11 May
2018
11 May
'18
1:32 p.m.
I agree with what Marius wrote. Those models will perform very well in a network like
that. We use a CCR1009 in our gateway for the 44.137.0.0/16 network (BGP routed on
internet)
and use it to provide VPN services to users and nodes inside the country, and to feed the
radio
network as well. The RB1100AHx4 should be equally capable of that. I would avoid the
RB3011,
should there be a tight budget or should there be a need for smaller devices at other
places
in the network it is better to use models like RB750Gr3 or the proven RB2011.
As with any router and in fact with any device connected to internet, you will have to
make
sure it runs uptodate software (software can be upgraded for free as long as the device
gets
software updates, which will be quite some time for these models) and also you have to
configure it in a reasonably secure way, e.g. make sure the management interfaces
(telnet, ssh, webfig, winbox) are only accessible for your own people and not for the
internet
at large. This can be done by restricting them to certain interfaces, subnets, individual
addresses
on internet, and/or by using a VPN for management access.
Keeping the management ports (22,23,80,8291) open on internet has proven to be a recipe
for disaster.
Rob