Product Line, Case Study & Setup

Part Thirty-Two: Product Portfolio & Selection

The topic

A fundamentals course has to include mapping a requirement to the right hardware. The Peplink line is broad but organized, and a handful of families cover almost every case.

How it works on Peplink

The portfolio sorts by role:

• Balance — enterprise/branch routers for fixed sites; multi-WAN, SpeedFusion, the workhorse line (Balance 20X up through the 580X and the high-end EC models).
• SDX / EPX / Balance 5000 EC — high-throughput aggregation and headquarters/hub platforms with 40G/100G interfaces, up to ~110 Gbps total and ~30 Gbps SpeedFusion, often with edge-computing capability.
• MAX (mobility) — the mobile and rugged line: BR (BR1/BR2 and the BR1 Mini family, including 5G and RedCap variants), Transit, UBR, MBX / HD MBX (high-capacity multi-cellular, e.g., HD4 MBX with X65 5G), PDX, and the Dome antenna-routers for vehicles and vessels.
• B One — enterprise branch router.
• SFE (SpeedFusion Engine) — an embeddable SpeedFusion endpoint.
• FusionHub — the virtual SpeedFusion appliance (Part Fifteen) for the cloud/DC end.
• Switches and APs — Peplink’s managed switch series (centralized PoE, multi-gig, SFP+, InTouch-manageable) and the AP line (Part Twenty-Five).
• Accessories — SIM Injectors/Extenders (Part Twenty-Two) and the antenna range (Part Twenty-Three).

Care plans wrap the hardware: the first year of SD-WAN, cloud management, and warranty is included, renewable in 1–4 year increments (PrimeCare and the other tiers), and now bundling an SFC usage allowance (Part Sixteen).

Why it matters

The right model is a function of a few questions: how many and what kind of WANs (cellular count, 5G vs RedCap vs LTE, fiber), required throughput (and SpeedFusion throughput, which is lower than raw), fixed vs mobile/rugged, whether edge compute or high-density aggregation is needed, and whether a care plan and SFC allowance are in scope. An engineer who can walk that decision tree turns a vague requirement into a correct bill of materials, and avoids the two classic errors of under-spec’ing throughput or putting a fixed-site box on a moving asset.

Field note

The full every-model catalog with real specs, introduction years, status, and field deployments is in Part Thirty-Four (the Summer 2026 Edition product line), and Part Thirty-Five covers FusionHub and InControl-Appliance installation. Size for SpeedFusion throughput and modem count, not just the marketing Mbps, a heavily-protected bonded stack (Part Ten) needs headroom. For mobility, lead with the MAX/Dome families and plan the antenna and SIM strategy with the unit. And always confirm the care plan: it’s how the customer keeps firmware, cloud management, and SFC, and it’s part of the value, not an afterthought.

Part Thirty-Three: A Field Case Study — The Day the Phones Went Down

A real West Networks call, used here because it shows the whole document working at once: the troubleshooting mindset, and the one rule that, if it had been known, would have prevented a full day of downtime.

What happened

Cox (the site’s wired broadband) went out, taking several locations with it, including the spa. The site’s internet was actually still up on backup, but the spa’s phones were dead. The team’s read was “people made changes to the phone system and now it’s all messed up,” and they started changing the phone configuration. The phones stayed down for an entire day.

On the drive back from Tampa, the call came in that the phones were still down. The fix, once at a keyboard, took about sixty seconds.

The wrong instinct (and why it’s wrong)

When something that worked stops working, the reflex is to start changing the thing that broke, here, the phone system. That is exactly backwards. Don’t change something that worked. Instead, find what is different and what isn’t working, and you’ll find the source.

The other trap is inventing a complicated cause. “The tunnel was working and now it isn’t, so it must be something exotic, T-Mobile is blocking the tunnel.” But we never knew T-Mobile and the tunnel were working together at all, so that’s a guess about a thing we have no evidence for. What we know for a fact is simpler: Cox is down, and the phones were working before Cox went down. Start from the facts, not the theory.

Source-first diagnosis

Logged into the router. Cox was down, and the SpeedFusion tunnel was down. That was enough, the phones never needed to be touched, because the phones are a symptom. The VoIP rides the SpeedFusion tunnel; if the tunnel is down, the phones are down. So the real question was never “what’s wrong with the phones,” it was “why is the tunnel down when there’s a 5G backup WAN sitting right there?”

