DrayTek Vigor3912 Series Broadband Router

The Vigor3912 series Multi-WAN routers are high-performance enterprise-level broadband routers with 2 x 10Gb SFP+ Fibre configurable WAN/LAN slots, 2 x 2.5GbE configurable WAN/LAN ports, 4 x 1GbE configurable WAN/LAN ports, and 4 x 1GbE fixed LAN ports with 15.6 Gbps max. NAT throughput and Software Acceleration (bi-directional), 1,000k NAT sessions and other enterprise-level features. With the capacity to handle up to 500 VPN tunnels including 200 OpenVPN /SSL-VPN tunnels, and 100 IP subnets simultaneously, Vigor3912 routers are an excellent solution for network applications in corporations, organisations and governments.

The session-based Load Balance feature allows the aggregation of multiple WAN connections to provide a higher speed internet connection. In addition to the Load Balance and Failover multi-WAN functions, the Vigor3912 supports High Availability (Common Address Redundancy Protocol) with hardware redundancy to ensure 24/7 system uptime for all WAN interfaces.

The Central Management feature provides a centralised console to manage your network. It includes AP Management to configure and manage up to 50 DrayTek Access Points, and Switch Management to configure and manage up to 30 DrayTek VigorSwitches.

The Vigor3912S model comes equipped with a 256GB SSD which supports Linux with Docker applications such as Suricata IDS and VigorConnect. Together with this router’s capacity, these powerful applications eliminate the need for additional servers, enforcing security options at the door.

The Vigor3912S model comes equipped with a 256GB SSD pre-installed with Ubuntu OS and Docker applications such as Suricata IDS and VigorConnect to enhance network security:

The Vigor3912S router supports Docker applications such as VigorConnect directly on the device. This capability simplifies network management by allowing VigorConnect to monitor DrayTek devices without requiring an additional computer. The installation process is straightforward and can be completed through the router’s web user interface (WUI) with just a few clicks. This feature provides a convenient and efficient solution for network administrators to oversee and manage their network infrastructure.

A popular open-source threat detection application for detecting and preventing a wide range of network threats.

The Vigor3912S is pre-installed with the Linux-based application Suricata, an open-source threat detection system that supports more than 60,000 rules, including 6,000+ CVE (Common Vulnerabilities and Exposures) rules, and it can detect and prevent a wide range of network threats, such as malware, network intrusions, denial-of-service attacks and data breaches.

Suricata, an intrusion detection system (IDS), monitors LAN and WAN traffic through the router. A log is generated if any unusual activity is detected, which can be sent to the network administrator via the router’s Web Notification function.

Blocking can be achieved with the “Smart Action” feature in the router.

This feature monitors network traffic and detect malicious activity in real time. Suricata works by analysing packets and comparing them to a set of rules to determine whether the traffic is legitimate. If it detects suspicious activity, it can raise an alarm. Suricata is highly customisable and can monitor many network environments, from small homes to large enterprise networks.

Statistical Graph

Suricata Statistical Graph presents the timing and frequency of threats. When the mouse hovers over the point representing the most frequent threat, a small menu will pop up to display the number of occurrences of that threat. Additionally, a click on the item will display more details that are crucial for security enhancement.

Smart Action allows predefined events to trigger predefined actions. Vigor users can pre-configure up to 64 event-to-action profiles. Actions, such as sending alerts, emails, removing a VPN profile, etc., can be programmed for events such as network conditions, occurrence counts, etc., associated with specified time and date.

– Event → Action: A predefined event triggers the predefined action.

– Web Notification.

– Log Keyword Match (syslog log, console log, Suricata log).

NAT throughput (1.9x times faster)

IPSec throughput
(2.1 times faster)

SSL-VPN throughput
(2.9 times faster)

Wireguard throughput
(3.2 times faster)

**bi-directional(TX+RX) performance

Enhance overall network performance with optimised data packet processing and forwarding. This feature improves network efficiency by improving transmission speed, and enhances user experience by minimising network latency, making it ideal for real-time applications such as large file transfers and voice calls.

High Performance with 10Gb SFP+

For both NAT and routing network, and for both 10Gb-WAN and 10Gb-LAN, Vigor3912 is ready to deliver high throughput to your business.

Layer 3 Routing with BGP and OSPF

With the most popular Exterior and Interior Gateway Protocols, Vigor3912 is ideal for ISP deployment.

Layer 2 Security with PPPoE Server and VLAN

With 200 PPPoE user accounts and 100 VLAN/LAN subnets, the Vigor3912 provides 15.6 Gbps (bi-directional; TX+RX) NAT throughput, making network infrastructure segmentation secure and easy.

12 Ports in total

8 ports from a total of 12 ports, can be configured as either a LAN port or a WAN interface. For example, the following port options are achievable:

• 8 x WAN interfaces and 4 x LAN Ports or
• 1 x WAN interface and 11 LAN Ports

VPN from LAN

This feature offers a more secure method for connecting to servers by restricting LAN clients’ access to LAN servers through a VPN only. This ensures that data transmission between LAN clients and servers is encrypted, protecting critical data and enhancing overall security.

VPN User Isolation

Activating a VPN connection to access a company’s internet for work has become a common routine for many employees.

Teleworkers need to connect to the company’s servers through VPN connections. However, it is often unnecessary for VPN users to access each other, which may pose security risks. By enabling the “Isolate VPN Users from each other” option, you can ensure that each VPN user is isolated and the VPN network is more secure.

2FA with AD/LDAP Server

Enhance the security of remote dial-in VPN connections with two-factor authentication integrated with AD/LDAP servers. DrayTek offers various authentication methods, including TOTP, email, SMS, and URL links. This approach not only adds an extra layer of security but also helps reduce costs associated with SMS messages and official authentication system license fees.

Packet Capture Tool for VPN Tunnel

By either mirroring all packets to a designated LAN port or VPN connection, whether LAN to LAN profiles or remote Dial-in users, or even downloading PCAP files via WUI remotely, spotting an issue is easier than ever.

For organisations that host multiple servers in their network, a policy of server load balance can be configured, such that the router can distribute the inbound NAT sessions evenly for the servers based on the configured load balance weight. This will avoid excessive load on a single server, prevent server failure due to overloading, and optimise resource usage.

The Port Redirection function is often used to allow internal servers to be accessible from the Internet. However, the opened ports present security threats as these can be scanned by hackers and malware. Vigor3912 series employs Port Knocking, a technology that adds an extra layer of protection to internal servers by allowing only users with a matching password to open the port and be connected to the server, effectively closing the door for unauthorised accesses.

Auto-Discovery

Automatically discover LAN subnets and add detected VigorSwitches/APs into the managed list.

Provisioning

Most-frequently used settings can be pre-defined on the Vigor Router, which can then be provisioned to the managed VigorSwitch/AP.

Monitoring

Vigor Routers provide a centralised view of managed devices so you can always check if the managed Vigor Switch/AP is online.

System Maintenance

Support basic maintenance remotely via Vigor Router, such as remote reboot, factory reset, configuration backup/restore.