Direct answer for enterprise buyers
The Ubiquiti Enterprise Firewall Core, model EF-Core, is an enterprise-scale UniFi Cloud Gateway used to route, secure and manage very large wired and wireless networks. It is primarily intended for organisations that have outgrown smaller UniFi gateways or need 25G and 100G connectivity, high session capacity, extensive VPN scale and advanced inspection without leaving the UniFi Network operating model. Buyers should consider it when their validated throughput, user, device and resilience requirements justify an enterprise platform. Before proceeding, confirm the precise topology, required interfaces, optics, rack environment, upstream circuits, redundancy design, security subscription choices and implementation scope.
What the EF-Core does
EF-Core acts as the high-capacity gateway and security enforcement point for a UniFi Network environment. It can terminate multiple WAN connections, route between internal segments, enforce zone-based policy, identify applications, perform content and URL filtering, inspect encrypted traffic where configured, provide intrusion detection and prevention, and establish site-to-site or remote-access VPN connectivity.
Its role is wider than basic perimeter filtering. It can also support multi-WAN load balancing, dynamic routing with OSPF and BGP, policy-based routing, advanced NAT, LACP aggregation, quality-of-service controls and internet quality reporting. The value comes from combining these functions with centralised UniFi management, but the final design still requires careful policy, addressing and change planning.
Who should consider it
The platform may be appropriate for large education campuses, hotel groups, healthcare facilities, logistics hubs, retail estates, mixed-use developments, corporate headquarters and multi-site organisations that manage substantial UniFi switching and wireless estates. It is especially relevant where the gateway must process high volumes of east-west and north-south traffic while retaining detailed policy control.
It is not automatically the right choice for every UniFi deployment. Smaller offices may obtain a better operational and commercial fit from a lower-capacity Cloud Gateway. EF-Core should be selected because measured demand, growth forecasts, interface requirements or resilience targets justify it, not simply because it has the highest published figures.
Business challenges the platform can help address
Gateway bottlenecks
High-speed internet, data-centre links and large internal routing loads can expose limitations in smaller gateways. EF-Core offers a 100 Gbps platform and multiple high-speed interfaces, but real performance still depends on enabled services and traffic characteristics.
Large security workloads
Encrypted applications and dense client populations generate significant inspection demand. Published IDS/IPS performance of 79 Gbps and SSL/TLS inspection capacity help address that workload, subject to policy and session design.
Operational fragmentation
Organisations already using UniFi switches and access points may prefer a gateway managed through the same Network application, reducing the number of separate operational consoles while preserving role-based administration practices.
Continuity requirements
Dual hot-swappable power supplies and Shadow Mode gateway failover support resilient designs. A complete high-availability outcome also depends on upstream links, switching, power feeds, cabling and tested operational procedures.
Core capability band
Product-fit matrix
| Requirement | Suitable when | Confirm before ordering |
|---|---|---|
| Very high throughput | Measured or forecast traffic exceeds the practical range of smaller UniFi gateways. | Traffic mix, inspection features, packet sizes and growth headroom. |
| 100G or 25G connectivity | Core switches, providers or data-centre links require QSFP28 or SFP28 interfaces. | Optical standard, fibre type, cable length, module compatibility and breakout needs. |
| Large UniFi estate | The organisation manages a dense campus or multiple sites with substantial device and user counts. | Current device inventory, adoption plan, controller migration and administration model. |
| Gateway resilience | A planned high-availability pair is required to reduce single-gateway dependency. | Pair design, upstream redundancy, addressing, state behaviour, maintenance and testing. |
| Enhanced threat intelligence | The security policy requires broader signature coverage and frequent threat updates. | CyberSecure Enterprise subscription, term, regional availability and renewal ownership. |
Verified technical information
| Brand | Ubiquiti |
|---|---|
| Product | Enterprise Firewall Core |
| Model | EF-Core |
| Product type | Enterprise-scale UniFi Cloud Gateway and firewall |
| Form factor | 1U rack mount |
| Dimensions | 442.4 × 43.7 × 400 mm |
| Weight | 7.85 kg |
| Processor and memory | 24-core ARM v9 at 2.5 GHz, 32 GB system memory |
| Storage | Integrated 128 GB SSD |
| Platform throughput | 100 Gbps |
| IDS/IPS throughput | 79 Gbps |
| Managed UniFi devices | 2,250+ |
| Simultaneous users | 22,500+ |
| Concurrent sessions | 10 million |
| New sessions per second | 120,000 |
| SSL/TLS inspection sessions | 10,000 concurrent sessions |
| 100G interfaces | 4 × QSFP28, supporting 100G/40G |
| 25G interfaces | 4 × SFP28, supporting 25G/10G/1G |
| 10G copper interfaces | 8 × RJ45, supporting 10G/5G/2.5G/1G/100M |
| Additional ports | 2 × 1 GbE RJ45, 1 × management RJ45 and 1 × console |
| Maximum WAN port count | 8 |
| High availability | Shadow Mode using VRRP gateway failover |
| Power | Two hot-swappable AC/DC 550W PSUs; 100–240V AC input |
| Maximum consumption | 171W |
| Operating environment | 0–40°C, 5–95% non-condensing humidity |
| Security subscription | CyberSecure Enterprise is optional and subscription dependent; 95,000+ IDS/IPS signatures are stated with this service. |
| Availability | Contact FourTeck for current UAE availability, regional version, quantity and vendor lead time. |
Configuration, subscription and compatibility dependencies
Published platform figures describe the appliance under vendor test conditions and should not be treated as a guarantee for every policy set. Throughput changes with packet size, enabled inspection, SSL decryption, logging, VPN encryption, routing complexity and concurrent session behaviour. A sizing exercise should include normal utilisation, busy-hour peaks and realistic growth headroom.