The sixty-second fix

Opened the tunnel settings. The 5G connection from the synergized device was not selected as a member of the tunnel. Selected the 5G modem, clicked Save & Apply, the tunnel came up, and the phones started working. About a minute, start to finish.

Why it broke (the lesson)

When that 5G was added by Synergy, it was never enrolled in the SpeedFusion tunnel, and a newly added interface is off in the tunnel by default. While Cox was up, the tunnel rode Cox and nobody noticed the 5G wasn’t a member. The instant Cox dropped, the tunnel had no remaining member to use, so it went down, and the phones with it. The site was down for a day not because anything was truly broken, but because no one looked at the tunnel.

This is the rule to carry, and it is the same one in Part Twenty-One and Part Thirty: whether it’s Synergy mode or a plug-in module, any new interface you add to a Peplink router will not be part of the SpeedFusion tunnel, it is default-off. You have to open the tunnel settings and add that interface. Add the WAN to the router and add it to SpeedFusion, every time.

The extra hour — looking at the whole system

The tunnel fix took a minute. Taking an hour to look deeper is what kept the next outage from happening:

• The router was on 8.5.2 special firmware and the 5G device wasn’t stable; updating firmware (8.6.x, and 8.5.4 on the Transit) made it steadier and the speed was solid, about 180 Mbps down.
• The cellular kept resetting, so a 5G MAX adapter went into the USB port to bring a second service online.
• Planning to swap the Transit for one of the owned HD1 Dome Pros, the 24-port switch turned out to have the failed PoE daughterboard, no PoE, and no uplink to the Netgear, which also explained why Daniel had been having trouble reaching his systems. That switch was a latent outage: the PoE-powered APs on it would have died on the next reboot.
• Swapped in a 48-port switch from owned equipment, created a WAN 3 access port for the Dome to land on WAN 3 of the Balance 380 (enabling another synergized port to bring in the HD1 Dome), moved every connection onto the 48-port switch, and removed the dead Netgear and the no-PoE 24-port switch. The new Dome service was left intentionally inactive to build out API auto-provisioning while everything was already up.

The takeaways

• A symptom is not the source. Phones down was the symptom; the tunnel with no member was the source; Cox dropping was the trigger. Fix the source and the symptom disappears, chasing the symptom (the phone config) wasted a day.
• Find what changed or what isn’t working. Ninety-nine percent of the time the problem is the obvious, simple issue. Begin from what you know is true, not from a theory about an exotic cause.
• Don’t change what worked. Observe what’s different before you touch anything.
• Add your new WANs to SpeedFusion. The single technical rule behind this whole event, and the one most worth memorizing.
• A minute to fix, an hour to look. The fix was 60 seconds; the deeper hour found three problems (failing PoE board, dead Netgear, unstable firmware) before they became the next emergency.

Part Thirty-Four: The Peplink Product Line — Summer 2026 Edition

The topic

This is the working catalog an engineer uses to map a requirement to a model — re-issued each season (this is the Summer 2026 Edition) because the hardware line turns over quickly. It carries real specs from the current datasheets. Throughput is standardized: stateful throughput is the firewall/router forwarding rate (firewall and router throughput are the same number), and SpeedFusion is the bonded-tunnel rate shown two ways — no-AES (unencrypted) and AES (256-bit encrypted). Always size to the SpeedFusion AES number, not the marketing Mbps, and confirm the active Care plan. Each model shows its introduction year and status: Active models are organized by family; discontinued models are collected in the EOL subsection at the end (you will still see them in the field). Real, source-linked deployments follow in From the Field.

Fixed-Site & Branch Routers

Aggregation Hubs

Mobile Routers — BR1 & UBR

Mobile Routers — BR2, Transit & PDX

High-Capacity Mobility — MBX & HD

Dome Antenna-Routers

Switches

Wi-Fi Access Points

Adapters, FWA & SIM Injector

Antennas

Virtual & Cloud

EOL Products — You May See These in the Field

Discontinued models, kept for historical reference. Still common in installed bases — recognize them and know the current replacement.

From the Field — Real Deployments

Real, published Peplink deployments mapped to each active router. “Closest” indicates the nearest real story where none names that exact model. Sources are listed at the end.

