As an early entrant into the business Wi-Fi 7 market, EnGenius now boasts an extensive portfolio of access points (APs) suited to a wide range of environments and budgets. The only space it hasn't focused on a great deal is wall plate APs as up until now, its only offering has been the ECW215 Wi-Fi 6 model.

The ECW515 improves the situation as it delivers Wi-Fi 7 services to target markets such as the hospitality, classroom, meeting room and multi-tenant sectors. It may only be a dual-band AP, but has the hardware to handle a high demand as it sports the same powerful Qualcomm Networking Pro 1220 platform and quad-core ARM Cortex-A73 CPU as Engenius' flagship APs.

This BE3600-rated AP offers two spatial streams each for the 2.4GHz and 5GHz bands and claims maximum speeds of 700Mbits/sec and 2,900Mbits/sec respectively. It offers plenty of connection options as along with a main 2.5GbE multi-Gig port, it has a built-in quad-port Gigabit switch with the fourth port (LAN5) providing an 802.3af PoE feed for powering in-room devices such as IP phones.

EnGenius ECW515 review: Hardware features

The ECW515 is one of the smallest wall plate APs we've yet seen as it measures a mere 110 x 42 x 130mm (WDH) and weighs only 328gms. It has a metal chassis and polycarbonate cover and presents the main 2.5GbE port at the rear with the four Gigabit ports in the base.

The box includes a solid metal mounting plate which the AP is clipped on to and secured with one screw. A single orange status LED is located on the side which shows cloud connection status and flashes when the AP is booting or receiving a firmware upgrade.

If the AP is powered over 802.3at PoE+, the LAN5 port will supply 7W to a powered device (PD). Using an optional external 54V DC supply will boost this to 15W.

EnGenius ECW515 review: Cloud management

EnGenius offers two types of wireless AP and all ECW models can only be cloud managed. The Wi-Fi 6 EWS Fit6 models are aimed at small businesses with limited on-site IT expertise and can be standalone or cloud-managed from the free FitXpress web portal.

For testing, we connected the ECW515 to the lab's Engenius ECS2512FP 2.5GbE PoE+ switch. The AP presents a local web interface but this only displays an overview of LAN, internet and cloud connection status.

Assigning the AP to our cloud account was easy as we used the Cloud To-Go iOS app on an iPad to scan its QR code. Once we had added the AP to our chosen site, it received a firmware upgrade and started broadcasting our predefined site SSIDs.

The cloud portal dashboard provides details on all APs, switches and wireless clients with graphs below for wireless throughput plus the top APs, clients and SSIDs. Enable the application control service on your SSIDs and the dashboard populates a table below with the top ten apps and their bandwidth usage.

Up to eight SSIDs per radio are supported and for each one, you can choose the active radios, apply an encryption scheme, enable L2 isolation and turn on MLO (multi-link operations) with the console warning you that legacy clients that don't support WPA3 will be excluded. The drop-down menu at the top offers plenty of other useful features including assigning download and upload rate limits for the entire SSID or per client and adding captive portals, hotspot services and basic firewall rules.

The four Gigabit ports are remotely controlled from the portal so you can enable or disable any of them as required. A smart feature is 'SSID on LAN' as this allows you to bind a selected SSID to them and apply wireless VLAN, security settings and captive portals to wired devices.

Adding a Pro licence to your portal account enables enhanced features such as a 30-day log retention period, network topology views and 7-day timeline charts of the APs a client connected to, the authentication methods in use and details of association errors such as incorrect passwords. Prices are quite reasonable with 1-year and 3-year subscriptions costing £57 and £136 per device respectively.

Captive portal features are good as you can present wireless guests with custom splash pages created using the portal's integrated HTML editor toolbox. Standard authentication methods include local user accounts, Radius servers and vouchers with a Pro licence enabling LDAP, Active Directory, Google LDAP and Azure AD.

EnGenius ECW515 review: Wi-Fi 7 performance

For our performance tests, we used a Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and a Dell PowerEdge Windows server connected to one of the switch's 10GbE fibre ports. We enabled MLO on our WPA3-protected SSID and saw the Windows 11 client create an aggregated link using both radios and report a link speed of 3,570Mbits/sec.

To test maximum speed, we used the OpenSpeedTest HTML5-based tool and ran the server component of our Windows Server host. On the Windows 11 client, we pointed a browser at the OpenSpeedTest server address and port and watched it report back with close-range upload and download rates of 169MB/sec and 200MB/sec.

Moving the AP 10 metres away and into an adjoining room with a wall in the way saw it deliver upload and download speeds of 137MB/sec and 174MB/sec. Use the application analysis service with caution as this will hit performance with further tests showing it can drop wireless speeds by up to 10%.

EnGenius ECW515 review: Is it worth it

EnGenius has a very limited number of UK resellers and the only vendor that could provide us with a price for the ECW515 was Solwise with it quoting £187 including VAT. This is a little pricey as the TP-Link EAP775-Wall we recently reviewed only costs around £13 more and delivers tri-band Wi-Fi 7 in-room services.

The ECW515 is very easy to deploy though, and its dual radios deliver a performance that should satisfy the target market of hotel guests and meeting room participants. The cloud portal offers a good range of remote management services and the smart SSID on LAN feature allows you to secure access to the four Gigabit ports.

EnGenius ECW515 specifications

Zyxel offers an impressive range of business Wi-Fi 7 access points (APs), and the tri-band WBE665S signals a concerted move into enterprise territory. Designed to deliver stable and reliable wireless connections in demanding environments such as warehouses, large-scale retail, cold storage, manufacturing, and stadiums, the WBE665S looks capable of handling everything the great outdoors can throw at it. Largely because this massive, ruggedly built AP has a high IP67 rating.

It's also built for performance as it presents 12 spatial streams spread equally across the three radios and has a huge BE22000 rating. This allows it to claim maximum speeds of up to 1,376Mbits/sec for 2.4GHz, 8,646Mbits/sec for 5GHz and a whopping 11,530Mbits/sec for 6GHz.

The AP can be managed in standalone or cloud mode using Zyxel's Nebula Cloud Control (NCC) portal. The WBE model designation means it can also be locally managed from Zyxel's USG Flex WLAN controllers, and the price includes a 1-year NCC Pro Pack license, which enables Zyxel's SecureWiFi, CDR (collaborative detection and response), and the AI-powered WiFi Aid and Wireless Health troubleshooting tools.

Zyxel WBE665S review: Build quality and design

Measuring 410 x 410 x 110mm and weighing nearly 5kg, the WBE665S is easily the largest Wi-Fi 7 AP we've yet seen. The sturdy metal chassis and thick polycarbonate shell are built for outdoor action as the AP has 6kV lightning protection and can operate between -40 and +70 degrees C, while its IP67 rating means it's fully dust-tight and can handle temporary immersion in water.

The WBE665S puts its extreme size to good use as it incorporates a 120-degree ultra-wide smart antennae array which dynamically optimises its patterns and signal directions to the RF environment in real time. All of its performance potential is unleashed by a fast copper 10GbE multi-Gig uplink port, which requires an 802.3bt PoE++ source for all features to function.

For those that want a connection distance of more than 100 metres, there's a 10GbE SFP+ fibre port and a 24-48V DC input. All ports are arranged neatly under the chassis at the rear, and the box includes waterproof cable glands and an industrial-strength aluminium pole mount kit.

Zyxel WBE665S review: 6GHz restrictions

Due to potential interference with weather radars, the radio astronomy service (RAS) and satellite links, Ofcom currently restricts standard Wi-Fi 7 6GHz usage in the UK to indoors only. It does permit VLP (very low power) usage, but this is strictly limited to the lower 5925-6425MHz band and 25mW levels.

Furthermore, outdoor VLP usage will only be permitted when the device is under the control of a third-party AFC (automated frequency control) system. AFC may also, at first, be used to control access to the upper 6GHz band, but this is currently under consultation with a decision not expected until later this year.

Zyxel has come up with a nifty workaround, as you can set the WBE665S to indoor mode, which enables the 6GHz radio. Or use the outdoor mode, which disables it. It's available as a single toggle switch in both the standalone web console and NCC portal. However, you'll need to ensure you don't accidentally set the AP to indoor mode when deploying it outside.

Zyxel WBE665S review: Cloud management

Standalone mode is easy to use as the AP's web console offers a quick start wizard, but we'll focus on cloud management as this is likely to be the preference for most businesses. Adding the WBE665S to our NCC account was easy, as we used the Nebula iOS app on an iPad to scan the QR code on the box and choose the site it should take its settings from.

The NCC portal is well designed and offers menu options at the top to choose an organisation and the sites it manages. Down below is an informative dashboard offering an at-a-glance site status overview along with customisable widgets for all Zyxel cloud-managed devices, APs by usage, connected clients and their detected OS, total wireless traffic, and PoE consumption for Zyxel switches.

As with standalone mode, up to eight SSIDs per site are supported, and you can create custom captive portals for guest wireless networks. Each can have its own logo and message, a choice of authentication methods including 2FA with Google Authenticator, and L2 isolation to stop guests from seeing each other.

A key feature of all the latest Zyxel APs is their auto-MLO feature. Set the radios to 11be operations, apply Enhanced Open, WPA3 Personal, or WPA3 Enterprise encryption, and any MLO-capable client device will automatically create an aggregated link.

The indoor and outdoor settings are accessed in the NCC portal by selecting the AP and choosing the installation environment mode from its status screen. In standalone mode, the local web console has a dedicated section for this in its configuration menu.

Zyxel WBE665S review: 5/6GHz performance

For performance testing, we hooked the WBE665S up to the lab's Zyxel XMG1930-30HP multi-Gig PoE++ switch, which confirmed a 10GbE connection and a PoE++ power draw. Our test hosts were a Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and a Dell PowerEdge Windows Server 2022 host connected to the switch over 10GbE.

Starting with 6GHz testing, we set the AP to indoor mode after which our Windows 11 client created a 2.4/6GHz MLO connection with an aggregated link speed of 6,108Mbits/sec. We used the OpenSpeedTest HTML5-based tool to measure raw performance and watched it report back with stunning close-range upload and download rates between the client and server of 538MB/sec and 445MB/sec.

After swapping the AP to outdoor mode from the NCC portal, our Windows 11 client automatically reconnected with a 2.4/5GHz MLO link and a link speed of 3,570Mbits/sec. Close-range performance looked good with OpenSpeedTest recording close-range upload and download rates of 353MB/sec and 317MB/sec.

Moving the AP 10 metres away and into an adjoining room with a wall in the way saw it deliver very respectable 2.4/6GHz upload and download speeds of 378MB/sec and 300MB/sec. Swapping back to outdoor mode returned 2.4/5GHz distance speeds of 275MB/sec and 211MB/sec.

Zyxel WBE665S review: Is it worth it

With prices in the £1,000-£1,200 range, the WBE665S compares well on value with the competition in this market sector. This huge Wi-Fi 7 AP delivers a lot for your money as its ruggedized build quality is exemplary and the mighty BE22000 rating delivered a superb 5/6GHz performance in our lab tests.

It's easy to deploy and management options are very versatile as it supports standalone, appliance or NCC cloud modes. The smart Indoor/Outdoor operational modes ensure compliance with local regulations and it's ready for 6GHz outdoor operations whenever Ofcom permits it.

Zyxel WBE665S specifications

Zyxel is rapidly becoming the go-to place for Wi-Fi 7 access points as it offers a remarkable range of solutions with a sharp focus on performance, features, and value. The NWA240BE on review is the latest to join the club and stands out for its meaty BE15000 rating and competitive price.

The NWA240BE presents eight spatial streams, with two each for the 2.4GHz and 6GHz radios and four handed to the 5GHz radio. Its BE15000 rating claims maximum speeds of up to 688Mbits/sec for 2.4GHz, a stonking 8,646Mbits/sec for 5GHz, and 5,764Mbits/sec for 6GHz.

The NWA model designation indicates it's designed to offer SMBs a more affordable solution with a reduced feature set. It can be managed in standalone mode or using Zyxel's Nebula Cloud Control (NCC) portal, but unlike the WBE models, the price doesn't include a 1-year NCC Pro Pack license.

Zyxel NWA240BE review: Build and design

Tipping the scales at 848gms, this hefty lozenge is very well built from high-impact plastic and has an embedded 4G/5G interference filter so it can coexist happily with cellular networks. It can be mounted on the wall or ceiling, and the kit includes a universal mounting plate with an optional 5-pack of T-rail clips costing around £17.

All of its performance potential is unleashed by a fast 10GbE multi-Gig uplink port, and the AP can be powered over 802.3at PoE+ or 802.3bt PoE++ without any restrictions. The AP also offers a USB-C port, which can be used to power it with an appropriate 2A USB PD 15 supply.

The rear panel has plenty of ventilation slots, which work well, as we didn't find the AP getting overly hot during testing. There isn't much to see at the front with the single multi-color LED showing AP, boot, uplink, plus wireless status, and if wireless clients are connected.

Zyxel NWA240BE review: Standalone mode

Installation is helped along by the AP's web console wizard, which starts by offering two choices for standalone or cloud management. After selecting the former, we were guided through changing the default admin password, setting the country of operation, creating our first SSID, choosing the active radios, and accepting the offer of an automatic firmware upgrade.

The AP supports up to eight SSIDs, which are created using a combination of profiles and objects. It takes a little while to get the hang of their relationships, but AP management objects use radio profiles to define their active bands, operating mode, and channel width.

Each object references SSID profiles, which control the active radios and can be used to apply upload and download rate limits, QoS (quality of service) for prioritising voice or video traffic, and a time schedule that controls when the SSID is active. Each SSID profile is also assigned a security profile, which sets the encryption method.

MLO (multi-link operations) is supported in standalone mode, but you won't find a toggle switch in the web console for it. Setting the operating mode for the radios to 11be brings Zyxel's auto-MLO into play, which will enforce the mandatory Enhanced Open, WPA3 Personal, or WPA3 Enterprise encryption.

Zyxel NWA240BE review: Cloud management

Swapping the NWA240BE to our NCC account was a breeze as we used the Nebula iOS app on an iPad to scan the QR code on its base and choose the site it should take its settings from. The portal presents an informative dashboard with customisable widgets showing the status of all Zyxel cloud-managed devices, total wireless traffic, APs by usage, all connected wireless clients, along with their detected OS and PoE consumption for our Zyxel switch.

As with standalone mode, up to eight SSIDs per site are supported, and tags can be applied so they are only broadcast by APs that have a matching tag. For guest wireless networks, you can present custom captive portals with your own logos and messages, use a variety of authentication methods, including 2FA with Google Authenticator, and enforce L2 isolation so guests only get internet access.

Network coverage can be easily expanded as the NWA240BE supports Zyxel's Smart Mesh technology, which uses the 5GHz or 6GHz radios as backhaul connections between a root and repeater APs. Upgrading devices managed by NCC with a Plus Pack enables features such as 7-day logging, topology views, and scheduled firmware updates, while a Pro Pack adds client diagnostics, Wi-Fi health reports, remote SSH, and a 1-year report history with Broadbandbuyer, showing a Pro price of around £27 per licence.

Zyxel NWA240BE review: Wi-Fi 7 performance

For performance testing, we connected the NWA240BE to the lab's Zyxel XMG1930-30HP multi-Gig PoE++ switch, which confirmed a 10GbE connection and a PoE++ power draw. Our test hosts were a Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and a Dell PowerEdge Windows Server 2022 host connected to the switch over 10GbE.

The TP-Link Wi-Fi 7 adapter supports MLMR (multi-link multi-radio) and can combine the 2.4GHz band with either the 5GHz or 6GHz bands. With 11be enabled on all three radios, Windows 11 confirmed an MLO link using the 2.4/6GHz bands and an aggregated connection speed of 6,453Mbits/sec.

To test maximum speed, we used the excellent OpenSpeedTest HTML5-based tool and ran the server component of our Windows Server host. On the Windows 11 client, we pointed a browser at the OpenSpeedTest server address and port and watched it report back with superb close-range upload and download rates of 378MB/sec and 483MB/sec.

Real-world SMB tests using 25GB file copies between the client and server returned average sustained close-range speeds of 280MB/sec. With the AP moved 10 metres away and into an adjoining room, we saw this drop to a respectable 243MB/sec.

The NWA240BE also performed very well over a 2.4/5GHz MLO connection. OpenSpeedTest reported back with top upload and download rates of 353MB/sec and 321MB/sec.

Zyxel NWA240BE review: Is it worth it

Absolutely. Available at Broadbandbuyer for £192 excluding VAT, Zyxel's NWA240BE will appeal to SMBs seeking an affordable upgrade to full Wi-Fi 7 services. This well-built tri-band AP is easy to deploy, delivers outstanding performance and supports standalone and cloud management.

Zyxel NWA240BE specifications

TP-Link has traditionally offered an extensive range of discrete wall-mounted wireless access points (APs), and the EAP775-Wall is its first tri-band Wi-Fi 7 model. Aimed at environments such as meeting rooms and hotels looking to provide in-room network services, it offers plenty of connection options, along with a main 2.5GbE multi-Gig port at the rear. It has another 2.5GbE plus three Gigabit downlink ports in its base.

These add extra versatility as the first two ports offer pass-through services for networking other devices, while the last two Gigabit ports can both provide PoE or one can offer PoE+, allowing the AP to power extra in-room devices such as IP phones. The AP also has Bluetooth 5.3, which is used for quick provisioning of the AP using TP-Link's mobile app.

This BE9300-rated AP offers two spatial streams each for the 2.4GHz, 5GHz, and 6GHz bands and claims maximum speeds of 688Mbits/sec, 2,882Mbits/sec, and 5,765Mbits/sec, respectively. The US version has a higher BE11000 rating as it supports the 5GHz 240MHz channels, which are not cleared for use in the UK and EU.

Management options are abundant as the EAP775-Wall can be deployed in standalone mode and configured from its own web console. TP-Link's Omada cloud service will appeal to businesses and hotels with multiple APs and sites as they can keep a close eye on them all, along with Omada-enabled switches and routers, from one central web portal.

TP-Link Omada EAP775-Wall review: Design and build quality

Measuring slightly less than 42mm thick, the EAP775-Wall is clothed in a sturdy polycarbonate casing with an aluminium inner shell. The AP ships with a removable and paintable cover that slips over the main unit, and for those that don't have in-wall cabling, there's a small knock-out panel at its base to feed a network cable through.

The kit includes a steel wall mounting plate, and TP-Link takes a leaf from Ubiquiti's book as it provides a cardboard template with a spirit level. The plate has three mounting lugs, and when you slide the AP down over them, an anti-theft latch in its back locks it in place so it can only be removed with the included metal L-shaped key.

Think carefully about your proposed PoE provisioning, as the type of supply will affect a number of features. Giving it the full 802.3bt PoE++ will enable PoE-out on both Gigabit ports and Bluetooth, 802.3at PoE+ will disable PoE-out but leave Bluetooth enabled, while basic 802.3af PoE disables everything - including all three radios.

TP-Link Omada EAP775-Wall review: Standalone mode

The AP is simple to deploy in standalone mode with its web console wizard requesting a new username and password, tightening security by deleting the default admin account and checking for firmware upgrades. Up to eight SSIDs per radio are supported, and the wizard offers the option of configuring one for each radio and providing encryption keys.

The device status page provides plenty of information about the AP, including bar charts of CPU and memory utilisation. Move to the wireless page, and you can see all SSIDs along with details on their associated radios, security, and guest networks, with another view showing all connected clients.

Creating new SSIDs is as swift as selecting a radio, providing a name, and choosing an encryption scheme. Basic captive portals can be assigned to specific SSIDs, although authentication is restricted to a global password or an external Radius server. When guests connect, you can apply a redirect URL and present them with a web page and AUP (acceptable use policy) message they must accept to continue.

TP-Link Omada EAP775-Wall review: Wi-Fi 7 performance

We hooked the EAP775-Wall up to the lab's Zyxel XMG1930-30HP switch, which confirmed a 2.5GbE connection and a PoE++ draw. For Wi-Fi 7 performance testing, we used a Lenovo desktop client running Windows 11 Pro and equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter.

To gauge raw TCP performance, we used Microsoft's NTttcp utility, which reported reasonable upstream and downstream speeds of 302MB/sec and 235MB/sec between the client and a server on the 10GbE LAN. Our real-world large file copies between the client and server averaged close-range speeds of 235MB/sec, dropping to 190MB/sec with the AP moved 10 metres away and into an adjoining room.

The AP supports MLO (multi-link operations) for all three radios, and after our client connected using the 2.4/6GHz bands, Windows 11 reported an aggregated connection speed of 6,453Mbits/sec. Subsequent NTttcp tests revealed improvements in upstream speeds to 310MB/sec but no increases in downstream rates.

TP-Link Omada EAP775-Wall review: Cloud management

TP-Link's Omada cloud service will be the preferred choice for most businesses as they can monitor and manage all their APs and other Omada-enabled switches and routers from one central web portal. There are plenty of choices as TP-Link offers four OC-series hardware or free self-hosted software on-site controllers.

Cloud-based controller options see big improvements as TP-Link's Omada Central provides a single platform for network and surveillance management, while Omada Cloud focuses on network devices. Even better, TP-Link offers free Central and Cloud Essentials versions, which provide base sets of management and monitoring features for smaller businesses.

To add the EAP775-Wall to our licensed Omada Cloud Standard account, we scanned its bar code using the Omada iOS app, and once adopted, it took all its settings from the cloud controller and broadcast our predefined SSIDs. Usefully, the AP's downlink ports can be enabled or disabled from the standalone web console or cloud portal, and on the last two, you can remotely control PoE services.

The Omada Network 6 update presents a radically redesigned portal interface with multi-tab dashboards for quick access to topology, WiFi, traffic, and client activity views. It also introduces a network health scoring system in the Overview tab that evaluates all devices and clients to help locate potential performance issues.

Not available in the Omada Essentials edition, the RF scanning service is accessed from the statistics tab in the AP management screen and provides charts of RF scan results for each radio, while interference scans discover all other APs in the vicinity.

TP-Link Omada EAP775-Wall review: Is it worth it?

Available for £146 excluding VAT at Broadbandbuyer, the EAP775-Wall looks comparatively good value. It's very well constructed and delivers a reasonable Wi-Fi 7 performance with a good range that should cover most hotel and meeting rooms.

The extra downlink ports make this AP very versatile although you will need to provide a PoE++ source to get the best from it. It's simple to install and TP-Link offers an impressive range of smart cloud management services with the free editions having particular appeal to smaller businesses.

TP-Link Omada EAP775-Wall specifications

The National Cyber Security Centre (NCSC) has uncovered two new Russian-linked campaigns aimed at harvesting login credentials from personal web and email services.

The APT28 group, also known as Fancy Bear or Forest Blizzard, has exploited vulnerable internet routers to enable Domain Name System (DNS) hijacking - allowing it to intercept traffic and steal sensitive data including passwords and access tokens.

In an advisory on 7 April, the security agency said the activity appears to be opportunistic in nature, starting with a scattergun approach to reach large numbers of potential victims. Thereafter, threat actors then narrow in on targets of interest as the attack develops.

Attackers redirect traffic through DNS servers under their control, with the resulting malicious DNS resolutions enabling adversary in the middle (AitM) attacks that harvest passwords, OAuth tokens, and other credentials for web and email related services.

The NCSC said it believes APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Centre Military Intelligence Unit 26165.

This group is believed to have been behind an attack against the German parliament in 2015, which led to data theft and disrupted the email accounts of German members of parliament and the vice chancellor, as well as an attempted attack against the Organisation for the Prohibition of Chemical Weapons (OPCW) in 2018.

That particular attack was aimed at disrupting the independent analysis of chemicals weaponized by the GRU in the UK.

Microsoft issues separate alert

In a separate alert, Microsoft has issued a similar warning, saying that the group has been carrying out this activity since at least August 2025.

"By compromising edge devices that are upstream of larger targets, threat actors can take advantage of less closely monitored or managed assets to pivot into enterprise environments," it said.

"Microsoft Threat Intelligence has identified over 200 organizations and 5,000 consumer devices impacted by Forest Blizzard’s malicious DNS infrastructure."

SOHO routers targeted in campaign

The first cluster of activity identified by the NCSC saw the DHCP DNS server settings of compromised small office/home office (SOHO) routers modified to include IP addresses owned by the attackers.

These settings were subsequently inherited by downstream devices such as laptops and phones.

Lookups for domain names containing key terms associated with particular services - frequently email applications or login pages - would be resolved by the malicious DNS servers to further IP addresses controlled by the group.

DNS requests that don't match the actor’s targeting criteria would instead be resolved to the legitimate IP addresses for the services being requested.

The group would then attempt to conduct AitM attacks against both user browser sessions and desktop applications, aiming to harvest user account credentials.

In the second cluster of activity, some servers received DNS requests via compromised devices including models of MikroTik and TP-Link routers. The DNS requests were forwarded from these servers to other servers under the group's control, the NCSC noted.

This cluster of infrastructure was also involved in interactive operations against a small number of MikroTik routers, mostly located in Ukraine, and probably of intelligence value to the actor.

"This activity demonstrates how exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors," said Paul Chichester, NCSC director of operations.

"We strongly encourage organizations and network defenders to familiarise themselves with the techniques described in the advisory and to follow the mitigation advice."

The NCSC advises organizations to protect the management interfaces of their systems, keep devices, networks, and software up to date, set up a security monitoring capability, and add applications to an allowlist.

They should also deploy a host-based intrusion detection system and use multi-factor authentication (MFA).

FOLLOW US ON SOCIAL MEDIA

All foreign-made consumer routers have been banned from import into the US over security risks following a spate of attacks that targeted infrastructure.

The US Federal Communications Commission (FCC) said the ban applies to all new device models, including those designed in the US but manufactured overseas.

It will be possible for overseas-made routers to be added to an approved list, but that may require divulging a list of foreign investors and efforts to shift manufacturing to the US – something Trump has tried to encourage across the tech industry, including with threats of tariffs on chips.

Overseas threat?

So far, no router makers are on that exclusion list, but they have been encouraged to apply for conditional approvals.