CyberSecure Enterprise is an optional annual service rather than an assumption that should be built into every quotation. Buyers should decide whether the additional signature coverage and threat-intelligence service are required, who will own renewal, and whether the subscription is available under the intended regional procurement route. Similarly, UI Care and professional support terms shown in some international stores may not apply to a UAE quotation unless specifically confirmed.
High-speed optics and cabling must match both sides of each link. QSFP28 and SFP28 modules, fibre type, connector type, wavelength, direct-attach length, breakouts and switch compatibility should be checked in the bill of materials. Never assume that a visually compatible transceiver is operationally supported.
A practical purchase and deployment journey
Measure the requirement
Collect current WAN usage, inter-VLAN traffic, client counts, UniFi device inventory, tunnel counts, session data and three-year growth expectations.
Design the topology
Define WAN diversity, core connections, routing domains, security zones, management paths, high availability and failure behaviour.
Build the bill of materials
Specify appliance quantity, regional model, optics, DAC cables, patching, rack hardware, power feeds, subscriptions and spare components.
Stage and validate
Back up the existing environment, prepare addressing and policies, adopt the appliance, test routing, failover, inspection and monitoring.
Migrate with controls
Use an approved change window, rollback plan, stakeholder communication and post-change checks rather than treating gateway replacement as a simple cable swap.
High-capacity inspection without abandoning operational visibility
The most important capability is not the headline port speed alone; it is the ability to apply security controls while the network is busy. EF-Core supports stateful and application-aware firewalling, DPI, content filtering, URL controls, intrusion prevention and SSL inspection. This gives administrators a richer policy model than source, destination and port rules alone.
Encrypted traffic inspection should be introduced carefully. Certificate deployment, privacy obligations, excluded applications, troubleshooting procedures and endpoint trust must be planned. Some applications use certificate pinning or other controls that prevent inspection. A pilot policy is preferable to enabling decryption everywhere at once.
Routing flexibility for campus and multi-site designs
Support for OSPF and BGP makes the platform relevant to networks that need more than static routes. Dynamic routing can improve scalability, simplify path exchange and support multiple upstream or internal routing domains. Policy-based routing and advanced NAT add control over how specific traffic leaves the network.
These features also raise the need for disciplined design. Route filtering, summarisation, administrative boundaries, convergence expectations and change ownership should be documented. A gateway with advanced routing capability should still be introduced with a controlled routing policy that prevents accidental route propagation.
Resilience as a system, not a single feature
Shadow Mode high availability and two hot-swappable power supplies provide useful building blocks. A resilient deployment, however, needs duplicated upstream and downstream paths, independent power where available, correct switch configuration, monitored failover and procedures for software upgrades or hardware replacement.
Buyers should decide whether they need a single unit with power redundancy or a true gateway pair. The latter requires additional budget, rack space, ports, optics and design effort. FourTeck can help translate the required recovery objective into a suitable topology and quotation scope.
Ideal environments and use cases
Large education campuses
Universities and school groups with dense wireless usage, segmented departments, guest networks, laboratories and multiple internet services may benefit from the high client and device scale.
Hospitality and mixed-use properties
Large properties can separate guest, staff, building systems, retail tenants and operational networks while retaining central traffic visibility and multi-WAN control.