• Balance 20X — European medical clinics · healthcare. A European group of medical clinics (~100 sites) had its MSP deploy a Balance 20X per clinic with LTE backup, building a secure SpeedFusion/IPsec network for patient data managed in InControl 2. [[1]](https://www.peplink.com/case-studies/clinics-in-europe-secure-a-healthy-network-through-an-msp/)
• Balance 310 5G — Protection & Rescue Zurich · public safety. Protection & Rescue Zurich deployed dual Balance 310 5G in its mobile command center, combining multi-SIM cellular, Starlink and fiber for unbreakable emergency connectivity. [[2]](https://www.peplink.com/case-studies/mobile-command-center-for-protection-rescue-zurich-locks-in-secure-connectivity/)
• Balance 310 Fiber 5G — Protection & Rescue Zurich · public safety. (closest) Closest deployment: Protection & Rescue Zurich’s mobile command center used Balance 310 hybrid 5G routers to combine cellular, Starlink and fiber for resilient emergency-services connectivity. [[3]](https://www.peplink.com/case-studies/mobile-command-center-for-protection-rescue-zurich-locks-in-secure-connectivity/)
• Balance 310 — Protection & Rescue Zurich · public safety. (closest) Closest deployment: Protection & Rescue Zurich’s mobile command center ran dual Balance 310 5G routers for redundant multi-WAN emergency connectivity. [[4]](https://www.peplink.com/case-studies/mobile-command-center-for-protection-rescue-zurich-locks-in-secure-connectivity/)
• Balance 310X — Boating company · maritime. (closest) Closest deployment: a yacht fitted with a Balance 310X bonded 5G/LTE with a VSAT backup and HD1 Dome/Maritime antennas for seamless failover at sea. [[5]](https://www.peplink.com/case-studies/sailing-right-through-connectivity-challenges-with-peplink/)
• Balance 310X 5G — Boating company · maritime. A boating company deployed a Balance 310X 5G in a yacht, bonding built-in 5G/LTE with a VSAT backup and HD1 Dome/Maritime 40G antennas plus a SIM Injector for drop-free connectivity while sailing. [[6]](https://www.peplink.com/case-studies/sailing-right-through-connectivity-challenges-with-peplink/)
• Balance 580X — NET25 · broadcast. (closest) Closest deployment: Filipino broadcaster NET25 used a Balance 580 to keep its New Year’s Eve live-stream broadcasting connectivity unbreakable. [[7]](https://www.peplink.com/case-studies/balance-580/)
• B One — SIEM Shipping · maritime. SIEM Shipping built a setup around the B One to integrate Starlink, 5G and Iridium satellite with centralized InControl management for dependable maritime connectivity. [[8]](https://www.peplink.com/case-studies/siem-shippings-seamless-connectivity-the-power-of-starlink-5g-iridium-and-peplink-integration/)
• B One Plus — 5Gstore (deployment guide) · retail. (closest) Closest deployment: 5Gstore positions the B One Plus (built-in LTE + dual Ethernet WAN) for branch offices, small retail and kiosks needing wired primary with automatic cellular failover. [[9]](https://5gstore.com/blog/2026/03/27/peplink-b-one-series/)
• B One 5G — MobileMustHave / 5Gstore · small office / RV. (closest) Closest deployment: reseller coverage positions the B One 5G (embedded X62 5G, up to five WAN paths) as an entry multi-WAN router for home-office, small-office and light-mobility/RV WAN bonding. [[10]](https://mobilemusthave.com/products/peplink-b-one-5g)
• Balance 1350 EC — European medical clinics · healthcare. (closest) Closest deployment: a European clinic group’s MSP ran dual Balance 1350 routers in HA at its data center to securely aggregate VPN traffic from ~100 clinic sites. [[11]](https://www.peplink.com/case-studies/clinics-in-europe-secure-a-healthy-network-through-an-msp/)
• Balance 2500 — Cruise tour operator · hospitality / maritime. A global cruise tour operator across the Mediterranean and Caribbean used a Balance 2500 to bond cellular, wireless and VSAT links for reliable passenger and operational connectivity at sea. [[12]](https://www.peplink.com/case-studies/balance-2500/)
• Balance 2500 EC — Terrenova · service provider. Terrenova used Peplink (incl. Balance 2500 EC) to extend affordable cellular into remote African regions, aggregating and managing connectivity for inclusive telecom development. [[13]](https://www.peplink.com/case-studies/terrenova-brings-affordable-cellular-connectivity-to-remote-african-regions-with-peplink/)
• Balance 5000 EC — European medical clinics · data-center aggregation. (closest) Closest deployment: a European clinic group’s MSP ran dual high-availability Balance routers at its data center to aggregate secure VPN traffic from ~100 sites. [[14]](https://www.peplink.com/case-studies/clinics-in-europe-secure-a-healthy-network-through-an-msp/)
