimate switch ports and camera counts from the same inputs — we've published the sizing rules behind our network configurator.

Access Point Recommendations by Office Size

Small Office (1-10 People): U7 Pro ($189)

The U7 Pro is our preferred baseline for WiFi 7 deployments. Its tri-band operation with 6 GHz support, 2.5 GbE uplink, and 300+ client capacity deliver reliable performance for standard office environments.

Key specs:

• 6 spatial streams (2×2:2 tri-band)
• Full WiFi 7 with 6 GHz support
• 140 m² (1,500 sq ft) coverage
• Rated for 300+ connected devices
• 2.5 GbE uplink (PoE+, 21W max)
• 5.8 Gbps maximum 6 GHz data rate (320 MHz channel; real throughput is lower)
• Real-world power draw: 17–19W sustained (vs 21W maximum)

Deployment strategy: Two U7 Pro access points often cover a small office of 2,000-3,000 sq ft, with enough overlap for roaming if they are placed well. Place one near the main work area, the second near conference rooms or high-traffic zones.

For a detailed comparison explaining why the U7 Pro is worth the premium over U7 Lite, see our U7 Lite vs U7 Pro comparison.

Medium Business (10-50 People): U7 Pro XG ($199)

The U7 Pro XG adds 10G uplink capability and enhanced thermal management in a fanless design. At $199 (US list price, rechecked October 16, 2026), it costs $10 more than the U7 Pro, a small premium for a 10 GbE uplink. We default to the XG when the switching can use the faster uplink.

Key specs:

• 6 spatial streams (2×2:2 tri-band)
• 10 GbE RJ45 uplink (supports 1/2.5/5/10 Gbps)
• 140 m² (1,500 sq ft) coverage
• 300+ connected devices
• PoE+ power (22W max)
• 30% thinner profile with improved cooling
• Real-world power draw: 19–21W sustained (vs 22W maximum)

When to choose U7 Pro XG over U7 Pro:

• You have 10G switching infrastructure (Pro XG switches)
• Multiple high-bandwidth clients connect simultaneously
• Upgrade capacity for 10G backbone
• Fanless operation matters (quieter in professional environments)

Read our U7 Pro XG review for real-world performance testing and deployment scenarios.

Large Business (50+ People): U7 Pro XGS ($299) or U7 Pro Max ($279)

For high-density environments with 50+ concurrent users, two models deliver enhanced capabilities:

U7 Pro XGS ($299): Upgrades to 4×4 MIMO on the 5 GHz band (8 spatial streams total) and adds a dedicated spectral scanning radio that monitors the RF environment without interrupting client traffic. This hardware upgrade delivers higher aggregate throughput when multiple clients connect simultaneously, and the real-time interference detection is useful in congested RF environments.

Key specs:

• 8 spatial streams (2×2 on 2.4/6 GHz, 4×4 on 5 GHz)
• 10 GbE uplink
• Dedicated spectral scanning radio
• 160 m² (1,750 sq ft) coverage
• 500+ connected devices
• PoE++ power (29W max)
• Real-world power draw: 25–27W sustained (vs 29W maximum)

U7 Pro Max ($279): Enhanced 4×4 MIMO on 5 GHz improves aggregate throughput when multiple clients connect simultaneously.

Key specs:

• 8 spatial streams (4×4 on 5 GHz)
• Dedicated spectral scanning radio
• 160 m² (1,750 sq ft) coverage
• 500+ connected devices
• 2.5 GbE uplink

Choose U7 Pro XGS when: You have 10G infrastructure and need higher throughput in challenging RF environments (dense urban areas, multi-tenant buildings, high-interference zones).

Choose U7 Pro Max when: You need spectral scanning and high-density support but don't require 10G uplinks. See our U7 Pro Max field review.

Enterprise (100+ People): E7 Enterprise ($499)

The E7 Enterprise is Ubiquiti's highest-tier WiFi 7 access point, with 10 spatial streams and 10 GbE uplink capability. Designed for stadiums, convention centers, and large campus deployments.

Key specs:

• 10 spatial streams
• 10 GbE uplink
• Metal enclosure for durability
• High client density support

Best for: Organizations requiring the highest available performance and client density. Pair with Pro XG switches and the Enterprise Fortress Gateway for complete 10G infrastructure.

