PLANET XVR-800: Enterprise Dual 10G VPN Security Router with ML-KEM

PLANET XVR-800 – Enterprise Dual 10G VPN Security Router with 4-Port 10/100/1000T

Overview

The XVR-800 acts as a central gateway between the local network and one or two upstream links. Both 10G ports – copper and fiber – can be configured as WAN or LAN in software, so administrators can adapt the port layout to the site rather than to the hardware. The SFP+ slot accepts a wide range of transceivers, supporting multi-mode fiber from 550 m to 2 km and single-mode or WDM fiber up to 120 km, which allows the router to uplink directly to a backbone switch or monitoring center over long distances.

On the security side, the router pairs a stateful packet inspection (SPI) firewall and DoS/DDoS mitigation with Secure Boot, a built-in Hardware TRNG and ML-KEM for hybrid key exchange in TLS.

Hardware and Interfaces

The XVR-800 provides four 10/100/1000BASE-T RJ45 LAN ports (Ports 1–4), one 1G/2.5G/5G/10GBASE-T RJ45 port (Port 5) and one 1G/2.5G/10GBASE-X SFP+ slot (Port 6). Ports 5 and 6 can each operate in WAN or LAN mode through software configuration. A USB 2.0 port handles configuration backup and restoration, and a reset button returns the unit to factory defaults.

The router ships in a metal 1U enclosure measuring 330.2 × 200 × 43.1 mm and weighing 1725 g. It can be placed on a desktop or mounted in a rack. Power is supplied by an auto-sensing 100–240V AC input at 50/60 Hz, with consumption ranging from about 3.3 W at idle to 11 W under full load. The device operates from 0 to 50 °C at 5–95% non-condensing humidity, and carries CE and FCC compliance.

Dual-WAN Resilience and Flexible 10G Uplink

XVR-800 dual-WAN topology

With one copper and one fiber WAN interface, the XVR-800 maintains Internet connectivity through automatic failover. Administrators set the WAN priority, and when the primary link goes down the secondary interface takes over so that mission-critical services stay online. Weighted outbound load balancing distributes traffic across both links to make fuller use of available bandwidth.

Because the SFP+ slot supports transceivers for FTTx and long-distance runs, the router can be adapted to the site's distance requirements – from short multi-mode links up to 120 km single-mode or WDM spans. PLANET's SD-WAN function adds application-aware optimization across multiple WAN links, which helps improve performance and reduce operating cost for distributed sites.

Security: Secure Boot, Hardware TRNG and ML-KEM

XVR-800 threat defense

A Secure Boot mechanism verifies that only authenticated firmware runs at startup, blocking tampered or unauthorized images at the system level. A built-in Hardware TRNG (True Random Number Generator) supplies high-entropy material for cryptographic key generation. In addition, the XVR-800 supports hybrid key exchange in TLS using ML-KEM (Kyber). This combines traditional and post-quantum key exchange methods to strengthen the long-term protection of encrypted sessions against future quantum computing threats.

For everyday network protection, the SPI firewall inspects traffic state, while DoS/DDoS mitigation blocks SYN and ICMP flooding. Content filtering covers MAC, IP and web rules, and NAT ALGs support SIP, RTSP, FTP, H.323 and TFTP. Virtual server and DMZ functions let internal servers publish services to Internet users without exposing the wider network.

Comprehensive VPN Suite and Throughput

XVR-800 VPN connectivity

The XVR-800 carries a broad VPN stack: IPSec (Net-to-Net and Host-to-Net) with an IPSec Remote Server, GRE, PPTP Server, L2TP Server, SSL Server/Client (OpenVPN, compatible with services such as Surfshark, NordVPN and PureVPN) and WireGuard Server/Client. Encryption options include DES, 3DES and AES up to AES-256, with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 authentication. This range lets a single device serve site-to-site tunnels, remote workers and lightweight high-speed connections from the same platform.

According to the specification, tunnel capacity reaches 16 IPSec, 5 GRE, 100 PPTP and up to 200 SSL VPN tunnels. WireGuard provides the highest published VPN throughput over the 10G interface, followed by IPSec/AES128 and IPSec/AES256. The table below lists the throughput ranges published by PLANET.

Integrated Wi-Fi and Network Management

XVR-800 integrated AP Controller

The router integrates an AP Controller, Captive Portal, RADIUS authentication and a DHCP server, so administrators can roll out secure employee and guest Wi-Fi without adding external servers. Through the web interface, PLANET Smart APs are managed centrally: SSIDs, radio settings and security policies are configured in a short four-step process, and profiles can be pushed to multiple APs or groups at once. APs of the same model can be clustered for unified management, bulk provisioning and firmware upgrades from a single control point.

Routing covers static routes, RIPv1/v2 and OSPFv2, and a NAT-disable option lets the device run in pure routing mode for end-to-end IP transparency in backbone or data-center scenarios. The XVR-800 is managed over a web browser, SSHv2, TLSv1.3 and SNMP v1/v2c/v3, and integrates with PLANET's Smart Discovery utility, UNI-NMS, NMS System and the CloudNMS app for centralized monitoring. An SFP-DDM function reports real-time transceiver parameters such as optical power, temperature, bias current and supply voltage.

Deployment Scenarios