• SDX — Marine engineering firm · construction / maritime. A marine engineering & construction firm (with West Networks) replaced MPLS with an SD-WAN ecosystem of 4x SDX in HA, 20x SD Switch and 28x AP One Enterprise across two HQs, eliminating a planned data center and cutting costs. [[15]](https://www.peplink.com/case-studies/a-marine-engineering-and-construction-company-replaces-entire-network-with-sd-wan-ecosystem/)
• SDX Pro — Hyperlink · oil & gas. Hyperlink modernized SCADA networking for remote pipeline operations using SDX Pro with Starlink, delivering dependable multi-WAN redundancy for industrial monitoring. [[16]](https://www.peplink.com/case-studies/sdx-pro/)
• EPX — Heathgate Resources · mining. Heathgate Resources, a uranium-mining leader, adopted Peplink (EPX) with Starlink for reliable, redundant connectivity to its remote Australian mining operations. [[17]](https://www.peplink.com/case-studies/heathgate-resources-unearths-reliable-peplink-and-starlink-connectivity/)
• SpeedFusion Engine (SFE) — Alarm-monitoring conglomerate · security / monitoring. (closest) Closest deployment: a multinational conglomerate replaced fragile MPLS with SpeedFusion (BR1 Pro 5G + HA SDX Pro at HQ) to keep 500+ alarm/CCTV monitoring devices online 24/7. [[18]](https://www.peplink.com/case-studies/speedfusion-disaster-recovery-on-alarm-monitoring-system/)
• BR1 Mini (HW3) — 1SimplePhone · mobile / VoIP. VoIP provider 1SimplePhone needed to mass-deploy 100 BR1 Minis fast; with automated InControl scripts and 3D-printed docks they configured all 100 in about one hour. [[19]](https://www.peplink.com/case-studies/automated-deployment-for-a-batch-of-100-br1-minis/)
• BR1 Mini 5G — 5Gstore · mobile / fleet. (closest) Closest deployment: 5Gstore drove a BR1 Mini from Chicago to Denver, confirming InControl 2 GPS fleet tracking stayed accurate over 17 hours using under 3MB of data. [[20]](https://5gstore.com/blog/2025/06/10/peplink-icontrol2-gps-data-usage/)
• BR1 Mini Core — Electric cooperative · utility. (closest) Closest deployment: a US electric cooperative migrated ~50 substations off sunsetting EVDO using rugged BR1 Mini units for LTE telemetry, managed via InControl 2. [[21]](https://www.peplink.com/case-studies/electric-cooperative-seamlessly-migrates-substations-to-lte-connectivity/)
• BR1 Mini M2M — Hyperlink / oil & gas · utility / M2M. (closest) Closest deployment: for a Western Canada oil & gas operator, Hyperlink used a BR1 Mini as cellular backup to Starlink at helicopter-only pipeline SCADA sites, with SpeedFusion Hot Failover keeping telemetry online. [[22]](https://www.peplink.com/case-studies/hyperlink-boosts-scada-performance-with-peplink-in-remote-pipeline-operations/)
• BR1 Pro 5G — American non-profit · events. An American non-profit’s 1,000-attendee conference skipped costly venue Wi-Fi by deploying BR2 Pro and BR1 Pro 5G over 5G, supporting attendee Wi-Fi and event systems with no congestion via InControl. [[23]](https://www.peplink.com/case-studies/non-profit-conference-prospers-with-a-5g-centric-peplink-network/)
• BR1 Pro CAT-20 — SeaBits · maritime. (closest) Closest deployment: marine reviewer SeaBits tested the BR1 Pro aboard a boat in Puget Sound, calling its CAT-20/5G modem the fastest Peplink router he had tested and his top single-radio pick for vessels. [[24]](https://seabits.com/peplink-max-br1-pro-5g-first-impressions/)
• BR1 IP67 — SBM Offshore · maritime. SBM Offshore’s vessel SBM Installer replaced costly high-latency VSAT with a weatherproof MAX BR1 IP67 mounted outdoors, giving the crew reliable 4G primary WAN for VoIP, video and streaming. [[25]](https://www.peplink.com/case-studies/sbm-offshore-supply-vessel/)
• UBR Plus — Mobile Internet Resource Center · mobile / RV. (closest) Closest deployment: the Mobile Internet Resource Center reviewed the UBR Plus, detailing dual Cat-7 modems and 900 Mbps as an always-on connectivity option for RVers and boaters. [[26]](https://www.rvmobileinternet.com/peplink-releases-the-ubr-plus-router-with-dual-cat-7-modems/)
• BR2 — Comprehensive Communication Services · public safety. (closest) Closest deployment: Comprehensive Communication Services builds first-responder command trailers around rugged dual-cellular BR2-series routers plus Starlink, bonded via SpeedFusion with a Mobility 42G antenna. [[27]](https://www.peplink.com/case-studies/comprehensive-communication-services/)
• BR2 Micro — Network Innovations · construction. (closest) Closest deployment: Network Innovations / Frontier EU used a compact rugged BR2-family router for bonded-cellular connectivity enabling real-time remote control of unmanned machinery in remote areas. [[28]](https://www.peplink.com/case-studies/network-innovations-transforms-remote-machinery-control-with-peplink/)
