Ubiquiti USG-PRO-4 - performance test

USG-PRO-4, the advanced and powerful router with security gateway working in the Ubiquiti UniFi system allows to safely expand the network capabilities. This is professional equipment, although thanks to its compatibility with the Ubiquiti UniFi Controller software, its incorporation into an existing network should not be a problem, even for beginners. Support for VLAN, VPN Pass-Through support, advanced firewall setting options and powerful components should be a guarantee of creating a stable and secure network. Check out our performance test and see how the Ubiquiti Unifi Security Gateway Pro performs under simple test conditions.

Ubiquiti UniFi Security Gateway Pro has two optional Gigabit SFP WAN ports on board, providing fiber optic communication for backhaul applications, four Gigabit Ethernet ports, including 2 LAN and 2 WAN ports interchangeable with SFP, a console port and a USB 2.0 port. Additionally, there is a small physical reset button on the front panel, as well as a large square illuminated boot button with the Ubiquiti manufacturer's logo, classic for Ubiquiti UniFi hardware. Rear panel of the device is a series of ventilation holes and cloverleaf power cable entry. Ubiquiti UniFi USG-PRO-4 has been equipped with a built-in AC/DC Power Adapter, 60W, 24V, 2.5A. It is not compatible with the UniFi Redundant Power System, which makes it more difficult to ensure continuous operation in case of power supply failure or a failure of the power supply itself and requires using external solutions.

The equipment is designed to be mounted in a 19'' rack.

The interior of Ubiquiti Security Gateway Pro 4 hides quite powerful components. It is a Dual-Core 1 GHz MIPS64 processor equipped with hardware acceleration for Internet packet processing, 2 GB of DDR3 RAM, and 4 GB of On-Board Flash Storage. The whole thing is actively cooled by two fans.

According to the manufacturer's specifications, UniFi Security Gateway Pro 4 has a total packet switching capacity of 4 Gbps - Full Line Rate Layer 3 Forwarding, for packets 512b or larger. For smaller 64-byte packets, the manufacturer claims the ability to switch more than one million packets per second, with the brochure specification specifying this value at 2,400,000 pps. According to the data, throughput with IPS/IDS, DPI, firewall, and bandwidth management options enabled has a performance of 250Mbps

After connecting Ubiquiti UniFi Security Gateway Pro 4 to an existing Ubiquiti UniFi Controller managed network, an adoption issue occurred. It was necessary to perform a software update and enter the configuration manually. However, this may have been due to the unusual network topology where the Security Gateway Pro was not the only device accessing the WAN. The tests were conducted on a single WAN and LAN connection, so they only illustrate partial capabilities of the device. Hardware configuration is intuitive and possible through the GUI and the mentioned Ubiquiti UniFi Network Controller software. The system suggests installing the software for better operation of the device. In addition to a simple menu, it is also possible to search for individual settings.

Below, we present how the main menu of the Ubiquiti UniFi controller looks like

The tests performed were done in three device configuration variants in combination with two types of tests, using TCP and UDP packets. The configuration variants are:

● Basic configuration, Internet Thread Management OFF,

● Security protection mode level 1, optimized for performance, Internet Thread Management ON - Level 1 Maximum Performance,

● Security protection mode level 5, optimized for security, Internet Thread Management ON - Level 5 Maximum Protection,

In the second and third variants with configured security management, the Ubiquiti UniFi USG-PRO-4 network device had IPS/IDS Intrusion Detection System/Intrusion Prevention System, DPI Deep Packet Inspection and firewall options enabled. It is worth noting that the functionalities for individually set security rules, which probably can lower the final performance, were not enabled.

The tests of actual device performance are therefore simplified. In TCP tests, the device managed to saturate to a maximum speed of 800 Mbps with one active WAN port. For the UDP test the result was a bit of a surprise, as the values obtained were half those for TCP. With the aforementioned IPS/IDS, DPI, firewall and bandwidth management options enabled, the simplified tests resulted in throughputs between 400 and 500 Mbps for both UDP and TCP protocols. Test results under the described conditions are illustrated by the following graphics.

Internet Thread Management OFF, test TCP

Internet Thread Management OFF, UDP test