Enterprise headquarters
High-speed internet, cloud workloads, unified communications and large user populations can justify a gateway designed to preserve inspection performance at scale.
Multi-site operations
Retail, logistics, services and distributed businesses can use VPN and SD-WAN capabilities to connect branches, though tunnel design and addressing consistency remain essential.
Integration and operational considerations
EF-Core runs the UniFi Network application and is intended to sit within a UniFi-managed environment. Before migration, confirm the source controller version, supported backup and restore path, site ownership, administrator roles, remote-access method and monitoring dependencies. The appliance supports current UniFi mobile applications, but operational processes should not rely on mobile access alone.
Addressing and segmentation deserve special attention. Document VLANs, DHCP scopes, DNS forwarding, internal routes, public IP addresses, NAT rules, policy objects and VPN networks. Clean up obsolete rules before migration rather than carrying years of technical debt into a new gateway. Where regulatory or internal controls apply, involve the relevant security and compliance owners in rule approval.
Logging requirements may include retention, external syslog, security monitoring or incident-response workflows. Confirm what telemetry must leave the gateway, how it is protected and how alert ownership is assigned. High session volumes can generate substantial operational data, so visibility should be designed around useful events rather than collecting information without a review process.
Finally, plan lifecycle activities. Define software maintenance windows, configuration backup ownership, administrator access reviews, subscription renewal dates, spare optics, vendor support routes and periodic failover testing. The platform can simplify daily UniFi operations, but governance remains a customer responsibility.
Buyer questions to resolve before ordering
Separate internet speed from internal routing, VPN, east-west traffic and SSL inspection demand. Use peak measurements, not only circuit labels.
Map each WAN, core, management and HA link to a port type and speed, then select the matching optics or copper cable.
Define the acceptable outage, maintenance approach and upstream redundancy before choosing one appliance or two.
Confirm CyberSecure Enterprise, renewal term, regional eligibility and any additional support coverage as separate quotation items.
List core switches, identity systems, DNS services, monitoring platforms, VPN peers, cloud services and external logging requirements.
Assign responsibility for design, configuration, testing, rollback approval, documentation and post-migration monitoring.
Procurement checklist
How FourTeck can assist
FourTeck can help translate an enterprise network requirement into a clearer procurement scope. Assistance may include reviewing user and device counts, validating port and uplink needs, identifying optics and cable dependencies, comparing a single gateway with an HA pair, and discussing whether optional security services should be included.
For projects that require more than supply, installation and configuration scope can be discussed separately. This may cover rack planning, initial adoption, WAN configuration, network migration, VLAN and policy implementation, VPN setup, routing validation, failover testing and handover documentation. Final activities depend on the approved statement of work.
Explore network security services or send the project requirement for review.
UAE availability and support guidance
Contact FourTeck to confirm current UAE availability. Supply timing may depend on the regional model, requested quantity, optional accessories, subscription choices and vendor lead time. A quotation should clearly separate the appliance, optics, direct-attach cables, subscriptions, installation and configuration services so that procurement teams can compare the complete requirement.
Delivery and project coordination can be discussed after the exact bill of materials and destination are confirmed. For deployment planning, provide the rack location, power arrangement, WAN handoff details, core-switch interfaces, existing UniFi environment and preferred migration period.
Browse other enterprise firewall products and related solutions.
Dubai, Abu Dhabi, Sharjah and Ajman coverage
FourTeck can coordinate requirement review and quotation discussions for organisations in Dubai, Abu Dhabi, Sharjah and Ajman. The engagement can begin with a remote review of the network design, current UniFi deployment, expected capacity, interface map and security objectives. Where installation, configuration or migration support is required, the location, access conditions, change window, customer responsibilities and acceptance criteria should be included in the project scope. Product availability, engineer scheduling and delivery planning remain dependent on the confirmed model, quantity, destination and agreed statement of work.
GCC availability
Organisations planning an EF-Core deployment elsewhere in the GCC can contact FourTeck for requirement review, model selection, quotation coordination and regional project planning. The same gateway may be considered for enterprises in the United Arab Emirates, Saudi Arabia, Kuwait, Qatar, Bahrain or Oman, but procurement conditions should never be assumed to be identical. Product version, licensing eligibility, delivery schedule, support route, service visits and vendor lead time can vary by country, quantity and project scope. Buyers should provide the destination country, number of appliances, single-unit or HA requirement, preferred interfaces, subscription term, deployment site and expected implementation period. FourTeck can then discuss a suitable bill of materials, configuration scope and delivery approach without implying local inventory, fixed customs outcomes or guaranteed installation dates. For Kuwait-related enquiries, the FourTeck Kuwait resource may also support regional coordination.