• BR2 Pro — iTel Networks · agriculture. iTel Networks built its iLink solution around BR2 Pro plus Starlink for high-performance multi-WAN connectivity at a year-round sustainable agriculture operation in the remote Canadian Arctic. [[29]](https://www.peplink.com/case-studies/reliable-year-round-sustainable-arctic-agriculture-powered-by-peplink-and-starlink/)
• Transit Pro / Pro E — Avy B.V. · transit / drone. Drone pioneer Avy B.V. uses MAX Transit Duo Pro routers to power BVLOS drones for urgent healthcare deliveries and emergency monitoring, providing seamless live video and comms midair. [[30]](https://www.peplink.com/case-studies/peplink-in-midair-seamless-live-streams-communications-for-avy-drones/)
• PDX 5G — Drone delivery company · transit / drone. (closest) Closest deployment: a drone-delivery company piloting store-to-door service used the rugged quad-cellular PDX to bond multiple carriers for drone video and command data. [[31]](https://www.peplink.com/case-studies/deliveries-by-drone-made-possible-with-peplink-solutions/)
• PDX — Drone delivery company · transit / drone. A drone-delivery company piloting store-to-door service used the rugged MIL-STD-810H quad-cellular PDX to bond up to four carriers, seamlessly carrying drone video and command data. [[32]](https://www.peplink.com/case-studies/deliveries-by-drone-made-possible-with-peplink-solutions/)
• MBX Mini 5G — SeaBits / Kaos · maritime. Aboard the vessel Kaos, an MBX Mini served as the network core, bonding two Starlink antennas plus multiple cellular plans and a 5G MAX Adapter for layered failover, with AP One APs covering blindspots. [[33]](https://www.peplink.com/case-studies/starlink-with-peplink-case-studies/)
• HD2 MBX / HD4 MBX (LTE) — US broadcasting network · broadcast. A US broadcasting network needed smooth live video from news vehicles; an MSP deployed MAX HD4 MBX to bond up to four carriers with SpeedFusion, WAN Smoothing and Hot Failover for jitter-free feeds. [[34]](https://www.peplink.com/case-studies/msp-creates-a-stream-of-reliable-connectivity-for-a-broadcasting/)
• HD2 MBX 5G / HD4 MBX 5G — Czech TV · broadcast. Partner Smart Informatics equipped Czech TV’s outside-broadcast fleet with MAX HD4 MBX 5G bonding as a flexible, cost-effective alternative to traditional DSNG satellite trucks. [[35]](https://www.peplink.com/case-studies/smart-informatics-equips-czech-tv-to-broadcast-beyond-boundaries-with-peplink/)
• MAX HD2 Mini — North American police force · public safety. A North American police force needed a flexible network for portable security cameras; the MAX HD2 Mini provided bonded, low-latency cellular with failover for resilient mobile video streaming. [[36]](https://www.peplink.com/case-studies/max-hd2-mini/)
• MAX HD4 IP67 — Pacific Drilling · maritime / offshore. (closest) Closest deployment: ultra-deepwater driller Pacific Drilling used a MAX HD4 plus two MAX BR1 IP67 routers bonding 6 SIMs for ~1 TB/month low-latency drillship-to-HQ connectivity. [[37]](https://www.peplink.com/case-studies/connecting-a-drillship-to-her-headquarter-using-lte/)
• HD1 Dome Pro — SIEM Shipping · maritime. SIEM Shipping fitted its Ro-Ro fleet (via Rio Innovations) with HD1 Dome Pro delivering 5G up to 85 km offshore that auto-engages in range to boost performance and cut satellite costs. [[38]](https://www.peplink.com/case-studies/siem-shippings-seamless-connectivity-the-power-of-starlink-5g-iridium-and-peplink-integration/)
• Dome Pro Duo — AirBridge Networks · mining. At a remote Australian mine with no terrestrial service, AirBridge Networks built a transportable hub whose SDX aggregated 6 Starlink kits and 2 Dome Pro Duos for dual-5G connectivity serving 200+ workers. [[39]](https://www.peplink.com/case-studies/bridging-the-divide-reliable-connectivity-for-remote-mining-operations-with-peplink/)
• Dome Pro LR — SIEM Shipping · maritime. (closest) Closest deployment: SIEM Shipping fitted its Ro-Ro fleet with Peplink Dome Pro antennas delivering 5G up to 85 km offshore alongside Starlink and Iridium. [[40]](https://www.peplink.com/case-studies/siem-shippings-seamless-connectivity-the-power-of-starlink-5g-iridium-and-peplink-integration/)
• FusionHub — Don Mueang Airport · aviation. Don Mueang Airport (via CYN Communication) used FusionHub as the cloud aggregation server, bonding feeds from MAX Transit Duo routers and 8 encoders for low-latency live video in its emergency response plan. [[41]](https://www.peplink.com/case-studies/don-mueang-airport-emergency-response-plan-live-stream/)

