The Trend
The traditional model—centralized data centers with clearly defined perimeters—has been replaced by distributed, hybrid architectures spanning branch offices, remote users, IoT deployments, and cloud environments. This decentralization has elevated the role of the network edge from a simple access point to a critical control and security layer.
Encrypted traffic at the edge is now the norm rather than the perquisite, and applications demand lower latency and higher bandwidth. These changes place significant pressure on edge devices, which must now deliver more performance and functionality than ever before, while becoming smaller, more efficient, and easier to deploy.
In addition, physical constraints have not disappeared. Space, power consumption, thermal limitations, and deployment flexibility remain critical considerations—especially in small offices, retail environments, industrial sites, and remote locations.
The Challenge
Traditional edge architectures struggle to keep pace with evolving workloads where packet processing and encryption rapidly consume CPU resources, creating performance bottlenecks. While CPU overhead remains a critical part of the challenge, this is only one piece of a broader set of limitations.
Beyond performance constraints, deployment realities further complicate edge design. Many environments such as SMB offices, branch sites, retail locations, and industrial spaces impose strict physical limitations that cannot accommodate large or rack-mounted appliances.
Reliability requirements add another layer of complexity. Edge devices are frequently installed in remote or difficult-to-access locations where maintenance opportunities are limited. In these scenarios, system stability and uptime become critical, as any disruption can directly impact business operations.
This combination of performance requirements, physical constraints, and operational risk creates a persistent gap between modern network demands and what conventional edge appliances can realistically deliver, especially in compact form factors.
The Solution
Enterprise-grade Performance in a SOHO-sized Edge Device
NEXCOM DTA 1600 addresses these challenges by rethinking how performance, efficiency, and resilience are delivered at the edge. Rather than scaling up traditional architectures, it integrates hardware acceleration, optimized connectivity, and system-level resilience into a compact, fanless platform.
Comparable in size to a conventional home router (165 x134.5 x 34 mm and a weight under 800 grams), DTA 1600 fits easily into space-constrained environments. This compact footprint does not imply reduced capability.
At the core of the DTA 1600 is the MediaTek MT7988Aprocessor, built on a quad-core ARM Cortex-A73 architecture and integrating dedicated acceleration engines for networking and security workloads:
- Packet Processing Engine (PPE) provides hardware-accelerated routing, switching, and forwarding by offloading high-throughput packet handling from the main CPU.
- EIP-197 is a hardware cryptographic engine that accelerates security protocols, enabling high-throughput encryption and decryption with maximum CPU offload for network security processing.
DTA 1600 features versatile set of network interfaces, including a 10GbE SFP+ port to support high-bandwidth WAN or uplink connectivity. While 10GbE is still uncommon in compact SMB-class platforms, its inclusion addresses growing throughput requirements without increasing system footprint. Additional interfaces include one 2.5GbE RJ45 port for flexible LAN/WAN deployment, and four 1GbE RJ45 switch ports with one bypass pair for resilient local connectivity.
This configuration supports aggregated traffic flows and flexible deployment scenarios, enabling the device to function as both a gateway and a compact switching node. The inclusion of a 10GbE uplink ensures scalability as bandwidth demands grow.
DTA 1600 also integrates TPM 2.0 for hardware-based security and NEXBOOT® dual-layer OS failover to ensure system recovery at firmware and hardware levels, delivering a truly self-healing, resilient edge platform.
DTA 1600 is based on an OpenWRT SDK running on a Linux kernel, streamlining development, validation, and deployment of routing, firewall, VPN, and application-layer services, while ensuring platform openness and eliminating proprietary software lock-in for system integrators.
Performance Validation
To evaluate real-world performance, DTA 1600 was tested under multiple scenarios using open-source routing, firewall, and VPN frameworks without additional tuning or optimization. This baseline reflects deployment on NEXCOM’s ported OpenWrt kernel 5.4, where functionality is validated rather than performance fully optimized.
Final system performance will vary depending on the selected software stack, configuration, and level of optimization. With hardware-aware tuning and application-specific adjustments, ISVs and SIs can further unlock platform capabilities and achieve higher performance levels.
1. Routing Performance with and without PPE Acceleration
Routing performance was evaluated using a traffic model that simulates data flow from DTA 1600 multiple LAN interfaces (1 × 2.5GbE and 4 × 1GbE) toward a single 10GbE WAN uplink. This setup reflects a common edge gateway scenario where aggregated internal traffic is forwarded to higher-speed upstream connectivity.
The evaluation focused on the impact of the Packet Processing Engine(PPE), which is responsible for hardware-level offloading of routing and switching tasks.