Africa availability
FourTeck can also assist organisations evaluating enterprise UniFi gateways for projects in Africa. Requirement planning may cover the EF-Core appliance, high-availability quantity, optics, power considerations, subscriptions, routing design, migration tasks and support expectations. Fulfilment can depend on the destination country, regional product version, quantity, shipping arrangement, vendor lead time, local power and regulatory considerations, and whether installation or remote configuration is requested. Buyers should share the destination, exact product requirement, proposed topology, quantity, preferred deployment schedule and any onsite coordination needs before expecting a quotation. This information allows a more appropriate review without promising local inventory, immediate shipment, customs clearance or country-wide field coverage. Organisations in East Africa can consult FourTeck Kenya or FourTeck Uganda, while broader regional enquiries can use the FourTeck Africa portal.
Related products and services to evaluate
Enterprise Fortress Gateway
A lower-capacity enterprise UniFi gateway may be a better fit where 25G connectivity and lower device scale satisfy the requirement. Compare measured needs rather than selecting by name.
CyberSecure Enterprise
Consider the optional annual threat-intelligence service when the project requires the expanded signature set and managed renewal planning.
100G and 25G connectivity
QSFP28 modules, SFP28 modules, DACs and fibre patching should be selected for the exact distance, medium and connected equipment.
Installation and migration
A structured service can include discovery, configuration preparation, change planning, testing and documentation rather than appliance supply alone.
Why businesses contact FourTeck
Enterprise gateway purchasing involves more than matching a throughput figure. Businesses contact FourTeck to clarify the requirement, compare a single appliance with a resilient pair, validate the physical interface plan, identify missing optics, separate included functions from subscriptions, and coordinate a quotation that procurement teams can understand.
FourTeck can also discuss installation planning, configuration boundaries, migration dependencies, documentation and regional delivery coordination. The objective is not to make unsupported promises; it is to help the customer define what must be supplied, configured, tested and maintained. Learn more about FourTeck and its approach to business technology requirements.
Frequently asked questions
What is the Ubiquiti EF-Core used for?
It is an enterprise UniFi Cloud Gateway used for high-capacity routing, firewall policy, traffic inspection, VPN connectivity, multi-WAN operation and central management of large UniFi Network environments.
How much IDS/IPS throughput does it provide?
Ubiquiti publishes 79 Gbps IDS/IPS throughput. Actual results depend on traffic profile, packet size, inspection settings, encrypted traffic, logging and other enabled services, so project sizing should include realistic workload assumptions.
Does EF-Core support 100G connections?
Yes. It has four QSFP28 interfaces supporting 100G and 40G. The required modules, fibre or DAC cables must be selected separately for the connected equipment and link distance.
Can the EF-Core be deployed as a high-availability pair?
Yes. The platform supports Shadow Mode using VRRP gateway failover. A complete HA design also requires redundant links, switch ports, power and an agreed failover-testing procedure.
Is CyberSecure Enterprise included?
It should be treated as an optional annual subscription unless the quotation states otherwise. Ubiquiti associates its 95,000-plus IDS/IPS signature figure with CyberSecure Enterprise.
Does it support dynamic routing?
Yes. Confirmed capabilities include OSPF and BGP, along with policy-based routing and advanced NAT. Routing policy should be designed and tested to prevent unintended route exchange.
Is the EF-Core suitable for a small office?
Usually only when a specific high-speed, interface or resilience requirement justifies it. Smaller UniFi gateways may offer a more proportionate fit for modest user counts and internet speeds.
What information is needed for an accurate quote?
Provide quantity, destination, WAN speeds, user and device counts, port map, optic requirements, HA objective, security subscription choice, rack and power details, and any installation or migration scope.
Is the EF-Core currently available in Dubai?
Availability should be confirmed for the required quantity and regional model. FourTeck can review the requirement and coordinate current UAE availability and lead-time information.
Can FourTeck help with configuration and migration?
Configuration, installation, migration, testing and documentation can be discussed as project services. The exact deliverables depend on the existing environment and approved statement of work.
Plan the EF-Core around your real network
Share the expected traffic, user count, UniFi device inventory, interface requirements, redundancy objective and destination. FourTeck can help prepare a clearer appliance, accessory, subscription and service quotation.
Reviews
There are no reviews yet.