Mounting UniFi USG and Cloud Key Gen 2 Plus Together (1U)

The UniFi Security Gateway and the Cloud Key Gen 2 Plus are both a hardware generation behind Ubiquiti's current lineup, and both are still bolted into thousands of homelab racks doing exactly what they were bought to do. If you are running that pair, the question is rarely "should I replace them." It is "how do I get them off a shelf and into the rack without buying two separate mounts and a fistful of adapters." This post walks through the geometry, the power, and the cabling of putting a USG and a Cloud Key Gen 2 Plus into a single 1U slot, plus the handful of spots where the job quietly goes sideways.

The two devices, by the numbers

Before you decide how to rack anything, measure it. Both of these boxes are small, both are passively cooled, and both were designed to sit on a desk rather than hang off rack rails, which is the whole reason a mount exists.

The USG-3P is roughly 135 mm square and about 29 mm tall. All of its connectivity lives on one face: a WAN port, a LAN port, a third configurable LAN2/WAN2 port, a serial console port, and a 5 V DC barrel jack for the external power brick. Three gigabit RJ45 ports, no PoE in or out, no fan. Ubiquiti rates the routing engine at roughly line-rate gigabit for plain NAT, but turn on IDS/IPS and real-world throughput collapses to somewhere around 85 Mbps. Hold that number; it comes back at the end.

The Cloud Key Gen 2 Plus is a different shape: roughly 105 mm wide, 115 mm deep, and about 43 mm tall. That extra height is the 2.5-inch hard drive it carries — a 1 TB spinner from the factory — because this unit runs UniFi Protect as a small NVR alongside the Network controller. It takes power over 802.3af PoE or USB-C, has an internal battery for graceful shutdown when the feed drops, and puts a small status screen on the front face. Its network and power feed come in on the rear.

Two things matter for what follows: the Cloud Key is the taller of the two at about 43 mm, and it is the only one of the pair with a moving part inside.

Why one rack unit holds both

A rack unit under EIA-310-D is 44.45 mm of vertical space — the "1U" everyone quotes. A 19-inch rack is 482.6 mm across the outside of the rails, with roughly 450 mm of usable width between them once you account for the mounting flanges. That width is the number that makes this combination work.

Set the USG's 135 mm footprint next to the Cloud Key's 105 mm and you are using about 240 mm side by side, leaving north of 200 mm of open panel for cable routing and airflow. Height is the tighter constraint: the Cloud Key's 43 mm body sits just under the 44.45 mm ceiling of a 1U opening, with almost nothing to spare. A combined tray like the UniFi USG & Cloud Key Gen 2 Plus - 19" Rack Mount 1U is built around exactly that clearance, cradling both devices face-forward so the Cloud Key screen stays visible and the USG ports stay reachable.

The "face-forward" choice is deliberate. You could turn the USG around so its ports face the rear and the cabling disappears behind the rack, and plenty of builders do. The tradeoff is that you then lose sight of the USG's link LEDs, which are the fastest way to tell whether the ISP handoff is actually up. Mounting both faces to the front keeps diagnostics visible at the cost of routing patch cables around to the front lip — a fair trade in a homelab you look at, less so in a sealed closet you never open.

Power and cabling: the actual gotchas

This is where a clean-looking plan meets reality. The two devices are powered in completely different ways, and neither is as tidy as a rack purist would like.

The USG runs on a 5 V DC barrel jack fed by an external wall brick. There is no getting around that brick — it has to live somewhere. The least ugly options are to velcro it to a rear rail, drop it on a vented shelf below, or zip-tie it to the PDU tray if you have one. What you do not want is the adapter dangling by its own cord behind a device that weighs almost nothing, because over months that cord works the barrel connector loose and you get intermittent reboots that look like a failing gateway.

The Cloud Key is the easier half. Feed it from an 802.3af PoE port on a nearby switch and its power and data arrive on a single cable, roughly a 7 to 9 W draw well inside the af budget. That is the setup to aim for. If you have no PoE to spare, the USB-C alternative works but drags a second wall wart into the picture, which defeats much of the point of racking cleanly.

