Service gateway ESR-3200

• Data routing
• Flexible service configuration
• Hardware acceleration of data processing
• Multi-protocol Label Switching (MPLS)
• Construction of secure network perimeter (NAT, Firewall)
• Intrusion prevention and detection (IPS/IDS)
• Service quality monitoring (SLA)
• Filtering of network data by various criteria (including filtering by applications)
• Organization of secure network tunnels between different offices of a company
• Remote connection of staff members to office
• Management and distribution of Internet channel width within an office by using QoS
• Organization of redundant connection (by means of wires or 3G/LTE modem)
• Subscriber termination and bandwidth limiting — BRAS (IPoE)
• Possibility to operate with the equipment of leading manufacturers

The ESR-3200L service routers are universal hardware platforms capable of performing a wide range of tasks related to network security, data encryption, subscriber termination, etc.

The product line includes models that can be used in networks of various sizes, from enterprise networks to service provider networks and data centers.

The key features of ESR service routers are data processing hardware acceleration means that ensure a high level of performance. Hardware and software processing is distributed among the units of the device.

Interfaces

• 1000BASE-X/10GBASE-R/25GBASE-R (LAN/WAN) - 4
• 10GBASE-R SFP+/1000BASE-X SFP (LAN/WAN) - 8
• Console RS-232 (RJ-45) - 1
• OOB - 1
• USB 2.0 - 1
• microSD card slot - 1

Performance

• Firewall/routing (1518B frames) - 18.2 Gbps; 1495.1k pps
• Firewall/routing (IMIX)1 - 8.4 Gbps; 1520k pps
• IPsec VPN (1456B frames) - 1.1 Gbps; 127k pps
• IPsec (IMIX) - 779.2 Mbps; 145.5k pps
• IPsec tunnel (1456B frames) - 320.7 Mbps; 27.5k pps
• IPsec tunnel (IMIX)2 - 169.6 Mbps; 31.7k pps
• IPS/IDS 10k rules - 729 Mbps; 135.6k pps
• MPLS L2VPN switching (IMIX) - 1.4 Gbps; 267.6k pps
• MPLS L3VPN switching (IMIX) - 915.9 Mbps; 167.1k pps

Switching

• Up to 4094 VLAN (802.1Q)
• Voice-VLAN
• Q-in-Q (802.1ad)
• MAC-based VLAN
• Bridge domain
• LAG/LACP(802.3ad)
• Port-security, protected port
• Jumbo frames

MPLS

• LDP
• L2VPN VPWS
• L2VPN VPLS Martini Mode, Kompella Mode
• L3VPN MP-BGP (Option A, B, C)
• L2VPN/L3VPN over GRE, DMVPN
• Transparent transfer of service protocols

Routing

BGP:

• Address family: IPv4, IPv6, VPNv4, L2VPN, IPv4 label-unicast, Flow-spec
• Flexible management of route information by attributes. Support for Conditional Advertisement, Route Aggregation and Local-AS mechanisms
• Scalability and configuration flexibility: support for peergroup, dynamic neighbor, as-range, Route-reflector
• Fall over based on BFD and Fast Error Peer Detection
• Graceful restart
• Authentication
• Flexible redistribution from/to BGP process of other protocol routes
• Ability to run up to 64 processes simultaneously
• ECMP
• Support for policy-based routing

OSFP(v3):

• Different types of zones: Normal, Stub, Totally stub, NSSA, Totally NSS
• Operation in different types of networks: Broadcast, NBMA, Point-to-point, Point-to-multipoint, Point-to-multipoint non-broadcast
• Summarization and filtering of route information
• Authentication
• ECMP
• Passive interface
• Flexible redistribution from/to OSPF process of other protocol routes
• Ability to run up to 64 processes simultaneously
• Support for BFD
• Auto cost calculation mechanism
• Support for policy-based routing

IS-IS:

• Operation in different types of networks: Broadcast, Point-to-point
• Setting the neighbourhood of L1/L2 layers
• Мetric style: narrow, wide, transition
• Authentication
• Filtering of route information
• Flexible redistribution from/to IS-IS process of other protocol routes
• Ability to run up to 64 processes simultaneously
• Support for policy-based routing

RIP(ng):

• Operation modes (RIP only): Broadcast, Multicast, Unicast
• Summarization and filtering of route information
• Managing route metrics
• Authentication
• Passive interface
• Flexible redistribution from/to RIP process of other protocol routes
• Support for policy-based routing

Static:

• Support for BFD
• Recursive search
• Managing route metrics
• Ability to select the option of notifying the sender when traffic is blocked

Quality of Service (QoS)

• Up to 8 priority or weighted queues per port
• L2 and L3 traffic prioritization (802.1p (CoS), DSCP, IP Precedence (ToS))
• Hierarchical QoS
• Queue management: RED, GRED, SFQ, CBQ, WFQ, WRR
• Session labeling
• Bandwidth management (policing, shaping)

IPsec

• «Policy-based» and «route-based» modes
• Incapsulation modes: tunnel and transport
• Authentication pre-shared key, public key, xauth (ikev1 only), eap (ikev2)
• Support for mobike (ikev2 only)
• Support for ike ikering

Remote Access

• PPTP, L2TP over IPsec, OpenVPN, WireGuard
• PPPoE-/PPTP-/L2TP client
• User authentication
• Connection encryption

Security

• Access Control Lists (ACL) based on L2-/L3-/L4 fields
• Zone-based Firewall in two modes: stateful and stateless. Rule triggering logging, counters
• Filtering by applications
• Protection against DoS-/DDoS-/Spoof attacks and their logging
• Intrusion detection and prevention systems (IPS/IDS) and their logging3
• Signature analysis via IPS in two modes: transit and mirrored traffic analysis3
• Interaction with Eltex Distribution Manager to obtain licensed content — rule sets provided by Kaspersky SafeStream II4

Monitoring and management

• Support for standard and extended SNMP MIB, RMONv1
• Zabbix agent/proxy
• Authentication methods: RADIUS, TACACS+, LDAP
• Protection against configuration methods, automatic configuration recovery
• CLI, Syslog
• System resource usage monitoring
• Ping, monitor, traceroute (IPv4/IPv6), packet information in the console output
• Firmware upgrade, configuration upload and download via TFTP, SCP, FTP, SFTP, HTTP(S)
• Support for NTP
• Netflow v5/v9/v10 (exporting of URL statistics for HTTP, host for HTTPS)
• Local control via RS-232 (RJ-45) and OOB
• Remote control via Telnet and SSH (IPv4/IPv6)
• LLDP, LLDP MED
• Local/remote router configuration storage

SLA

• SLA-responder for Cisco-SLA-agent
• Eltex SLA:
  • Delay (one-way/two-way)
  • Jitter (one-way/two-way)
  • Packet loss (one-way/backward/two-way)
  • Packet Error Rate
  • Out-of-order delivery (one-way/backward/two-way)

Redundancy and clustering

• VRRP v2, v3
• Tracking based on VRRP or SLA test
• Managing VRRP parameters
• Managing PBR parameters
• Managing the administrative status of the interface
• Activating and deactivating a static route
• Managing AS-PATH and preference attributes in a route-map
• DHCP failover to reserve the IP address database issued by the DCHP server
• Failover Firewall to reserve Firewall and NAT sessions
• MultiWAN
• Dual-Homing

High availability cluster:

• Easy administration and integration: syncronization of configurations, time, versions, licences; Zero Touch Provisioning (ZTP)
• Redundancy of all connections in the cluster
• Router redundancy (the current version supports «1+1» redundancy)