Reviews
Part of Network security for small business: separation, router settings, and quarterly checks
How to bench-test network security gear before buying it for 2027
How to evaluate office network security equipment: the five jobs it must do, a three-hour bench trial that proves them, and what the datasheet leaves out.
What to take away
- Bench-test on a desk, never on the live officetwo laptops, one phone on cellular data, one printer.
- Six steps take about three hours, from segmentation to a configuration restore.
- Record pass or fail for every step, plus the numbers named in each one.
- Datasheet throughput is measured with inspection off. Ask for the figure with every feature enabled.
- Score candidates against your own written requirements, not the vendor's feature list.
Five jobs the product has to do
Start with the drawing: which groups of devices may talk to each other, and which may be reached from outside.
Five jobs the product must do
- Keep work, weak, payment, guest groups apart
- Provide one authenticated way in from outside
- Filter what leaves through a filtering service
- Look after itself and say when it cannot
- Keep a record you can read later
Keep the groups apart. Work devices, devices that cannot defend themselves, payment equipment, guests. Each gets a segment, with rules between them that a person can read back a year later.
Provide one authenticated way in from outside. A VPN or an identity-aware path with a second factor, and nothing else open inbound. That administrator login is one of your most sensitive credentials, and identity and access explains how to hold it to the same standard as the rest.
Filter what leaves. Resolve names through a filtering service at minimum, so known-bad destinations fail before a connection starts. Category filtering and full inspection cost performance, so price that first.
Look after itself. Firmware updates on a schedule you set, a warning as the model nears end of support, and a configuration you can export and re-import. Equipment past support cannot be fixed, and CISA's catalog of known exploited vulnerabilities lists the flaws already used in attacks.
Keep a record you can read later. Which rule fired, who signed in remotely, what changed in the configuration, kept long enough to matter after an incident.
NIST's guidelines on firewalls and firewall policy argue that rules should come from a written policy instead of accumulating over the years.
The three-hour bench trial, step by step
Put the candidate on a desk with two laptops, a phone on cellular data, and a printer. Work through six steps, writing each result as you go.
The three-hour bench trial
- Place the segments on the box.Create an office zone and a guest zone, one laptop in each, the printer in the office zone. Pass: the guest laptop cannot reach the office laptop or the printer. Record the rule count and the writing time.
- Prove the way in.Turn on remote access with a second factor, connect from the phone over cellular, then scan the box's outside address. Pass: only the expected port answers, and no account can switch the second factor off. Record connection time and open ports.
- Test what leaves.Point a laptop at the product's resolver and request one known-bad domain from a public blocklist, then an ordinary site. Pass: the bad name fails and the good name loads at normal speed. Record whether a block page appeared.
- Check it looks after itself.Set the update schedule and find the published end-of-support date for the model on the quote. Pass: the date is published, and the vendor states how you will be told. Record the date.
- Make traffic, then find it.Sign in remotely, change one rule, and search the logs for both events. Pass: you can say who signed in and what changed without calling the vendor. Record retention in days and where logs can be sent.
- Break it on purpose.Export the configuration, factory-reset the unit, re-import it, then repeat step 1. Pass: the rules return and the guest laptop is still isolated. Record the restore time.
Step 6 is the one people skip. An export nobody has imported is a promise rather than a way back, the same test that backup and recovery recommends for files.
Test one device at a time. If guest isolation fails, you want one phone that cannot print, not an office that cannot work.
What the datasheet leaves out
Vendors show the same six lines, and each one hides a decision.
Datasheet claims vs what to ask
Datasheet line
- Throughput
- Measured with inspection off
- Cloud managed
- Console is elsewhere
- Advanced threat protection
- A subscription
- Supports VLANs
- Some number of them
- Logging
- It writes logs
- Enterprise grade
- A marketing tier
What it usually means
- Throughput
- Throughput with every feature on?
- Cloud managed
- What works when console unreachable?
- Advanced threat protection
- What stops when subscription lapses?
- Supports VLANs
- How many, on APs too?
- Logging
- How long, at our volume, sent elsewhere?
- Enterprise grade
- When does it leave support?
Ask instead
- Throughput
- Cloud managed
- Advanced threat protection
- Supports VLANs
- Logging
- Enterprise grade
What it usually means
- Throughput
- Measured with inspection switched off
- Cloud managed
- The console is elsewhere
- Advanced threat protection
- A subscription
- Supports VLANs
- Some number of them
- Logging
- It writes logs
- Enterprise grade
- A marketing tier
Ask instead
- Throughput
- What is the throughput with every feature on this quote enabled?
- Cloud managed
- What still works, and what can we change, when the console is unreachable?
- Advanced threat protection
- What stops working on the day the subscription lapses?
- Supports VLANs
- How many, and on the access points as well as the router?
- Logging
- For how long, at the volume our office produces, and can they be sent elsewhere?
- Enterprise grade
- When does this model leave support, and how will we be told?
Buy against your own list
Write the drawing in one column and your own requirements beneath it: segments, which device reaches which, how many people need remote access, log retention.
Then audit what you already own against the same list. Plenty of business-grade routers handle the first four jobs, which is why network security suggests starting with the cupboard.
NIST's Small Business Cybersecurity Corner frames the spend as managing IT risk rather than buying features. A box bought now that leaves support in 2027 is a one-year purchase, so put the end-of-support date beside the price.