Special Use Cases

Conference Rooms: U7 Pro Wall ($199) The U7 Pro Wall provides the U7 Pro radio platform in a low-profile wall-mounted design. Choose the U7 In-Wall when downstream Ethernet ports are required for displays, phones, or workstations. Our U7 Pro Wall comparison covers the in-wall options.

Outdoor Coverage: U7 Pro Outdoor ($279) The U7 Pro Outdoor features IPX6 weather protection (IP67 with cable-gland door kit) for patios, loading docks, and outdoor work areas. AFC (Automated Frequency Coordination) support enables 6 GHz outdoor operation in supported regulatory regions. For a full comparison of all outdoor models — including the U7 Outdoor, U7 Mesh, and U6 Mesh — see our outdoor access point guide.

Hotel-Style Deployments: U7 In-Wall ($149) The U7 In-Wall fits standard electrical boxes with an integrated three-port 2.5 GbE switch and PoE output for downstream devices. Common in hotels, dormitories, and multi-unit residential buildings where each room needs both WiFi and a wired Ethernet connection.

Access Point Comparison Table

Specs	1-10 People U7 Pro Check price on Amazon	10-50 People U7 Pro XG Check price on Amazon	High-Density U7 Pro XGS Check price on Amazon
WiFi Standard	WiFi 7 (802.11be)	WiFi 7 (802.11be)	WiFi 7 (802.11be)
Bands	Tri-Band (6 GHz)	Tri-Band (6 GHz)	Tri-Band (6 GHz)
Streams	6 (2×2:2)	6 (2×2:2)	8 (4×4 5GHz)
Uplink	2.5 GbE	10 GbE	10 GbE
Coverage	1,500 sq ft	1,500 sq ft	1,750 sq ft
Rated Clients	300+	300+	500+
	Check price on Amazon	Check price on Amazon	Check price on Amazon

For comprehensive guidance on selecting the right WiFi 7 access point based on office size and uplink infrastructure, see our Best WiFi 7 Access Points for Small Business guide.

Cameras & UniFi Protect: Security Without Subscriptions

UniFi Protect provides local video recording and detection without a cloud subscription. Storage lives locally on gateway hard drives or dedicated NVRs, and AI-powered detection (people, vehicles, license plates, faces) runs on-device. The hardware is a one-time purchase.

Why UniFi Protect Makes Sense

No recurring fees: Many cloud camera services bill per camera per month, so cost grows with camera count. UniFi Protect has no subscription for core recording and detection. Weighing other camera systems? See UniFi Protect vs Reolink vs TP-Link.

Local storage: Recordings stay on your network, not in someone else's cloud. RAID protection (on Dream Machine Pro Max or UNVR Pro) lets recordings survive a single-drive failure.

AI on-device: The G6 camera lineup includes on-device AI processing for smart detection. No cloud processing required, no additional fees.

Camera Recommendations

G6 Bullet (~$199): 4K outdoor camera with long-range IR night vision. Commonly used for perimeter coverage, parking lots, and building exteriors.

G6 Turret (~$199): 4K indoor/outdoor camera with wide-angle coverage. Ideal for entrances, hallways, and open office monitoring.

G6 Dome (~$279): Vandal-resistant design for high-risk areas. Same 4K sensor as G6 Bullet in a tamper-proof housing.

G6 Instant (~$179): A WiFi-connected 4K camera powered through USB-C, suitable for temporary coverage, retrofits, and locations without an Ethernet drop.

G6 Pro Bullet ($479): 4K camera with 2.36× optical zoom and improved low-light performance, suited to areas where image detail matters most.

For hands-on testing notes and placement guidance across the full G6 lineup, see our best UniFi Protect cameras guide. Choosing between Bullet models? See G6 Bullet vs Pro Bullet vs G6 PTZ.

Storage Planning

Retention depends on bitrate, recording mode, scene activity and drive capacity, so we do not quote one retention figure for "six cameras". The answer can change by a factor of three or more with those inputs. Use the arithmetic instead.

Worked example: six G6 Bullet cameras, 30 days. Assumptions are planning values, not Ubiquiti specifications: 8 Mbps per 4K camera while recording (the same planning bitrate as our storage planning guide), and TB per day ≈ total Mbps × 0.0108.

Six cameras at 8 Mbps is 48 Mbps, or about 0.52 TB per day. Over 30 days:

Two 12 TB drives in RAID 1 give 12 TB usable, leaving about 54% headroom over the moderate-activity estimate of 7.8 TB; this is the drive size in the growing-business build above. Busier scenes or continuous recording need more capacity. Two 8 TB drives give 8 TB usable, which fits the moderate case with almost no spare room, while two 4 TB drives hold only about 8 days of continuous recording at this bitrate. Allow roughly 30-50% headroom for the recording pattern you expect, then confirm the real figure after 7-14 days of recording.

