Cisco delivers service-stuffed routers

Not that long ago, a small-office router handling a single T1 was more or less fully consumed by that task. Throwing more features into the software to support services such as VoIP or firewalling just wasn’t practical, given the cost of CPU and RAM available for the smaller units.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Now, the converse is true: SOBO (small office/branch office) routers have plenty of horsepower to spare. As the availability of high-power embedded platforms grows, the prices drop, and the headroom provided by the new platforms enables manufacturers to bring together into a single solid-state unit services that used to require several devices and possibly a few servers. Cisco’s new line of access routers, dubbed ISRs (Integrated Services Routers), fits this bill nicely.

In the lab
I evaluated two examples from Cisco’s ISR series: the 1811W and 2811. The 1811W is a fixed-configuration router designed almost exclusively for the small office. It offers DSL or Ethernet handoff, firewalling, VPN tunneling, integrated wireless capabilities, integrated Ethernet switching, and even optional PoE (Power over Ethernet) switch ports for VoIP phones.

My 1811W evaluation unit came with a Wi-Fi AP (access point), two antennas, and an eight-port 10/100 Ethernet switch with PoE capabilities when paired with a single outboard brick-style power supply, an integrated 56K modem, two USB ports, and two dedicated 10/100 Ethernet interfaces.

The 2811 expands on this concept by providing most of the above, except the AP, in a modular 1U chassis and adding eight switch ports, embedded VoIP call-handling capabilities, voice mail, and as many as 16 FXS/FXO ports. With four WIC (WAN interface card) slots and a single NM (network module) slot in the rear, my 2811 evaluation unit came with a 16-port 10/100 PoE blade containing a single Gigabit Ethernet port; a two-port FXO (foreign exchange office) card for POTS connections; and two built-in 10/100 Ethernet ports.

Both routers run Cisco IOS (Internetwork Operating System), providing the familiar CLI and borrowing against over 20 years of development. Cisco has a habit of providing a management GUI and configuration tools only at a premium, but in this case, the company tacked them on as part of the package. The 1811W comes complete with a Java-based management application launched from a Web session to the router itself. Nearly all the configuration options available to this router are also available through this interface, with a few notable additions.

The SDM (Security Device Manager) GUI is subject to the vagaries of incompatible JREs (Java Runtime Engines). I had a hard time firing it up on a Linux workstation running JRE 1.5, but it worked well on a Mac PowerBook and a Windows XP workstation running JRE 1.4 flavors.

The SDM GUI is somewhat reminiscent of the Cisco PIX PDM (PIX Device Manager), with a relatively well-laid-out, frames-based config dialog. All the basic configuration elements are there, from basic interface addressing options to VPN configuration. In addition, there are several extensions available, such as a built-in security-reporting tool that will evaluate the router configuration and make recommendations on changes that can improve security. Also available are network utilization reports. For most single-office uses, this GUI will be all that’s needed; they won’t need to mess with the CLI at all.

Phoning it in
The 2811 comes with the Web-based Cisco Unity Express manager, which gives users a graphical interface for managing and configuring their phone access. This model also comes with an optional, completely self-contained version of CME (CallManager Express), a subset of Cisco’s flagship CallManager VoIP platform.

I ran into a few problems with the CME management GUI. Unless you configure the CME with its Web application from the start, it’s unlikely to function correctly. Although the CLI-based configuration on the router might be perfectly functional, the CME Web interface wouldn’t load properly until I had reset the configuration to defaults and started fresh.

For my testing, I configured the 2811, along with a few Cisco IP phones, to support several VoIP extensions, incoming hunt groups, voice mail, and voice-assisted call routing. Armed with the right interfaces, this router can also act as a Wi-Fi AP, while handling up to 30 simultaneous digital calls, a maximum of 24 users, and 50 voice mail boxes. All in all, a pretty nice trick for a router.

In the real world
The upside to the ISR plan is that you get all these features at an attractive price. With fewer devices in your network closet, you have fewer management- and support-contract costs.

The downside is that a low-level device failure, such as a blown power supply, can render everything offline, from the phones to the network. Another concern is that inadequate security provisions on such an integral device can result in an attacker gaining complete control over the entire office infrastructure in one fell swoop. Furthermore, the Wi-Fi support in the 1811W may actually be viewed as a detriment as it’s impossible to physically disable this feature. The surreptitious enabling of Wi-Fi access could be a problem that goes undetected for quite a while.

These caveats aside, the ISR concept is well represented by the 1811W and the 2811 routers, and the trend is far from a fad; it’s the next step in network infrastructure evolution.