Sources: [1] · [2] · [3] · [4] · [5] · [6] · [7] · [8] · [9] · [10] · [11] · [12] · [13] · [14] · [15] · [16] · [17] · [18] · [19] · [20] · [21] · [22] · [23] · [24] · [25] · [26] · [27] · [28] · [29] · [30] · [31] · [32] · [33] · [34] · [35] · [36] · [37] · [38] · [39] · [40] · [41]

Part Thirty-Five: Setup & Installation Guides

The topic

Understanding the products includes standing them up. This part is the field procedure for the two pieces engineers most often have to install themselves — FusionHub (the virtual SpeedFusion endpoint) and the InControl 2 Appliance (ICVA, on-prem InControl) — plus how to reach a device over CLI/SSH, update firmware, and adopt switches and APs. The steps below follow Peplink’s FusionHub User Manual & Installation Guide and the InControl 2 Appliance Setup Guide (2.14.2.7).

Installing FusionHub

FusionHub runs on VMware (ESXi 6.7/7.0, Workstation, Player), VirtualBox, XenServer, Hyper-V, and the major clouds (AWS, Azure, GCP, Vultr). Minimum VM size is tiny — 1 vCPU / 1 GB RAM / 1 GB disk — so it’s the resource cost that’s small; the licensing is what scales (by peer count).

1. Sign in to InControl 2 and create your organization/group (name, time zone, location).
2. Acquire the license: Organization → Settings → Warranty & License → Acquire FusionHub License, then choose an Evaluation (temporary) or Solo (permanent) license. InControl emails you the license info, including the FusionHub serial number.
3. Download the image: on the same screen click Download FusionHub (or get it from peplink.com/products/fusionhub/; for AWS use the Marketplace AMI instead).
4. Deploy the VM on your hypervisor. On ESXi: Create/Register VM → Deploy from OVF/OVA → upload the FusionHub .ova → choose storage and the network/port group → set the NIC (e.g. VMXNET 3) and tick Connect at power on. Give it a WAN adapter (and a LAN adapter if you want a separate LAN).
5. Power on and open the VM console — it shows the version and the admin URL (WAN defaults to DHCP).
6. Find the web admin: with DHCP the URL is on the console (e.g. http://10.8.8.252). With no DHCP, set your PC to a 169.254.x.x/16 address and browse to http://169.254.254.254.
7. Log in with admin / admin (on AWS Marketplace the default password is the AWS Instance ID). Change it under System → Admin Security.
8. Run the Setup Wizard: set the WAN method (DHCP / Static / PPPoE), and configure the LAN port if a second adapter exists. For a static WAN, keep FusionHub on the host’s subnet.
9. Add FusionHub to InControl: Organization → Settings → Add Devices → enter the serial number from the license email.
10. Build the SpeedFusion profile (router → FusionHub): on FusionHub, set a Local ID (e.g. FusionHubVM) under Advanced → SpeedFusion VPN, then add a profile for each remote router (Name, Remote ID = the router’s Local ID, a pre-shared key) and Apply.
11. On each router: Advanced → SpeedFusion VPN → set its Local ID → New Profile → Remote ID = FusionHubVM, the matching pre-shared key, and Remote IP = FusionHub’s IP. Apply. The tunnel establishes back to the hub.
12. If the license shows “virtual machine server changed” (the VM/host ID moved), go to Organization → Warranty & License → FusionHub → Renew; the new license arrives within ~3 hours or at next boot.