Ubiquiti's retention levers are recording mode per camera (Always or Detection Only), schedules, per-camera retention, and Enhanced Retention in Protect 5.1 and later, which downgrades older footage to lower quality. See Ubiquiti's storage and retention and recording modes articles, and our Protect storage estimator.

Storage options:

• Dream Machine Pro Max: two 3.5" HDD bays, RAID 1 recommended
• UNVR: standalone NVR with four 3.5" HDD bays
• UNVR Pro: seven 3.5" HDD bays with RAID support

To choose between NVR models, see UNVR vs UNVR Pro vs UNVR G2. To archive footage to a NAS, see can UniFi Protect use a NAS.

Privacy and retention: Decide who can view footage, how long you keep it, and where cameras must not point (restrooms, neighboring property) before you mount them. Audio recording, signage and retention rules vary by location and industry, so check them with counsel. Protect's retention settings and Detection Only mode are the tools for enforcing the decision.

For gateway-specific limits, see the camera-capacity table in the constraints section near the top of this guide.

Complete Protect Resources

Getting started: Our UniFi Protect CCTV Guide walks through complete system design, camera placement, and configuration.

G6 Instant deployment: The G6 Instant review compares WiFi vs PoE cameras and explains when wireless cameras make sense.

Budget-friendly security: Build a complete UniFi Protect system under $2,000 with on-device AI detection.

Procurement Planning

Availability changes across UniFi's product line, and models can sell out at the official store. Verify current stock before scheduling an installation date, particularly for the Enterprise Fortress Gateway and Pro XG 24 PoE, and order early for projects with 10 or more access points.

Add Later: NAS, Phones, and Door Access

Common Questions & Pitfalls

These common questions and mistakes appear frequently in UniFi deployments. Knowing them before you buy helps avoid rework.

Do I Need a UniFi Gateway?

You need a UniFi controller, but not necessarily a UniFi gateway. A Cloud Gateway is the simplest option because it combines routing and management in one device. Networks using a third-party firewall can instead use a CloudKey, self-hosted Network Server, or Ubiquiti's hosted controller options. If you are weighing non-UniFi gateways, see UniFi gateway alternatives.

Common mistake: Buying UniFi access points without any controller, then discovering they require one for configuration and adoption.

Self-hosting note: Advanced users can self-host the UniFi Network Server on a VM or Docker container. This provides full switch and AP management but does not include the integrated routing, firewall, or UniFi Protect camera support that hardware gateways provide.

Keep WiFi 6 or Move to WiFi 7?

One UniFi Network site can manage WiFi 6 and WiFi 7 access points together, so the question is coverage and clients, not the controller.

• Keep WiFi 6 access points when they are PoE-powered, still receive updates, give usable signal in every room during a walk test, and most of your clients are WiFi 6 or older.
• Move to WiFi 7 when you want 6 GHz capacity, a 2.5G switch is ready, you are re-cabling anyway, or the old units are out of support.
• In a mixed deployment, add WiFi 7 in the busiest rooms first, then walk the site with real phones and laptops. Roaming and band selection depend on the client as well as the controller.

If the complaint is slow or unreliable WiFi, diagnose it first. Cabling, PoE and interference often explain it, and new access points will not fix those. For a full upgrade project, see our WiFi 7 implementation guide.

What Internet Speed Do I Need?

UniFi gateways support internet connections from 100 Mbps to 10 Gbps. The gateway's IDS/IPS throughput should match or exceed your internet speed:

• 1 Gbps internet: Cloud Gateway Max (2.3 Gbps IDS/IPS) or higher; Cloud Gateway Ultra is rated for 1 Gbps IDS/IPS with no headroom
• 2 Gbps internet: Dream Machine Pro (3.5 Gbps IDS/IPS) or higher
• 5 Gbps internet: Dream Machine Pro Max (5 Gbps IDS/IPS) or higher

Important: IDS/IPS throughput differs from routing throughput. Always check IDS/IPS specs when security features matter. If your ISP delivers service over PPPoE, expect lower real-world numbers than either spec—see the PPPoE throughput penalty above.

