TP-Link TL-ER7206 Multi-WAN VPN Firewall Review

The TP-Link TL-ER7206 is the better model from the SafeStream Gigabit Multi-WAN series and it was designed to act as the security gateway to an Omada system. So, it’s very similar to the Zyxel USG Flex 100 and probably closer in functionality to the Ubiquiti ER-X, especially since it has a multitude of WAN ports available.

Indeed, the TP-Link TL-ER7206 supports up to 4 WAN connections, three Ethernet ports and even an SFP WAN port (module) that you can use in case you have fiber wiring available. Furthermore, the device will also work as a reliable VPN router, offering up to 100 LAN to LAN IPsec connections, 50 OpenVPN, 50 L2TP and 50 PPTP VPN connections. And there’s also the support for the Omada SDN which I have seen in action a few times with some wireless access points and Ethernet switches.

But, besides seeing how well it integrates with other Omada devices, there is one particular reason why I chose to check out the TP-Link TL-ER7206. I have been waiting for a replacement for the Cisco RV340 which has reached EOL and the security support will end in October this year, but Cisco seems to have moved away completely from this affordable series (for now, at least).

That is, unless you want to go the enterprise route and use the Cisco ISR 1000. For those that don’t, the TP-Link TL-ER7206 may just be what they were waiting for. And let’s not forget that TP-Link has been throwing punches towards Ubiquiti as well, offering a very similar software experience to the UniFi. So, without further ado, let’s check out the TP-Link TL-ER7206 multi-WAN VPN router.

Design and Build Quality

The TP-Link TL-ER7206 follows the design of most firewall gateways out there (with the exception of the wavy DrayTek Vigor2926), so expect a rectangular case entirely made of metal, including the front side. The case is covered by a black matte finish and it measures 8.9 x 5.2 x 1.4 inches (22.6 x 13.1 x 3.5 cm), so it’s fairly compact, but the downside is that you can’t really mount the router in a rack, unless you decide to use a tray.

It’s not really the ideal solution, but TP-Link surely made available the possibility to mount the TL-ER7206 on the wall, right? No, you only get four silicone feet to keep the firewall router on your desk, which is unfortunate.

As for ventilation, the TP-Link TL-ER7206 is surprisingly conservative, having only a few holes on the sides and nothing more. So, does it heat up? I have used the AGM Glory Pro to see the temperature of the router while I was running some tests and, as you can see it gets warm, but doesn’t display any signs of overheating.
And it doesn’t really surprise me considering that there is no PoE output built into the TP-Link TL-ER7206 (you will need to use a separate Ethernet switch to connect your PoE access points). This takes us to the ports section.

From the right, there’s the recessed Reset button (to return the device to its factory settings), followed by five Ethernet ports. The first is separate and it’s a Gigabit WAN port, then, there are two WAN/LAN ports which, as the name suggests can function in either manner; lastly, there are two other LAN-only Gigabit ports. Moving further to the left, you’ll see the Gigabit SFP slot which is covered by a protective plastic piece (would have preferred silicone) and next to it, there is a SFP WAN LED.

If it’s flashing, then there is activity, otherwise, the LED will stay solid green and the same is true foe each LED that’s positioned at the top of the Ethernet ports. The last two LEDs will show the status of the Power and the System (if it’s flashing, then it works fine, otherwise, it means that it has encountered an issue that needs to be investigated).

If there would be a minus, it’s that there is no USB port to allow for one more WAN interface using a 3G/4G dongle. Turning the TP-Link TL-ER7206 on the other side, you’ll see the Kensington lock slot, followed by the grounding screw and the three-pin power connector – don’t worry, the PSU is internal.

Internal Hardware (TP-Link TL-ER7206 Teardown)

There are no particular impediments to opening the case since all you have to do is to remove the three screws from the rear side and slide the top cover out. So, no warranty seals or any other annoying attempt at self repair discouragement.

But, after having a look at the board I noticed that TP-Link used that annoying glue paste thing for the heatsink of one chip and it soldered the heatsink of another. This makes me think that it wasn’t really a cost-effective solution, it’s to keep prying eyes out. And it works because most would have no idea how to remove these safely. Unfortunately, neither did I because not only was the main chip soldered, it was also glued with that dreaded paste.

The good news is that I did remove the smaller heatsink, revealing a RTL8367S LQFP-128, high-performance 10/100/1000M Ethernet switch. I could also identify the 512MB of RAM (2X Samsung SEC 204 K4B2G16) and 128MB of flash storage from ESMT (F59L1G81MB). I also decided to check out the FCC ID website with the hope that I may yet see the CPU, but this device doesn’t seem to be on that website.

What I could gather is that it’s a 64-bit dual-core CPU with the clock at 880MHz, which is not that impressive. As expected, the TP-Link TL-ER7206 does not have any WiFi capabilities, so you will need to use additional wireless access points. For example, I did recently tested the EAP660 HD which worked great with Omada – you may also need a PoE switch, such as the TP-Link TL-SG2210P.

Note: I need to mention that the model that I got is v1.0 and there is a v1.6 which may suggest that it has different components. But, this is not the case because it seems to only indicate that the TP-Link TL-ER7206 was built in a different facility, everything else is the same.

The Standalone Mode

Even if the TP-Link TL-ER7206 is advertised as an Omada gateway, it’s going to work just fine in standalone mode as well. And the quickest way to access the interface is by connecting the router to your PC and entering 192.168.0.1 in the URL bar. Immediately, you’ll be asked to create a new admin account (don’t use admin as the username) and that’s about it, you’ll be able to access the GUI.

Since there was no Internet access, I connected an Ethernet cable from my modem to the main WAN port and then I went to Network > WAN > WAN, chose PPPoE as the Connection Type and entered the ISP credentials. I clicked on Save and Connect to gain access to the Internet. The GUI doesn’t feel crowded and you don’t get dozens of options thrown at your face.

And that’s not because the TP-Link TL-ER7206 is lacking any important feature, it just has a good layout. As a quick overview, you can enable additional WAN ports under Network, as well as configure the Ports behavior (Port Mirroring, Rate Control and Flow Control). I noticed that TP-Link put the VPN IP Pool list under Preferences, but the most interesting features can be found under Transmission.

Here, you can configure the NAT-related features (One-to-One NAT, Virtual Servers, NAT-DMZ, ALG and Port Triggering), the Bandwidth Control, the Routing settings (Static Route and Policy Routing) and the Load Balancing which includes Link Backup and Online Detection. The Firewall offers Anti ARP Spoofing, Attack Defense and Access Control, there’s also Behavior Control with Web Filtering and Security, and then, we get access to VPN.

Pages: 1 2