"A majority of the routers currently in Americans' homes and businesses are manufactured in foreign countries," the government said via a statement shared by the FCC. "Given the criticality of routers to the successful functioning of our nation's economy and defense, the United States can no longer depend on foreign nations for router manufacturing."

The ban applies to any routers made outside the US, but the vast majority are produced in China or Taiwan. The rule only applies to new equipment: companies need not rip out existing infrastructure or bin the routers they already have.

This isn't the first time the US has targeted foreign-made infrastructure over security reasons: in 2020, the US demanded telcos "rip and replace" China-based Huawei kit, designating that company and compatriot ZTE as security threats. The UK has also banned Huawei from key networks. Such government bans aren't limited to networking equipment, as the US has also banned software made by Russia's Kaspersky.

Security threat to critical infrastructure

The move follows a string of attacks against US infrastructure that made use of home and small office routers, the FCC noted, pointing to the Volt, Flax, and Salt Typhoon campaigns that targeted critical infrastructure.

Salt Typhoon targeted American politicians' emails and compromised telecoms companies, while the Volt attacks went undetected for nearly a year, disrupting key infrastructure, including water utilities. Last year, thousands of Asus routers were hijacked to run a state-sponsored spying campaign, and flaws are frequently spotted in consumer-grade equipment, with compromised devices used to build bot networks.

"Recently, malicious state and non-state sponsored cyber attackers have increasingly leveraged the vulnerabilities in small and home office routers produced abroad to carry out direct attacks against American civilians in their homes," the FCC said. "From disrupting network connectivity to enabling local networking espionage and intellectual property theft, foreign-produced routers present unacceptable risks to Americans."

The FCC said it had been sent a national security designation from the central government saying the risk was no longer acceptable. "Routers in the United States must have trusted supply chains so we are not providing foreign actors with a built-in backdoor to American homes, businesses, critical infrastructure, and emergency services," the document said.

The FBI warned last year that outdated routers were being used for criminal attacks, and businesses have been warned that they must address common issues such as misconfiguration and weak encryption to avoid becoming victims.

Prices for business Wi-Fi 7 access points (APs) have been falling steadily, and Zyxel makes small businesses a tempting offer as its diminutive NWA50BE Pro costs less than £70. It sweetens the deal further as this dual-band AP is designed to offer future-proofed wireless networks with its BandFlex technology, allowing you to swap from 5GHz to 6GHz operations whenever you want.

This entry-level AP claims speed of up to 688Mbits/sec on the 2.4GHz radio, 4,324Mbits/sec on 5GHz and 5,764Mbps on 6GHz. But bear in mind the top 5GHz speed will drop to 2,880Mbps here in the UK as the 240MHz channels are only certified for the US. If you don't feel a need for the 6GHz band, you can save a few more pounds as Zyxel's NWA50BE Wi-Fi 7 model presents 2.4GHz/5GHz radios and costs only £62.

Zyxel has one of the most diverse ranges of Wi-Fi 7 APs on the market, and it's worth clarifying the differences between its NWA and WBE models. Both support standalone and cloud management, with the NWA APs offering a reduced feature set and aimed at cost-conscious SMBs. The more expensive WBE models target larger businesses, include a 1-year NCC Pro Pack license, and can also be managed by Zyxel's USG Flex WLAN on-premises controller appliances.

Zyxel NWA50BE Pro review: Build quality and features

Measuring only 150mm square and 35mm deep, the NWA50BE Pro is the same size as the non-6GHz NWA50BE model. The chassis is constructed from sturdy high-impact plastic, and the front panel has a single multi-colour LED for at-a-glance status views.

At the rear, you'll find a 2.5GbE multi-Gigabit LAN uplink port which supports a PoE+ source. Worry not if you don't have one, as the AP also has a 12V DC input jack, and the price includes an external power supply with a 3-pin UK plug adapter.

The AP is powered by a quad-core Qualcomm CPU and employs internal aluminium plates that act as RF interference shields and heat dissipaters. They worked well during testing as the back plate did get warm to the touch, but not hot enough to be of concern.

The NWA50BE Pro offers all the Wi-Fi 7 features you'd expect to see, but be careful using MLO as the latest firmware brings it into line with the new 802.11be standard. This mandates WPA3 encryption for devices using MLO, and Zyxel automatically enables it on all SSIDs operating in this mode, meaning legacy devices that only support WPA2 will get kicked off the network.

Zyxel NWA50BE Pro review: Standalone management

The NWA50BE Pro is easy to deploy as a standalone AP, as its web console opens with a quick-start wizard. After selecting standalone mode, we were guided through setting the country of operation, changing the default admin password, and creating our first SSID.

The AP supports up to eight SSIDs, which are created using profiles and objects, although first-time users may find the process isn't very intuitive. Profiles are created for the two radios, and you assign SSID profiles to each one, which sets the active bands and their channel width, along with options such as upload and download rate limits and a time schedule that controls when the SSID is active.

Security profiles are assigned to each SSID to set the encryption scheme. Choices include WPA2 and WPA3, but only the personal versions are available, as unlike the NWA90BE Pro, which is aimed at larger businesses, this AP doesn't support enterprise encryption with external Radius server authentication.

You can start with 5GHz services, and when you feel the time is right, you swap to the 6GHz band just by assigning a new profile to the second radio. Another handy feature is rogue AP detection, as enabling this presents a list of all external SSIDs within range, along with their active wireless bands and encryption type.

Zyxel NWA50BE Pro review: Cloud control

Moving to cloud management is a breeze as we used the Nebula iOS app on an iPad to scan the AP's QR code, and after five minutes, it started broadcasting our cloud-managed SSIDs. The NCC widget-based dashboard is easily customised and tells you everything you need to know about all your cloud-managed APs, wireless networks, switches, firewalls, and routers.

As with standalone mode, it supports up to eight site SSIDs, where you choose your encryption scheme and optionally use tags so they are only broadcast by APs that match them. The NCC portal opens up more features than standalone mode, as its Smart Mesh service creates self-healing meshed wireless networks across multiple APs but the NWA50BE Pro doesn't support captive portals and won't broadcast any SSIDs with these enabled.

The base NCC cloud service is free, but logging is restricted to a rolling 24 hours, with features such as topology views, email alerting, and scheduled firmware updates disabled. These and more are enabled with an NCC Plus pack license, which costs around £10 per year for each device.

Zyxel NWA50BE Pro review: Wireless performance

To test performance, we hooked the AP up to the lab's Zyxel XMG1930-30HP multi-Gig PoE++ switch and used a Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter. Starting with a 5GHz 160MHz profile, Microsoft's NTttcp utility reported raw TCP upstream and downstream speeds between the client and a Dell Windows server on the 10GbE LAN of 210MB/sec and 137MB/sec.

Real-world SMB tests using large file copies between the client and server returned averaged close-range speeds of 143MB/sec, dropping to 99MB/sec with the AP moved 10 metres away and into an adjoining room. From the cloud portal, we used the BandFlex feature to swap over to a 6GHz 320MHz profile and watched NTttcp report faster upload and download rates of 225MB/sec and 204MB/sec while our real-world copy tests improved to 158MB/sec and 119MB/sec.

The auto-MLO feature worked fine, as after setting the 2.4GHz radio to 11be mode, our Windows 11 client reported an aggregated link speed of 6,108Mbits/sec across the 2.4GHz and 6GHz bands. Alas, repeating our performance tests showed no speed improvements.

Zyxel NWA50BE Pro: Is it worth it

Available at Broadbandbuyer for £68 excluding VAT, Zyxel's NWA50BE Pro will appeal to smaller businesses that aren't ready to invest in full-strength tri-band Wi-Fi 7 APs. Overall, wireless performance is quite respectable for such a low-cost AP. It supports standalone or cloud management and is ready to go with you when you want to make the jump to the 6GHz spectrum.

Zyxel NWA50BE Pro specifications

Thousands of ASUS routers around the world have been hijacked in a sophisticated campaign believed to be backed by China.

According to SecurityScorecard’s Strike threat intelligence team, the WrtHug campaign leverages the proprietary AiCloud service with Nth day vulnerabilities in order to gain high privileges on end-of-life ASUS WRT routers.

The pattern of attacks and the severity of the vulnerabilities indicate potential command injection capabilities, if not root-level privileges, researchers warned.

“Operation WrtHug is a case study in how nation-state actors are embedding themselves in consumer infrastructure to build stealthy, resilient, global espionage networks,” said Gilad Maizles, security researcher at SecurityScorecard.

“The deliberate targeting of end-of-life ASUS devices by compromising proprietary applications and services such as AiCloud, reflect growing strategic interest in SOHO devices. This shows us the willingness of threat actors to specialize in targeting them as reliable staging points.”

The campaign currently appears to be affecting around 50,000 compromised devices around the world, particularly in Taiwan, the US, and Russia, with more victims in some other Southeast Asian and European countries.

All the hijacked routers share a unique, self-signed TLS certificate with a 100-year expiration date - unusually long, researchers noted, and a critical indicator of compromise that points to a level of coordination reflecting careful and calculated espionage.

It was this certificate that first alerted the team to the campaign.

Six flaws underpin the ASUS espionage campaign

The attackers have been leveraging six distinct vulnerabilities for the campaign.

CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, and CVE-2023-41348, all nearly two years old, enable attackers to perform direct OS command injection on ASUS WRT devices using insufficient filtering related to token modules. They're associated with the command injection vulnerability CVE-2023-39780.

Meanwhile, CVE-2024-12912 is an arbitrary command execution vulnerability and CVE-2025-2492 is an improper authentication control vulnerability that can lead to unauthorized function execution via a crafted request.

All are known and have officially been patched - which is why it's mostly end-of-life devices being targeted.

According to researchers, the targeted devices, methods, and timing mirror previous intrusion campaigns that have been linked to China - the LapDogs ORB, for example, recently uncovered by the Strike team.

Some of the vulnerabilities are tied to another ongoing suspected China-linked ORB operation known as AyySSHush, reported to be targeting ASUS devices earlier this year.

The team said it spotted seven IPs with signs of compromise in both Operation WrtHug and AyySSHush, suggesting either a single, evolving campaign or coordination between the two groups.

"These campaigns have demonstrated a clear evolution in attacker methodology. Persistent, resourced hackers are moving beyond simple brute-force attacks to multi-stage infections that exploit a variety of vulnerabilities," said the team.

"By chaining command injections and authentication bypasses, threat actors have managed to deploy persistent backdoors via SSH, often abusing legitimate router features to ensure their presence survives reboots or firmware updates."

MORE FROM ITPRO

• China cyber threats: What businesses can do to protect themselves
• FBI warns 'indiscriminate' Salt Typhoon hacking campaign has hit organizations in more than 80 countries
• A new 'top-tier' Chinese espionage group is stealing sensitive data

Zyxel continues its drive to deliver future-proofed wireless networks with the NWA110BE and NWA210BE dual-band Wi-Fi 7 access points (APs). Investing in tri-band Wi-Fi 7 APs can be expensive for smaller businesses that don't currently anticipate a high user demand. And these two APs employ Zyxel's BandFlex technology, allowing them to swap from 5GHz to 6GHz operations when the time is right.

The NWA110BE is an entry-level BE6500-rated model. We have the higher-end NWA210BE for review, which offers six spatial streams with two for the 2.4GHz band and four set aside for the 5GHz or 6GHz bands. Its top BE12300 rating is achieved when you activate the 6GHz band; this combines its top claimed throughput of 11,530Mbits/sec with the 688Mbits/sec from the 2.4GHz radio. It uses the 5GHz radio, and the rating drops to BE9300.

Zyxel offers two distinct types of AP, and the NWA models are designed to offer SMBs a more affordable solution with a reduced feature set. The main differences are in software, as both types can be managed in standalone mode or using Zyxel's Nebula Cloud Control (NCC) portal. However, the WBE models include a 1-year NCC Pro Pack license, which enables Zyxel's SecureWiFi plus CDR (collaborative detection and response) and can be locally managed from Zyxel's USG Flex WLAN controllers.

Zyxel NWA210BE review: Design and features

At first glance, you'd be hard pushed to see any physical differences between the NWA110BE and NWA210BE, as both are clothed in identical lozenge-shaped shells made from sturdy high-impact plastic. Flip them over, though, and you'll find that the NWA210BE has a standard 2.5GbE multi-Gigabit uplink port and a second 2.5GbE port, which can be used in bridged mode to connect other network devices such as a computer or switch.

The AP's uplink port requires a PoE+ source, or you can connect an appropriate 2A USB PD 15 supply to its USB-C port. The kit includes a universal mounting bracket, and Zyxel offers an optional 5-pack set of clips costing around £22 for drop ceiling deployments.

The NWA210BE provides all key Wi-Fi 7 features, including 4K-QAM (quadrature amplitude modulation) and MLO (multi-link operations), but the latest firmware version 7.2 makes a major change to the latter. Previously, you had a toggle button in the local web interface and NCC portal to enable or disable MLO on an SSID, but this has been removed. The Wi-Fi 7 802.11be standard mandates WPA3 encryption for devices using MLO, so Zyxel now automatically enables it on all SSIDs operating in this mode to ensure compliance.

Zyxel NWA210BE review: Standalone mode

Installation is helped along by the AP's web console wizard, which starts by offering two choices for standalone or cloud management. After selecting standalone mode, we were guided through changing the default admin password, setting the country of operation, and creating our first SSID.

The local web console design hasn't seen any changes for years, but at least those already familiar with Zyxel APs won't have any problems using it. The NWA210BE supports up to eight SSIDs, and you use custom profiles and objects to create them. These are assigned to SSID profiles and determine which bands are active and can be used to apply upload and download rate limits and QoS (quality of service) for prioritising voice or video traffic.

Security profiles are assigned to each SSID, and you can choose personal or enterprise encryption schemes along with the mandatory WPA3 for Wi-Fi 7. When you're ready to swap over to 6GHz operations, you change the assigned profile for the second radio.

Zyxel NWA210BE review: Cloud management

Using the NCC iOS app on an iPad, we added the NWA210BE to our cloud account and site by scanning the QR code on its base. It took five minutes to add it to our site, after which the AP began broadcasting our cloud-managed SSIDs.

The customisable NCC dashboard offers plenty of information on all your cloud-managed APs, switches, firewalls, and routers. As with standalone mode, up to eight SSIDs are supported, where you choose your encryption scheme and optionally use tags so they are only broadcast by APs that match them.

NCC supports wireless captive portals, which are assigned to specific SSIDs and use multiple designs with custom logos and messages. To swap between the 5GHz and 6GHz bands, you access the radio settings in the NCC configuration page, where you'll find a list of all APs at the bottom and a BandFlex option for enabling either band.

Zyxel NWA210BE review: Wi-Fi 5/6GHz performance

For performance testing, we connected the NWA210BE to the lab's Zyxel XMG1930-30HP multi-Gig PoE++ switch. Our test hosts were a Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and a Dell PowerEdge Xeon Scalable Windows Server 2022 host connected to switch over 10GbE.

Very specific conditions need to be met for the auto-MLO feature to work, as both active radios must be set to 11be operations and enforce Enhanced Open, WPA3 Personal, or WPA3 Enterprise encryption. Bear in mind that Wi-Fi 7 client devices capable of aggregating the 5GHz and 6GHz bands won't be able to do this with the NWA210BE, and setting its 2.4GHz radio to 11be mode will stop legacy clients from associating.

Starting with a 5GHz 160MHz profile assigned to the AP's second radio, we ran Microsoft's NTttcp utility and recorded raw TCP upload and download speeds of 279MB/sec and 159MB/sec. Real-world SMB tests using large file copies between the client and server returned average close-range speeds of 185MB/sec, and moving the AP 10 metres away into an adjoining room saw this drop to 132MB/sec.

Using the NCC BandFlex option, we swapped over to a 6GHz 320MHz profile and watched our NTttcp tests return increased upload and download rates of 285MB/sec and 211MB/sec. Our real-world tests also received improved close-range and distance copy speeds of 190MB/sec and 143MB/sec.

Zyxel NWA210BE review: Is it worth it

Available at Broadbandbuyer for £177 excluding VAT, Zyxel's NWA210BE will appeal to SMBs that aren't ready to invest in tri-band Wi-Fi 7 APs. However, some may be tempted by Zyxel's NWA130BE, as although its 6GHz band is half as fast, it is a full-strength tri-band Wi-Fi 7 AP costing a mere £133.

Auto-MLO is a smart feature, but businesses that need to support mixed client environments with legacy devices won't be able to use it. Even so, the BandFlex feature is very easy to use, 5GHz and 6GHz wireless performance is good, and you have the choice of standalone or cloud management.

Zyxel NWA210BE specifications

Two security flaws have been spotted in TP-Link routers, and one is the result of the company's patch for a previous flaw.

That’s according to Forescout Research's Vedere Labs, which spotted a flaw (CVE-2025-7850) that allows OS command injection via WireGuard VPN settings.

Another (CVE-2025-7851) allows unauthorized root access via residual debug code following a patch of a previous flaw.

Researchers Stanislav Dashevskyi and Francesco La Spina said they partially pinned their discovery on the use of a technique called "vulnerability variant hunting".

This is a technique whereby an attacker – or in this case, researcher – looks for new ways to exploit a known bug rather than take the "time-consuming and labor-intensive" effort of looking for an entirely fresh one.

"Vendors typically patch the reported issues, but they do not always perform root-cause remediation across the codebase," the researchers noted.

ITPro contacted TP-Link for comment, but has yet to receive a response. The TP-Link Omada security advisory scores the flaws as critical and high in terms of severity.

"Attackers may execute arbitrary commands on the device’s underlying operating system,” the advisory notes.

What TP-Link products are affected?

Researchers noted that the newly discovered vulnerabilities impact TP-Link Omada and Festa VPN routers. Both flaws allowed them to gain root privileges and “served as the foundation for broader vulnerability research across additional TP-Link device families.

One of the flaws (CVE-2025-7851) is the result of TP-Link's patch for a previous flaw (CVE-2024-21827) which left debug functionality accessible, creating an access route for attackers to take advantage of.

Last year, TP-Link fixed CVE-2024-21827 after Cisco Talos reported it allowed arbitrary command execution by taking advantage of used leftover debug code.

"After TP-Link patched it in 2024, devices could no longer be rooted this way — at least until we uncovered a new path," the researchers noted.

That was because the debug functionality was left in – likely because it was useful for developers or support staff, researchers noted – but hidden away so it would be harder to access.

Indeed, finding a route to that debug functionality helped the duo spot the other flaw (CVE-2025-7850).

"The WireGuard VPN settings in the Web UI expose a private-key field that is not properly sanitized, allowing an authenticated user to inject arbitrary OS commands that the device executes with root privileges," they noted.

Using this bug, researchers were able to take advantage of the first flaw. Beyond the issues detailed in the Verdere Labs report, the researchers found additional vulnerabilities that have been reported to TP-Link.

These are expected to be addressed in a patch due to arrive early next year.

"Our protocol analysis also uncovered multiple, additional vulnerabilities — several of them critical and remotely exploitable," the researchers noted. "The issues are currently under coordinated disclosure with the vendor."

What should companies do?

Vedere Labs' researchers advised companies to apply the already available firmware patches. The advisory from Omada also advises changing the password after the firmware upgrade to prevent leakage.

"Apply vendor firmware updates for TP-Link Omada and Festa VPN routers, as well as any other internet-facing devices as they become available," the Verdere Labs researchers said.

"We found the vulnerabilities on firmware version V2.6_2.1.3 (the latest at the time), but several versions are affected."

The researchers also advised the addition of web application firewalls to block command injection and web-based attacks, and to lockdown remote administration access where possible.

Companies should, as ever, log all admin sessions and router traffic to spot anomalies and review vendor support mechanisms on any devices.

MORE FROM ITPRO

• TP-Link Omada SX3832MPP review
• TP-Link just hit a 'critical milestone' in breakthrough Wi-Fi 8 trials
• TP-Link Omada EAP723 review

TP-Link has successfully completed a trial of Wi-Fi 8 in a move the company described as a “critical milestone” in the development of next-generation wireless connectivity.

In a trial conducted alongside an unnamed industry partner, the company said data transmission using a “prototype” device. This test successfully validated both the Wi-Fi 8 beacon and data throughput, according to TP-Link.

“This underscores the feasibility of the technology and marks a critical milestone in global Wi-Fi 8 development,” the company said in a statement.

“TP-Link is taking the next important step towards the highly reliable wireless performance that the industry requires, given the increasing availability of devices and bandwidth-intensive applications.”

The announcement from TP-Link comes in the wake of rapid Wi-Fi 7 adoption in recent years. As ITPro reported in early 2024, the Wi-Fi Alliance began certifying devices that supported the new connectivity standard, which offers improved speed and connectivity compared to its predecessor.

Wi-Fi 7, for example, provides speeds up to four-time faster than Wi-Fi 6 and 6E.

However, if you’re expecting similar improvements akin to the jump from Wi-Fi 6E to Wi-Fi 7, you might be left disappointed. This latest iteration won’t blow users away as far as speed or bandwidth goes.

Indeed, specifications released by the company show Wi-Fi 8 will use the 2.4 GHz, 5 GHz, and 6 GHz bands – which are already used by Wi-Fi 7. Elsewhere, Wi-Fi 8 will also use a 48 Gbps data rate with a 320 MHz maximum channel bandwidth.

So what’s all the fuss about?

What to expect from Wi-Fi 8

TP-Link is keen to emphasize that this marks the first major breakthrough in development of the new standard, which is a significant milestone.

There will be notable improvements for users, however. Chief among these are stability and reliability, the firm noted.

“Wi-Fi 8 is the next Wi-Fi standard, focused on ultra-high reliability,” TP-Link said in a statement. “Instead of striving for maximum speed, it focuses on stable connections, stronger coverage, and smoother roaming – even on heavily congested networks.”

Wi-Fi 8 will also better manage more devices simultaneously and provide users with a stable connection while moving around a home or office space, for example.

“Devices experience less lag and greater stability - even at greater distances from the router.”

Don’t hold your breath for the arrival of Wi-Fi 8, however. The standard still needs to be ratified, which the Institute of Electrical and Electronics Engineers (IEEE) recently noted will be finalized by 2028.

MORE FROM ITPRO

• Looking for affordable Wi-Fi 7 services for your small business? Check out our EnGenius ECW516L review
• The Ubiquiti Networks UniFi U7 Pro is a great Wi-Fi 7 package for businesses
• The TP-Link Omada EAP723 offers a basic Wi-Fi 7 access point at an incredibly low price

Wireless networking and security specialist Zyxel Networks has announced the appointment of BroadbandBuyer, a specialist networking-focused distributor with extensive reach into the SMB market.

The agreement will see the companies collaborate on service and support to take Zyxel's portfolio of solutions to more UK-based installer and MSP partners.

BroadbandBuyer will stock the vendor's full range of products, including its line of 13 WiFi 7 access points, the new USG-FLEX firewalls appliances, multi-gigabit managed switches, and 5G routers.

The distributor will also encourage partners to leverage Zyxel Networks' Nebula cloud platform as a tool for growing their managed services business. The offering enables MSPs to monitor multiple networks and devices remotely, while providing automatic configuration of devices to save time and costs for both partners and customers.

Partners will also be offered the chance to sign up to the vendor's partner program, designed to recognise businesses for selling products and licenses, as well as reward them for building their managed services customer base.

In an announcement, Rachel Rothwell, senior director at Zyxel Networks, highlighted BroadbandBuyer's networking product expertise and focus on SMB-oriented installers and MSPs.

"That aligns perfectly with Zyxel Networks' focus on delivering enterprise networking products at affordable prices," she explained. "It enables us to reach out to a wider group of partners who will be able to take our extensive range to their customers and use our Nebula platform to grow and develop their remote configuration and managed services business."

Founded in 2002, BroadbandBuyer has grown to serve around 20,000 registered customers and operates as an employee-owned trust. The distributor boasts extensive reach into the UK community of installers, resellers, and MSPs, and provides more than 11,000 networking and storage solutions via its website.

Commenting on its latest agreement with Zyxel Networks, BroadbandBuyer managing director, Oliver Essame, said the vendor offers a range of networking solutions that "fits perfectly" with the profile of the distributor's installer and MSP customers.

"In addition, Nebula, with its remote installation and monitoring capabilities, presents a whole new world of potential for partners to expand their services proposition and deliver more value to SMB customers," he added. "We look forward to working with the Zyxel Networks UK team to bring new partners on-board."

TP-Link was one of the first vendors to deliver Wi-Fi 7 access points (APs) and now offers an impressive portfolio of products aimed at a wide range of businesses. The EAP723 on review is the latest to join the family and stands out from the crowd as this has to be the lowest cost Wi-Fi 7 AP currently on the market.

Costing only £70 excluding VAT, the EAP723 looks remarkably good value, but there is a catch as it's an entry-level model that doesn't have a 6GHz radio. It isn't mandatory for Wi-Fi 7 APs to have this, though, and there are many other vendors offering low-cost dual-band models – although none currently come close to this low price.

The EAP723 is a BE3600-rated AP offering two spatial streams each for the 2.4GHz and 5GHz bands and claiming maximum speeds of 688Mbits/sec and 2,882Mbits/sec respectively. The US version has a higher BE5000 rating as it supports the 5GHz 240MHz channels.

It may only be a dual-band AP, but the EAP723 is endowed with all key Wi-Fi 7 features, including 4K-QAM (quadrature amplitude modulation) and multi-RUs (resource units). The latest firmware version adds support for MLO (multi-link operations), which allows compliant wireless devices to connect over an aggregated link using both bands.

TP-Link Omada EAP723 : Build quality and version variations

With a 160mm diameter and 37mm thickness, the EAP723 is the most discrete Wi-Fi 7 AP we've yet seen. Clothed in a sturdy polycarbonate casing with an aluminium inner shell, it presents a 2.5GbE port in a recess underneath and only requires an 802.3at PoE+ power source.

Along with a reset button, the AP also has a 12V DC input socket in the recess. You'll need to source your own 1.5A power adapter, though. The box includes a complete mounting kit with wall-mount screws and plugs, plus T-Rail brackets for dropped ceilings.