Routing Performance with PPE Acceleration Test Results
/table
!Packet Length | PPE Activate | = | = | PPE Deactivate | = | =
!^ | Throughput (Gbps) | PPS (Mpps) | CPU Utilization (%) | Throughput (Gbps) | PPS (Mpps) | CPU Utilization (%)
64B | 2.857 | 5.58 | 0.12 | 2.890 | 5.64 | 83.33
512B | 6.124 | 1.5 | 0.12 | 5.775 | 1.41 | 83.63
1500B | 6.124 | 0.51 | 0.12 | 5.711 | 0.48 | 99.75
/endtable
For 64B small-packet workloads, enabling PPE reduces CPU utilization from 83.33% to 0.12%, effectively offloading routing tasks to dedicated hardware and minimizing processing overhead. Under large packet conditions(512B and 1500B), DTA 1600 is able to process up to 6.124 Gbps with PPE enabled at just 0.12% CPU usage, whereas disabling PPE maintains a comparable throughput of approximately 5.7x Gbps, but at the cost of a significantly higher CPU utilization (83.63%~99.75%).
Achieved results prove DTA 1600 ability to preserve routing efficiency under both small- and large-packet conditions, ensuring CPU resources remain available for other applications.
2. Firewall Performance and Rule Scaling Behavior
To provide a comprehensive view of firewall performance, both single-port and multi-port scenarios were evaluated using firewall rulesets ranging from 0 to 5000 entries to simulate increasing policy complexity. This range reflects real-world deployment scenarios, from simple configurations to large-scale rule bases.
The single-port test isolates per-interface performance, allowing clear observation of how rule complexity impacts throughput without the added variable of traffic concurrency. This scenario represents use cases such as a dedicated WAN-to-LAN firewall path or controlled traffic environments.
The multi-port test introduces concurrent traffic flows across multiple interfaces, more closely reflecting real-world deployments, where the system must process packets from multiple paths in parallel, increasing CPU load and stressing internal packet handling mechanisms.
Single- and Multi-port Firewall Throughput Test Results
/table
!Rule number | Single-port (1 x 2.5GbE RJ45) | Multi-port (1 x 2.5GbE + 4 x 1GbE RJ45)
0 | 2.34 Gbits/sec | 5.85 Gbits/sec
1000 | 2.34 Gbits/sec | 5.44 Gbits/sec
3000 | 2.34 Gbits/sec | 3.88 Gbits/sec
5000 | 2.21 Gbits/sec | 2.67 Gbits/sec
/endtable
Single-port test results show 2.34 Gbps throughput for0–3000 firewall rules and 2.21 Gbps at 5000 rules, indicating that single-stream processing remains relatively stable even as policy evaluation load increases. In the multi-port test scenario, throughput measured 5.85 Gbps at 0 rules, decreasing progressively to 5.44 Gbps at 1000 rules, 3.88 Gbps at3000 rules, and 2.67 Gbps at 5000 rules.
DTA 1600 maintains stable single-port firewall performance under increasing rule complexity, while multi-port throughput scales according to concurrent traffic load and policy evaluation demands across multiple interfaces.
3. IPSec VPN Throughput Performance
IPSec VPN performance was evaluated in two operational modes—transport mode and tunnel mode—to reflect both intra-site and inter-site secure communication scenarios. Both tests were conducted using AES256-GCM16 encryption.
Transport mode represents a host-to-host secure connection, typically used when two servers communicate within the same local network but requireprotection against internal traffic interception or sniffing.
Tunnel mode represents a full LAN-to-LAN or remote access VPN scenario, where entire IP packets are encapsulated to secure communication between geographically separated networks such as headquarters and branch offices.
The results clearly demonstrate the impact of hardware acceleration via the EIP-197 cryptographic engine. In transport mode, enabling increasing throughput to 1.65Gbps, approximately 7x higher than the 239 Mbps when the engine was disabled. In tunnel mode, throughput reached 1.27Gbps with acceleration enabled, compared to 213.8 Mbps without it.
IPSec VPN Transport & Tunnel Mode Test Results
/table
!Packet Length | Transport Mode | = | Tunnel Mode | =
!^ | EIP-197 Engine Active | EIP-197 Engine Deactivate | EIP-197 Engine Active | EIP-197 Engine Deactivate
64B | 455 Mbits/sec | 175 Mbits/sec | 243.1 Mbits/sec | 238.8 Mbits/sec
512B | 1.60 Gbits/sec | 233 Mbits/sec | 1.148 Gbits/sec | 240 Mbits/sec
1500B | 1.65 Gbits/sec | 239 Mbits/sec | 1.27 Gbits/sec | 213.8 Mbits/sec
/endtable
DTA 1600 leverages build-in EIP-197 hardware cryptographic engine to offload encryption workloads from the CPU, enabling sustained high VPN throughput under increasing traffic loads while preserving processing capacity for other security tasks.
Conclusion
For ISVs and system integrators targeting SMB and SOHO deployments, DTA 1600 is accelerating time-to-market for diverse edge security and networking requirements. Its compact form factor with a 10GbE SFP+ interface extends edge bandwidth capabilities, while SDK support enables faster integration and customization.
Performed tests proves that compact form factors and enterprise-grade performance are not mutually exclusive. By combining hardware acceleration, optimized connectivity, and system-level resilience, DTA 1600 delivers a balanced solution for modern edge environments and efficiency, measured in throughput per watt, per size, and per cost.
NEXCOM completed OpenWrt OS kernel 5.4 and 6.6 bring-up for baseline system performance index. It provides a ready platform for DevOps teams to evaluate the appliance in operation and serves as a foundation for porting and optimizing application workloads.
References:
