Everything in this course so far has been about keeping traffic moving. This chapter is about keeping it yours. Peplink’s security model is built into the same hardware you bought for bonding — there is no separate appliance to add, license, or forget to renew.
The five layers
1. Encrypted transport, per link
Every SpeedFusion tunnel runs AES-256 over TLS 1.3, and each WAN link inside a bonded tunnel is uniquely keyed — three carriers means three independently encrypted transports, not one key shared three ways. With firmware 8.6, FIPS mode is a permanent platform capability and the hardware itself is TAA-compliant for government purchasing. Deep dive: encryption, FIPS & TAA →
2. A hardened management plane
Random admin passwords with automatic 30-day rotation, changeable admin usernames, and TACACS+/RADIUS so router access follows your directory instead of sticky notes. 802.1X authenticates devices at the port on routers and PWS switches. Deep dive: access hardening →
3. A real firewall
Four rule domains — inbound, outbound, internal, and local service — plus DPI-based application blocking, intrusion detection, DoS protection, content filtering, and per-VLAN Cloudflare DNS on 8.6. Segmentation between VLANs is written in the same policy language as edge rules. Deep dive: firewall & DPI →
4. Identity-driven segmentation
Grouped networks (IP/URL lists) and grouped MAC addresses are named, API-updatable objects that firewall and outbound policy both understand. The classic rule — corporate PCs may reach corporate servers, and nothing else — is one line, enforced fleet-wide. Deep dive: segmentation & groups →
5. Evidence for your SIEM
NetFlow, URL logging, session logging, and SNMP stream from every site to whatever your SOC runs, so remote branches are as observable as headquarters — and audits get evidence, not assurances. Deep dive: visibility & SIEM →
Where compliance lands
If your world involves card data, the platform maps cleanly onto PCI DSS 4 — segmentation, strong crypto, unique IDs, logging, and zero-touch consistency across every site.
Course takeaway: bonding gets you uptime; the security layer makes that uptime defensible. Explore the full Security & Compliance section for configuration-level detail on each layer.