Service gateway ESR-15R

• Data routing
• Hardware acceleration
• Multiprotocol Label Switching (MPLS)
• Construction of secure network perimeter (NAT, Firewall)
• Intrusion prevention and detection (IPS/IDS)
• Service Level Agreement (SLA)
• Filtering of network data by various criteria (including filtering by applications)
• Organization of secure network tunnels between different officesof a company
• Remote connection of staff members to an office
• Internet channel management and bandwidth allocation within an office using QoS
• Pairing with equipment of leading manufacturers
• Organization of redundant connection (by means of wires or 3G/LTE modem)

ESR-15R are service routers designed for connection of small and middle-sized offices in enterprise networks. The functionality of firewall and router allows ensuring security with various Internet connection options. The device supports advanced routing, WAN organization and network security functions.

The key elements of ESR service routers are data processing hardware acceleration means that ensure a high level of perfor-mance. Hardware and software processing is distributed among the units of the device.

Interfaces

• Ethernet 1000BASE-X SFP - 2
• Ethernet 10/100/1000BASE-T - 4
• Console RS-232 (RJ-45) 1
• USB 2.0 - 2

Performance

• Firewall/NAT/routing (1518B frames) - 1.15 Gbps; 94.7k pps
• Firewall/NAT/routing (74B frames) - 67 Gbps; 113.2k pps
• Firewall/NAT/routing (IMIX)1 - 564.7 Mbps; 102.3k pps
• L2 switching (1518B frames) - 1.15 Gbps; 94.7k pps
• IPsec VPN (1456B frames) - 249.7 Mbps; 21.4k pps
• IРsec (IMIX)2 - 130.5 Mbps; 24.4k pps
• Single IРsec tunnel (74В frames) - 8 Mbps; 13.4k pps
• Single IРsec tunnel (1456B frames) - 128.3 Mbps; 11k pps
• IРsec (IMIX) - 65.3 Mbps; 12.2k pps
• IPS/IDS 10k rules - 35.8 Mbps; 9.5k pps

System features

• VPN tunnels - 10
• Static routes - 1k
• Concurrent sessions - 4k
• VLAN support - up to 4k active VLANs in accordance with 802.1Q
• BGP routes - 1M
• OSPF routes - 30k
• RIP routes - 1k
• MAC table - 2k entries per bridge
• FIB size - 1M
• VRF - 32

Interfaces

• USB 3G/4G/LTE modem
• E1 TopGate SFP

Remote Access VPN clients

• PPTP/PPPoE/L2TP/OpenVPN/IPsec XAUTH

Remote Access VPN server

• L2TP/PPTP/OpenVPN/IPsec XAUTH

Site-to-site VPN

• IPsec: “policy-based” and “route-based” modes
• DMVPN
• DES, 3DES, AES, Blowfish, Camellia
• IKE MD5, SHA-1, SHA-2 message authentication

Tunneling

• IPoGRE, EoGRE
• IPIP
• L2TPv3
• LT (inter VRF routing)

L2 functions

• Packet switching (bridging)
• LAG/LACP (802.3ad)
• VLAN (802.1Q)
• Logical interface
• LLDP, LLDP MED
• MAC-based VLAN

L3 functions (IPv4/IPv6)

• NAT, Static NAT, ALG
• Static routes
• RIPv2, OSPFv2/v3, IS-IS, BGP
• Route filtering (prefix list)
• VRF
• Policy Based Routing (PBR)
• BFD для BGP, OSPF, static routes

BRAS (IPoE)3

• Subscriber termination
• White/black URL lists
• Quotas for traffic volume, session time, network applications
• HTTP/HTTPS Proxy
• HTTP/HTTPS Redirect
• Session accounting via Netflow protocol
• Interaction with AAA, PCRF servers
• Bandwidth management by offices, SSIDs and user sessions
• User authentication by MAC or IP address

Network security functions

• Intrusion Prevention/Detection system (IPS/IDS)3
• Interaction with Eltex Distribution Manager for obtaining licensable content — rule sets distributed by Kaspersky SafeStream II3
• Web filtering by URL, by content (cookies, ActiveX, JavaScript)
• Zone-based Firewall
• Filtering based on L2/L3/L4 fields and applications
• Support for access control lists (ACL) based on L2/L3/L4 fields
• Protection against DoS/DDoS attacks and notification on them
• Logging of attack and rule triggering events

Quality of Service (QoS)

• Up to 8 priority or weighted queues per port
• L2 and L3 traffic prioritization (802.1p (CoS), DSCP, IP Precedence (ToS))
• RED, GRED congestion avoidance algorithms
• Priority re-marking mechanisms
• Policy-map
• Bandwidth management (shaping)
• Hierarchical QоS
• Session labeling

IP addressing management (IPv4/IPv6)

• Static IP addresses
• DHCP client
• DHCP Relay Option 82
• Embedded DHCP server, 43, 60, 61, 150 options support
• DNS resolver
• IP unnumbered

Network reliability assurance means

• VRRP v2,v3
• Routes tracking based on VRRP
• WAN interfaces load balancing, data stream redirection, channel switching during QoS control
• Firewall sessions backup

Management and monitoring

• Support for standard and extended SNMP MIB, RMONv1
• Embedded Zabbix agent
• Authentication methods: RADIUS, TACACS+, LDAP
• Protection against configuration errors, automatic configuration recovery. Ability to restore the factory configuration
• CLI
• Syslog
• System resource usage monitoring
• Ping, traceroute (IPv4/IPv6), packet information in console output
• Firmware upgrade, configuration upload and download via TFTP, SCP, FTP, SFTP, HTTP(S)
• NTP
• Netflow v5/v9/v10 (export for URL statistics for HTTP, host for HTTPS)
• Local control via RS-232 (RJ-45) console port
• Remote control via Telnet, SSH (IPv4/IPv6)
• Displaying information on services/processes
• Local/remore router configuration storage

MPLS

• LDP
• 2VPN VPWS
• L2VPN VPLS Martini Mode
• L2VPN VPLS Kompella Mode
• L3VPN MP-BGP

SLA control functions

• Eltex SLA
  Channel parameters evaluation:
  • Delay (one-way/two-way)
  • Jitter (one-way/two-way)
  • Packet loss (one-way/two-way)
  • Packet Error Rate
  • Out-of-order delivery

Physical specifications and environmental parameters

• Maximum power consumption - 18 W
• Power supply - 100–264 V AC, 50–60 Hz
• Operating temperature - from 0 to +40 °C
• Storage temperature - from -40 to +70 °C
• Operating humidity - no more than 80 %
• Storage humidity - from 10 to 95 %
• Dimensions (W × H × D) - 267 × 44 × 160 mm
• Weight - 1.405 kg