Installing the InControl 2 Appliance (ICVA)

ICVA is on-premises InControl for organizations that can’t use the public cloud. It is two VMs — an InControl (IC) VM and a Database (DB) VM — joined by an Internal virtual switch (no physical NIC), with a WAN virtual switch for web/device access. It runs on ESXi 6.7/7.0, Hyper-V, KVM, AWS, GCP, and Azure. Size for the fleet: up to 100 devices needs roughly an IC VM with 12 GB RAM (24 GB system + 20 GB data) and a DB VM with 8 GB RAM (24 GB system + 100 GB data); larger tiers scale to 96 GB RAM and multi-TB disks for 5,000 devices.

1. Create two virtual switches on the host: WAN (with a physical adapter) and Internal (no physical adapter — IC↔DB only). The WAN must not use 192.168.1.0/24 (the default Internal subnet), and a DHCP server must be present on the WAN during install.
2. Download the Virtual Appliance image and the Database Server image from peplink.com (OVF/VMDK for VMware, .vhdx for Hyper-V) and extract them.
3. Deploy the DB VM first (Create/Register VM → from OVF/OVA → all DB files → storage → map its one adapter to Internal). It boots automatically.
4. Deploy the IC VM (its files), mapping adapter 1 → WAN and adapter 2 → Internal.
5. Power up both and wait ~2 minutes for full boot.
6. From the IC VM console note the WAN IP (from DHCP). Console login for network changes is setup / setup. Default Internal IPs are 192.168.1.1 (IC) and 192.168.1.3 (DB).
7. Open the Control Panel at https://{server}:4443/ and log in with admin / admin.
8. Update the IC VM firmware right after first boot.
9. License it: email your Server Name (shown on the Control Panel) plus any order number to ica@peplink.com for a key, then enter it in the License Key field. (A 7-day grace period applies on 2.9.0+.)
10. Set the Server Name and supporting services: SMTP e-mail, a Google Maps API key (or OpenStreetMap), and an FTP/SFTP archive server. If you change a VM’s Internal IP, update the Database IP Address on the Control Panel first.
11. Connect devices either by pointing each device at the appliance address (internet-isolated) or by redirecting them from Peplink InControl (internet-accessible), then import them and build your Organization/Group.
12. Licensing sync: since 2.9.0 the appliance auto-syncs warranty/subscription data with Peplink every 6 hours; if fully isolated, sync manually from the device-management page.

CLI / SSH and “using the systems”

• Reaching the CLI: connect over SSH or the serial console (fixed 80×24), logging in with the router’s web-admin administrator credentials. (Enable SSH and set the port in the router’s web admin under System → Admin Security.)
• Status commands: get system (model, serial, firmware, MACs), get wan <n> (per-WAN IP/gateway/DNS/MTU and cellular signal), get pepvpn (tunnel status), get clientlist, get session, get cpu load, get ha, get bandwidth.
• Diagnostics: support ping | traceroute | nslookup | arp | ip-route-show, support pepvpn (detailed tunnel info), support cellular-mdstatus | -simstatus | -mdreset, and support serial for OOBM to attached serial gear.
• System: system reboot, system restore (factory defaults), system backup tftp <ip>, and system clionly enable — which disables web admin entirely, leaving CLI as the only management path (reverse with system clionly disable).

