Best Site-to-Site VPN Router for Business

Site-to-Site VPN: The Foundation of Multi-Site Connectivity

A site-to-site VPN (or site-to-site IPsec VPN) is a permanent encrypted tunnel between two network devices (firewalls or routers) located at different geographic sites. Traffic between the two sites is encrypted using AES-256 and authenticated—an observer on the Internet sees only encrypted ESP packets, not their content. It is a cost-effective alternative to MPLS: an IPsec VPN over the Internet costs approximately the price of the fiber connection (~€60/month), compared with approximately €800/month for an equivalent MPLS link.

In 2026, site-to-site VPNs are used by 85% of French multi-site businesses. Even businesses with MPLS add a backup IPsec VPN over the Internet for redundancy. With SD-WAN, IPsec tunnels have also become the primary transport overlay supporting application policies.

Criteria for Choosing a VPN Router

Real-World IPsec Throughput: The Metric That Matters

The IPsec VPN throughput stated in datasheets varies considerably depending on the encryption method, packet size, and hardware. Always compare performance using AES-256-GCM and IMIX traffic (a realistic mix of packet sizes). Marketing figures for 'IPsec throughput' are measured using AES-128 with 1400-byte packets and are not representative of real-world performance.

• FortiGate 60F: 6.5 Gbps IPsec (AES-256-GCM, accelerated by the NP6 ASIC). The best price-to-throughput ratio on the market.
• FortiGate 100F: 11.5 Gbps IPsec. Designed for multi-site VPN hubs.
• FortiGate 200F: 27 Gbps IPsec. Designed for central VPN concentrators.
• Cisco ISR 4321: 250 Mbps IPsec (x86 CPU, no ASIC). Sufficient for small branches.
• Cisco Catalyst 8200: 1 Gbps IPsec. Designed for SD-WAN branches.
• Cisco ASR 1001-X: 5 Gbps IPsec. Designed for enterprise VPN aggregation.
• Juniper SRX300: 300 Mbps IPsec. Designed for SMBs and basic branch deployments.
• Juniper SRX1500: 4.5 Gbps IPsec. Designed for mid-range data centers.

IKEv2: The Only Protocol to Use in 2026

IKEv1 is obsolete—it has known vulnerabilities and lacks native EAP and MOBIKE support. IKEv2 (RFC 7296) is the standard: it provides faster negotiation (2 exchanges vs 6 for IKEv1), native NAT-T support, EAP support for authentication, and MOBIKE for mobility and transparent WAN failover.

• Recommended algorithms for 2026: AES-256-GCM (combined encryption and integrity), SHA-384 (IKE integrity), and DH group 19 or 20 (ECC P-256/P-384). This is sometimes referred to as 'Suite B' or 'Next Generation Encryption'.
• Always avoid DES, 3DES, MD5, SHA-1, and DH group 1/2/5. These algorithms have been broken or weakened.
• PFS (Perfect Forward Secrecy): always enable it with DH group 19. It ensures that compromising one key cannot be used to decrypt past sessions.

FortiGate: The Leader in IPsec VPNs

FortiGate dominates the site-to-site VPN market for a simple reason: the NP7/NP6 ASIC provides hardware acceleration for IPsec. A FortiGate 60F priced at ~€700 delivers 6.5 Gbps of IPsec throughput, while a Cisco ISR 4321 priced at ~€2,500 is limited to 250 Mbps. At an equivalent budget, the ratio is 26× in FortiGate's favor.

• FortiGate 60F (FG-60F): 6.5 Gbps IPsec. 200 site-to-site tunnels. Designed for SMB hubs supporting 5-20 sites. OPTINOC price: ~€700 excluding tax.
• FortiGate 100F (FG-100F): 11.5 Gbps IPsec. 2000 tunnels. Designed for mid-market hubs supporting 20-100 sites. Price: ~€2,800 excluding tax.
• FortiGate 200F (FG-200F): 27 Gbps IPsec. 10000 tunnels. Designed for data center VPN concentrators. Price: ~€5,500 excluding tax.
• Sample configuration: VPN → IPsec → Create New → Site to Site. Phase 1: IKEv2, AES-256-GCM, SHA384, DH19, PSK or certificate. Phase 2: selectors (subnets), AES-256-GCM, PFS DH19.
• FortiManager centralizes multi-site VPN management. It provides tunnel templates, status monitoring, and alerts when a tunnel goes down. It is essential for deployments with 10 or more sites.

