UniFi Network Build: 2.5GbE with Dedicated Firewall
A modular approach with Cloud Gateway Ultra and Flex Switch 2.5G PoE, March 5, 2026
After researching UniFi options, I landed on a dedicated firewall + switch + AP approach rather than an all-in-one Dream Machine. Here's why and the full buildout with expansion options for additional buildings.
🎯 Why Separate Firewall & AP?
| Approach | Pros | Cons |
|---|---|---|
| Dream Machine (All-in-One) | Simple, cheap, one device | Shared resources, no PoE on some models, limited throughput |
| Dedicated Gateway + Switch + AP | Full throughput, PoE, modular, upgradeable | More expensive, more to manage |
For my use case (multiple buildings, 2.5GbE needs, potential expansion), the dedicated approach makes more sense. The Cloud Gateway Ultra handles routing/firewall while the Flex Switch 2.5G provides PoE+ and 2.5GbE ports.
📦 Main Building Build
| Item | Price | Qty | Subtotal |
|---|---|---|---|
| UniFi Cloud Gateway Ultra (UCG-Ultra) | $129.00 | 1 | $129.00 |
| UniFi Flex Switch 2.5G PoE (8-port) | $199.00 | 1 | $199.00 |
| UniFi U7 Long-Range AP | $159.00 | 1 | $159.00 |
| AC Adapter 210W (PoE power) | $79.00 | 1 | $79.00 |
| Vertiv Liebert PSA5 UPS 1500VA | $185.16 | 1 | $185.16 |
| Total | $751.16 |
Optional Add-ons
- • UI Care U7-LR: $39
- • UI Care USW-Flex: $39
- • UI Care UCG-Ultra: $25
- • CyberSecure (UCG-Ultra): $99
Why These Choices?
- • 2.5GbE for faster LAN speeds
- • PoE+ to power AP without adapters
- • Dedicated firewall = full throughput
- • UPS keeps network up during outages
🏗️ Expansion: Adding More Buildings
If you have additional buildings (like rental properties or workshops), you can extend the network with just a POE switch and AP — no additional firewall needed since they're behind the main gateway.
Per Building Add-on
| Item | Price | Notes |
|---|---|---|
| UniFi Flex Switch 2.5G PoE | $199.00 | 8-port, PoE+ |
| UniFi U7 Long-Range AP | $159.00 | WiFi 7, PoE powered |
| Cat6a Cable (100ft) | ~$30-50 | Or fiber for longer runs |
| Per Building Total | ~$390-410 |
🔌 Network Topology
Internet →
↓
Modem → UCG-Ultra (Firewall/Router)
↓ (WAN)
USW-Flex-2.5G-8-PoE (Main Switch)
├─→ Devices (2.5GbE ports)
├─→ U7-LR AP (PoE, Main Building WiFi)
├─→ Building 2 (Ethernet/Fiber run)
│ └─→ USW-Flex-2.5G + U7-LR
└─→ Building 3 (Ethernet/Fiber run)
└─→ USW-Flex-2.5G + U7-LR
🌿 Ethernet vs. Fiber
- < 300ft: Cat6a Ethernet ($30-50/100ft)
- > 300ft: Fiber (single mode)
- Fiber media converters: ~$20-40 each
- Direct attach: SFP+ DAC cables work too
⚡ PoE Considerations
- • Flex Switch 2.5G provides PoE+ (30W/port)
- • U7-LR needs 802.3af PoE
- • 210W adapter powers all 8 ports
- • Total budget: 30W × 8 = 240W max (adapter limited)
💰 Cost Summary
| Configuration | Main Building | +1 Building | +2 Buildings |
|---|---|---|---|
| Gateway + Switch + AP | $566 | $566 | $566 |
| UPS | $185 | $185 | $185 |
| Building Add-ons | — | ~$400 | ~$800 |
| Cabling (est.) | $50 | $100 | $150 |
| Total | ~$800 | ~$1,250 | ~$1,700 |
📋 Specs Breakdown
| UCG-Ultra | Up to 1 Gbps routing, 5 VLANs, UniFi OS |
| USW-Flex-2.5G | 8 × 2.5GbE ports, 6 × PoE+ (120W budget) |
| U7-LR | WiFi 7, 4×4 MU-MIMO, 802.3af PoE, 1.3 Gbps |
| UPS | 1500VA/900W, 10 outlets, 2 USB charging |
💡 Pro Tip
The UCG-Ultra handles up to 1 Gbps routing. If you have multi-gig internet (like Verizon Fios 500+), consider the UCG-Max or Dream Machine Pro SE for higher throughput.
This setup gives you a solid, expandable UniFi network with 2.5GbE throughout, dedicated firewall protection, and the ability to add buildings as needed. The UPS keeps you online during power outages — critical when you rely on internet for work.