Cisco 871 Integrated Services Router - router ( CISCO871-K9 )

Comment: I recently bought eleven Cisco871s for remote locations and a Cisco 2901 as the termination point at my headquarters. Simple VPN configuration with everything coming back to my main site, even got a CCNP (he also has CCVP, CCIP,CCDP, CS-CIPCCES, Security+, A+) to configure them for me. I wasted two weeks of trying to get them working with the contractor before I got them working.

The money I thought I was saving over buying an easy to configure Checkpoint or Sonicwall was quickly lost on the contractor, not to mention the pain of working on them for two weeks.

I don't understand why Cisco thinks they need to make configuring a device so complicated. Plenty of other companies have figured out how to make and actual graphical interface that works. Even their fancy Cisco Configuration Professional I heard was so great is pathetic.

Comment: I was looking for a router that was a step above the typical home models that are out there. For the money this is a solid value but there are some drawbacks that you need to be aware of. First of all you need to purchase a Cisco Smartnet service contract in order to download the firmware. Second loading and configuring the firmware is not a simple task. You get unlimited phone support with your service contract, but I spent many hours on the phone getting the router set up and configured. Also, there was a bug in the latest release of their firmware so I ended up having to downgrade to the previous version. That being said, once it was up and running I have had no issues or complaints.

Comment: NOTE: This is review is also in the context of setting up a CCSP/CCNP lab.

Granted in a production environment, the plethora of integrated security features are nice, and if you have fewer than 20 systems on your network, then this little guy is exactly what you need. For a branch-office, its inline security design is ideal. Additonally it supports up to 5VPN tunnels, so admins should be able do whatever tasks are needed. However, if you plan on using this for a DMZ, I'd recommend you reconsider. This only has 128MB of DRAM, and isn't the fastest CPU either, so you -will- have latency on a heavily accessed webserver. If its an extranet for some business partners, I'm sure you can get away it, but this will NOT meet your needs for consumer traffic destined for eCommerce or email relay servers for large corporations.

As far as setting up your own Cisco lab goes, this is by far the cheapest unit to support all the IOS features that must be mastered for CCNP's ISCW, and CCSP's SND and SNRS exams. Specifically:
-CBAC
-APPFW
-DES/3DES IPSec VPN [primarly for site-to-site]
-EZ VPN
-IPS
-WebVPN
-SDM
-AAA

Additionally, it can be configured to interoperate w/ a Micro$oft CA; another plus as far as self-training goes. Not -that- common in Corporate America; however if you plan on deploying smart cards to a highly mobile IT team, it can be useful to know how to do this.

NOTE: For the tests I used IOS 12.4(9), since the exams specificaly as you about attack-drop.sdf, 128.sdf, and 256.sdf. In newer versions of the IOS, they now use v5.x of the signature files, which is completely different format and no longer uses the predefined SDF files.