PoE Planning Mistakes

PoE budget planning: Calculate total PoE requirements before selecting a switch. Six U7 Pro access points at 21W each = 126W minimum. A switch rated for 120W PoE budget would not provide sufficient power for all devices.

Wrong PoE standard: PoE+ (802.3at) delivers 25.5W per port. PoE++ (802.3bt) delivers 60W per port. Most UniFi access points require PoE+ minimum. Check device specifications before purchasing switches.

PoE headroom planning: Plan for 15–20% PoE headroom beyond calculated maximum requirements. Devices draw maximum power during boot, and future expansion requires available budget.

Power Protection & UPS Sizing

Protect the gateway and switch with a UPS so a short outage does not drop the network, and size it in watts rather than VA.

1. Add up the load that must stay up. Ubiquiti lists the Pro Max 16 PoE at 25 W without PoE output and 210 W at full PoE output. The access points and cameras are already inside the switch's figure, so do not add them again. The build order above works through one example, about 136 W at manufacturer maximums.
2. Check the manufacturer's runtime at that load. Runtime falls quickly as load rises. The CyberPower CP1500PFCLCD is listed at 10 minutes at 500 W and 2.5 minutes at 1,000 W, and Ubiquiti lists the UPS 2U at 8 minutes at 500 W. These are manufacturer figures, not promises for your rack. See our best UPS for UniFi guide.
3. Decide what a UPS has to do. For most small offices it is enough to ride through a brief outage and shut down cleanly. For longer outages, plan a larger battery or backup power rather than a bigger VA number.

Ubiquiti's RPS and similar redundant power gear suit sites where even a brief switch outage is unacceptable. They cost more than a typical UPS.

Who Runs It After Install? Support and Operations

UniFi has no mandatory management license, which moves some work to you. Someone has to own the admin account, apply firmware updates in a change window, keep configuration backups, and respond when something fails. Our four-year fleet report shows what failed across 538 Ubiquiti devices in commercial deployments. There are three common models:

• In-house IT: lowest ongoing cost, but it depends on one person's availability and knowledge.
• A local integrator on a maintenance agreement: faster response, with a recurring cost that replaces the license fee other platforms charge.
• Self-managed with optional UI Care: Ubiquiti's optional hardware coverage is priced separately, so check what it covers before relying on it.

Decide this before you buy, because lower hardware cost does not remove the need for someone to run the network.

When to Hire Professional Installation

Consider professional installation when:

• Running new Cat6A cabling through walls or ceilings
• Deploying 10+ access points requiring coverage optimization
• Implementing VLANs for network segmentation
• Integrating with existing infrastructure (firewalls, servers, phone systems)
• Requiring High Availability or RAID configuration

Our UniFi installation services include site assessment, equipment procurement, professional cabling, configuration, and staff training.

For common installation challenges and solutions, see our UniFi Installation Challenges guide.

Next Steps

Start with the four constraints near the top of this guide, pick the build that matches your office, and get an all-in quote before you order. If you would rather have someone validate the plan against your floor plan, contact our team. We provide site assessment, equipment procurement, professional cabling, configuration, and staff training throughout South Florida, and our UniFi Network Services cover network design. For the wider project, the Small Business Network Setup Guide covers internet, cabling and security, and the Miami office network planning guide covers local ISP and cabling considerations.

Price Ledger: US Store, October 16, 2026

Every other list price in this guide was also rechecked on October 16, 2026 and matched the US store. Store surcharges and prices change, so confirm the cart total before ordering.

Related Resources

• UniFi Gateway Comparison Guide 2026 — all UniFi gateways with upgrade thresholds.
• Dream Router 7 vs Express 7 vs Cloud Gateway Fiber — the three compact gateways side by side.
• Dream Router 7 Review and Dream Machine Pro Max Review — real deployment notes.
• Best WiFi 7 Access Points for Small Business and U7 Lite vs U7 Pro — access point selection.
• UniFi Office Network Blueprint and UniFi Network Design Guide — implementation and architecture.
• UniFi Protect CCTV Guide and Protect Storage Planning Guide — camera design and retention.
• Best UPS for UniFi and Power over Ethernet Guide — power planning.
• UniFi Business Network Guide 2026 — security features and NIST framework alignment.
• UniFi Small Office Case Study and Small Business Network Setup Guide — a real installation and the wider project plan.
• UniFi Network Services, UniFi Security Cameras and Network Cabling Services — installation and Cat6A cabling in South Florida.