ZyXEL USG20-VPN VPN Firewall Reviewed

[thiggins]

ZyXEL's USG20-VPN is a flexible VPN router that also supports content filtering and anti-spam.

Read on SmallNetBuilder

 

[vnangia]

Thanks for the review. Any chance of getting (informal) numbers on what the hit is on WAN-LAN throughput when the UTM features are enabled?

 

[kvic]

Interestingly this device has a Cavium 7010. The tested VPN throughput seems lower than what the HW is capable of...

 

[sfx2000]

Interestingly this device has a Cavium 7010. The tested VPN throughput seems lower than what the HW is capable of...

Software tuning perhaps?

 

[kvic]

Software tuning perhaps?

yeah, I would guess config/setup not right or FW not properly done before release.

 

[thiggins]

Thanks for the review. Any chance of getting (informal) numbers on what the hit is on WAN-LAN throughput when the UTM features are enabled?

Not likely. I am trying to catch up on the review backlog created while new test processes were being developed. Sorry.

 

[dreid]

Interestingly this device has a Cavium 7010. The tested VPN throughput seems lower than what the HW is capable of...

Thanks for your comment. Router manufacturers typically use a UDP based test to rate throughput on their devices. The TotuSoft test uses TCP. UDP has a lower overhead than TCP, so manufacture VPN ratings are typically higher than my measurements.

 

[System Error Message]

1 core :O, as i keep complaining why is anyone using these cavium CPUs keep using old setups? What about their 32 or 48 core MIPS variants? Ubiquiti wont be able to compete with mikrotik in performance if they keep using dual cores. Other VPN router manufacturers also still need to consider using many core. Its not like the encryption engine is a per chip, its usually a per core thing.
In terms of UTM performance i would expect that chip to do around 100Mb/s or lower in throughput.

 

[Kevlar3D]

I am currently in the process of replacing 16 of these because ZyXEL doesn't keep current with patching their software. I had to disable external https access because ZyXEL still hasn't patched known vulnerabilities. From a reliability and throughput standpoint, these are great but ZyXEL needs to make security a priority before I will ever consider their products again.

 

[sfx2000]

1 core :O, as i keep complaining why is anyone using these cavium CPUs keep using old setups? What about their 32 or 48 core MIPS variants? Ubiquiti wont be able to compete with mikrotik in performance if they keep using dual cores. Other VPN router manufacturers also still need to consider using many core. Its not like the encryption engine is a per chip, its usually a per core thing.
In terms of UTM performance i would expect that chip to do around 100Mb/s or lower in throughput.

It's actually a pretty decent chip - Cavium has done a good job with their functional blocks, and in an application like this, and at the pricepoint - it's a good enough solution... the core itself is generally in a supervisory role, much of the code runs on the FUB's..

 

[roundtree]

UDP has a lower overhead than TCP, so manufacture VPN ratings are typically higher than my measurements.

One correction for the article. While the protocol overhead from TCP vs. UDP will see a drop in throughput, the drop won't be much. Instead, the dropoff is due to the throttling nature of TCP. UDP assumes that the application will responsibly monitor end-to-end data transmission. TCP connections will suffer from the "sawtooth" effect as source and destination continually negotiate connection parameters.

 

[8bitbanger]

Did Zyxel remove the ADP feature of the original USG20? Or has this somehow been rolled into the content filtering? Seems like a pretty important feature for a SOHO-targeted UTM.

 

[Dan-H]

Curious, who won the give-away ?

http://www.smallnetbuilder.com/contests/33007-smallnetbuilder-giveaway-zyxel-usg20-vpn-vpn-firewall

 

[thiggins]

http://www.smallnetbuilder.com/contests/33012-smallnetbuilder-giveaway-results-zyxel-usg20-vpn

 

[L&LD]

http://www.smallnetbuilder.com/contests/33012-smallnetbuilder-giveaway-results-zyxel-usg20-vpn

Is that page link blank for anyone else, or just me?

 

[Dan-H]

Is that page link blank for anyone else, or just me?

the page is blank for me too, but this page shows the lucky winner at the top of the page.

http://www.smallnetbuilder.com/contests

 

[sfx2000]

ad blocks disabled...

 

[thiggins]

Sorry guys. Forgot to flip a bit in the publishing system. Should be ok now.