Selection & Interfaces

5.1 Core Product Introduction

Router selection for security-focused deployments must consider not only throughput and port density, but also the breadth and depth of security feature support. Key security-relevant capabilities include hardware-accelerated ACL and uRPF processing, CoPP/CPP support with per-class rate limiting, routing protocol authentication (MD5, SHA-256, TCP-AO), management plane isolation (dedicated management VRF, OOB port), AAA integration (TACACS+, RADIUS), secure boot and image verification, and NETCONF/YANG or REST API support for automated compliance checking.

The three product tiers shown below represent the typical selection range for enterprise and service provider deployments. Branch routers provide essential security features in a compact, cost-effective form factor suitable for ZTP deployment. Edge routers provide full security feature sets with hardware-accelerated processing suitable for high-throughput WAN and DC edge deployments. Service provider chassis routers provide carrier-grade scale, redundancy, and feature depth for the most demanding environments.

Figure 5.1: Core Product Introduction — Branch Router, Edge Router, and Service Provider Chassis Router

5.2 Interface Logic & Port Assignment

Proper interface assignment is a foundational security control: each interface must be assigned to the correct VRF, have the appropriate security policy applied, and be documented with its logical role. The interface logic diagram below shows the physical front panel layout, the logical interface assignment table, and the VRF topology with routing boundaries. This three-layer view enables engineers to understand both the physical reality and the logical security model simultaneously.

The VRF topology shows three routing domains: PROD-VRF for production traffic, MGMT-VRF for management traffic, and PARTNER-VRF for partner/extranet traffic. Route leaking between VRFs is strictly controlled via MP-BGP with explicit import/export policies, ensuring that only specifically permitted routes cross VRF boundaries.

Figure 5.2: Interface Logic & Port Assignment — Physical Panel, Logical Table, and VRF Topology

Interface Security Policy Matrix

5.3 Core Product Feature Table

The following comprehensive feature table covers all security-relevant capabilities across the three product tiers, organized by functional category. This table serves as the primary reference for procurement specifications and acceptance testing criteria. Each feature is rated as Supported (full hardware implementation), Partial (software implementation or limited scale), or Not Supported.