A few routing notes worth writing on the back of your hand:

• Keep the USG's barrel connector supported so its weight is not hanging on the jack. A single zip tie anchoring the DC lead to the tray is enough.
• Run the Cloud Key on PoE if you possibly can; one cable beats three.
• Leave a service loop on both network drops. These devices sit shallow in the rack and you will want the slack the first time you pull one for a firmware sulk.
• Label the WAN drop at the USG. On a three-port gateway with two identical-looking RJ45 jacks, a mislabeled WAN is a five-minute mystery every single time.

Thermal reality

Neither device has a fan, so all the heat leaves by convection and conduction through the case. On their own, in open air, both run warm rather than hot. The complication is the hard drive in the Cloud Key. A spinning 2.5-inch drive is a continuous, modest heat source, and it is the component you least want to cook, because it is the one holding your Protect footage.

Practical rules: do not sandwich this tray directly beneath something that dumps heat, like an amplifier or a hard-working PoE switch, without at least a vent gap or a 1U blanking strip with perforations between them. Keep the closet or cabinet ambient under about 40 C and the drive will be fine for years; let a sealed cabinet climb into the high 40s in summer and you are shortening its life on purpose. The UniFi USG & Cloud Key Gen 2 Plus - 19" Rack Mount 1U leaves the tops of both devices open rather than shrouding them, which is the right call for two passively cooled boxes — a closed cover would trap exactly the heat they need to shed.

If you are the type to monitor everything, the Cloud Key reports its own drive temperature in the UniFi OS console. Watching that figure across a summer is a better guide than any generic rule of thumb about closet temperatures.

The 10-inch alternative when it is USG only

Not everyone racking a USG still runs a Cloud Key next to it. Plenty of builders have moved the controller onto a UDM, a Cloud Gateway, or a self-hosted host, and kept the USG in place purely as the router. If that is you, a full 19-inch combined tray is wasted width.

For a gateway-only build in a compact cabinet, the UniFi Security Gateway 10" Rack Mount - 1U is the more sensible footprint. A 10-inch rack gives you roughly 220 mm of usable internal width, and the USG's 135 mm body drops into that with room for cable dressing on one side. Half-depth 10-inch cabinets have become the default for small homelabs precisely because devices like this one were never deep to begin with, and hanging a 300 mm gateway off 19-inch rails always looked faintly absurd.

The decision is really about what else lives in the rack. If the Cloud Key is staying and you want them together, the combined 19-inch tray earns its space. If the USG is flying solo in a 10-inch homelab cabinet, the UniFi Security Gateway 10" Rack Mount - 1U keeps the whole build in the smaller form factor without an adapter shelf.

Is the USG still worth racking in 2026?

Worth asking before you spend an evening on cable management for a device Ubiquiti stopped selling. The honest answer is: it depends entirely on your WAN speed and whether you want intrusion detection.

That 85 Mbps figure from the top is the ceiling. With IDS/IPS enabled, the USG's processor cannot push much past it, so if your internet plan is 300, 500, or 1000 Mbps and you actually want the security engine running, the gateway becomes the bottleneck on your own connection. There is no tuning around it; the silicon is what it is.

Keep the USG racked if your WAN is comfortably sub-gigabit, if you run it as a plain router without IPS, or if it has simply been rock-solid and you would rather not touch a working network. All three are legitimate. The replacement path, when you get there, is a UXG-Lite or a Cloud Gateway Ultra, both of which route gigabit with the security features on and cost less than the USG did new. But "still works, still stable, mount it and move on" is a defensible position, and a tidy 1U tray is a lot cheaper than a new gateway.

Wrap-up

Two legacy boxes, one rack unit, and about four decisions: face-forward versus ports-to-the-rear, PoE versus USB-C for the Cloud Key, where the USG's power brick lands, and whether you even need the 19-inch width. Get those right and a USG plus Cloud Key Gen 2 Plus disappears into a clean 1U line with visible LEDs and a drive that stays cool. If the pair is staying together, the UniFi USG & Cloud Key Gen 2 Plus - 19" Rack Mount 1U is the one-part answer; if the USG is on its own in a compact cabinet, the UniFi Security Gateway 10" Rack Mount - 1U keeps it in the 10-inch world where a device this size belongs.