Cisco ISR / Catalyst 8000: The Enterprise Alternative

Cisco remains the preferred choice for businesses with in-house CCNP expertise and advanced routing requirements (BGP, MPLS, and Segment Routing). Cisco IPsec VPNs are robust, but throughput is limited by the x86 CPU architecture, with no dedicated IPsec ASIC except on the ASR platform.

• ISR 4321 (ISR4321/K9): 250 Mbps IPsec. 2 GbE WAN ports + 2 GbE LAN ports. Designed for small, straightforward branch deployments. OPTINOC price: ~€2,200 excluding tax.
• Catalyst 8200 (C8200-1N-4T): 1 Gbps IPsec. Compatible with Viptela SD-WAN. Designed for enterprise branches. Price: ~€3,000 excluding tax.
• ASR 1001-X: 5 Gbps IPsec. Designed for enterprise VPN aggregation. Price: ~€8,000 excluding tax.
• Configuration: crypto ikev2 proposal → encryption aes-gcm-256 / integrity sha384 / group 19. crypto ikev2 keyring → peer SITE-B / address X.X.X.X / pre-shared-key.

Juniper SRX: VPN with Junos Routing

The SRX combines firewall, VPN, and advanced routing capabilities under Junos OS. Its advantage is that Junos provides the most expressive configuration model when advanced BGP/OSPF functionality is required within the VPN tunnel, including redistribution and route leaking between VRFs. Its drawback is modest IPsec throughput compared with FortiGate due to its CPU architecture and lack of a dedicated ASIC.

• SRX300: 300 Mbps IPsec. Designed for SMB and branch deployments. OPTINOC price: ~€1,200 excluding tax.
• SRX320: 300 Mbps IPsec + 8 integrated PoE ports. Designed for branches with APs and phones. Price: ~€1,500 excluding tax.
• SRX1500: 4.5 Gbps IPsec. Designed for mid-range data centers. Price: ~€8,000 excluding tax.
• Junos configuration: set security ike proposal P1 authentication-method pre-shared-keys / dh-group group19 / encryption-algorithm aes-256-gcm.

Multi-Site Sizing

• 5-10 sites (SMB): 1 FortiGate 60F as the central hub + 1 FortiGate 40F per remote site. Hub-and-spoke IPsec VPN. Budget: ~€3,000-5,000 excluding tax in total.
• 10-50 sites (mid-market): 1 FortiGate 100F hub + 1 FortiGate 60F per site. FortiManager VM for orchestration. Budget: ~€25,000-50,000 excluding tax.
• 50-200 sites (large enterprise): 2× FortiGate 200F in an HA hub configuration + FortiGate 60F-100F at each site. FortiManager + FortiAnalyzer. Consider SD-WAN instead of a basic VPN. Budget: ~€100K-200K excluding tax.
• 200+ sites: Fortinet SD-WAN or Cisco Viptela—a standalone site-to-site VPN architecture is no longer operationally scalable due to tunnel management, failover, and monitoring requirements.

OPTINOC Recommendations

For 90% of multi-site VPN use cases, choose FortiGate. ASIC-accelerated IPsec throughput, SD-WAN included without an additional license, and an unbeatable TCO make it the clear solution. Alternatives remain relevant for deployments requiring advanced BGP/MPLS routing or integration with an existing Cisco or Juniper ecosystem.

OPTINOC supplies FortiGate, Cisco ISR/Catalyst 8000/ASR, and Juniper SRX products with manufacturer warranties. Preconfigured VPN solutions are available upon request. Delivery across Europe within 24-72h.