There are two hardware versions of this AP, and we can highlight the differences as we have both the original V1 and the later V2 models. Dimension-wise, they are identical, but you can easily tell them apart as they have differently shaped recesses.

TP-Link advised us that it only changed some internal materials to ensure the supply with both models supporting MLO. Other minor differences are the V2 is 2gms lighter and its maximum PoE+ power consumption is 1.8W less.

TP-Link Omada EAP723 review: Standalone management

Deploying the EAP723 in standalone mode is simple as its web console's quick start wizard required us to supply a new username and password after which it sensibly removed the default admin account. The AP supports up to eight SSIDs per radio, and the wizard offers the opportunity to configure the first ones for each radio and secure them with a new encryption key, which includes mandatory support for WPA3.

The AP's web console is a simple affair that presents a status page showing CPU and memory utilization, all wireless networks, plus tables of inbound and outbound traffic, and lists of connected clients. Each SSID can have their own authentication scheme, upload and download rate limits, and L2 isolation, which blocks wireless clients from the local network.

A built-in scheduler controls when the AP or its SSIDs are active, QoS (quality of service) can be applied to voice and video traffic, and MLO is enabled by creating a new SSID, which automatically has both radios assigned. Basic captive portals can be applied to selected SSIDs, and although authentication is limited to a global password or an external Radius server, you can apply a redirect URL and present them with a web page and AUP (acceptable use policy) message that they must accept to continue.

TP-Link's Omada mobile apps also support managing APs in standalone mode. We connected an iPad to one of its SSIDs and, after choosing the app's standalone mode, could view the AP's status, enable and disable selected radios, and create new SSIDs.

TP-Link Omada EAP723 review: Wi-Fi 7 performance

For testing, we hooked the EAP723 up to the lab's Zyxel XMG1930-30HP multi-Gig PoE++ switch, which confirmed a 2.5GbE connection and a PoE+ power draw. We ran performance tests between a Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and a Dell Windows Server 2025 host connected over 10GbE fibre.

With the 5GHz 160MHz channels enabled, our client confirmed a 2.8Gbits/sec link speed. We used Microsoft's NTttcp utility to measure raw TCP upstream and downstream speeds between the desktop and server, which reported back rates of 201MB/sec and 170MB/sec.

Our real-world large file copies between the client and Windows server averaged close-range speeds of 180MB/sec, dropping to 156MB/sec with the AP moved 10 metres away and into an adjoining room. With MLO enabled, the client reported an aggregated link speed of 3,570Mbits/sec and further NTttcp tests revealed a very small increase in upstream speeds to 204MB/sec.

TP-Link Omada EAP723 review: Cloud mode

TP-Link offers one of the widest range of options for cloud management, as you can choose from four OC-series hardware or free self-hosted software on-site controllers or use its cloud-based versions. The latter has extra appeal as TP-Link offers a free Omada Essentials cloud controller which provides a base set of management and monitoring features for smaller businesses.

To cloud-manage the EAP723, we swapped the Omada iOS app over to controller mode, chose our Essentials account, scanned the AP's QR code label and added it to our site. Once adopted, it took all its settings from the controller and broadcast our predefined SSIDs with the portal also offering a firmware upgrade.

The Essentials dashboard presents a basic overview of all managed devices along with the most active SSIDs and wireless clients, but, unlike the Standard version, it can't be customised. Other features not available in Essentials include WLAN optimisation, IPS/IDS, ACLs, and DPI.

Cloud management supports the same number of SSIDs as standalone mode, and from the site settings page, you can easily create new ones, apply encryption schemes, assign rate limit profiles, and enable MLO. Wireless meshing can be enabled on compliant APs to extend coverage, and captive features are superior to standalone mode as these support more authentication methods and allow you to create custom landing pages.

TP-Link Omada EAP723 review: Is it worth it?

Small businesses and retail outlets looking to offer Wi-Fi 7 services will be very tempted by the EAP723's incredibly low price. The AP is easy to deploy, offers good coverage and client density while its palm-sized package makes for a discrete solution.

The trade-offs are its underwhelming Wi-Fi 7 performance and the lack of 6GHz radio so clients won't get the benefit of this cleaner, less congested space. TP-Link scores highly for its wealth of management choices though, with the free Omada Essentials cloud portal providing all the features its target market is likely to need.

TP-Link Omada EAP723 specifications

Businesses with a lot of legacy client devices and a desire to future-proof their wireless networks will find Zyxel's WBE510D and WBE630S Wi-Fi 7 access points offer an interesting solution. Their integral BandFlex technology allows you to configure them for 2.4GHz and 5GHz operations and, when the time is right, swap over to the 6GHz spectrum.

We review the WBE510D model, which provides four spatial streams – two for the 2.4GHz band and two for the 5GHz or 6GHz bands, with the latter two supporting their respective high-speed 160MHz and 320MHz channels. It's a BE6500-rated AP claiming maximum speeds of 688Mbps for the 2.4GHz radio, 4,324Mbps for 5GHz, and 5,764Mbps for 6GHz.

Zyxel offers a range of AP models aimed at different markets, with the entry-level NWA family targeting smaller businesses seeking an affordable wireless solution. The WBE models offer an advanced feature set, including SmartMesh and SecureWiFi, and are NebulaFlex Pro versions that come with a 1-year Pro Pack license for Zyxel's Nebula Cloud Control (NCC) cloud portal and support management from Zyxel's on-premises controllers, such as its USG Flex security appliances.

Zyxel WBE510D review: Design and build quality

The lozenge-shaped casing is sturdily constructed from high-impact plastic and weighs a solid 818gms. The box includes a universal mounting bracket and drop ceilings are supported as Zyxel offers an optional set of clips costing around £22 for a 5-pack.

Along with dual-optimised aerials that support wall or ceiling mounting, the AP presents a 2.5GbE multi-Gig port and one advantage of BandFlex is it only requires an 802.3at PoE+ power source. An unusual feature is the USB-C port alongside which can be used with an appropriate 2A USB PD 15 supply to power the AP.

Whether you choose 5GHz or 6GHz operations, you'll find the WBE510D offers all key Wi-Fi 7 features. These include 4K-QAM (quadrature amplitude modulation) and MLO (multi-link operations) which allows compliant wireless devices to connect over an aggregated link using the 2.4/5GHz or 2.4/6GHz bands.

Zyxel WBE510D review: Standalone management

Installation is ably aided by the AP's web console wizard, which starts by offering three choices for standalone, cloud or appliance-based management. After selecting the first option, the wizard then took us through changing the default admin password, setting the country of operation, and creating our first SSID.

The AP has an active default unsecured SSID for initial setup access, but once the wizard has completed, check that it has been disabled. Up to eight SSIDs are supported, and you use custom profiles and objects to create them, although the process isn't particularly intuitive.

First, you have an object for each of the two radios, and these are then assigned SSID profiles, which determine which bands are active and can be used to enable features such as upload and download rate limits and QoS (quality of service) for prioritising voice or video traffic. Next, you assign a security profile to each SSID, which determines an encryption scheme that includes personal and enterprise versions along with the mandatory WPA3 for Wi-Fi 7.

When the time comes to swap to 6GHz operations, you simply change the assigned profile for the second radio. Note that although the WBE510D supports MLO, this can only be enabled from the CLI or NCC portal and not from the local web console.

Zyxel WBE510D review: Wi-Fi 5/6GHz performance

With the WBE510D hooked up to the lab's Zyxel XMG1930-30HP multi-Gig PoE++ switch, we ran performance tests between the lab's Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and a Dell Windows Server 2025 host connected over 10GbE fibre.

We started with a 6GHz profile assigned to the AP's second radio and watched Microsoft's NTttcp utility record raw TCP upstream and downstream speeds between the desktop and server of 282MB/sec and 224MB/sec. Real-world SMB tests using large file copies between the client and server returned average close-range speeds of 199MB/sec, dropping to 182MB/sec with the AP moved 10 metres away and into an adjoining room.

Swapping over to a 5GHz 160MHz profile, our Windows client registered a 2.8Gbits/sec wireless connection, and running NTttcp returned upstream and downstream speeds of 265MB/sec and 167MB/sec. Further real-world file copy tests saw close-range and distance speeds of 156MB/sec and 135MB/sec.

Zyxel WBE510D review: NCC management

Moving to cloud management is a simple process as we logged into our cloud account using the NCC iOS app on an iPad, selected our site and scanned the QR code on the box label. The app added it to the site and five minutes later, the AP started broadcasting our cloud managed SSIDs.

The NCC portal presents an informative dashboard with customisable widgets showing the status of all Zyxel cloud-managed devices, total wireless traffic, APs by usage, all connected wireless clients along with their detected OS and PoE consumption for our Zyxel switch. Up to eight site SSIDs are supported where you choose your encryption scheme and optionally use tags so they are only broadcast by APs that match them.

Unlike standalone mode, NCC supports wireless captive portals. These allow you to create multiple designs using custom logos and messages along with a good range of authentication methods.

To swap between the 5GHz and 6GHz bands, you visit the NCC configuration page and select the radio settings option. At the bottom of this page, you'll find a list of all APs, tabs for the three bands and an extra BandFlex tab for enabling the 5GHz or 6GHz bands.

MLO can be enabled in an SSID's advanced settings and our TP-Link Wi-Fi 7 adapter supports MLO (multi-link operations) using MLMR (multi-link multi-radio). Our Windows 11 client created an aggregated 6,453Mbits/sec link across the 2.4/6GHz bands but subsequent runs of NTttcp showed the top download speeds wouldn't go beyond 282MB/sec

Zyxel WBE510D review: Is it worth it

With the WBE510D available at Zyxel's UK store for £217 excluding VAT, businesses that don't want to cough up for a full strength triple-band Wi-Fi 7 AP will find it a cost-effective alternative. The BandFlex feature makes it simple to swap between 5GHz and 6GHz operations, wireless performance is good and Zyxel's NCC provides top quality cloud management services.

Zyxel WBE510D specifications

Zyxel has steadily built up an impressive portfolio of network switches and offers a wide choice of solutions for the SMB sector. Introduced in 2022, the XGS1930 series of switches offers plenty of features at a good price, but after three years of solid service, Zyxel has decided the time is right to retire them.

The new XGS1935 series offers an equally good range of options as they are also available in 24- and 48-port versions, all with a quartet of 10GbE SFP+ uplink ports. As before, you also have two PoE models, and in this hands-on review, we take a closer look at the flagship XGS1935-52HP.

As with their predecessors, the XGS1935 series is all Layer 2 (L2) switches with 'Lite-L3' capabilities. They support static IPv4 and IPv6 routing along with client DHCP request relays from one network to another, but not the dynamic routing offered in more costly full Layer 3 (L3) switches.

For switch management, you can opt for a standalone operation mode or move it all into the cloud using Zyxel's Nebula Control Center (NCC) platform. Unlike Zyxel's new USG Flex firewall appliances, the Smart Sync hybrid management feature isn't available, so you have to choose between standalone and cloud modes.

Zyxel XGS1935-52HP review: Hardware and new features

Existing users of the XGS1930 models looking for an upgrade are unlikely to be tempted by the new switches, as their performance specifications are identical. That said, the XGS1935-52HP looks capable of handling a high throughput as it sports a 176Gbits/sec backplane, which delivers a high forwarding rate of 130.9 million packets per second (Mpps).

The switch presents 802.3at PoE+ services on all 48 copper Gigabit ports and has a reasonable power budget of 375W. Zyxel is aiming the switch at powering devices such as APs, IP cameras, and IP phones, but the lack of multi-Gigabit ports makes it less appealing for businesses looking to deploy high-performance Wi-Fi 7 APs – we use Zyxel's XMG1930-30HP in the lab, which has every Wi-Fi and PoE angle covered.

There are a number of changes to the new switches that aim to improve their green credentials. Incorporating more energy-efficient components, Zyxel has reduced idle power consumption for the XGS1935-52HP from 46.8W to 32.2W and maximum power usage from 498.4 to 470.1W.

It's significantly smaller as Zyxel has reduced its depth by 60mm and slimmed it down by nearly 1.5kgs with Zyxel claiming a 36% reduction in unit packaging. Other new features include 4kV ESD/surge protection and support for energy-efficient Ethernet (EEE).

Zyxel XGS1935-52HP review: Standalone mode

Setting up the switch for standalone operations is easy. Its local web console presents wizards for setting a default admin password, plus SNMP community names and configuring security features, VLANs, and quality of service (QoS).

The console's dashboard view presents a switch graphic showing all ports, their connection speeds, and whether they are supplying power. Down below are widgets for system utilisation, total power usage, temperatures, plus fan operations (which are extremely quiet,) and clicking on any of them transports you to a monitor page for more detailed information.

The 375W power budget may be stretched with so many Gigabit ports, but the switch has a warning LED on the front for high PoE usage, and you can apply one of three power priorities to each port. If the total power draw gets close to the maximum available, those with the lowest priority will be switched off first.

All configuration options are easily accessible from the left-hand menu with an abundance of L2 features, including support for port-based and 802.1q VLANs along with static and LACP link aggregation groups. VoIP networks are on its radar as the switch identifies traffic from IP phones using a customisable OUI (organisationally unique identifier) list and automatically prioritises it by dynamically creating voice VLANs.

Security features are equally good as the switch supports access control lists (ACLs), port security, plus 802.1x port authentication, and can automatically move users with incorrect login details to a secure guest VLAN. Monitoring features include support for all versions of SNMP, but you don't get Zyxel's internal sFlow agent, as this is only provided in its higher-end switches.

Zyxel XGS1935-52HP review: Cloud management

Cloud deployment is equally swift, as we used the Nebula iOS app on an iPad to scan the QR code label on the box. Two minutes later, the switch popped up in our cloud portal and received all our site settings, which included changing the local admin password to the one set for all site devices.

The widget-based NCC dashboard can be easily customised, and we added ones to show the online status of our switch and total power usage. Selecting the switch took us to its monitoring page, which provides a location map, hardware monitor, and colour-coded views of all ports plus 2 and 24-hour traffic and power graphs which can be extended to 7 days with an optional NCC Plus licence and 30 days with a Pro version.

As far as we can see, all the features available in the local console can be configured in NCC. From the portal's switch configuration menu, you select individual ports, set their PoE priority, apply one of five global PoE schedules that determine when powered devices (PDs) are active and PoE services can be disabled and enabled – handy for remotely rebooting a PD that isn't responding.

Other options include creating static routes, port mirroring, access control lists, and voice VLANs. The new port profile feature allows you to create up to 10 groups of global settings and apply them to selected ports.

Zyxel XGS1935-52HP review: Is it worth it?

Zyxel's XGS1935-52HP delivers a lot for a good price as we found it at Broadbandbuyer for £528 excluding VAT – around £100 less than its predecessor. It supports standalone or cloud management and is an affordable choice for SMBs seeking a port-dense Gigabit PoE+ solution for office-wide deployments of IP phones, wireless APs and IP cameras with room for 10GbE upgrades.

Zyxel XGS1935-52HP specifications

While some wireless network vendors dithered with support for Wi-Fi 7, EnGenius went full steam ahead over a year ago and now offers an extensive range of access points (APs). The ECW536 and ECW526 impressed us with their fine combination of features and performance, but their comparatively high price tags put them beyond the budgets of smaller businesses.

The 'Lite' range rectifies this and introduces three new APs with a sharp focus on value. The ECW210L and ECW212L are Wi-Fi 6 APs, while the ECW516L, on review, delivers Wi-Fi 7 services at a more affordable price.

It may be an entry-level model, but the ECW516L surprises with its big BE14000 rating – much higher than the more expensive BE9300-rated ECW526. It offers eight spatial streams comprising two for its 2.4GHz radio plus three each for the 5GHz and 6GHz bands and claims maximum speeds of 700Mbits/sec, 4,300Mbits/sec and 8,700Mbits/sec respectively.

EnGenius ECW516L: Hardware features

There are a number of compromises to get the price down as the ECW516L sports a basic 2GHz Mediatek MT7986A A53 CPU. The ECW536 and ECW526 get the benefit of a more powerful Qualcomm Networking Pro 1220 platform, which employs a quad-core ARM Cortex-A73 CPU.

Furthermore, whereas its bigger brothers have high-speed 10GbE ports, the ECW516L receives a 2.5GbE multi-Gig port. This only requires an 802.3at PoE+ power source, or you can use the power jack alongside with the optional adapter costing around £20.

Weighing 616gms, the ECW516L is 104gms lighter than the ECW526 and easily wall or ceiling mounted. The box includes a complete kit with wall-mount screws and plugs plus two sizes of T-Rail brackets for dropped ceilings.

Status LEDs are in abundance as the AP has one for power and cloud management connection, another for the LAN port, and separate ones for each radio. General build quality is good as the ECW516L has a solid polycarbonate front cover and a finned metal chassis which acts as a heatsink.

EnGenius ECW516L: Cloud management

As with all ECW models, the ECW516L can only be cloud-managed and Engenius introduces a new low-cost Cloud Lite service offering a reduced feature set. All Lite APs come with a licence-free basic plan included in the price, which is similar to the standard ECW version but designed for up to 50 users, supports 100 concurrent devices per AP, and doesn't offer features such as Hotspot 2.0 and dynamic VLAN services.

You can upgrade to a Lite Professional plan at any time with a 1-year license costing only £8 and a 3-year licence upping this to around £18 per device. These increase log storage to 30 days and add features such as device configuration backups, real-time views of connected clients, and facilities to export client lists to CSV files.

For testing, we connected the AP to the lab's Engenius ECS2512FP cloud-managed 2.5GbE PoE+ switch and used the Cloud To-Go iOS app on an iPad to scan its QR code. Once the AP was added to our organisation, it started broadcasting all our predefined SSIDs.

The Engenius cloud portal sees a few new design touches and presents a non-customisable dashboard displaying connection details of all APs and switches with graphs showing the number of connected wired and wireless clients plus power status for PoE switches. Enable the application control service on your SSIDs, and the dashboard adds another table below showing the top ten apps and their bandwidth usage.

Each site supports up to eight SSIDs, and for each one, you can decide which radios are active, enable L2 isolation, band steering plus fast roaming and apply download and upload rate limits for the entire SSID or per client. Note that SSID masking is not supported on the 6GHz radio, and the ECW516L doesn't support the Wi-Fi 6 160MHz channels.

Engenius takes wireless security seriously as it won't allow you to present open, unsecured SSIDs. You can choose from OWE (opportunistic wireless encryption) for safe open public networks or apply the appropriate encryption version up to the mandatory WPA3 for Wi-Fi 7.

The ECW516L supports wireless meshing but only with other Lite APs and not the standard ECW models. You enable this in the cloud portal's radio page and can have a mesh of up to eight nodes, preferably with no more than two hops between them and the root node.

EnGenius ECW516L: Wi-Fi 7 performance

To test performance, we called up the lab's Lenovo Windows 11 Pro desktop client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter and hooked up a Windows Server 2025 host to one of the switch's fibre 10GbE ports. Starting with Microsoft's NTttcp utility, we recorded reasonable raw upstream and downstream speeds between the desktop and server of 235MB/sec and 202MB/sec.

Real world SMB tests using large file copies between the client and server returned average close-range speeds of 191MB/sec dropping to 179MB/sec with the AP moved 10 metres away and into an adjoining room. Performance isn't overwhelming but it is in the same range as many other low-cost Wi-Fi 7 APs we've tested.

The TP-Link Wi-Fi 7 adapter supports MLO (multi-link operations) using MLMR (multi-link multi-radio) and after enabling it on the ECW516L, we could see that our Windows 11 client had created an aggregated link across the 6GHz and 2.4GHz radios. Windows showed the aggregated link speed as 6,453Mbits/sec but further runs of NTttcp didn't see any noticeable performance improvements.

One thing we did spot was the MediaTek CPU struggling with our NTttcp stress tests as the cloud portal's AP diagnostics graph showed utilization getting close to 100%. The web portal also warns that using the application analysis service can hit performance, and further tests showed it dropping wireless speeds by up to 10%.

EnGenius ECW516L review: Is it worth it

For a BE14000-rated Wi-Fi 7 AP, the ECW516L represents reasonably good value for small businesses looking to upgrade their wireless networks. We could only find two UK resellers with Solwise offering the best price of £190 excluding VAT.

Overall Wi-Fi 7 performance is good and although the AP's CPU will struggle under heavy load, it's unlikely to cause any problems in less demanding small business environments. Along with an easy deployment, the ECW516L delivers plenty of features for the price and the free Lite cloud portal provides great remote management features.

EnGenius ECW516L specifications

Cloud-managed networking is a valuable ally for most businesses as they can monitor and configure all their security, switching, and wireless services from a centralised cloud portal. A main drawback is that the majority of vendors lock out local device access when this is enabled, and as we've found on a number of occasions, some advanced features don't get ported over to the respective cloud portals.

Zyxel neatly overcomes these limitations as its USG Flex H series of UTM (unified threat management) appliances introduces the Smart Sync feature. You can manage these appliances from their local web console or Zyxel's Nebula Cloud Control (NCC) portal, and any configuration changes made in one will be automatically synced to the other.

We review the top-dog USG Flex 700H, which looks to offer an impressive security package at a competitive price. Zyxel declined to tell us what CPU it was using, but it must be fairly good as the 700H boasts a high raw SPI firewall throughput of 15Gbits/sec and a respectable 4Gbits/sec with the anti-malware and intrusion prevention services (IPS) enabled.

Zyxel USG Flex 700H review: Hardware and security features

The appliance offers plenty of port choices, with the first two 2.5GbE multi-Gig ports available for dual WAN services. Next up, you have two copper 10GbE multi-Gig ports presenting 802.3at PoE+ services, eight standard Gigabit LAN ports, and two 10GbE SFP+ fibre uplink ports.

Prices on Zyxel's store website start at £1,475 including VAT, with the base subscription bundling the appliance and a 1-year subscription to Zyxel's IP reputation filter and SecuReporter cloud reporting service. The appliance with 1-year Gold Security Pack subscription only costs £1,679 and enables everything Zyxel has to offer, including anti-malware, web content filtering, IPS, application patrol, and cloud sandboxing – further one-year Gold subscriptions cost £914.

There's more as the Gold pack includes an NCC Pro Pack upgrade which enables features such as email alerting, organisational audit logs, scheduled device firmware updates, configuration backup and restore, and a rolling one-year log retention service. You also get the Device Insight service on the appliance, which provides full visibility on all connected wired, wireless, plus BYOD devices, details such as their MAC address and detected OS, and options to block selected ones.

The Gold Pack enables the Secure WiFi feature, which allows remote and home workers using a Zyxel AP that supports Remote AP (RAP) mode to create a secure, encrypted tunnel to the appliance. There's one catch, though, as this feature won't be available until later this year.

Zyxel USG Flex 700H review: Deploy and configure

Deployment is a breeze as the appliance's local web console runs a wizard that requires an admin account password change, enables your selected WAN port, and then offers to create one subnet for the 10GbE PoE and the first two Gigabit ports, and another for the last four Gigabit ports each with their own DHCP server. It then asked us to register the appliance with our NCC account, while new users are offered the chance to create an account and define their first organisation and site.

You can easily configure the security services as they are all accessed from the relevant menu in the local console or from one page in the NCC portal. Most can be enabled with one click, and for the anti-malware service, you can request that specific file types, such as executables and ZIP archives, be checked against Zyxel's cloud threat intelligence database.

The web content filtering service offers 105 URL categories that can be blocked or allowed, while Zyxel's DNS threat filtering intercepts DNS queries and blocks known malicious domains. Profiles for the application control service can include any of the thousands of predefined signatures or you can choose from 26 categories to block all access to services such as social networking.

We found that most advanced security features are mirrored across both the local and NCC interfaces, and the Smart Sync service worked perfectly. We made numerous changes to various services and firewall policies from NCC, and each time, the local console flagged up an alert that changes had been made and automatically updated itself. Equally, any changes made in the local console appeared in the NCC portal.

Some features, such as Device Insight, can only be enabled and viewed from the local console, but Zyxel has this covered. Select the firewall from the NCC devices page, and you can use the remote configurator tool to open a secure session to the appliance's local console, which automatically closes after 30 minutes.

Zyxel USG Flex 700H review: Monitoring and SecuReporter

The appliance's local console provides two dashboard views, with one presenting an appliance hardware status overview and port traffic statistics. The Security dashboard provides charts and graphs of all security services, the top apps, detected threats, plus sandbox activity, and you can use the security statistics section to drill down into individual services for more detail.

The NCC dashboard can be customised with a range of widgets for all Zyxel cloud-manageable devices. The lion's share of widgets is for wireless network monitoring, but ones are provided for the firewall and show the top ten network applications, CPU utilization, and security alerts.

One click on the security alerts widget takes you straight to the SecuReporter cloud portal, which opens with a detailed dashboard showing the status of every security service, a global threat map, and details of all detected attacks. The Analysis pages provide deeper insights into security issues with options to generate and email regular reports, while the AI-powered SecuPilot offers views of the most severe threats and remediation advice.

Zyxel USG Flex 700H review: Is it worth it?

Most definitely. Zyxel's security appliances have always offered SMBs great network protection features at affordable prices, and the USG Flex 700H continues this tradition with a price tag that'll give the competition nightmares.

It offers an impressive choice of network ports, and although the appliance's PoE power budget of 30W is on the low side, it should be enough to drive a couple of Wi-Fi 6/7 wireless access points. The Gold Security Pack delivers an impressive set of security measures, but the standout feature has to be Zyxel's Smart Sync, as it doesn't force you to choose between local and cloud management.

Zyxel USG Flex 700H specifications

Cybersecurity experts have issued an alert over a new cyber espionage network that’s believed to have compromised thousands of devices globally.

Dubbed 'LapDogs' by researchers at SecurityScorecard, the campaign has focused on the US, Japan, South Korea, Taiwan, and Hong Kong.

The use of Mandarin in developer notes within the startup script, along with the tools, techniques, and procedures (TTPs) used and the choice of targeted regions means it is likely to be run by a China-based group.

Victims recorded so far include ISPs, hardware vendors, and specific organizations in several sectors, including IT, networking, real estate, and media.

The campaign appears to have been running since September 2023, with infections remaining undetected for months, allowing for long-term surveillance and exploitation.

It involves stealthy, long-term intrusion campaigns, and exploits IoT devices and Small Office/Home Office (Soho) routers, including legacy devices from vendors such as Ruckus Wireless and Buffalo Technology.

Unlike traditional botnets, researchers said the campaign leverages sophisticated Operational Relay Boxes (ORBs) — malicious nodes that route traffic through legitimate devices without triggering alarms, thereby masking the attackers' activities.

"This campaign shows a surging interest from China-Nexus threat actors in using ORB Networks to conduct covert intrusion campaigns both around the globe and tailored to specific victims of interest," researchers warned.

"With an increasing interest in this approach, security teams should be on alert that China-Nexus threat actors are disrupting traditional playbooks for IOC tracking, response, and remediation."

A custom Linux- and Windows-compatible backdoor called ‘ShortLeash’ enables silent control, persistence, and lateral movement inside networks, researchers noted.

ShortLeash also generates TLS certificates that are spoofed as being signed by the Los Angeles Police Department (LAPD) to further obscure its origin.

The LapDogs campaign is expanding at pace

Researchers warned that LapDogs has been spreading methodically, with attackers using it both to anonymize their operations and to establish beachheads into broader infrastructure, including enterprise networks.

“LapDogs reflects a strategic shift in how cyber threat actors are leveraging distributed, low-visibility devices to gain persistent access,” said Ryan Sherstobitoff, chief threat intelligence officer at SecurityScorecard.

“These aren’t opportunistic smash-and-grab attacks—these are deliberate, geo-targeted campaigns that erode the value of traditional IOCs (Indicators of Compromise).”

While there are similarities with PolarEdge, another China-linked ORB network, LapDogs operates independently and its TTPs do differ.

Researchers said they identified 162 discrete intrusion sets, with around a third sharing a common geographical location or ISP. This, they added, suggests that the operators are highly focused on several specific locations and that LapDogs is a goal-oriented actor.

"Overall, LapDogs is a vast, prolonged intrusion operation with clear intent and planning, emphasizing the need for vigilance in securing embedded devices," the researchers warned.

MORE FROM ITPRO

• China cyber threats: What businesses can do to protect themselves
• Warning issued after Chinese hacker group breaches telco firms in "dozens of countries"
• Why government email servers are top targets for state-backed hackers

Zyxel has traditionally focused on the SMB switching market but the CX4800-56F signals a first move into the enterprise and service provider spaces. It comes in with a big bang as this 1U Layer 2/3 switch presents no less than 48 10/25GbE SFP28 fiber ports and teams them up with eight high-speed 100GbE QSFP28 uplink ports.

Aimed at top-of-rack (ToR) deployments and core network aggregation services, the CX4800-56F is designed to deliver plenty of headroom to handle future growth as businesses look to move from 10GbE to 25GbE. Zyxel also has AVoIP (Audio-Visual over Internet Protocol) networks on its radar as the switch's management console offers an option to swap directly to a Network AV Mode that presents a condensed web interface with only the features required to monitor and maintain these types of networks.

Management options look good as you can run the switch in standalone mode or hook it up with Zyxel's Nebula Control Center (NCC) service for full cloud access. For the latter, the switch includes a 1-year NebulaFlex Pro Pack licence which enables all NCC features.

Zyxel CX4800-56F review: Hardware features

The switch has a 2.1GHz quad-core Intel Atom C3538 CPU in the driving seat, partnered by 64MB of Flash memory and 8GB of DDR4 RAM with a 32GB M.2 SSD looking after the operating system. The CX4800-56F is the first of Zyxel's next generation of switches to feature its new Linux-based FaOS software which is designed to retain the look and feel of ZyNOS but offer improved security, flexibility, and hardware compatibility.

Hardware redundancy looks good as the switch sports dual hot-plug 650W PSUs at the rear and Zyxel offers AC or DC versions. Cooling is also handled well as in between the PSUs is a bank of four field replaceable hot-swap fan modules.

The switch clearly won't have any problems handling a very high demand. It boasts a fast 4Tbps backplane teamed up with an impressive 2 billion packets per second (Bpps) forwarding rate – easily the match of more expensive core switches.

Zyxel CX4800-56F review: Standalone management

A dedicated network port at the rear can be used for out-of-band (OOB) management and first contact with the local web interface requires the default admin password to be changed. You can then choose standard mode if you want full access to all settings or the Networked AV mode for simplified management but don't worry if you change your mind as all each mode does is present a different interface without changing any settings.

The home page dashboard has a switch graphic showing all ports, their connection status, and negotiated speed. In standard mode, you get a system status and utilization table below plus quick links to common tasks while AV mode changes the page layout to list bandwidth usage for all ports.

There are a lot more configuration options in standard mode which are all neatly categorised in the left-hand menu. L2 features are extensive and include support for 802.1q, port, MAC, protocol, and IP subnet based VLANs along with static and LACP link aggregation groups.

For security, the switch supports access control lists (ACLs), port security plus 802.1x port authentication and has the ability to move users with incorrect login details to a secure guest VLAN. Monitoring features include support for all versions of SNMP and the switch has an internal sFlow agent which can send packet samples from selected ports to four different collectors.

We received an early review sample that only supports Zyxel's L3 Access Standard features – similar to the entry-level XGS2200 switch series. Services yet to be enabled include L2 features such as physical stacking for two switches and support for 100GbE to 4 x 25GbE breakout ports plus advanced L3 routing features like RIP, OSPF, ECMP and VRRP. Alas, it's going to be a long wait for these as Zyxel advised us they won't be available until December 2025.

Zyxel CX4800-56F review: Cloud control

The OOB port can't be used for cloud management so before deploying the switch in this mode, you need to ensure it has a management VLAN configured for internet access. Adding the switch to our NCC cloud account was simple as we used the Nebula iOS app on an iPad to scan the QR code label located inside the box lid.

The switch duly appeared online in our cloud portal and took all its settings from those we'd previously configured for our site. The customizable NCC dashboard told us everything we needed to know about our Zyxel devices with the topology view showing all connections to the CX4800-56F for our PoE switches, access points, servers, and clients.

Select the switch from the device menu and you can view all its details including available firmware updates, check on the status of the fans and PSUs from the hardware monitor, and see all port connection speeds. Selecting a port from the main switch graphic presents a bandwidth utilization graph with a more detailed traffic table below.

The NCC Configure tab provides menus for all cloud-managed device categories. The switch section allows you to access and configure individual switch ports, assign port profiles, implement switch stacking, and set up features such as static routes, port mirroring, and access control lists.

Zyxel CX4800-56F review: Is it worth it?

It certainly will be when all the advanced features have been enabled with future firmware upgrades. An RRP of £4,999 excluding VAT makes the CX4800-56F competitively priced as similarly specified switches from Aruba, Cisco, and Netgear cost around 2-3 times as much.

The CX4800-56F is very versatile as it delivers a high density of 10/25GbE ports, teams them up with 8 100GbE ports, and offers a choice of two management modes. Larger businesses and enterprises looking to upgrade their infrastructure from 10GbE to 25GbE will find this a powerful and cost-effective solution.

Zyxel CX4800-56F specifications

Ruijie Networks focuses on enterprise network infrastructure provisioning and launched its Reyee sub-brand in 2014 with the aim of delivering a wide range of affordable networking products to the SMB market. The Reyee family comprises modular and fixed-port switches, routers, firewalls plus wireless access points (APs) and all look very affordable.

Another bonus of the Reyee products is they can all be remotely managed from Ruijie's free Cloud portal. Many competitors in this space offer a free basic cloud portal but some advanced features can only be enabled with yearly subscriptions.

On review is the RG-RAP72Pro Wi-Fi 7 AP which at first glance, looks incredibly good value as it only costs around £126 excluding VAT. There is a catch though, as to get the price down so low, Ruijie has dispensed with the 6GHz radio.

Ruijie Reyee RG-RAP72Pro review: Features and build quality

It isn't mandatory for Wi-Fi 7 APs to have a 6GHz radio and a number of other vendors also offer lower priced dual-band models. The BE5040-rated RG-RAP72Pro has a comparatively high throughput as it offers two spatial streams on the 2.4GHz radio plus three for 5GHz and claims maximum speeds of 688Mbits/sec and 4,323Mbits/sec respectively.

The AP's 5GHz radio supports the high-speed 160MHz channels and delivers all key Wi-Fi 7 features. These include 4K-QAM (quadrature amplitude modulation) and MLO (multi-link operations) which allows compliant wireless devices to connect over an aggregated link using both bands.

This distinctively-shaped AP is clothed in a high-impact polycarbonate shell and the kit comes with a metal plate and fittings for wall or ceiling mounting. The AP locks in place when slid down on the metal plate and can be removed with the metal latch key provided in the box.

As you'd expect at this price, the main LAN port is the 2.5GbE multi-Gig variety which requires a basic 802.3at PoE+ power source. The AP also presents a Gigabit port for cable networking other devices and although there's a power input provided, a 12V adapter is optional.

Ruijie Reyee RG-RAP72Pro review: Deployment options

The AP can be deployed in standalone mode using its own web console but cloud management will be the preferred method for businesses with multiple APs spread across different sites. For cloud deployment, there's the very easy way and the not-quite-so-easy way.

Our review sample was supplied by Broadbandbuyer which offers a free cloud provisioning service. During the order process, you fill in a secure online questionnaire about your networking requirements and receive a link to a personal portal which is prepared with a project ready and waiting.

When the products arrive, you connect them to the network after which they appear online in your portal's project workspace preconfigured with the details you supplied. As we already have a Ruijie Cloud account, we took the not quite so easy way which only took a couple of minutes with the AP's local console quick start wizard linking it to our account.

Ruijie Reyee RG-RAP72Pro review: Cloud portal features

The Ruijie Cloud portal is pleasing to the eye with its home page listing projects that represent each site and selecting one takes you to a Workspace view which shows all associated Reyee devices and topologies plus graphs for wireless rates and Wi-Fi-experience. The RG-RAP72Pro supports up to eight SSIDs and Workspace quick access icons are provided for creating them, running wireless optimization scans, and setting up mesh networks with other compliant Reyee APs.

Monitoring services abound with the client view identifying devices and categorizing them as PCs, tablets, smartphones, IoT, cameras and so on. The Smart Config feature helps create wired and wireless VLANs and apply access controls while the AI Diagnostics service scans the network, highlights faults, and provides root cause analysis.

There's much more as the Network HawkEye provides detailed Wi-Fi experience, load and channel health graphs. The Data-Board feature presents graphical network reports showing areas such as client summaries, traffic rates, AP loads, and AP rankings by client and traffic.

For guest wireless networks, you can assign custom captive portals to selected SSIDs complete with your own logos, background images and messages. A variety of authentication methods can be applied and you can set an access duration and the number of times per day a guest can login.

Ruijie Reyee RG-RAP72Pro review: Wireless performance

For Wi-Fi 7 testing, we used a Zyxel XS1930-12HP 10GbE PoE++ switch which confirmed a 2.5GbE connection to the AP and a PoE+ power draw. For our wireless client, we used a Lenovo desktop client running Windows 11 Pro 24H2 and equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter.

The client showed a 2,880Mbits/sec connection to the AP's 5GHz radio and to test raw TCP performance, we used Microsoft's NTttcp utility which recorded upstream and downstream speeds of 277MB/sec and 212MB/sec between the wireless client and a Windows server on our 10GbE LAN. To test SMB performance, we ran large file copies between the client and server which returned a top average throughput at a close range of 208MB/sec and 186MB/sec at 10 meters.

Our TP-Link TBE550E adapter supports MLO using MLMR (multi-link multi-radio). After enabling this on the AP in the cloud portal, our client confirmed an aggregated link speed of 3,570Mbits/sec across the 2.4GHz and 5GHz radios but further tests showed no appreciable performance improvements.

We also ran tests using a Windows 11 client with a TP-Link AXE3000 Wi-Fi 6 adapter which connected to the AP's 5GHz radio at 2,400Mbits/sec. NTttcp reported upstream and downstream speeds of 203MB/sec and 190MB/sec while our file copy test averaged top speeds of 173MB/sec at close range and 160MB/sec at 10 meters.

Ruijie Reyee RG-RAP72Pro review: Is it worth it?

The RG-RAP72Pro scores well on value and we found that even without the 6GHz radio, it delivers a real world performance that's the equal of many budget-priced tri-band Wi-Fi 7 APs. The downside is it can't offer benefits such as the ultra-wide 320MHz channels and a cleaner, less congested 6GHz space.

This AP will suit budget-conscious businesses that want to present their users with fast 2.4GHz and 5GHz services along with many of the best Wi-Fi 7 features. Ruijie's Cloud portal adds plenty of appeal too, as this subscription-free service offers an impressive range of management and monitoring features.

Ruijie Reyee RG-RAP72Pro specifications

Compromised network edge devices have rapidly emerged as one of the biggest attack points for small and medium businesses, prompting calls for firms to shore up defenses.

Statistics from Sophos’ Annual Threat Report show firewalls, routers, and VPNs accounted for initial compromise in nearly 30% of all incidents observed by the firm over the last year.

Virtual private networks (VPNs) were cited as the most frequently compromised, accounting for over 25% of all incidents and also 25% of ransomware attacks.

What’s more, these figures come from cases that could be confirmed by telemetry, Sophos said, so the actual number of cases could be much higher.

Sean Gallagher, principal threat researcher at Sophos, said the report highlights how attackers have aggressively targeted edge devices over the last several years.

“Compounding the issue is the increasing number of end-of-life (EOL) devices found in the wild – a problem Sophos calls digital detritus,” he commented.

“Because these devices are exposed to the internet and often low on the patching priority list, they are a highly effective method for infiltrating networks.”

Gallagher added the aggressive targeting of edge devices forms part of a larger shift in cyber criminal tactics. In its report, Sophos said this means attackers don’t have to deploy custom malware and can employ ‘living off the land’ techniques to maximize their impact on target organizations.

“They can exploit businesses’ own systems, increasing their agility and hiding in the places security leaders aren’t looking,” Gallagher said.

Other popular attack methods highlighted in the report were social engineering via Software as a Service platforms. These widely-adopted platforms have become heavily abused products commonly used for initial compromise.

Business email compromise is also a growing concern, according to the report, attributing to an alarming rate of initial compromises in security incidents.

In these instances, malware deployment, credential theft, and social engineering are being used extensively, the report warned.

Phishing of credentials via adversary-in-the-middle (AiTM) attacks and multi-factor authentication (MFA) token capture was cited as the main drivers of the increase.

AiTM attacks are a specific variant of the traditional 'man in the middle' attack method, whereby cyber criminals intercept communications between two parties to steal data.

This new type of attack differs greatly, however, enabling threat actors to actively interfere with and modify communications rather than simply intercepting them.

This particular method has been growing in popularity among threat groups in recent years, with state-backed threat actors in particular employing the technique.

In an advisory last year, Microsoft warned AiTM attacks have now become one of the 'go-to' methods for cyber criminals, with the tech giant's Digital Crimes Unit (DCU) observing a 146% increase across 2024.

MORE FROM ITPRO

• Six of the best malware removal services you can use today
• We ranked the best VPNs for businesses
• The best Wi-Fi and access points for your enterprise

Netgear has always had a sharper focus on the consumer Wi-Fi 7 market with its extensive Orbi and Nighthawk router families but it also offers two business-class access point (AP) solutions. The flagship tri-band WBE750 delivers a big BE18400 rating with an equally high price tag. The lower-cost WBE710 we have on review targets budget-conscious SMBs.

The WBE710 keeps the price down by presenting two spatial streams on each radio, which deliver a lower BE9400 rating, claiming maximum speeds of 688Mbits/sec on the 2.4GHz radio, 2,882Mbits/sec on 5GHz, and 5,765Mbits/sec on 6GHz with the ultra-wide Wi-Fi 7 320MHz channels enabled. As you'd expect, the LAN port is the 2.5GbE variety, but it only requires an 802.3at PoE+ power source.

One of the most prominent features of these APs is their size, as they are both easily the smallest business Wi-Fi 7 APs currently available. Whereas all competing Wi-Fi 7 APs use their metal back-plates as passive heatsinks, the WBE750 and WBE710 have an internal cooling fan located behind a circular inlet at the front.

You have two management choices as the WBE710 can be deployed in standalone mode, where it presents a local web interface. Alternatively, you can move it all into the cloud and use Netgear's Insight portal – the AP's price includes a one-year subscription to the Premium service with further subscriptions costing around £8 per year for each device.

Netgear WBE710 review: Standalone management

Deploying the WBE710 is simple as its web interface presents a 'Day Zero Easy Setup' option where you select the country of operation, change the default admin password, and create your first secure SSID. The console opens with an informative dashboard that provides details on connection status, client distribution across SSIDs and radios sorted into OS types, traffic distribution by SSID, and a real-time traffic trend graph ranging between two and 48 hours.

Up to eight SSIDs are supported, and you can choose to make them available across all radios or only on selected ones and use different security settings up to the stronger WPA3. Advanced features include client isolation, rate limits, URL tracking, and basic captive portals using click-through or external authentication.

You can still access the standalone interface when the AP has been imported into Insight, but all settings that are being cloud managed are greyed out. There is one good reason why you may want to use the local console, as this is the only way you can view the AP's fan status.

The dashboard's traffic trend graph can be swapped to show the fan speed and temperature, which can also be viewed from the interface's system monitoring page. During testing, we found the fan would only turn on occasionally when the internal temperature went above 65C and it was virtually silent in operation.

Netgear WBE710 review: Insight mode

Netgear's Insight cloud portal can be used to centrally manage distributed wireless networks along with Netgear's Insight-enabled switches and routers. Adding the WBE710 to our account was a cinch as we used the Insight iOS app on an iPad to scan its QR code and assign it to a predefined site in our Insight organisation, after which it started broadcasting our preconfigured SSIDs.

Insight offers the same level of access to the AP's wireless features as standalone mode, but adds extra services such as meshed network creation. One AP that is wired to the network is set as a root device, and you expand the network by adding node APs that connect wirelessly to it.

The Insight portal's summary page shows the health of all cloud-managed Netgear devices and an overview of wireless activity, while a topology map reveals which APs clients are connected to. The Wireless page provides plenty of widgets so you can see graphs of wireless traffic for each AP, client connection trends, their individual data consumption, and detected OSes.

Insight's captive portal features are superior as guest SSIDs can have redirect URLs, custom logos, AUPs (acceptable use policies), and session timeouts assigned. Authentication options include basic click-through with redirect and web authentication using a third-party provider, an external Radius server, or the paid-for RaGaPa cloud service.

Netgear WBE710 review: Wi-Fi 7 performance

For Wi-Fi 7 testing, we connected the AP to the lab's Zyxel XS1930-12HP 10GbE PoE++ switch, which confirmed a 2.5GbE connection and a PoE+ power draw. For our wireless client, we used a Lenovo desktop client running Windows 11 Pro 24H2 and equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter.

To test raw TCP performance, we used Microsoft's NTttcp utility, which recorded good upstream and downstream speeds of 258MB/sec and 202MB/sec between the wireless client and a Windows server on our 10GbE LAN. Real world speeds over SMB were lower but still respectable, with large file copies between the client and server returning a top average throughput at close range of 218MB/sec and 182MB/sec at 10 metres.

The WBE710 supports the Wi-Fi 7 MLO (multi-link operation) feature, and this can be enabled in the AP's local interface or from Insight. Our TP-Link TBE550E adapter supports MLO using MLMR (multi-link multi-radio), and although it created an aggregated link, further tests showed no appreciable performance improvements.

Netgear WBE710 review: Is it worth it?

Not really. A price tag of £270 excluding VAT makes the WBE710 a comparatively expensive entry-level Wi-Fi 7 AP. TP-Link's BE9200 Omada EAP773 and EnGenius' BE9500 ECW526, for example, cost £191 and £225 respectively, and both are endowed with 10GbE ports, which delivered superior speeds in our lab tests.

The WBE710's internal cooling fan may be an issue as although it significantly reduces the size of the AP, will limit placement options due to increased dust ingress. On a positive note, the WBE710 comes with a 5 year warranty, and Netgear scores highly for cloud management as its Insight portal delivers an excellent range of features with the price, including a one-year subscription.

Netgear WBE710 specifications

EnGenius may not have such a high profile in the UK as a number of other wireless network vendors but it stands out for its impressive range of business-class access points (APs). It made quite a splash when it launched its flagship ECW536 Wi-Fi 7 AP as this BE19000-rated model impressed us with its superb wireless performance.

Smaller businesses less keen on its high price tag will find the ECW526 on review more appealing as it drops the price by over £130. Normally, we expect to see a lot of compromises with budget-priced Wi-Fi 7 APs, but the ECW526 is endowed with a surprisingly good hardware specification.

Its BE9500 rating is half that of the ECW536 as it presents six spatial streams and claims top speeds of 5,800Mbits/sec on the 6GHz radio, 2,900Mbits/sec for 5GHz and 720Mbits/sec for 2.4GHz. What lies beneath is of more interest as it employs the same powerful Qualcomm Networking Pro 1220 hardware platform featuring a 2.2GHz quad-core ARM Cortex-A73 CPU.

Unlike most lower-cost Wi-Fi 7 APs which only have a 2.5GbE port, it also sports a full-strength 10GBase-T copper network port. Another bonus is it only requires an 802.3at PoE+ power source so you won't need to spend extra on a switch that delivers PoE++.

EnGenius ECW526 review: Build quality

The ECW526 is reassuringly solid with a sturdy polycarbonate front cover and metal chassis which also acts as a heatsink. It does a fine job as during testing, we found the rear of the AP was always only warm to the touch.

Tipping the scales at only 720gms, the ECW526 can be easily wall or ceiling mounted. The kit includes screws, plugs plus T-Rail clips for dropped ceilings and a circular plastic mounting bracket with twist-lock tabs.

The latter does a good job as once the bracket has locked, it's very difficult to release but for extra physical security, there's a Kensington lock slot on the side. The AP has a 12V DC power jack alongside the network port but an adapter is an optional purchase.

A single multi-coloured LED at the base provides plenty of status information. It'll tell you when the AP has successfully connected, if its firmware is being updated, and will change colour to show which radios are active.

EnGenius ECW526 review: Cloud management

EnGenius offers two types of wireless AP and all ECW models can only be managed from the cloud. The Wi-Fi 6 EWS Fit6 models are a separate range aimed at small businesses with limited on-site IT expertise and can be standalone or cloud-managed from a dedicated portal.

The ECW526 presents a local web interface, but this only displays an overview of LAN, internet, and cloud connection status. Adding the AP to our cloud account was simple as we used the Cloud To-Go iOS app on an iPad to scan its QR code, and after adding it to our organisation, it started broadcasting all our predefined SSIDs.

The cloud portal sees a small redesign and opens with a dashboard displaying connection details of all APs and switches, with graphs showing the number of connected wired and wireless clients plus power status for PoE switches.

Each site supports up to eight SSIDs, and for each one, you can decide which radios are active, enable L2 isolation, band steering, plus fast roaming, and apply download and upload rate limits for the entire SSID or per client. WPA3 encryption is mandatory for Wi-Fi 7 clients, but you can present SSIDs that enable all radios and use mixed WPA2/WPA3 security.

Guest wireless users can be presented with a captive portal that supports click-through, Engenius cloud managed users, Radius, and voucher authentication. A splash page can be displayed to guest users and customised from the portal's integral HTML editing toolbox.

A Basic cloud licence is free, but you can upgrade to a chargeable Pro version, which enables plenty of enhanced features. These include a 30-day log retention period, network topology views, and 7-day timeline charts of the APs a client connected to, the authentication methods used, and details of association errors such as incorrect passwords.

EnGenius ECW526 review: Wi-Fi 7 performance

For performance testing, we hooked up the ECW526 to the lab's Zyxel XS1930-12HP 10GbE multi-Gig PoE++ switch, which confirmed a 10GbE connection and PoE+ delivery. Our wireless client was a Lenovo Windows 11 Pro 24H2 desktop system equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter.

To test raw performance, we used Microsoft's NTttcp utility, which reported high upstream and downstream rates of 325MB/sec and 275MB/sec between the client and a Windows server on the 10GbE LAN. Real world speeds over SMB were equally good with close range large file copies between the client and server averaging 248MB/sec, dropping to a creditable 221MB/sec with the AP 10 metres away and into an adjoining room.

The ECW526 supports the Wi-Fi 7 MLO (multi-link operations) feature, and our TP-Link TBE550E adapter also supports it using MLMR (multi-link multi-radio). With MLO enabled, Windows 11 reported an aggregated 2.4/6GHz connection and a link speed of 6,453Mbits/sec with subsequent NTttcp tests reporting modest upload and download rate increases to 330MB/sec and 279MB/sec.

EnGenius ECW526 review: Is it worth it

EnGenius could do with a few more UK resellers in its network, and we recommend checking prices first as there are substantial variations. The best price we found was with Solwise, which offers the ECW526 for a very reasonable £225 excluding VAT, but another outlet showed the same AP for around £140 more.

Going with the lower price, we'd say the ECW526 is good value as it offers a very powerful hardware package and, for a BE9500-rated AP, delivers an impressive Wi-Fi 7 performance. It's easy to deploy, and the EnGenius cloud portal offers a fine range of wireless network management features.

EnGenius ECW526 specifications

TP-Link has always been at the forefront of wireless network development and its mighty BE19000-rated EAP783 Wi-Fi 7 access point (AP) set a very high standard for performance. A price tag of over £600 won't endear it to SMBs though, making the EAP773 on review a much more affordable alternative.

The EAP773 has a lower BE9300 rating and claims to deliver up to 573Mbits/sec on its 2.4GHz radio, 2,880Mbits/sec on 5GHz, and 5,760Mbits/sec on 6GHz with the ultra-wide Wi-Fi 7 320MHz channels enabled. The US version of this AP has a higher BE11000 rating as it supports the 5GHz 240MHz channels to increase maximum speed on this radio to 4,320Mbits/sec.

Costing just under £200 excluding VAT, the EAP773 initially looks expensive for a BE9300 AP, but it is endowed with a 10GbE multi-Gig network port. The majority of budget-priced Wi-Fi 7 APs cost around £60 less but only offer a 2.5GbE port.

Management options abound as the EAP773 can be deployed in standalone mode and configured from its own web console. TP-Link's Omada cloud service will appeal to businesses with multiple APs and sites as they can keep a close eye on them all, along with Omada-enabled switches and routers, from one central web portal.

TP-Link Omada EAP773 review: Standalone mode

In standalone mode, the AP's web console wizard requests a new username and password and tightens security by deleting the default admin account. Eight SSIDs per radio are supported, and the wizard offers you the option of configuring one for each radio and providing encryption keys.

The device status page provides plenty of information about the AP, including bar charts of CPU and memory utilization. Move to the wireless page, and you can see all SSIDs along with details on their associated radios, security, and guest networks, with another view showing all connected clients.

Creating new SSIDs is as swift as you select a radio, providing a name, enabling SSID masking if required, and choosing an encryption scheme up to the mandatory Wi-Fi 7 WPA3. The EAP773 supports MLO (multi-link operations) but only applies it to the 5GHz and 6GHz radios.

Basic captive portals can be applied to selected SSIDs, although authentication is limited to a global password or an external Radius server. When guests connect, you can apply a redirect URL and present them with a web page and AUP (acceptable use policy) message that they must accept to continue.

TP-Link has updated its Omada mobile app, which now supports managing APs in standalone mode. Connect your device to one of its SSIDs, choose this mode, and you can view the AP's status, enable and disable selected radios, and create new SSIDs.

TP-Link Omada EAP773 review: PoE confusion and Wi-Fi 7 performance

We hooked the EAP773 up to the lab's Zyxel XS1930-12HP switch, which provides twelve 10GbE ports with up to 802.3bt PoE++ power delivered on the first eight. The switch status LEDs reported the AP connecting at 10GbE and drawing 802.3bt PoE++ power.

The AP's datasheet states that early firmware versions required a PoE++ source, with the latest version we were running supposed to drop this to PoE+. There's more confusion as the product page on TP-Link's UK website says PoE++, whereas the US site shows PoE+.

For Wi-Fi 7 performance testing, we used a Lenovo desktop client running Windows 11 Pro 24H2 and equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCIe adapter. To gauge raw performance, we used Microsoft's NTttcp utility, which reported upstream and downstream speeds of 310MB/sec and 235MB/sec between the client and a server on the 10GbE LAN

Real-world performance was noticeably lower with large file copies between the client and server, averaging top close range speeds of 245MB/sec, while moving the AP 10 metres away and into an adjoining room saw average speeds of 205MB/sec. The 10GbE port has a measurable impact on performance as TP-Link's 2.5GbE-equipped BE9300 EAP772 delivered NTttcp upstream and downstream speeds of 219MB/sec and 201MB/sec and top close-range file copy speeds of 192MB/sec.

TP-Link Omada EAP773 review: Cloud management

For remote management, you can choose from TP-Link's hardware and free software on-site controllers or use its cloud-based versions. The latter has extra appeal as TP-Link now offers a free Omada Essentials cloud controller, which provides a base set of management and monitoring features for small businesses.

The main Omada portal presents a list of all controllers assigned to your account. We use TP-Link's Standard cloud controller, and selecting it took us to its own portal, which presented a customisable dashboard and a ribbon across the top showing internet capacity, gateway usage, switches, APs, clients, and guests.

To manage the EAP773, we used the Omada iOS app to scan its barcode, add it to our site, and assign a cloud license to it. Once adopted, it took all its settings from the controller and broadcast our predefined SSIDs.

The cloud portal supports the same number of SSIDs as standalone mode, and from the site settings page, you can easily create new ones and apply encryption schemes and rate limits. Our TP-Link Wi-Fi 7 adapter supports MLO using MLMR (multi-link multi-radio), but after enabling it on the site SSID, our Windows 11 client wouldn't create an aggregated link. The reason is that the adapter supports MLMR using either the 2.4/5GHz or 2.4/6GHz bands, so it won't work with the AP, which only applies MLO to the 5/6GHz bands.

Cloud management enables many other features, such as wireless meshing to increase coverage using compliant APs. Captive portal features are also superior as cloud profiles support a wider range of authentication methods and offer options to present custom portal pages with your own choice of colors, logos, and messages.

TP-Link Omada EAP773 review: Is it worth it?

The 10GbE port pushes the price up, but our lab tests show it could be worth the extra spend as maximum performance is noticeably better than lower-cost Wi-Fi 7 APs with 2.5GbE ports. TP-Link needs to sort out its confusion about the required power source, and we would suggest specifying PoE++, although switches that deliver this are also more expensive.

The EAP773 will appeal to businesses that want some extra network bandwidth that entry-level Wi-Fi 7 APs can't deliver. Overall performance is good, it's easy to deploy, and TP-Link's Omada cloud platform offers great remote management services.

TP-Link Omada EAP773 specifications

TP-Link takes a commanding lead in the business wireless AX class wars, with the Omada EAP690E HD being the first AXE11000 access point (AP) to market. Its mighty Wi-Fi 6E unit achieves this admirable feat by delivering quad-band wireless services comprising 2.4GHz, dual 5GHz, and 6GHz radios.

All four radios can be enabled simultaneously and deliver claimed maximum speeds of 1,148Mbits/sec on the 2.4GHz radio, 2,402Mbits/sec on each 5GHz radio, and 4,804Mbits/sec on the 6GHz radio, with the latter supporting the Wi-Fi 6 160MHz channels. That's a lot of bandwidth to cram through the AP's LAN connection, and TP-Link claims another first with the EAP690E HD sporting a high-speed 10-gigabit (10GbE) port.

TP-Link Omada EAP690E HD review: Setup

The LAN port supports an 802.3at PoE+ power source, and to get the best from it you'll need a switch that can provide this over a 10GbE connection; for testing, we used Zyxel's XS1930-12HP 10GbE multi-gigabit PoE++ switch. If you don't have a suitable PoE+ source that's fine, as TP-Link includes a power adapter in the box.

You can manage the AP as a standalone device, but TP-Link's Omada cloud service will be the preferred choice for most businesses as they can keep a close eye on all their APs and other Omada-enabled switches and routers from one central web portal. There are plenty of choices, too: you can install TP-Link's hardware or free software controller on-site; or use its cloud-based controllers, with yearly prices starting at £12 exc VAT per device.

We swapped over to a cloud controller a while ago as it's easier to use and provides zero-touch provisioning for fast device deployments to remote offices. From our main Omada portal account, we chose our cloud controller and imported the AP by entering its serial number, naming it, and assigning a license.

Once adopted, all access to its local web console was disabled and it started broadcasting our site-managed SSIDs. The controller portal presents a detailed dashboard that can be customized with widgets, and we added ones to show details such as AP traffic and client distributions, the most active APs, a Wi-Fi summary, and 24-hour graphs of client associations and overall wireless traffic. 

The EAP690E HD is great for high-density wireless environments, as it can handle over 2,000 clients and each radio supports eight SSIDs so you can present up to 32. Each can have their own mixed WPA2/WPA3 encryption, global or per client and SSID upload and download rate limits and guest networks to prevent users from accessing private networks.

They can also present captive portals using profiles to apply a global password, local user, voucher, Radius, or Facebook authentication, and add custom pictures, logos, greeting messages, and acceptable use policies (AUPs).

Another bonus of cloud management is the option to enable meshing to quickly extend your wireless network coverage. We set the AP to broadcast one SSID with all four radios enabled and tested 5GHz speeds with a Dell Windows 10 Pro workstation equipped with a TP-Link Archer TX3000E Wi-Fi 6 PCI-E adapter. Using the 80MHz channels, large file copies between the workstation and a 10GbE-connected Windows server delivered close-range speeds of 115MB/sec, dropping to 99MB/sec with the AP moved ten meters away into an adjoining room.

A Dell Windows 11 Pro workstation connected to the 6GHz radio using a TP-Link Archer TXE75E Wi-Fi 6E PCI-E adapter produced a big performance boost over the 160MHz channels, with close range copies averaging 233MB/sec and 187MB/sec at a distance of ten meters. We increased the pressure by running Iometer on both workstations connected to the same mapped share on the server and saw a cumulative write throughput of 283MB/sec, with the portal reporting AP CPU utilization of only 6%. 

TP-Link's Omada EAP690E HD has what it takes to satisfy businesses planning on serving up high-density wireless networks. This AXE11000 AP has a radio for every occasion, delivers impeccable wireless performance, and offers plenty of enterprise-class features at an SMB price.

TP-Link Omada EAP690E HD specifications

EnGenius has a fine reputation in the managed wireless network arena and it now wants to extend these capabilities to small businesses with limited IT expertise. The FIT range of network products comprises PoE switches, Wi-Fi 6 access points (APs), and an optional on-site controller, with a key feature being their extremely simple deployment.

All FIT switches and APs can be run in standalone mode, looked after by the little on-premises FitController appliance, or moved completely into the cloud courtesy of the FitXpress web portal and mobile apps. Costing £134, the FitController targets IT-savvy users, while FitXpress is for those that want it all done for them and is completely free.

In this review, we'll focus on the company's flagship EWS377-FIT, a dual-band AX3600 Wi-Fi 6 access point claiming top speeds of 1,148Mbits/sec on its 2.4GHz radio and 2,400Mbits/sec on the 5GHz radio. It also has a 2.5GbE multi-gig PoE+ LAN port, but it doesn't support high-performance 160MHz Wi-Fi 6 channels. 

You'll need a PoE source as a power adapter isn't included; we used the EWS2910P-FIT 8-port gigabit switch, which has a 55W power budget and costs £171. EnGenius offers four larger FIT Gigabit PoE switches up to the 48-port EWS7952FP-FIT and its large 740W power budget.

EnGenius EWS377-FIT review: Performance

For performance testing, we used Dell Windows 10 and 11 workstations equipped with TP-Link Archer Wi-Fi 6 and 6E PCI-E adapter cards. Close-range copies between the desktops and a Dell Windows server on our main LAN returned around 102MB/sec, and moving the AP ten metres away into the next room saw speeds drop to a creditable 86MB/sec.

Powered from the switch's PoE LAN ports, the FitController presents a web console that's a scaled-down version of EnGenius' enterprise cloud portal and is specifically for managing local networks only.

It's easy to use, with our switch and AP automatically appearing in its inventory for fast two-click registration, after which we assigned them to our preconfigured network.

Before adding APs, make sure you update the preconfigured wireless SSID, which is open by default. The controller supports 50 networks and 100 FIT APs and switches, with its console dashboard presenting an overview of all devices and wireless clients, as well as graphs for wireless throughput, the top APs, clients, SSIDs, and applications.

For each SSID, you decide which radios are active, choose from a range of WPA2 and WPA3 encryption schemes, enable L2 isolation, band steering, and fast roaming, and apply download and upload rate limits for the entire SSID or per client. Guest wireless users can be presented with a captive portal that supports click-through, EnGenius user, Radius, or voucher authentication methods, and you can present them with a custom splash page using the integral HTML editing toolbox.

The FitXpress web portal supports eight networks and 30 FIT devices and is a cinch to use: simply visit the fit.engenius.ai website, create a free account, and scan the QR code on a device quick start card to grab the mobile app. We quickly assigned the switch and AP to our cloud account using an iPad running the FitXpress app to scan their QR codes.

The web portal is a simple affair but, as with the FitController, you should update the default wireless SSIDs as they are open. When creating new SSIDs those designated as "Staff" offer more encryption and security options, including external Radius authentication servers.

Guest SSIDs can use WPA2/WPA3 Personal encryption and have L2 isolation enabled to stop users from seeing each other. You can also present open wireless networks and direct guests to a customizable captive portal with an acceptable use policy (AUP) agreement.

Small businesses that want easily deployed wireless networks with totally free cloud management will like the EnGenius FIT products. What they won't like is the price: at £386 the EWS377-FIT is expensive for a basic AX3600 AP, and the other FIT components aren't any better value, either.

FAQs

EnGenius EWS377-FIT specifications

ASUS has announced a raft of firmware updates to fix critical vulnerabilities found in a number of router devices. 

The firm revealed that nine security vulnerabilities were discovered in networking appliances - two of which were rated as ‘critical’ with six designated as ‘high’ risk. 

Tracked as CVE-2018-1160 and CVE-2022-26376, the two critical vulnerabilities were given a 9.8 severity rating out of a possible 10, the company said. 

Analysis shows that the former of these pertains to an out of bounds write bug found in Netatalk prior to version 3.1.12. This near-five-year-old vulnerability could enable an unauthorised party to achieve arbitrary code execution. 

Meanwhile, CVE-2022-26376 is a memory corruption vulnerability found in Asuswrt and Asuswrt-Merlin New Gen firmware. This flaw could allow an attacker to trigger this vulnerability by leveraging a “specially-crafted HTTP” request, which would cause memory corruption. 

Nearly 20 router models have been affected by disclosed vulnerabilities, ASUS revealed. 

These include:

• GT6
• GT-AXE16000
• GT-AX11000 PRO
• GT-AXE11000
• GT-AX6000
• GT-AX11000
• GS-AX5400
• GS-AX3000
• XT9
• XT8
• XT8 V2
• RT-AX86U PRO
• RT-AX86U
• RT-AX86S
• RT-AX82U
• RT-AX58U
• RT-AX3000
• TUF-AX6000
• TUF-AX5400.

In its security advisory on 19 June, ASUS urged customers to patch affected routers as soon as possible to avoid risk of exposure.  

The firm warned that customers choosing not to install new firmware updates should disable services accessible from via WAN to “avoid potential unwanted intrusions”. 

“These services include remote access from WAN, port forwarding, DDNS, VPN server, DMZ, port trigger,” ASUS said. 

The company also recommended frequent auditing of equipment to ensure firmware is up to date and to mitigate risk.

“We strongly encourage you to periodically audit both your equipment and your security procedures, as this will ensure that you will be better protected,” the firm said.

If you're looking for the fastest domestic router around, Netgear's mighty Nighthawk RAXE500 has a firm grip on the crown. In our performance tests, we measured incredible download speeds of more than 100MB/sec over Wi-Fi 6E, even from a room or two away.

However, at £550 the RAX500 is well out of reach of most home offices. That's where the RAXE300 comes in: it's hardly a pocket-money purchase, but it's significantly cheaper than its sibling while aiming to provide a similar all-round experience.

If you pore over the specs you can spot where the savings have been made. The RAXE500 supports speeds of up to 4.8Gbits/sec on both the 5GHz and 6GHz bands. The RAXE300 keeps the same 5GHz radio, but chops the 6GHz bandwidth in half, to a maximum of 2.4Gbits/sec. 

The RAXE300 has six antennas embedded in its upturned wings, versus the eight on the RAXE500. And while Netgear doesn't publish details of transmission power, the RAXE300 is advertised to cover an area of 230m2, while the RAXE500 claims a much greater 325m2.

Still, it's good to see that Netgear hasn't ditched the single 2.5Gbits/sec Ethernet socket, which sits at the rear next to four regular Gigabit Ethernet ports. And it's still possible to aggregate two of these together, giving you two ways to achieve a multi-gigabit wired connection.

We tested performance by copying files between a Wi-Fi 6E-enabled laptop and a NAS appliance connected to the router's 2.5GbE socket. We weren't disappointed with the results: with the laptop in the same room as the router, we saw a superb download speed of 142MB/sec. And in the downstairs living room we measured a still excellent 106MB/sec.

These speeds don't quite match the RAXE500, which gave us 152MB/sec and 136MB/sec in the same locations, but the RAXE300 blew every other rival out of the water. The Asus ROG Rapture GT-AXE11000 gave out 127MB/sec and 82MB/sec respectively – and at £480 it's more expensive.

Moving up to another floor, we saw the RAXE300's download speeds drop to 54MB/sec, while in the kitchen area we got 50MB/sec. If you want more even speeds throughout your home or small office, a mesh might suit you better – TP-Link's Deco XE75 gave us 82MB/sec on another floor and 65MB/sec in the kitchen area. It couldn't match the Netgear's highest speeds, though, topping out at 84MB/sec for a same-room connection.

Note that devices needn't support 6GHz connections to get stellar performance from the RAXE300. We repeated the tests with a regular Wi-Fi 6 laptop and still got a phenomenal 125MB/sec in the same room, falling to 37MB/sec in the kitchen area. Whatever devices you connect to this router, and however demanding they may be, bandwidth won't be a problem.

As for software, there's nothing to choose between the RAXE300 and the pricier RAXE500. Both routers run the standard Nighthawk firmware, and can be managed from either the Nighthawk mobile app or a pokey-looking web portal.

The app provides easy setup – just scan the QR code with your phone's camera – and lets you check up on connected devices and tweak basic Wi-Fi settings. It also includes a powerful Wi-Fi analytics module, with which you can scan the airwaves to work out how best to configure and situate the router. The web interface provides advanced settings like DHCP configuration and port forwarding.

You can also configure file and media sharing through the RAXE300's single USB-C port, and turn on a VPN server to allow secure access to your home network, though there's no support for outbound VPN connections. The big features are optional extras. Netgear's Parental Controls module costs an extra £50 a year, while the Armor security service is £34 for the first year, rising to £85 a year for renewals.

The fees are galling when you're already paying for a premium router such as this, but there it is. It's hard not to define the Netgear Nighthawk RAXE300 in terms of its titanic cousin. But if you can forget for a moment that the RAXE500 exists, what you're left with is one heck of a router in its own right.

It's hugely fast, with top-of-the-range wireless networking and multi-gigabit wired connectivity, and it's supported by a versatile software suite. Indeed, the most impressive thing about the RAXE300 is that, despite its positioning in the market, it doesn't feel like a compromise. Sure, if you really need the bragging rights you can spend the extra £150 on the RAXE500. But the Netgear Nighthawk RAXE300 hits a much sweeter spot: to anyone craving industry-leading performance on something loosely resembling a budget, it's all but irresistible.

Netgear Nighthawk RAXE300 specifications

Zyxel's WAX620D-6E access point is designed for businesses that want future-proofed wireless networks. Its integral BandFlex technology allows you to configure the AP for 5GHz operations and, when the time is right, swap over to the 6GHz spectrum.

This AXE5400 dual-band AP provides six spatial streams with 2 x 2 for the 2.4GHz band and 4 x 4 for the 5GHz or 6GHz bands, with the latter two both supporting the high-speed 160MHz channels. The main 2.5GbE port requires an 802.3at PoE+ power source, there's an extra gigabit LAN port for networking wired devices and the AP employs the same dual-optimized antenna array as Zyxel's WAX610D, which must be manually set for ceiling or wall mount placements.

Two management modes are available: the WAX620D-6E can be deployed in standalone mode or cloud-managed using Zyxel's Nebula Control Center (NCC) platform. Zyxel adds extra cloud appeal, as the price includes a one-year NCC Professional Pack license, which enables features such as email alerting, scheduled firmware updates, and a rolling one-year log-retention service.

Installation in standalone mode is aided by the AP's web console wizard, which guided us through setting the country of operation and changing the default admin password. The wizard creates radio profiles for the three bands and defaults to enabling 5GHz on the second radio, which you can change by assigning the 6GHz profile to it from the AP management screen.

Businesses deploying multiple APs will prefer Zyxel's NCC, as along with centralized remote management, it opens up extra features such as guest wireless networks with captive portals and meshing. We added the WAX620D-6E to our cloud account by using the Nebula iOS app on an iPad to scan the QR code on its base and choose the site from which it should take its settings.

The portal presents a customizable site dashboard with details of total wireless traffic, APs by usage, and all connected wireless clients along with their detected OS. Up to eight SSIDs per site are supported, with each one assigned its own encryption scheme along with a guest wireless network with captive portal, upload and download bandwidth restrictions, L2 isolation, and a walled garden.

For each SSID, you can choose from three band options. We elected to have one SSID presenting the 2.4GHz and 5GHz bands and another for the 6GHz band with WPA3 encryption. The AP radio settings page has a handy BandFlex view so we could easily see which APs supported Wi-Fi 6E and, for the WAX620D-6E, we could quickly swap between 5GHz and 6GHz bands and choose the maximum channel width up to 160MHz.

With the AP hooked up to a Zyxel XS1930-12HP 10GbE multi-gigabit PoE++ switch, we tested 5GHz speeds using a Windows 10 Pro Dell workstation equipped with a TP-Link Archer TX3000E Wi-Fi 6 PCI-E adapter.

Using the 160MHz channels, large file copies between the client and a 10GbE-connected Windows server delivered impressive close-range speeds of 206MB/sec, dropping to 161MB/sec with the AP moved ten meters away into an adjoining room.

After reconfiguring the AP to the 6GHz band, we connected a Windows 11 Pro Dell workstation using a TP-Link Archer TXE75E Wi-Fi 6E PCI-E adapter. This produced a noticeable boost, with close-range copies now averaging 220MB/sec and falling to a very creditable 168MB/sec at ten meters distance.

The WAX620D-6E is comparatively expensive but will appeal to SMBs that want the option of moving to Wi-Fi 6E and 6GHz at a time of their choosing. Wireless performance across the board is impeccable, and Zyxel's NCC cloud platform delivers top-notch remote management and monitoring services.

Zyxel WAX620D-6E specifications

EnGenius offers businesses a fine choice of wireless access points (APs) and the ECW336 is its most powerful yet. This tri-band AP supports the 2.4GHz, 5GHz and Wi-Fi 6E 6GHz bands, as well as the 6GHz high-speed 160MHz channels, and boasts a maximum throughput of 8.4Gbits/sec, giving it an impressive AX8400 rating.

The ECW336 presents 12 spatial streams spread equally across the three radios, claiming top speeds of 1,184Mbits/sec, 2,400Mbits/sec and 4,800Mbits/sec respectively. EnGenius ensures there are no bottlenecks to worry about, as the ECW336 is the first SMB-class AP we've seen to sport a 5GbE multi-gigabit network port.

The network port supports PoE+ and that's how you're expected to power it; although there's a power jack alongside, an adapter isn't included. For testing, we connected the AP to the lab's Zyxel XS1930-12HP 10GbE multi-gigabit PoE++ switch.

The ECW336 is designed to be managed using EnGenius's cloud portal. Its local web browser interface doesn't provide access to any configuration settings and only displays an overview of LAN, internet and cloud connection status. Adding the AP to our cloud account was swift, and we used the Cloud To-Go iOS app on an iPad to scan the QR code on its base.

The AP was automatically added to our organisation, where it took all our predefined wireless settings and started broadcasting them as soon as it was online. The cloud portal opens with a non-customisable dashboard showing all switches, APs and wireless clients, with graphs below for wireless throughput plus the top APs, clients and SSIDs.

Each site can support up to eight SSIDs. For each one, you can choose which of the three radios are active, enable L2 isolation, band steering and fast roaming, as well as apply download and upload rate limits for the entire SSID or per client. WPA3 encryption is mandatory for Wi-Fi 6E clients, but you can present SSIDs that enable all radios and use mixed WPA2/WPA3 security.

Guest wireless users can be presented with a captive portal that supports authentication methods such as clickthrough, EnGenius cloud-managed users, Radius, voucher and Facebook account logins. A splash page is displayed to users and the portal provides an integral HTML editing toolbox so you can easily customise it with your own logo, welcome message and acceptable use policy.

EnGenius offers a chargeable Pro version of the cloud portal that enables a range of enhanced features such as a 30-day log retention period, network topology views and seven-day timeline charts of the APs to which a client is connected, the authentication methods used, and details of association errors such as incorrect passwords. All EnGenius cloud-managed devices include a one-year Pro subscription in the price, with subsequent years costing around £35 per device.

We started our performance tests using a Dell Windows 10 Pro workstation equipped with a TP-Link Archer TX3000E Wi-Fi 6 PCI-E adapter. The AP's 5GHz radio doesn't support the 160MHz channels so our host showed a connection speed of 1,200Mbits/sec using the 80MHz channels.

Copying a large 25GB test file between the workstation and a 10GbE-connected Windows server on the LAN, we recorded close range speeds of 115MB/sec. Moving the AP ten metres away and into an adjoining room with a wall in the way saw speeds drop to 95MB/sec.

There was no such problem with our Dell Windows 11 Pro workstation and its TP-Link Archer TXE75E Wi-Fi 6/6E PCI-E adapter, as it happily connected to the 6GHz band with the 160MHz channels enabled and showed a connection speed of 2,400Mbits/sec. Speeds ramped up nicely, too, with our large file copies averaging 222MB/sec at close range and 183MB/sec at ten metres.

The ECW336 offers a mighty hardware package but comes with a premium price tag – Netgear's tri-band WAX630E only costs £235 and isn't far behind it for performance either. That said, the ECW336 scores well for cloud services, with the portal offering excellent business-class wireless management and security features.

Allied Telesis has a fine reputation in the network switching market and has traditionally offered an extensive range of business-class wireless access points (APs) as well. Stepping up to the top of its family of five SMB APs, the TQm6702 GEN2 on review is a dual-band Wi-Fi 6 AP with a sharp focus on ease of deployment, management and performance.

The TQm6702 GEN2 presents eight spatial streams and claims a top raw capacity of 4.8Gbps. It's rare to see an SMB-class Wi-Fi 6 AP with a 5GbE multi-Gigabit port but this model goes even further as you get two with both supporting PoE+ services.

These add extra versatility as they can be combined together in a static LAG (link aggregation group) for a doubling in available LAN bandwidth. The second port also supports a cascade mode and can be used to attach other devices such as a PC, printer or even another switch, to provide network access.

The TQm6702 GEN2 can be easily managed in standalone mode and also supports the optional Vista Manager application which provides fully centralised network management services. The higher-end TQ6702 GEN2 model has the same speeds and feeds but is designed for enterprise-wide deployments and offers extra features such as a hybrid mode supporting channel blanket and multi-channel operations for improved performance.

Allied Telesis TQm6702 GEN2 review: Standalone mode

Deploying the TQm6702 GEN2 in standalone mode is simple enough and although the local web console won't win any design awards, it does provide easy access to all features. The AP defaults to having all functions disabled so, unlike some other APs we could name, it won't be broadcasting open SSIDs when first powered up.

After enabling each radio, you set a country, choose a mode up to and including 11ax operations and set the bandwidth with the AP's 5GHz radio supporting the high-speed Wi-Fi-6 160MHz channel. Advanced settings include L2 isolation to stop clients on the same network from seeing each other, neighbour AP detection, airtime fairness, band steering, MU-MIMO and OFDMA.

Move to the VAP (virtual AP) page and you'll find this AP supports up to sixteen on each radio with a maximum of eight active on them at any one time. Each VAP has its own encryption scheme which can be WPA2, WPA3 or mixed, a MAC address control list, captive portal and fast roaming service.

VAP captive portal options are extensive and include click-through to an AUP (acceptable use policy) agreement with optional authentication, redirection to an external web page and direct to a Radius server. You can download a QR code for quick sign-in to a specific VAP for mobile users and for all captive portals, you can add a walled garden with up to 50 URLs that guest users can browse through before logging in.

Allied Telesis TQm6702 GEN2 review: Wi-Fi 6 performance

To speed test the TQm6702 GEN2, we hooked it up to a Zyxel XS1930-12HP 10GbE multi-Gigabit PoE++ switch and connected a Dell T640 Windows Server 2019 host over 10GbE giving us a test bed supporting a minimum 5GbE throughput. Our client system was a Dell Windows 11 Pro workstation equipped with a TP-Link Archer TXE75E Wi-Fi 6/6E PCIe adapter.

Starting with the 80MHz channels enabled on the AP, close range copies of a 25GB test file between the workstation and server averaged an impressive 111MB/sec. Moving the AP 10 metres away from the workstation and into an adjoining room with a partition wall in the way, saw copy speeds drop to 101MB/sec.

With the AP's 160MHz channels enabled, the workstation reported a 2.4Gbits/sec wireless connection and our close range copy tests returned an amazing 233MB/sec. The good news continued with the AP placed 10 metres away as our copies mustered a very creditable 173MB/sec.

Allied Telesis TQm6702 GEN2 review: Central management

To test the Vista Manager application we installed the EX version on a Window Server 2019 VM on our VMware ESXi 7 host. A one-year EX base licence costs around £1,340 and to manage our APs, we loaded the AWC (Autonomous Wave Control) plug-in which costs a further £80 per year for 10 APs.

The Vista Manager EX web console opens with a dashboard view of all managed devices along with charts of events and a network topology map. The asset management page provides more details on each device and along the TQm6702 GEN2 AP, it listed all its connected wireless clients.

Direct access to the AWC plug-in is provided and we manually registered the AP by providing a meaningful name, assigning a management group and adding its IP and MAC addresses (you can use a CSV file for multiple APs). Profiles group together AP settings and provide all the same options as you'll find in standalone mode.

A key feature of AWC is it uses game theory to analyse and optimise wireless networks by running regular calculations based on channel scanning, neighbour AP detection and signal strength. You can view the results from the AWC history page and apply its recommendations immediately to a management group or use a scheduled task.

There are plenty more useful features as you can select any AP and view wireless information and traffic graphs while a customisable building map shows AP coverage heatmaps for each radio. The IDS/IPS report page reveals all detected rogue APs along with their SSIDs and it'll identify any that are spoofing SSIDs or those using an AWC profile but with unmanaged security schemes.

Allied Telesis TQm6702 GEN2 review: Verdict

There's no denying the TQm6702 GEN2 is an expensive option for SMBs but it does offer a lot of features you won't find on cheaper Wi-Fi 6 APs. Build quality is exemplary, wireless features are extensive, it delivers outstanding performance and the Vista Manager software provides centralised management services and smart wireless network optimisation tools.

Allied Telesis TQm6702 GEN2 specifications

Netgear's Orbi meshes aren't cheap, but they typically offer excellent performance and a decent set of features. The latest model stretches the formula, though. It's an update to the Orbi RBK852, Netgear's first flagship Wi-Fi 6 mesh, but while it's still very much priced as a flagship product, it brings only modest enhancements to the original design.

Most notably, the Wi-Fi hardware hasn't been upgraded at all. Most high-end meshes have moved to Wi-Fi 6E, but the RBK863S uses the same Wi-Fi 6 configuration as the RBK852. In fairness, it's a beefy tri-band system, with 2.4GHz and 5GHz connections for clients, plus an additional 5GHz network that the mesh stations use to communicate with one another.

The 5GHz networks both support 4x4 MIMO, allowing for a maximum connection speed of 2.4Gbits/sec, and Netgear claims the RBK863S introduces a new antenna design with 20% better coverage than the original, so the three units can purportedly reach an area of 740m2.

There's one other upgrade to the hardware: the WAN connector has been boosted from 2.5Gbits/sec to 10GbE. This isn't much of a selling point, though, as the number of people in the UK who have an internet connection faster than 2.5Gbits/sec must be tiny. More to the point, even if you do have an ultra-fast broadband line, the Orbi RBK863S won't convey the full speeds it's capable of. That's because the LAN ports are stuck at single-gigabit speeds, while (you will recall) the wireless hardware tops out at 2.4Gbits/sec. It would have made much more sense to leave the WAN port alone and add multi-gig Ethernet on the LAN side.

So much for the design: how does the Orbi RBK863S perform? To find out, we set up the system in a home setting, with the primary unit in a study, the second in the adjoining bedroom and the third in the downstairs living room. We then carried a standard test laptop to various rooms in the house and measured average download speeds over the 5GHz network.

The results weren't shabby. When the laptop was in the same room as the primary Orbi station, we recorded an average download speed of 84MB/sec. This dropped off only to 72MB/sec in the living room, with a minimum of 41MB/sec in the kitchen. While that's fast enough to meet most people's needs, however, it's not special enough to justify the price. In fact, the RBK863S struggled to keep up with the much cheaper Orbi RBK763S. That mesh gave us download speeds ranging from 97MB/sec in the study to 47MB/sec in the kitchen -- and it's fully £500 cheaper.

There's a simple reason for this. The ageing radio hardware in the Orbi RBK863S is limited to a maximum channel width of 80MHz, whereas modern meshes – including the RBK763S – almost invariably support the fatter 160MHz option. The RBK863S does have the benefit of 4x4 MIMO, but most devices you're likely to be connecting from are limited to 2x2 multiplexing, so you'll only see a benefit from the RBK863S's 4x4 provision if you're connecting from two devices at once.

It's a shame, because Netgear's software features are, as usual, pretty good. To set up the system, you just need to scan the QR code into the Orbi mobile app to connect, then choose a network name and security settings. You can then use either the app or a slick web portal to manage your network; the interface and features are exactly the same as with other Orbi meshes, including Netgear's incoming VPN server that lets you connect to your home network from anywhere.

What's more, the "S" at the end of the model name denotes a bundled year of Netgear's Armor network security service, which was an optional extra with the RBK852. However, after your 12 months have run out, you're looking at £85 a year to keep it going, and parental controls are another £50 on top of that. It's a bit of a mickey-take when you've already paid so much for the mesh itself.

Indeed, the whole deal feels like Netgear is pushing its luck. The Orbi RBK852 was a fine mesh in its day, but that was three years ago, and the technology has moved on. When it comes to performance, the RBK863S can't hope to keep up with Wi-Fi 6E meshes such as TP-Link Deco XE75 or Netgear's own superlative Orbi RBKE963, which hit an amazing 118MB/sec in our tests. By the end of the year we're expecting to see the first Wi-Fi 7 systems, promising a four-fold performance boost over 6E. If you're focused on value rather than performance, meanwhile, the RBK863S makes even less sense.

You can get the Orbi RBK763S for a much lower price, while the Mercusys Halo H80X provides all the bandwidth an average family home requires for only £162. No matter what you're looking for, the idea of paying £1,099 for the RBK863S is frankly laughable.

Netgear Orbi RBK863S specifications

While most major networking brands embraced the Wi-Fi 6E standard last year, Linksys has been notably absent from the party. Now at last the company's first 6GHz-capable router has landed in the IT Pro offices. We're not celebrating too much, though: the Hydra Pro 6E was released in the US back in late 2021, so it's hard not to feel a little snubbed that it's taken so long to make its way across the Pond.

Still, the Hydra Pro 6E makes a strong entrance. The design is shiny and stylish, with four rectangular antennas and a moody blue LED at the front. And the Wi-Fi 6E specification is impeccable: the Hydra Pro 6E supports 4x4 MIMO and a 160MHz channel width on the 6GHz band, allowing connection speeds of up to 4.8Gbits/sec.

Curiously, 5GHz devices are much less generously catered for. Here there's only 2x2 MIMO and a channel width of 80MHz, meaning devices that don't use 6E get a mere quarter of the bandwidth. Right now that's likely to be most things in your home, so you may get something of a two-tier network experience.

Ethernet support is cursory too: the 5Gbits/sec WAN port is welcome, but LAN clients are stuck with standard-issue gigabit ports. We would have liked to see some sort of multi-gigabit provision for desktop systems or network storage devices – after all, the Wi-Fi 6E side of things is rated at almost 5Gbits/sec, on paper at least.

Then again, let's talk about that. Real-world wireless speeds never come close to the advertised maximums, and even routers with the same nominal hardware capabilities may perform very differently. That has much do with the size and shape of the antenna array, and the Hydra Pro 6E's 12.5cm aerials are comparatively dinky.

To test the actual performance of the Hydra Pro 6E, we set up the router in a home office, then carried a test laptop around different rooms and measured average download speeds. We started by connecting to the Wi-Fi 6E network, and saw encouraging results at close range – data whizzed down the line at 76MB/sec in the same room as the router, and we recorded an even faster 84MB/sec in the living room immediately below. But once we moved more than one room away, performance fell off a cliff: we got 27MB/sec in the kitchen, and only 10MB/sec in the bathroom at the rear of the house.

Performance on the 5GHz band followed a similar pattern: using regular Wi-Fi 6, we got quite decent speeds of 63MB/sec in the office and 45MB/sec in the living room. Stepping into the kitchen, however, saw the data rate plummet to 18MB/sec, and in the bathroom, we recorded a mere 12MB/sec. That's actually slightly better than we got over 6E – presumably because lower-frequency signals are better able to pass through walls. In all fairness, no single router can be expected to provide consistent coverage from one end of a house to the other – for that you need a mesh. And the slowest speeds we saw from the Linksys Hydra Pro 6E were still more than adequate for typical internet duties. Disney Plus recommends an internet speed of 25Mbits/sec for 4K video streaming, and even in the bathroom the connection was three times as fast as that.

However, if you're satisfied with adequate performance, you can get it far more cheaply than this. In the same tests the D-Link Eagle Pro AI R15 router achieved speeds broadly comparable to the Hydra Pro 6E on the 5GHz band, with a minimum of 10MB/sec in the bathroom – and that costs only £72.

Even at close range the Hydra Pro 6E doesn't come close to delivering the potential of Wi-Fi 6E. For £50 more, the Netgear Nighthawk RAXE300 router embarrassed the Linksys in every test, with download speeds of 142MB/sec in the study, 136MB/sec in the living room, 50MB/sec in the kitchen and 21MB/sec in the bathroom.

The Hydra Pro 6E does win back a few points for ease of use. Setup and management are a breeze via the Linksys mobile app, and a simple parental control module is included for free, although this doesn't let you block websites by category. There's also a USB 3 socket at the rear, which you can use to add shared storage to your network. Those of us who prefer to manage their network from a desktop browser will be less happy, though: Linksys' Smart Wi-Fi web interface works, but it's clunky and tiresome to navigate.

At the end of the day, the Linksys Hydra Pro 6E is best avoided. It might have made a reasonable impression 14 months ago, as one of the first consumer 6E systems to hit the shelves, but today it's plainly overpriced – and, despite the promising hardware specification, it can't keep up with rivals.

Linksys Hydra Pro 6E specifications

Zyxel's XMG1930-30HP could be the perfect partner for SMBs seeking a multi-gigabit Power over Ethernet (PoE) switch that has every angle covered. This 1U rack mount switch offers a total of 30 ports with a wide range of speeds and PoE feeds, a generous 700W power budget and a choice of two management modes.

The first 20 copper ports support 100Mbits/sec, 1GbE and 2.5GbE connections all with 30W PoE+; the next four have the same speeds but increase delivery to 60W PoE++; while the next four add 5GbE and 10GbE support and also present PoE++ services. The final two are standard 10GbE SFP+ ports for high-speed fibre uplinks over longer distances.

That big power budget means there's plenty of headroom for many powered devices. It will support a large wireless network installation, with high-power ports perfect for the latest Wi-Fi 6E wireless access points that require up to 60W.

The large LED status display on the front panel shows power, system and cloud connection status, while the PoE light turns yellow or red to warn when power usage is getting close to the maximum. You can see at a glance what the ports are doing as each one has a five-colour LED for the connection speed and another shows if they are delivering power.

For switch management, you can opt for a standalone operation mode or move it all into the cloud using Zyxel's Nebula Control Center (NCC) platform. In standalone mode, the local web console presents four wizards for setting a default admin password and SNMP community names, plus for configuring security features, VLANs and quality of service. Standard L2 features are in abundance and include port and protocol-based VLANs plus static and LACP link aggregation groups.

VoIP networks are covered, with the switch identifying traffic from IP phones using their organisationally unique identifier and automatically prioritises it by dynamically creating voice VLANs.

Zyxel refers to the XMG1930-30HP as a "Lite-L3" switch. That means it offers basic Layer 3 routing capabilities with support for static IPv4 and IPv6 routing, but not the dynamic routing found in more expensive full Layer 3 switches.

The web console provides plenty of details on system utilisation, port and PoE usage and overall powered device consumption. You can set one of three power priorities on each multi-gig port so if the power draw is getting close to the maximum available, those assigned a low priority will be switched off first.

Adding the switch to our NCC cloud was simple, as we used the Nebula iOS app on an iPad to scan the QR code label on its box. The switch then appeared online in our cloud portal in one minute and took all its settings from those we'd previously configured for the site. The portal's monitoring page provides plenty of detail on the switch with a colour-coded graphic showing each port's connection speed and those that are supplying power.

Further down are 24-hour traffic graphs for the switch's uplink port along with total power consumption, and these are extended to seven days with an optional Plus licence and one year with the Pro version.

Individual ports on the switch can be configured from NCC with options for enabling or disabling PoE services and assigning up to five global PoE schedules to specific ports that determine when attached powered devices are active. For general switch operations, all features available in standalone mode can be accessed from the portal and include options to set up voice VLANs, port mirroring, QoS services and aggregating up to eight ports in an LACP link.

Its extreme versatility makes the XMG1930-30HP a great choice for SMBs planning on installing a wireless network using the latest Wi-Fi 6/6E access points. The range of multi-gigabit ports and choice of PoE delivery covers virtually any type of powered decive and it can be easily managed from Zyxel's slick NCC cloud portal.

You might not recognise the name Mercusys – it's a new subsidiary of networking giant TP-Link, focused on low-cost networking systems for the mainstream market. That might sound unambitious, but the Halo H80X Wi-Fi 6 mesh represents a very strong debut for the brand.

The design is about as simple as it could be, consisting of a pair or trio of rather plain white boxes. They're not ugly, though: with a small footprint of 128 x 81mm the Halo units are cute and unobtrusive, and the air vents on top are decorated in a tasteful pattern of grooves. A single LED on the front shows your connection status, while three Gigabit Ethernet connectors are available at the rear.

And there's decent wireless hardware inside. Each unit contains a legacy 2.4GHz Wi-Fi 6 radio, plus a 5GHz radio supporting 2x2 MU-MIMO and the maximum 160MHz radio channel width, for speedy data rates of up to 2.4Gbits/sec. Note that not all of that bandwidth will be available for your devices, though: since there's no third radio for backhaul, the main 5GHz connection handles both client connections and station-to-station traffic.

It's also worth being clear that the Halo H80X doesn't support Wi-Fi 6E. That's not a huge problem: it means modern 6E-compatible phones and laptops won't get the performance advantages of the 6GHz frequency band, but those devices will simply connect to the Halo's 5GHz network instead, along with regular Wi-Fi 6 clients.

And we're pleased to say that 5GHz performance is more than satisfactory. We confirmed this by testing the Halo H80X at home, with one unit in the study and another at the opposite end of the adjoining bedroom. Mercusys suggests that two units are enough to cover a home of up to 460m2, but if you're lucky enough to live in a larger dwelling you can buy a three-pack (for around £80 more) with a claimed coverage of up to 650m2.

With the Halo stations in place, we used a standard test laptop (equipped with an Intel AX210 Wi-Fi card) to copy a series of 100MB files to and from an Asustor NAS appliance attached to the primary mesh node, and measured the average transfer speeds. You'll probably use the Halo more for internet access than for moving data back and forth between local devices, but testing this way ensures the wireless connection isn't bottlenecked by the broadband line.

Indeed, that would certainly have been the case here. With the laptop in the same room as the primary mesh node, we measured a superb download speed of 80MB/sec – equivalent to an internet connection running at more than 600Mbits/sec.

Things weren't quite as fast in other rooms, but the Halo kept us happy with strikingly consistent downloads throughout the house. We measured 36MB/sec in the downstairs living room, 37MB/sec in the kitchen, 38MB/sec in the bathroom and 42MB/sec in the bedroom.

If you're looking for the very best Wi-Fi speeds, you can do better than this. Across different rooms the Netgear Orbi RBK763S was between 20% and 85% faster. Step up to a Wi-Fi 6E system such as the TP-Link Deco XE75 or the Netgear Orbi RBKE963 and you can get downloads at almost twice the speed of the Halo, up to a massive 118MB/sec.

However, those systems are all far more expensive, with current prices ranging from £343 for the Deco XE75 to an enormous £1,699 for the Orbi RBKE963. Within its price range, the Halo H80X is an exceptional performer, easily outpacing sub-£200 rivals such as the Huawei Mesh 3.

In fact, the Halo is fast enough that most people won't need to spend any more. Disney+ recommends a connection speed of 25Mbits/sec for 4K HDR video streaming, equivalent to around 3.5MB/sec – and with the Halo mesh I got at least ten times that in every room of my home.

The Halo H80X is easy to manage, too, thanks to the Mercusys mobile app – a rebadged version of the Deco app that works with TP-Link's pricier meshes. The main dashboard gives you a handy overview of your network status and connected devices, and it takes only a few taps to configure things such as IP address reservation and port forwarding. There's a decent parental control feature, too, with time limits and web-filtering options for kids' devices. The one thing that's noticeably missing, compared to the Deco app, is any sort of security function.

On TP-Link-branded routers and meshes, the optional HomeShield service offers on-demand network scans and active threat detection; there's no equivalent here, so you'll need to look after your own security.

Even without that feature, the Halo H80X has plenty going for it. It has all the bandwidth you need for everyday streaming, gaming, web surfing and video calls, and its superbly even coverage means you won't be traipsing from room to room to find the best signal. That being the case, the price is a steal: if you're seeking an affordable Wi-Fi upgrade for your home or small office, this is without question the best-value mesh around.

Mercusys Halo H80X specifications

Stepping up to the pinnacle of TP-Link's family of Wi-Fi 6 business access points, the Omada EAP670 is the company's fastest yet. This big ceiling mount discus has an AX5400 rating and claims speeds of up to 574Mbits/sec on the 2.4GHz radio channel and 4,804Mbits/sec on the 5GHz radio, which includes support for the high-speed Wi-Fi-6 160MHz channels.

You can deploy the EAP670 in standalone mode, where the web console quick start wizard required us to supply a new username and password after which it removed the default admin account for extra security. The AP supports up to eight SSIDs per radio and the wizard also asks you to configure the first two and secure them with a new encryption key.

Most businesses will probably want to use TP-Link's Omada cloud service, since it allows you to manage multiple sites, all associated APs and other Omada-enabled switches and routers from one web portal. Each site requires a local controller that links up with your cloud account, which you can host yourself as free versions for Windows and Linux platforms are provided.

For testing, we used TP-Link's OC300 controller appliance, which runs the Linux version and costs around £103. In the near future, however, you'll be able to dispense with the on-premises controller as TP-Link is currently developing a cloud-hosted version.

To see site WAN utilisation speeds in the portal, we added TP-Link's TL-R605 broadband router, which costs £35. To complete the Omada picture, we connected the EAP670's 2.5GbE LAN port to TP-Link's TL-SG3210XHP-M2 8-port PoE+ multi-gigabit switch.

The EAP670 delivered great results in our Wi-Fi 6 performance tests, in which we used a Dell Windows 11 Pro workstation with a TP-Link Archer TXE75E Wi-Fi 6E PCI-E adapter. Starting with the AP's 80MHz channels enabled, large file copies between the workstation and a Windows server on our 10GbE LAN averaged 112MB/sec at close range, dropping to 95MB/sec ten metres away and in an adjoining room.

To enable the 160MHz channels from the Omada portal, we selected the AP from the devices list and turned them on in the radio configuration section. This unleashed a big speed boost, with our close-range copies now averaging 218MB/sec and holding on nicely at 194MB/sec with the AP placed ten metres away.

The Omada portal makes light work of managing multiple sites as it presents a list of all controllers assigned to your account. Selecting one takes you to its own portal, which opens with a customisable dashboard along with a ribbon at the top showing internet capacity, gateway usage, switches, APs, clients and guests.

Adding APs to our site was easy. After connecting them, they appeared as "pending" and, once adopted, they took all their settings from the controller and broadcast our predefined site SSIDs. You can create the same number of SSIDs as in standalone mode – up to eight per radio – and apply mixed mode WPA2/WPA3 encryption, rate limits and load balancing.

Omada brings a lot more into play: along with captive wireless guest portals that support an extensive range of authentication methods, you can enable meshing to quickly extend your wireless network coverage. A wired AP functions as a root, other compliant APs connect to it using their 5GHz radio as a backhaul, and you can have up to three hops between them and the root AP.

With a price tag the right side of £200, the Omada EAP670 offers businesses an affordable Wi-Fi 6 solution well suited to high-density environments. Performance across the board is very good and it offers plenty of business-class features, all easily managed from the smart Omada cloud portal.

TP-Link Omada EAP670 specifications

Small businesses seeking fuss-free wireless networks will like Aruba's Instant On family of access points (APs), since they're designed to make deployment and ongoing management as easy as possible. On review is Aruba's flagship AP25 model, an AX5374-rated dual-band Wi-Fi 6 AP with speeds of up to 4,800Mbits/sec on its 5GHz radio and 574Mbits/sec on the 2.4GHz radio.

This is a significant upgrade over Aruba's old AP22 model, with its 4 x 4 MU-MIMO services offering a trebling in aggregate wireless performance. It brings the Wi-Fi 6 160MHz channels into play and releases their extra bandwidth with a 2.5GbE multi-gigabit LAN port supporting PoE+.

Newcomers to Aruba will love the installation process: all you need is a mobile or tablet. After downloading the Instant On app to an iPad, we connected the AP25 to the lab's Zyxel XS1930-12HP 10GbE multi-gigabit PoE++ switch and started the app. After creating a personal Instant On cloud account, you're guided through the connection process. When the AP's status LED is flashing green and amber, it will automatically discover it. Next, you create your first secure wireless network, provide a name for its SSID and you're ready to go.

Using a Dell Windows 11 Pro workstation with a TP-Link Archer TXE75E Wi-Fi 6E PCI-E adapter, we found the AP25 is significantly faster than the AP22. With a wireless connection to the AP's 160MHz channels, close-range file copies between the host and a Windows server on our 10GbE LAN returned 151MB/sec, falling to 131MB/sec with the AP moved ten metres away and into the next room. Swapping to an AP22 saw close-range copy speeds of 80MB and 71MB/sec at ten metres.

Overall Wi-Fi 6 performance may not be up with the best, but wireless management doesn't get any easier. The app dashboard shows active wireless networks, client connections, data transferred over the past 24 hours and all Instant On devices. Tapping an icon takes you to the relevant section where you can view more details, modify network settings and create up to eight wireless networks per site.

For each SSID, you can use WPA2 or WPA3 encryption, set client bandwidth limits, decide which radios are active and apply daily schedules that determine when each network is available. If a mobile device isn't available, you can use the Instant On web browser portal which presents the same interface and admin features.

Creating guest networks is simple and these apply L2 isolation so clients only get internet access and can't see the local network. A smart toolset is provided for quickly creating PC and mobile--friendly custom portals with your own company logo and acceptable use agreement.

Aruba's application analysis service is a great feature; along with views of all upload and download traffic, it shows which application categories this comprises and the clients using them. These are separated into 20 categories, including email, productivity, streaming and malicious sites, and their use on specific SSIDs can be blocked by unticking the box next to them.

The Instant On ecosystem isn't just about APs; Aruba offers a range of network switches as well. Choices include gigabit, 10GbE and PoE+ enabled models, and they can be managed in standalone mode or from the Instant On portal and app.

Aruba's Instant On AP25 isn't the fastest Wi-Fi 6 AP on the planet, but it delivers a level of performance that will satisfy all but the most demanding of environments. It's a great choice for small businesses worried about the complexity of wireless network management as Aruba's smart mobile app and web portal make deployment a breeze.

Zyxel is upping its game in the business Wi-Fi 6 market, with its Ultimate range of access points (APs) offering a fine blend of features and performance. The WAX630S teams up a speedy dual-band AX3000 rating with support for high-speed Wi-Fi 6 160MHz channels and a choice of management modes.

It exhibits the same sturdy build quality as Zyxel's speedy WAX610D and also provides integral 4G/5G interference filters plus power surge protection. Speeds and feeds are the same for both APs; the main difference between them is their internal antenna circuit boards.

The WAX610D uses a dual-optimised antenna array that must be manually set for ceiling or wall mount placements. The WAX630S's board presents a smart array that will work in either position and dynamically adjusts its aerial patterns to boost performance.

