Bonded connectivity is only as valuable as it is defensible. This section is the honest map of the Peplink security surface — what’s built in, how to harden it, and how it feeds the compliance frameworks your auditors care about.
The posture in one paragraph
Every SpeedFusion tunnel runs AES-256 over TLS 1.3 with each WAN link uniquely encrypted. Firmware 8.6 brings permanent FIPS mode; the hardware is TAA-compliant for government procurement. Admin access supports rotating credentials, changeable usernames, TACACS+/RADIUS, and 802.1X on router LAN ports and PWS switches. The firewall enforces inbound, outbound, internal and service rules with DPI, application blocking, IDS/DoS protection and content filtering — driven by API-updatable grouped networks and MAC lists — and everything logs to your SIEM via NetFlow, URL/session logging and SNMP.
Encryption & compliance
AES-256 and TLS 1.3 tunneling with per-link encryption, permanent FIPS mode in firmware 8.6, and TAA-compliant hardware for regulated and government buyers.
Read more →
Access hardening
Rotating admin credentials, changeable usernames, TACACS+ and RADIUS authentication, and 802.1X port control on Peplink routers and switches.
Read more →
Firewall & DPI
Inbound, outbound, internal and service firewall rules, application blocking with DPI, intrusion detection and DoS protection, content blocking, and per-VLAN Cloudflare DNS.
Read more →
Segmentation & groups
API-driven grouped networks (IP and URL lists) and grouped MAC addresses power firewall and outbound policy — segment by who a device is, not where it sits.
Read more →
Visibility & SIEM
NetFlow export, URL logging, session logging and SNMP from every Peplink device — feed your SIEM the evidence it needs from every site.
Read more →
PCI DSS
Hardening Peplink routers and InControl 2 for PCI DSS 4 — segmentation, encryption, logging and the zero-touch rollout pattern for card-handling sites.
Read more →