One box, whichever job the site needs

The appliance is what your site's traffic goes out through. It hands out addresses, resolves names, connects your internal networks to each other and to the internet, and decides which link each kind of traffic takes.

Give it more than one internet connection (fibre, 4G/5G, satellite) and it watches all of them, moves traffic off one that degrades, and brings it back when the link recovers. Links can be ranked by cost so bulk transfers ride the cheap one, and traffic can be prioritised so a video call keeps working while a backup job runs.

There is no fixed limit of two: any port can be an internet link, so an N-port appliance carries up to N − 1 of them: three on the 4-port model, six on the 7-port, leaving one port to serve the network behind it. Failover walks the whole ranked list rather than flipping between a primary and a spare, so a site with a fibre line, two mobile connections and a satellite terminal keeps working down to the last one standing.

• Failover across up to N − 1 links, not just a primary and a spare
• Cost-aware routing and traffic priority across all of them
• Addressing, name resolution and published services on the ports you nominate
• Bandwidth and topology reporting per link and per device

Choose this when the site needs reliable connectivity and you already have security handled elsewhere, or as the first stage of a rollout.

Connectivity & traffic priority

The router role, plus a guard on everything crossing the boundary. Every connection in or out is checked against a continuously-refreshed picture of who is dangerous on the internet, and the recognised-bad ones are stopped before they reach a machine.

This is also where visitors and crew are handled: a sign-in portal and time-limited vouchers put guest devices on a network that never touches your business systems. Every decision the gateway makes is recorded with its reason, which is what turns "we are protected" into something you can show an auditor.

• Known-hostile addresses, domains and scanners blocked on sight
• Guest and crew access with vouchers, kept off the business network
• A time-stamped record of every block, usable as evidence

Choose this when you want the boundary genuinely defended without running an inspection stack you have to tune.

Network protection

The spare ports become your internal network. Each one is assigned to a zone (production, office, guest, management) and traffic between zones only moves where you have said it may, and is inspected and logged when it does.

That is the part an ordinary unmanaged switch cannot do: on a flat switch every device can reach every other one, which is exactly how one compromised laptop reaches a controller. It also supports tagged networks, so it drops into an existing VLAN scheme rather than replacing it.

• Per-port zones with an enforced, recorded policy between them
• Tagged-network support, so it fits an existing VLAN design
• Continuous discovery of what is plugged in, and an alert when something new appears

Choose this when a small site would otherwise need a separate managed switch. Do not use it as a wiring-closet switch for dozens of ports: the port count is the limit and switching is done in software, so for a larger floor put a proper switch in and give the appliance the uplink. We will say which you need.

Discovery & inventory

The deepest setting. Rather than only judging where a connection is going, the appliance looks inside it: what the traffic actually is, whether it matches a known attack, whether a file crossing the wire is known malware, and whether the pattern looks like somebody mapping your defences.

For traffic that hides inside encryption, it can be set to open, inspect and reseal it on the systems you choose. Nothing is inspected until you say so, and the exclusion list (the banking, health and other destinations you decide to leave sealed) is yours to set. Anything suspicious can be opened in a throwaway isolated machine first, so you find out what a file does without it running on yours.

• Deep inspection with known-attack detection, in line and in real time
• Encrypted-traffic inspection, scoped to the systems you nominate
• Malware fingerprint checks on files crossing the boundary

Choose this when the boundary is genuinely exposed and you accept the trade: inspection costs throughput, so this is the setting we size the appliance against. It can also run behind a router you already own and are not replacing.

Threat intelligence