The WAX630S costs only a little more, and we tested them to see which is best. We connected them to a Zyxel XS1930-12HP 10GbE multi-gigabit PoE++ switch, used a Dell T640 Windows server with a 10GbE connection to the switch and called up our Dell Windows 10 Home workstation equipped with a TP-Link Archer TX3000E Wi-Fi 6 PCI-E adapter.

With each AP set to use their 80MHz channels there was nothing between them, with close range copies of a 25GB test file between the workstation and server both averaging 107MB/sec. With the APs moved ten metres away and into an adjoining room, each delivered the same average speed of 94MB/sec. Enabling the 160MHz channels saw the WAX630S move slightly ahead, with close range speeds of 188MB/sec as opposed to 180MB/sec for the WAX610D. At ten metres, the WAX630S averaged 163MB/sec – a small 4MB/sec increase over the WAX610D.

You have three management choices. The WAX630S can run in standalone mode or be remotely managed using Zyxel's on-premises NXC controller appliances. However, most businesses will prefer Zyxel's Nebula Control Center (NCC) cloud management, which opens up a wealth of features, and the price includes a one-year Professional Pack licence that enables email alerting, scheduled firmware updates and a one-year log retention service.

Adding the WAX630S to our cloud account was easy. We logged into the Nebula app on an iPad, selected our predefined site and scanned in the QR code on the AP's base. The app picked up its MAC address and model name and added it to the active site with a single tap. Each site supports up to eight SSIDs, each with their own authentication scheme (including WPA3). You can enable custom captive portals, L2 isolation, walled gardens and upload and download rate limits. Every site SSID can be broadcast by all cloud-managed APs or you can assign custom tags to each one and associate specific SSIDs with them.

Cloud management brings Zyxel's smart mesh feature into play. One AP with a direct connection to your gateway is designated as a root device, with repeater APs wirelessly connecting to it for an easy increase in network coverage.

Small businesses that don't want the extra expense of a firewall wil find Zyxel's optional Connect and Protect+ (CNP+) service worth considering. Costing around £22 per AP per year, a CNP+ licence enables application visibility and threat protection using DNS and IP reputation filters to block users from browsing unsafe sites.

After enabling CNP+ on our WAX630S, the NCC site dashboard presented two new graphs showing the top applications being used and hits on the threat protection service broken down into web attacks, botnets, scanners, spam sites and malicious URLs.

The WAX630S isn't the cheapest Wi-Fi 6 AP on the market but it delivers a lot of smart features for the price. Performance is impeccable, it can be easily cloud-managed and the affordable CNP+ threat prevention service could save small businesses the cost of a firewall.

Zyxel's NR5101 has a connection for every occasion as this desktop mobile router combines 5G NR (new radio), Wi-Fi 6 and Gigabit networking services. This makes it incredibly versatile: it will suit businesses and home workers in remote or rural locations that can't get decent fixed-line broadband speeds, those that need a high-speed wireless router with 5G WAN failover, or mobile workers that demand anywhere internet access.

The NR5101 is solidly built and its 600g weight makes it reasonably portable, but if you want a 5G mobile router you can slip in your pocket then Zyxel's smaller NR2101 is worth considering. The NR5101 offers more features, though, and the latest firmware upgrade supports Zyxel's Nebula Control Center (NCC) for cloud-based remote management.

Two Gigabit ports are provided, with the first offering WAN and LAN services and the second for connecting other devices to its network. The NR5101 is an AX1800-rated Wi-Fi 6 access point (AP) with speeds of up to 1,200Mbits/sec on its 5GHZ radio and 573Mbits/sec on the 2.4GHz one. The Wi-Fi 6 high-speed 160MHz channels aren't supported, but the NR5101 mustered a very creditable performance in our real-world tests.

Copies of a 25GB test file between a Windows 10 Pro workstation equipped with a TP-Link Archer TX3000E Wi-Fi 6 PCI-E adapter and a server on the Gigabit LAN averaged 93.5MB/sec at close range, dropping to 82MB/sec when we moved the router ten metres away and into an adjoining room.

Zyxel supplied our review sample with a pre-configured Voxi 5G micro SIM card, which fits into a slot on the unit's base. There's also a removable panel at the back that provides dual SMA connectors for Zyxel's optional external aerials.

The NR5101 is simple to deploy using the wizard provided by its local web browser interface. It then presents a dashboard with details such as cellular status and signal strength, active wireless networks and Nebula cloud connections.

The router is supplied with active SSIDs on each radio, which are protected by strong default passwords. You can also create two active guest wireless networks that only permit internet access to connected clients. Cellular settings are provided in the network menu, where you can PIN-protect the SIM and enable data roaming should you wish.

An integral firewall offers three security levels set with a slider bar, and filters can be added for controlling access to specific network services. Zyxel's Air mobile app will undoubtedly come in handy. After we connected an iPad to the router's wireless network, it provided details on cellular signal strength and status. Alas, with the lab located in deepest, darkest Sussex, the app reminded us we only currently have 4G services in our area, and we also found that its internet speed test function is not currently supported by the NR5101.

To add the router to our Nebula account, we scanned its QR code using the Nebula iOS app. It appeared in the portal under the Mobile router section and we could add a status widget for it in the site dashboard. Selecting the mobile router in Nebula takes you to a screen with hardware details and a location map alongside. Down below are a set of tools for viewing WAN and cellular status, traffic graphs for up to 30 days and details of connected wired and wireless clients.

Nebula handles firmware updates so when a new version becomes available it can push it out for you. Nebula can't be used to configure the router, but its new remote configurator feature allowed us to load its local web browser interface directly from the portal. Zyxel's NR5101 is a competitively priced 5G mobile router; D-Link's DWR-978 costs nearly the same but only offers Wi-Fi 5 services.

The impressive range of features makes the NR5101 suited to a wide range of usage scenarios, and support for cloud management will appeal to businesses that want to deploy it to remote workers.

Zyxel NR5101 Specifications

DrayTek’s Vigor 2866ax looks like an ordinary wireless router – and for a small office it can fulfil that role perfectly well. It offers a solid set of Wi-Fi 6 services, with speeds of up to 574Mbits/sec on its 2.4GHz radio and 2.4Gbits/sec on the 5GHz band. It’s also one of the very few SMB routers we’ve seen that supports wide 160MHz channels for maximum bandwidth. Round the back, six Gigabit Ethernet ports allow for the direct connection of wired clients, or the sixth can alternatively be configured as a WAN socket, as we’ll discuss below.

Installation is a cinch. The router’s web console provides quick-start wizards for configuring internet access, presenting secure wireless services and setting up VPNs. The price includes support for 32 IPsec tunnels plus 16 SSL VPNs, with optional hardware acceleration for increased performance. The firewall is also enabled out of the box, and preconfigured with a strict security policy; this can be customised with rules and filters, which are also used to enforce application controls and web content filtering. Cloud management is available via the optional VigorACS 3 web portal.

DrayTek’s URL keyword filtering service is basic, but you can beef it up with the optional Cyren GlobalView service, which divides the web up into 81 site categories that can be blocked or allowed using up to eight profiles. A free 30-day trial can be activated from your MyVigor account, after which it costs around £35 per year.

Application controls are also free on registration, and provide a list of 160 apps and protocols that can be controlled. Services including Facebook, WhatsApp and LinkedIn can be instantly blocked using profiles enabled within your firewall rules, although we did notice that Twitter is oddly not covered.

One area where the Vigor 2866ax really stands out is WAN redundancy. Alongside the built-in G.Fast/VDSL2 modem, one of the Ethernet sockets can be set as an internet connection, and the two front-facing USB 2 ports will each take a 3G or 4G modem. Each WAN connection can be configured as an active or backup link, with the latter automatically brought online when the primary link fails or its traffic exceeds specific thresholds. Alternatively, you can set mutiple links as simultaneously active, and enable the load balancing service to distribute traffic across them all.

Wireless services are also good for the price. Up to four SSIDs can be defined on the 2.4GHz and 5GHz bands, each with its own security scheme, and you can present hotspot services for guest users with custom web portals and a range of authentication methods.

Performance is helped along by a clever hardware acceleration option that allows traffic that’s already been through the firewall and content filters to bypass the CPU. This can yield huge performance benefits: with acceleration disabled, close-range file copies between a server (connected via Ethernet) and a Windows workstation connected over Wi-Fi 6 averaged 65MB/sec, with router CPU usage peaking at 80%. Enabling acceleration saw speeds leap up to 105MB/sec, while CPU usage dropped to barely 5%. We were also able to gain a small performance increase by enabling the 160MHz channel width, which saw copy speed increase slightly to 107MB/sec.

The Vigor 2866ax offers a lot for a low price; it’s a great choice for small businesses that want reliable internet and security services in one unit. It lacks some advanced features such as gateway malware protection and anti-spam, but all the essential security measures are present, and thanks to DrayTek’s powerful hardware acceleration it’s faster than you might expect.

DrayTek Vigor 2866ax specifications

While Wi-Fi 6 may be the latest and greatest thing, it’s overkill for many businesses. SMBs with a modest mobile workforce will find Wi-Fi 5 access points (APs) offer perfectly good performance at more affordable prices. The D-Link Nuclias DBA-2820P is one such contender, offering strong speeds over 802.11ac and an extensive feature set, including cloud management.

To be clear, that latter part isn’t free forever. A one-year subscription to D-Link’s Nuclias cloud platform is included in the price, after which you’ll have to pay for an ongoing licence. Costs are quite reasonable, however, at £50 per device per year, or £125 for three years. It’s not a bad platform to be on, either: Nuclias supports any number of APs and can remotely manage D-Link’s Nuclias-enabled PoE switches.

The hardware is a dual-band AP with 4x4 MU-MIMO, theoretically capable of delivering speeds of up to 1,733Mbits/sec on its 5GHz radio and 800Mbits/sec on the 2.4GHz band. It has two Gigabit Ethernet ports too: the first requires a PoE+ source, while the second can provide other wired devices with network access.

Before you start connecting clients to the AP, it’s worth getting the Nuclias portal properly set up. Once your parent organisation is registered, you can set up multiple sites, while profiles within them represent your wireless networks.

Standard profiles are provided for each Nuclias-enabled AP model. You can configure up to eight SSIDs on each radio or disable either band altogether. Other security options include support for WPA3, and a guest access mode that keeps connected clients isolated from the local network. A thoughtful touch is that any unregistered APs connected to your network will only permit guest access via the default SSIDs.

You can configure guest networks to present custom captive portals to users, and there are plenty of authentication methods available, ranging from a simple click-through page with an acceptable use policy (AUP) to a login page with a custom credential list, SMS validation and authentication via third-party providers such as Google and Twitter.

Cloud deployment could hardly be easier. From the web portal, simply enter the device’s UID number, assign it to a site and choose a profile. If you use the Nuclias mobile app things are even simpler, as you can skip the typing and simply scan the AP’s QR code. Either way, the DBA-2820P is ideal for zero-touch deployment: when plugged in at a remote site it will automatically start broadcasting your assigned SSIDs, as well as updating its own firmware as new releases appear.

Once your network is ticking along, the Nuclias cloud portal presents an informative dashboard showing the status of all managed devices and the total number of wireless clients, with graphs alongside displaying connections for either the last day or the preceding week. Below, a bunch of charts reveal the most utilised devices and SSIDs, plus the busiest wireless clients.

For testing, we connected our APs to a Nuclias-enabled DBS-2000-10MP PoE network switch. Once registered with our portal account, the switch immediately picked up our predefined profile, and the dashboard updated itself with a pie chart showing PoE usage, plus a graph of the past day’s power consumption.

If you need more detail, the portal can generate reports for selected APs, switches or profiles over a choice of time ranges, which can be archived and saved as spreadsheets

And if you’re unsure whether Wi-Fi 5 can still cut the mustard, there’s more good news – we found that the DBA-2820P’s performance gave many Wi-Fi 6 APs a run for their money. File copies between a Windows 10 Pro desktop equipped with a Netgear AC1900 USB adapter and a LAN server averaged a speedy 84MB/sec at close range, dropping to 79MB/sec at 10m. Very few businesses will need more.

For SMBs that want an affordable, cloud-managed wireless network, the combination of the DBA-2820P and the Nuclias management platform will fit the bill very nicely. Don’t be put off by the last-gen Wi-Fi; this AP offers very good performance, along with plenty of business-class wireless features.

D-Link Nuclias DBA-2820P specifications

Cisco has launched four new devices in its Catalyst 8000 Edge series. They include a 5G cellular gateway, two Virtual CPE Edge units, and a heavy-duty aggregation router, all designed to support SD-WAN networking.

The company debuted its Catalyst 8000 family last October, and Cisco expanded the range by launching the Cisco Catalyst 8500L, the latest addition to the Catalyst 8500 Edge family. This is a collection of what Cisco calls aggregated service routers designed with large enterprises and cloud service providers in mind. They’re an evolution of the company's ASR 1000 series of routers.

Cisco designed the Catalyst 8500L for SD-WAN use cases, where wide area network (WAN) connectivity is configurable via software. They also support the emerging secure access service edge (SASE) model that Gartner defined in mid-2019. That builds on SD-WAN to offer zero-trust networking capabilities for secure access.

The 8500L is an SD-WAN capable router that offers WAN connectivity at speeds of up to 10 Gbps. Rackable in a 1RU form factor, it runs either at core sites or colocation sites and features twelve x86 cores and up to 64 GB of memory, which Cisco says will support secure connectivity for thousands of remote sites. It also includes Cisco Trust Anchor technology, a tamper-proof trusted platform module that guarantees the hardware is authentic to protect against supply chain attacks.

The Cisco Catalyst 8200 is a 1 Gbps branch office router with eight CPU cores and 8 GB of RAM, which Cisco says doubles the performance over the existing ISR 4300 series. That is helped by a hardware performance acceleration feature called Intel QuickAssist.

Complementing the Catalyst 8200 is the Cisco Catalyst 8200 uCPE, a branch office customer premises equipment (CPE) device with a small physical footprint. It features eight CPU cores and supports up to 500 Mbps aggregate IPsec performance. It can also take pluggable interface modules (PIMs), which are hardware extensions giving it cellular connectivity options.

Speaking of cellular communications, the new Cisco Catalyst Cellular Gateway 5G plugs into a router to offer on-premises cellular connectivity in sub-6GHz bands. The device uses Power over Ethernet (PoE) to relay cellular communications back to the router.

Admins can manage the devices using software, including vManage, licensed under Cisco's DNA model. vManage has three tiers:

• DNA Essentials offers core SD-WAN, routing, and security features.
• DNA Advantage gives subscribers the Essentials package, plus support for advanced routing capabilities including MPLS BGP; better security support with Advanced Malware Protection and SSL proxy features; and access to Cisco’s Cloud OnRamp, which helps with connectivity to multiple cloud service providers.
• DNA Premier adds centralized security management for all locations.

Cisco announced today the launch of its new wide area networking (WAN) platform: the Catalyst 8000 Series Edge.

Designed exclusively for intent-based networks, the Catalyst 500 Series provides businesses with flexible options for secure connectivity and better end-to-end visibility over applications running on the cloud, in data centers and on the edge. This will lead to accelerated cloud adoption.

“With the proliferation of applications, workloads and services becoming more distributed across the edge-cloud continuum, organizations are facing new realities at the WAN edge,” said JL Valente, vice president, product management for Cisco’s intent-based networking group.

“In building secure multicloud access architectures, IT organizations need the agility to change course and scale quickly along with the needs of business. The Cisco Catalyst 8000 Edge Platforms bridge the WAN edge and the cloud edge, providing secure, high-performance connectivity for distributed users to any cloud while delivering IT visibility and business agility.”

The Catalyst 8000 line offers solutions for growing WAN edge issues through built-in analytics for on-premise and cloud networks. For example, Cisco supports full-stack SD-WAN security for customers opting for an on-premise solution. For firms looking to adopt a secure access service edge (SASE) architecture, Cisco software-defined wide area network (SD-WAN) clusters cloud-managed SD-WAN and cloud-delivered security into one single solution.

Adventist Health System, a non-profit integrated health care provider serving more than 80 communities on the West Coast and Hawaii, will reportedly be the first organization to deploy the Cisco Catalyst 8000 Edge Platforms.

“Fueled by a growing use of cloud-based applications, tele-medicine, ultra high-definition imaging and remote collaboration, our network must deliver secure, highly resilient and scalable connectivity, and enable agility so we can address our patient care and business requirements,” said Ed Vanderpool, IT technical manager at Adventist Health System.

“As we expand our intent-based network, the Cisco Catalyst 8000 Edge Platforms check all the boxes for a flexible SD-WAN solution that can deliver the performance, visibility, and security needed to deliver these real-time connected experiences.”

The 8000 series will launch with three models:

• Catalyst 8500 Series Edge: This system is suited for data center, colocation, and aggregation sites. It includes the highest-performing SD-WAN with its integrated 40G and 100G ethernet ports all in a compact, single-rack unit.
• Catalyst 8300 Series Edge: This platform is great for edge connectivity at branch sites thanks to its modular access with a diverse set of connectivity choices. It also delivers on-demand services, allowing it to quickly adapt to organizational changes. Its SD-WAN service performance is four times better than the current Cisco Integrated Services Router, making it a worthy upgrade.
• Catalyst 8000V Edge Software: This flexible virtual routing platform runs on any x86 platform or ENCS or SCP appliance on the cloud. It delivers connectivity, visibility and security in multi-cloud environments, including AWS, Azure, and Google Cloud.

Cisco has also announced the release of its Catalyst Cellular Gateway. The plug-and-play device allows easy migration to 4G LTE without extensive changes to existing infrastructure. Support for 5G wireless WAN is in the works.

Cisco plans to ship the 8000 Edge Platforms and Catalyst Cellular Gateway through a flexible subscription-based delivery model.

We're big fans of DrayTek's SMB routers, and the VigorBX 2000ac delivers combines their trademark strengths with an integrated IP PBX. Along with dual-band 802.11ac wireless, it offers triple WAN redundancy, an SPI firewall, optional web-content filtering and all the VPN services you can eat.

It works brilliantly as a small business IP PBX, with support for 12 SIP trunks, 50 IP phone extensions and 20 simultaneous calls. Call handling features are extensive, and include dial plans, hunt groups, voice mail, an auto-attendant and much more.

The router's web interface provides plenty of wizards covering initial setup, VPNs and, of course, management of the IP PBX itself. WAN failover support is excellent: the router has an integrated ADSL2+/VDSL2 interface, along with a Gigabit WAN port, and will accept a 3G or 4G USB adapter.

Via the Ethernet WAN port, we had internet access running in under minute, enabling us to jump right into the IP PBX. Our first job was to link the router to our Sipgate SIP trunk, which was as easy as you could ask for: after we'd entered our account details, the Sipgate web portal immediately showed it as registered.

We then defined our office hours, so the auto-attendant could give appropriate messages to callers depending on the time of day, and set about creating extensions. For each of these, the process lets you define a unique number, create a user account with a password and a voicemail PIN, and specify which SIP trunks they're allowed to use. It's also possible to set certain extensions to use PSTN lines, so you're covered if internet access goes down.

Next, we customised each extension's call answering modes: if a call goes unanswered for so many seconds, is busy or offline, it can be passed to voicemail, forwarded to another extension or group or passed to the auto-attendant. For general call handling, the IP PBX comes with a bunch of predefined messages, but to use the auto-attendant you'll need to record some messages of your own, using a PSTN phone on one of the analogue ports. Once this is done, a wizard takes you through all the necessary steps to ensure a caller gets to the right person.

Incoming voicemail is, by default, stored on the router's embedded NAND flash. This offers a decent amount of space: after we'd left ourselves nine messages, totalling around 4 minutes, it showed 99% capacity still remaining. You can prevent chatty callers from eating up all your storage by limiting messages to 30 or 60 seconds: those who need a bigger buffer can plug in a USB flash drive and use that instead. If you've set up an SMTP mail server for the router, voicemails can also be forwarded to their recipients as email attachments and immediately deleted from its internal storage.

Sadly, the extension auto-provisioning feature proved to be a non-starter with our Yealink IP phones: we entered their MAC addresses as requested, but they refused to pick up profiles. This wasn't a deal-breaker, as we were able to register them by manually entering account details in each phone's web interface, but having to do this for every user could be an annoyance for a larger office.

Trying out DrayTek's free Windows softphone wasn't a seamless experience either. The utility is over five years old, and refused to work with the integrated audio systems on four of our test PCs. It did install successfully on a PC with a Creative Labs sound card; then we found that IP PBX auto-discovery didn't work either, so we had to enter account details manually.

These provisioning issues may make it a tedious task to get set up, but this router can't be faulted for its call-handling features. SMBs that don't want a cloud-based solution will find DrayTek's versatile VigorBX 2000ac has every networking angle covered.

This review originally appeared in PC Pro issue 272

Verdict

These provisioning issues may make it a tedious task to get set up, but this router can't be faulted for its call-handling features. SMBs that don't want a cloud-based solution will find DrayTek's versatile VigorBX 2000ac has every networking angle covered.

Desktop chassis

7 x Gigabit Ethernet (6 x LAN, 1 x WAN2)

ADSL2+/VDSL2 interface

2 x USB 2

1 x FXS/2 x FXO analogue ports

Dual-band 802.11ac wireless

External power supply

241 x 166 x 44mm (WDH)

2yr RTB warranty

It used to be that if you installed security software on your computer, you were protected. Not so anymore, as hackers aren't just after your computer, but any device you have connected to the internet, from smart TVs to security cameras.

Attacks on smart home devices are rather worrying and bound to increase. Last year, we saw the full threat when the Mirai botnet infected thousands of IoT devices and used in a distributed denial of service (DDoS) attack.

That is only the start of the problems, and an infected smart home device could open up your network to further attacks and issues.

Unfortunately, traditional routers aren't geared up to offer any protection from these kinds of attack, and can't and won't monitor your internet traffic for problems. Step forwards something different, the F-Secure Sense.

Sense is a combination of two products. First, there's the security-hardened router, which gives protection to all of your devices. It's a diamond-shaped glossy plastic box, and it looks fantastic. We love the clock that shines through the front. This can be dimmed or turned off, in case you have the router in a room where the bright lights would be a distraction.

Secondly, there's the Sense application, which uses F-Secure's anti-virus engine and protects your Android and Windows devices (there's an iOS app for setup only, while Macs currently aren't supported). It's powerful protection, protecting against 100% of threats in the most recent AV Test report.

Sense requires a yearly license (102 a year or 8.50 a month), with the first year included in the price of the router. This nets you all of the protection features, including software licenses for 25 Windows devices and unlimited Android devices.

F-Secure Sense is designed to be plugged into your existing wireless router. It will not work with a modem, such as the BT Openreach model, which is a real shame. Routers use a system called Network Address Translation (NAT), which lets you run many devices, each with their own internal IP address, through your internet's single IP address. By making you connect the Sense router to your existing router, you end up with a case of double-NAT (once on your existing router, and once on the Sense). This can make things like port forwarding much harder, as you have to configure the settings on both routers.

In some situations, this will not work at all, particularly for games and TV services. In fact, our BT YouView service wouldn't work with streamed channels, such as BT Sport. The only way around the issue is to plug certain devices into your existing router. We'd like to see F-Secure update the Sense router, giving a PPoE option so that it can connect to most UK broadband providers.

A second slight disappointment is that the Sense has just three Gigabit Ethernet ports. Having one port fewer than most routers could be a problem to some: we had to plug in an additional switch to connect all of our devices.

Once you've connected the Sense to your existing router, setup is managed through the Sense app for Android or iOS. Only one smartphone can control the router at a time, so make sure you use your primary phone. If you want to change phones later, you will have to reset the router and start again. If possible, we suggest using iOS, as the Android app can't currently configure Port Forwarding, which is a strange omission; support is coming soon.

As this is a secure router, the Sense configuration is a little different to that of most regular routers. First, you have to pair your controlling smartphone with the router. This is done via Bluetooth, and requires you to enter the four-digit code displayed on the router into your app.

After that, you're taken through a quick wizard to configure your wireless network name and password. Secure defaults are suggested, but we recommend disabling Wi-Fi on your old router and then configuring the Sense to use the same Wi-Fi name as your old router, so all of your existing devices connect.

One minor issue is that the Sense's DHCP server uses a new IP address range (192.168.71.30 to 192.168.71.249). If you've got devices that use static IP addresses you have two options. First, you can change their address to match the new range. Secondly, you can change your old router to use a different IP address range (you'll have a conflict, otherwise), and reconfigure the Sense router to use your old DHCP IP address range. Either way, it's a bit of a faff.

Finally, if you keep the Sense's default settings, you may find that some devices don't work. This is most likely because they've held onto to their old IP addresses. Rebooting them should fix the problem.

Security protection is very easy to manage, using toggle switches in the app. By default, the router is set to protect all devices, with browsing protection turned on. In this mode, Sense actively blocks malicious websites on all devices, reducing the risk of phishing attacks or drive-by malware installations. It works well, too, blocking all of our attempts to visit malicious sites. This isn't true web filtering, though, so you'll need parental controls if you want to filter what your children can see. A future update will add Advanced parental controls into the mix.

In the default mode, Sense builds up a profile of your smart devices, too. By monitoring the patterns of traffic and where the devices are talking to, Sense can see what's normal. Should your devices suddenly start sending loads of data, or communicating with known command servers (the parts that run botnets), Sense can automatically warn you and block internet access to that device.

Additionally, Tracking protection can be turned on, which will prevent websites and criminals tracking you through the web. We recommend turning this on. At the minimum, it will prevent so many tracking adverts from following you around, making the web nicer to browse.

From the app's main screen you can see your current network status, including whether any threats have been blocked. You can tap the threat count to find out what, specifically, was blocked.

Go to the Devices section, and you can see a list of connected machines. Where possible, Sense pulls the device's name or manufacturer, to help you identify what each product is. You can also override each device, rename it and choose a more meaningful icon. If Sense is struggling to pull any meaningful information (we had one device that identified as being from a Chinese manufacturer), you may want to go round your home and turn everything off. Then, turn on each device one at a time, so you can see what's connecting to your network and label it accordingly.

An option called "Identify Device Type" is available in Settings, but this currently just looks for Android and PC devices, and then warns you if they don't have the protection software installed. A future update promises to add IoT device reputation-based protection, which will detect the types of device on your network and provide specific protection for each one.

Select any device in the list, and you can choose to block the internet, which is a handy way to get the kids' attention when it's dinner time. It's a shame that schedules can't be configured at the moment, and we hope that this is part of the advanced parental controls update. Finally, the device status page shows you how many threats have been blocked, and if the device is OK or potentially compromised.

Sense currently has very simple networking controls. There's port forwarding (provided you use the iOS app), you can change the name of your wireless network, and you can change the DHCP range. That's it, and there's no control over the finer details of your network settings. Despite the fact that there's only one network listed, the Sense actually creates two networks: one 2.4GHz network and a 5GHz network, with '_5GHz' appended to the network name.

There's no guest network option, although this feature is also due to come in a future update, along with an integrated VPN. There's no option for UPnP, which is good in one way, given that the technology is so insecure; however, this means that some devices may not work correctly, and will have to be manually configured using port forwarding.

Of course, all updates are applied automatically to the router, reducing the traditional risk that the firmware goes out of date, leaving any flaws open to be exploited.

There's little point in additional security if performance isn't up to scratch. Internally, the router is a 802.11ac model, with AC1750 speeds (450Mbit/s 2.4GHz and 1,300Mbit/s 5GHz). That makes this a mid-level router, and our speed tests showed this.

At close range, the router managed 217.52Mbit/s upload speeds and 348.3Mbit/s down; moving one floor up, we saw 282.91Mbit/s up and 226.99Mbit/s down; on the second floor, speeds stayed steady at 269.52Mbit/s up and 248.26Mbit/s. These throughputs aren't bad but put the router a way off the pace set by routers with faster Wi-Fi chips.

We found that 2.4GHz performance was a little disappointing. At close range we measured throughput speeds of 65.12Mbit/s up and 46.68Mbit/s down; moving to the first floor, we saw throughput speeds of 66.09Mbit/s up and 50.97Mbit/s down; and on the second floor, speeds of 47.49Mbit/s up and 42.28Mbit/s down. While these throughputs are consistent, we'd expect to see results closer to 100Mbit/s from 2.4GHz networking.

If it's speed that you're looking for, then the Linksys WRT3200 ACM would be the best choice. Alternatively, a product like the BT Whole Home Wi-Fi could be connected to the Sense: it offers greater speed at distance, and even extended our Wi-Fi coverage into the entire garden. The only downside is that there's no option to disable the Sense router's Wi-Fi.

With all of that said, the F-Secure Sense is still an interesting product, genuinely improving the security of every device that's connected to your home network. However, in its current state, there are few too many omissions for us to wholeheartedly recommend it: it needs the updates to add much-needed features, the Android app needs to provide the same configuration options as the iOS version, and it would be much better if the Sense could replace your old router. Updates are due to come, improving things, so you may be better waiting for these before buying.

This review originally appeared in Computer Shopper.

Verdict

A clever router that protects every device connected to your home network, but it's currently lacking a few features.

Modem: Ethernet

Wi-Fi standard: 802.11ac

Stated speed: 450Mbit/s (2.4GHz), 1,300Mbit/s (5GHz)

USB ports: 1x USB3

Wall mountable: No

Warranty: Two years RTB

Details: www.f-secure.com

Part code: SENSE

Unreliable Wi-Fi is something that is hated by all - sudden dips in signal, downloads grinding to a halt, unexplained black spots in the home, these are annoyances that we encounter far too frequently in daily life. Thankfully, a solution is available in the form of mesh networking, the latest innovation courtesy of Google Wi-Fi.

Instead of the traditional setup, where one router is responsible for covering the entire property, helped with range extenders to fill in any gaps, mesh Wi-Fi spreads this out across discrete nodes, creating an interconnected web of blanket coverage that smothers any dead zones.

Similar to Linksys Velop or BT's Whole Home Wi-Fi, Google's solution is a modular network that allows you to simply add a new node to extend the coverage of the network. Unlike traditional range extenders, where the signal is stretched out, you get the same performance from every node. It also features a few advanced tools such as client-switching and band-switching, ensuring that the connection remains smooth and uninterrupted.

Design

Google Wi-Fi discards the tech-heavy design of traditional hardware that makes most routers look like stealth bombers rather than networking kit. Instead, it uses a minimal and understated design for each of its nodes - a squat, cylindrical body with an LED light ring that acts as the main indicator for the device.

It's a clean and attractive look that will fit with most home decors, and its small size means it can sit on a shelf without drawing too much attention. It's a far cry from the large, blinking boxes that you may be used to.

In terms of hardware, each node has two Gigabit Ethernet ports for hardwired connections, as well as support for dual-band 802.11ac wireless connectivity and 2x2 MIMO, with a theoretical upper limit of 1,200Mbits/sec.

Setup

If you've ever set up any of Google's Chromecast devices before, you'll be familiar with the process of getting Google WiFi up and running. The setup process is entirely app-based, in contrast to the browser-based configuration tools used by most routers.

As you'd expect from a Google device, setting up your network is simple and painless, the device taking you through each step with clear and easy-to-follow instructions. Getting the first node in your network set up should take less than 15 minutes from start to finish, with each subsequent node taking less than five minutes to add.

Maintenance

The beauty of Google WiFi is that it's a 'set it and forget it' system, meaning that you should never have to mess around with it again. That's courtesy of Google's intelligent software, which uses machine learning and dedicated sensors to determine which channels and bands to use, automatically switching between them to give you the best signal possible. Client switching also means that your device will automatically connect you to whichever node offers a better signal without you having to do anything, which is seriously impressive stuff.

That being said, however, there is a fairly substantial amount of additional settings and configuration options to sink your teeth into if you so desire. All the usual settings like UPnP, port forwarding, IP address management and DNS settings can be manually configured from within the app.

The router's firmware automatically updates itself in the background, which is an excellent feature, given that networking gear is frequently the thing that gets forgotten about in patching cycles and often gives criminals an easy way into your network. Regular updates ensure not only that your network is an secure as possible, but also that you've got a steady stream of new features and performance improvements.

Features

In addition to some smart behind-the-scenes stuff, Google has also thrown in a couple of impressive network monitoring features, too. There's real-time and historical lists of how many devices are connected (including exactly how much bandwidth they're using), as well as records of network usage, speed and more.

In addition to this, users have the ability to prioritise certain devices, meaning that they will always have the fastest and most reliable Wi-Fi connection. This is ideal for any business-critical appliances, like backups or servers, or for making sure that certain teams take precedence.

There's also family controls, allowing parents to block individual devices or groups of devices according to a pre-set schedule (mealtimes, for example), or to pause internet access altogether. Guest network settings are available too, which allow you to provide access to your Wi-Fi network and connected devices like Chromecasts and the like without also giving them access to shared folders and other private information.

Google has even thrown in a set of testing utilities, allowing you to check the internet speed from your ISP, the strength of the mesh connection between your nodes and the Wi-Fi signal to your mobile device.

Performance

The real test of a wireless router, however, is its performance. It can have all the fancy features in the world, but if it doesn't have a good coverage and throughput rate, it might as well be a paperweight. Thankfully, Google Wi-Fi handles both of these things with impressive aplomb.

The whole point of a mesh Wi-Fi network is to minimise the coverage issues that can crop up in large or thick-walled properties, so it's no surprise that Google WiFi performs well here. By placing nodes throughout the house, you can ensure that there's no weak signal areas or 'black spots' throughout the premises.

We found that two nodes were sufficient to provide a large, five-bedroom house with sufficient coverage, but you may want to add more for larger offices. The good thing is that there's no limit to the amount of nodes you can add to the network, and each downstream node only needs to be in range of the one before it in order to maintain a connection.

Be warned, however - individually, the coverage range of an individual node isn't great, and we found speeds dropping to 5MB/sec over longer ranges. We would not recommend purchasing an individual node to use as your primary router.

Google WiFi's performance was similarly capable in terms of raw speed. At close range, it racked up download speeds of 73MB/sec, with 27MB/sec speeds in our long-range tests. While that's highly credible, outperforming the more expensive Linksys Velop, it's not quite as fast as BT's Whole Home Wi-Fi system, which managed to hit 89MB/sec at close range and 36MB/sec at a distance.

Verdict

Google WiFi is one of the best mesh Wi-Fi products around. It's small, stylish and setup couldn't be easier. Not only that, but it's also got a host of network monitoring and management tools to ensure that your connection stays in tip-top shape.

Performance and coverage are excellent too, and while Google WiFi isn't quite the fastest mesh Wi-Fi product on the market, it's more than capable of keeping up with most home or small business use cases.

In fact, despite being primarily marketed as a consumer device, Google WiFi might just be one of the best small-business networking solutions we've seen in a while. The easy setup and maintenance ensures that even non-technical business owners should have no trouble using it, and the ability to add more nodes means that your network can scale with your business, without having to rely on boosters or range extenders.

Google WiFi is an excellent piece of kit, and if you're thinking about upgrading your wireless network, it's definitely going to make you happy.

Verdict

Google WiFi is the best mesh Wi-Fi network you can buy. It's not quite as fast as some others, but the excellent management and setup experience elevates it to the top spot.

Setting up wireless networks can sometimes be a pain. On top of clunky configuration interfaces, you've often got to contend with signal dropoffs and black spots, particularly if your building has thick walls. Mesh Wi-Fi products supposedly eliminate this problem, by using multiple interconnected nodes to create a single, seamless network.

The Linksys Velop is one such product, and is intended to take the fuss out of the often-complicated process of wireless networking. While it's primarily designed for a consumer rather than enterprise use-case, the Velop has some interesting applications for small businesses who want to invest in a mesh Wi-Fi network without the associated hassle of setting up business-grade IT solutions.

Design

Routers are rarely attractive, but this product definitely emphasises form as well as function. Linksys says the Velop is "designed to disappear", with the aim being for it to blend into your home decor.

Amazon uses a similar tactic with the Echo, and the two products share more than a few design cues. Like the Echo, the Velop opts for a sleek, minimalist shell rather than the squat, boxy chassis usually seen on networking products.

Comprised of a tall, square column of high-quality white plastic, the Velop has a footprint that the company claims is 88% smaller than traditional routers. We'd be willing to agree with this - this petite router will fit very well into even the most tightly-packed offices. It looks good, too; it's simple, elegant, and much more visually appealing than most other wireless equipment, which tends to either be bland and unprepossessing or over-designed to within an inch of its life.

It does a pretty good job of blending into a kitchen or living room but if you're planning to use it in a small office environment, that's probably not going to do much to sway your opinion either way... We did like the cabling setup, however, which involves plugging everything into a recess in the base and then neatly feeding it back out through a slot in the corner. It's a pleasing way of minimising cable clutter, which is always a good thing.

Setup and management

Unfortunately, we noticed one problem straight away. The Velop's plug is slightly wider than most others, meaning it won't fit comfortably in multi-way extensions. This can be remedied by finding some space on a wall socket, but it's an annoying inconvenience all the same.

Other than that, the setup process is easier than falling off a log. Done entirely through the Linksys app, the step-by-step process takes care of most of the configuration for you, and we got our network set up in no time. Adding new nodes to an existing network is simple too, meaning expansion shouldn't be a problem.

The management console (offered solely through the app) is good, too. It provides key settings and information such as connected devices and network status in a simple, easy-to-understand layout. It highlights more commonly-used configuration options like guest access and parental controls rather than in-depth networking protocol settings, but options like port forwarding, MAC filtering and IP settings are all still available through sub-menus. Of course, it can't rival the granularity offered by more high-end enterprise products, but for basic configuration it should more than suffice.

One setting that's notable by its absence, though, is channel and band switching. Although the Velop is a tri-band router, there's no way to specify which band you want to use - instead, the software takes care of all that, and will intelligently switch bands and channels on the fly in order to provide the best coverage.

We didn't notice any problems with interference while testing the Velop, but if manual channel control is a must-have, then you're out of luck.

Another area the Velop seriously falls down in is physical connectivity. Each node features two gigabit ethernet ports at the base, but if your current networking setup involves a mess of hardwired connections, this will likely get eaten up very quickly. You could always augment this with an ethernet switch, but adding extra gear to a product that supposedly takes the hassle out of networking would seem to defeat the purpose.

Price is also a major problem. A triple-pack of nodes will set you back by almost 500, which is somewhat less than ideal, particularly as BT is offering a similar solution for just under 300.

Performance

The Velop uses three internal radios - one on the 2.4GHz band and 2 on the 5GHz band - with MU-MIMO technology and beamforming for better speed, range and performance. The theoretical ceiling for wireless speeds is 50MB/sec on the 2.4GHz spectrum, rising to 108MB/sec with 5GHz. Sadly, as there's no way to specify which band your device uses, you'll have to leave this up to the router.

Performance was very capable when we tested it with iperf. We clocked a maximum throughput speed to the modem-connected node of over 50MB/sec at close range, with around 35MB/sec for the ones upstairs. The signal dropped off rather substantially at range, however, and we measured a throughput of around 10MB/sec over a distance of 25 feet.

Coverage is good, too. Despite thick walls usually leading to numerous black spots in our testing environment, three well-positioned Velop nodes meant we had excellent coverage across the whole area, although throughput speeds can drop if you're between nodes.

While that is indeed excellent, it's not quite as impressive as other rivals - BT's Whole Home Wi-Fi solution in particular outperformed it in terms of throughput.

We had some issues with reliability too - nodes occasionally dropped out and had to be re-added to the network. Thankfully, given that setup is so easy, it's a doddle to get them back up and running again.

Verdict

The Velop works best as a 'set it and forget it' system. If you want blanket Wi-Fi coverage without having to worry too much about setup, configuration or maintenance, it works pretty well. Coverage is generally good, and speeds were very respectable.

For any advanced use-cases, however, it's less ideal - particularly if your IT setup involves physical networking over ethernet. A lack of ports makes it tricky to link into existing physical infrastructure, and it's quite a bit more expensive than its rivals, which is particularly galling when BT's offering achieved better speeds.

On the other hand, there's a lot here to like. If you're looking to wire up a small, multi-level office with minimal IT needs, the Linksys Velop could be just the ticket, offering a persistent mesh Wi-Fi network that's all but entirely hassle-free.

Verdict

The Linksys Velop does a great job of making wireless networking easy and hassle-free but it's rather pricey, and a lack of ethernet ports and slightly lacklustre speeds may put off businesses with more advanced needs

TP-LINK'S ARCHER VR2600 is kitted out with the latest 4x4 MIMO technology, to give it a maximum throughput of 1,733Mbit/s on the 5GHz band. It's also designed to be a router for all, with both a Gigabit Ethernet WAN port and an RJ11 port for the combined VDSL/ADSL modem, so you can use it with fiber connections, too. In short, there's no internet connection that this router can't connect to.

Setup and configuration

Setup is pretty straightforward thanks to the brilliant setup wizard. This has default configs for all of the major ISPs, so you should be up and running quickly without having to hunt around for the settings you normally need.

TP-Link's interface is much like those from other router manufacturers and it's pretty easy to find your way around it. It's split into two sections, with Basic letting you change simple settings and Advanced letting you get into the more hardcore settings.

Performance

Although there's a headline speed of 1,733Mbit/s, this would require a device with a 4x4 MIMO chip and there aren't any at the moment. So, this is a router that will get faster with age, as you buy newer devices. In future, it will also support MU-MIMO (multi-user MIMO), which will let multiple devices that support the technology broadcast at the same time. With current MIMO, only one device at a time can connect.

Even though this router couldn't be run at its maximum theoretical speed, it still managed to blitz through our performance tests. It managed a staggering 419.43Mbit/s at close range (maxing out our test laptop), and 256.32Mbit/s at 10m. Switching to the 2.4GHz network, TP-Link claims a throughput of 800Mbit/s. We managed 66.32Mbit/s at 10m, which is still pretty fast, although we have seen faster from more expensive routers.

Still, this is about as quick as you can expect from a modern router and if you want something that's future-proof and will improve when you buy newer devices, the Archer VR2600 is it.

Features

TP-Link has fitted the router with most of the features that you'd expect. You get two guest networks: one of the 2.4GHz band and one on the 5GHz band. Both are secured and give you a way of letting guests access the internet without being able to see the rest of your network, or any storage devices that you have plugged into the router.

Two USB3 ports are there if you want to share a USB drive or a printer, but as with most routers a NAS does a better job and so many printers have Wi-Fi now that you shouldn't need a print server.

One neat use of the USB ports is for a 3G or 4G modem. This can provide you with your only internet connection or as a fail-over option should your main internet connection go down. If you rely on your internet for work, this could be a life-saver.

Parental controls let you block websites containing certain words, but you have to fill out the details manually, which is a little inconvenient. It would be nice if TP-Link could provide a block list automatically, or integrate with another service, such as OpenDNS. You also get all of the usual port forwarding, dynamic DNS and firewall controls, so you won't have a problem getting this router to work with any online service.

Verdict

For some of the latest technology, the TP-Link Archer VR2600 is well priced. While it couldn't be called cheap, it has both VDSL and Gigabit Ethernet WAN ports and it's exceptionally fast. As newer devices that support MU-MIMO and have 4x4 chips become available, its performance will only get better soon. For businesses that want the best speeds, this is the router to buy.

This review originally appeared in Computer Shopper issue 345

Verdict

With support for all types of internet connection and very fast 5GHz network, this router is one for those that want the best

With so much kit in our homes reliant on a strong wireless connection, a tri-band router, such as the TP-Link Archer C3200 makes a lot of sense. This router has a single 2.4GHz network but can provide two 5GHz 802.11ac networks. It means that you can use one 5GHz network for streaming devices and one for your other devices, so that you won't suffer from Wi-Fi congestion.

Wireless standards

Traditionally, tri-band routers have been quite expensive and, while not exactly cheap, the Archer C3200 is surprisingly well-priced: something that we've come to expect from TP-Link. Part of the reason for the lower price is because the Archer C3200 doesn't quite have the latest technology.

That means that there's no MU-MIMO (Multi-User MIMO) and throughput tops out a theoretical 1,300Mbit/s on the 5GHz channels. Admittedly, there aren't any MU-MIMO clients at the moment, but the technology looks set to become very exciting in the future.

With MU-MIMO, a router will be able to separate out different users, giving them their dedicated bandwidth, improving performance. Likewise, as support for faster than 1,300Mbit/s 802.11ac comes, this router will not be able to go faster.

Design

That's not to say that the Archer C3200 should be dismissed out of hand, as it's still an accomplished router in its own right and there's a lot to like about it. We're big fans of its design, as it's one of the smallest tri-band routers that we've ever seen. Rather than having an ungainly mess of antennas, the Archer C3200's fold up from the centre of the router and are evenly distributed.

There are four Gigabit Ethernet ports round the back, which is the minimum that we expect nowadays, plus a Gigabit Ethernet WAN port. This means that you'll need to have a separate modem to plug this router into, as it can't connect to ADSL/VDSL connections directly. Finally, there's a USB3 port for sharing printers or storage over the network.

Setup and configuration

Out of the box, the Archer C3200 comes pre-secured with all of its wireless networks having security by default, and the network password is written on a sticker attached to the router.

Connecting to the router's web-based management page for the first time prompts you to change your admin username and password, and then takes you through the quick setup wizard to get you connected. In no time at all we had the router connected to our BT Infinity Connection.

Changing settings is pretty straightforward through TP-Link's web interface. It's a little plain, but all of the settings were where we expected to find them. Our first job was adjusting the wireless settings, giving the networks the names and passwords we wanted them to have.

Features

The two 5GHz networks remain separate, with the first using the lower channels and the second using the higher channels, to prevent any interference. There's also an option to enable a Guest network, where users can access the internet, but they don't have access to your other devices: this is handy if you have a lot of guests around and don't want to give out your usual Wi-Fi password.

TP-Link has the usual range of features that you'd expect, including the option to share storage over the network. It's useful in some situations, but a full NAS is better. There's also web filtering to help protect your kids, although you have to fill out the whitelist or blacklist manually, which is a bit of a pain.

Testing and performance

Once the router was working, our first test was to see if streamed channels from YouView would work, as this requires very specific IGMP support. First go, we could not get the channels to work. Following a firmware update, we managed to get the router working. Sadly, the first time we streamed a live YouView channel, the router stopped responding to our Wi-Fi clients, and we had to reboot it. This happened once more, but then the router settled down and became reliable.

Testing the router, we used the free TamoSoft Throughput Test, which measures Wi-Fi throughput from a client to server. At close range, we saw throughputs on the 5GHz band of 339.88Mbit/s, moving up one floor we got 307.51Mbit/s while sitting on the top floor of our house, we got throughputs of 319.69Mbit/s.

That's fast, although the router doesn't match up the Netgear Nighthawk X8, which is admittedly a lot more expensive. Moving to the 2.4GHz band, we saw throughputs of 124.94Mbit/s at close range, 111.3Mbit/s on the first floor and 114.84Mbit/s on the top floor. Again, this is pretty quick.

To push the router, we started two Netflix streams from wireless clients (one 4K and one Full HD) and then re-ran the 5GHz test from the first floor. The router managed a respectable throughput of 390Mbit/s. However, switching to the second 5GHz network, performance increased to 575.94Mbit/s: this shows the power of a tri-band router.

Verdict

For a tri-band router, the TP-Link Archer C3200 is excellent value, but it is using slightly older tech. If you want to future proof with MU-MIMO and a faster Wi-Fi standard for future devices, and can deal with one 5GHz network, the Netgear Nighthawk X4S costs a similar amount of money but has a better web interface.

This review originally appeared in Computer Shopper issue 347

Verdict

A great price for a tri-band router, but the C3200 uses slightly old tech and you might want to future-proof with a different model

Wireless networking is hugely convenient, but it's lagged behind Gigabit Ethernet for speed - until now. The TP-Link Talon AD7200, bucks this trend, offering wireless performance that's nothing short of blistering. There's one simple reason for this: this is the first router to use the 802.11ad wireless standard, also known as WiGig.

Testing and max speeds

Using the 60GHz band, this router has a maximum throughput of 4,600Mbit/s. This dramatically outstrips that maximum one-way speed of Gigabit, which is 1,000Mbit/s. However, it's fair to point out that Ethernet uses duplex networking technology, which means it can transmit and receive at the same time at the maximum speed. Wi-Fi uses shared bandwidth so that 4,600Mbit/s has to be divided between transmitting and receiving. Even so, all things being equal, the Talon should be able to outstrip Gigabit Ethernet under the right conditions.

Testing this kind of router isn't easy, as you need a device with an 802.11ad wireless network card in it, and there aren't many. However, integrated chipsets for phones and laptops have recently been developed, so the number of WiGig devices is expected to explode in the future. Fortunately, for this review, TP-Link provided us with a test laptop.

Running our usual tests on the router, we saw average throughputs of 717Mbit/s - the fastest wireless speeds we've ever recorded.This was tested by measuring throughput to a server connected via Gigabit Ethernet. As mentioned, the Talon AD7200 should be faster than Gigabit Ethernet, so we were actually limiting its speed (Gigabit Ethernet usually tops out in real-world tests at around 900Mbit/s).

At a previous demo, we saw a similar test being run between two 802.11ad laptops, with nothing to limit the available speed. Under these conditions, we saw throughputs of 1,700Mbit/s. Effectively, 802.11ad can replace a wired Ethernet cable and, in some cases, exceed the speeds.

Range and performance

That's the good news. The bad news is that the 60GHz band doesn't penetrate walls at all. Moving to the room next door to the router, we got no signal whatsoever. This makes 802.11ad a room-only solution, so it's better-suited for open-plan environments, such as offices.

For regular use, the Talon AD7200 has a traditional dual-band 802.11ac Wi-Fi network (1,733Mbit/s 5GHz and 800Mbit/s 2.4GHz). Here, we saw excellent throughputs on the 5GHz band, with 540Mbit/s at close range, 532Mbit/s on the first floor and 393.77Mbit/s on the second floor. MU-MIMO support should ensure fast speeds for multiple clients when available. The 5GHz results put this router near the top of the performance benchmarks, although the tri-band Netgear Nighthawk X8 (Shopper 345) is faster.

We found that 2.4Ghz performance wasn't quite as impressive, dropping off at range: we saw 86.9Mbit/s at close range, 79.13Mbit/s on the first floor and just 58.08Mbit/s on the second floor. That's a touch disappointing, and we'd like to have seen more consistent results. It's also a shame that there's currently no band steering on this router. So, if you're using 802.11ad and move to a different room, the Talon AD7200 will not switch you to a different, longer-range band.

Setup and configuration

TP-Link has used a neat design for the Talon. Its square body contains eight antennas that flip up around the router's edge, making it easy to set up and configure. Around the back are four Gigabit Ethernet ports for wired devices, and one Gigabit Ethernet WAN port, so you'll need to plug this router into a modem to get it online. There are also two USB3 ports for basic printer and storage sharing.

Configuring the router is done through TP-Link's web-based management page. When you first connect it takes you through a wizard, getting you to set a new admin username and password, as well as configuring the wireless networks. TP-Link's interface is best described as functional. It's not particularly pretty, but all of the options are pretty much where you'd expect to find them, ranging from port forwarding and smart DNS to guest wireless networks.

There's an IGMP proxy option in the router, which we were hopeful would work with YouView's streamed channels, such as BT Sport. However, our YouView box would not connect through this router, so it appears as though it will require a firmware update.

Verdict

Hands-down the TP-Link Talon AD7200 is the fastest router that you can buy and, at 350, is not as expensive as we'd first feared. Its main problem is that 802.11ad's range is poor and there aren't enough devices. Currently, the Talon isn't a mainstream product and those seeking fast Wi-Fi for today would be better with the high-end Netgear Nighthawk X8 or well-priced TP-Link Archer C3200.

This review originally appeared in Computer Shopper issue 349

Verdict

Incredibly fast, this wireless router shows what the future of wireless is, but the lack of devices and poor range hold it back.