Firmware, switches & APs

• Firmware: update from the router UI (System → Firmware) or fleet-wide from InControl with a firmware policy; treat the newest stable release as part of the deployment (Part Thirty-One). Verify a device’s model support before promising a feature.
• Switches: Peplink switches are managed from InControl (or locally) — adopt the switch into the group, then push VLANs, PoE schedules, and port settings centrally; PoE consumption is reported per device.
• Access points: enable the router’s AP Controller (or InControl), define an AP Profile carrying the SSIDs/VLANs and radio settings, and apply it; deliver guest Wi-Fi via a QR code and keep guest on an isolated VLAN (Part Twenty-Five).

FAQ: Field Questions, Answered

The questions our own engineers actually ask, collected. Several are answered in more depth in the body of the paper; this is the quick-reference version.

Should SpeedFusion Connect, SpeedFusion VPN, WAN Smoothing, and FEC go in the Networking Fundamentals paper, or somewhere else? Somewhere else, here. The first paper is vendor-neutral fundamentals that apply to any gear, and it stays useful by staying neutral. These four are Peplink-specific implementations, so they belong in this companion volume. That is the reason this paper exists.

My customer has only one WAN (cable, not cellular) and is asking about WAN Smoothing. Would you turn it on with only one WAN? How much better would it be with error correction? On a single WAN, no, do not use WAN Smoothing. Its entire benefit is path diversity (it duplicates packets across different links and uses the first copy to arrive), and with one link there is no second path, so you would pay 100–400% overhead for almost no benefit and zero protection against the link congesting or dropping. Use FEC instead: standard FEC adds about 13.3% (Low) to 26.7% (High) overhead, and Adaptive FEC about 6–20%, recovering lost packets by interpolation without retransmits, and it works on a single link. On a lossy-but-not-saturated cable link, Adaptive FEC (or FEC at Low/Medium) meaningfully cleans up choppy voice and video at a fraction of smoothing’s cost. Be honest about its limits, FEC cannot create bandwidth or survive the link going fully down, and on a congested link it makes things worse. Also remember both features are SpeedFusion tunnel features, so even on one WAN they require a tunnel to a second endpoint (a FusionHub or hosted SpeedFusion Connect endpoint) to do the encoding and decoding; a router terminating no tunnel can do neither. Best single-WAN recipe: SpeedFusion + Boost + Adaptive FEC to a cloud endpoint, no smoothing. And the real fix for uptime (as opposed to quality) is a second diverse link, an on-demand SFC 5G/LTE cellular plan is often the cheapest way to get one. (Full reasoning in Parts Five, Six, and Eight.)

Can a single Peplink router bond my two connections by itself? No. Bonding (and smoothing and FEC) happen between two cooperating endpoints. With one router and no tunnel partner you get load balancing and sub-second hot failover, both valuable, but not true session-surviving bonding. Give the tunnel somewhere to land (a second site, a FusionHub, or a hosted SFC endpoint) and you get the full feature set. (Part Two.)

What is the difference between PepVPN and SpeedFusion? PepVPN is the base secure tunnel, on every Peplink device. SpeedFusion is PepVPN with the bonding and protection features (bonding, hot failover, smoothing, FEC, Boost) enabled. Every device can build a tunnel; the SpeedFusion features layered on it differentiate the models and care plans. (Part Two.)

WAN Smoothing vs. FEC, when do I use which? Smoothing for real-time traffic across multiple diverse links that cannot tolerate a single lost packet (VoIP, live video), accepting 100–400% overhead, ideally on a dedicated sub-tunnel. FEC for links with measurable but moderate loss where you want recovery cheaply (13.3–26.7% standard, ~6–20% Adaptive). Reach for FEC first; smoothing is the nuclear option. (Parts Five and Six.)

What is the baseline overhead of just turning SpeedFusion on? About 14–18%, from encryption, sequence numbers, reorder buffers, and tunnel framing (mechanically, 80 bytes per packet). Overhead is additive on top of that: + Adaptive FEC ≈ 20–38%, + FEC High ≈ 41–45%, + WAN Smoothing ≈ +114% to +400%+ depending on level. Measure in the real environment before sizing. (Part Ten.)

Why did my second sub-tunnel come up and then start flapping? Almost always firewall ports. Each sub-tunnel needs its own UDP pair (base 32015/4500, then 32016/4501, 32017/4502, …), bidirectional. The base tunnel working fine masks the missing ports for the others. (Part Twenty.)

I added a new WAN (synergized a device / added a modem / added a second ISP) but it never carries traffic and the site didn’t fail over to it. Why? Because you added the WAN to the router but not to the SpeedFusion tunnel. A newly added WAN defaults to a disabled priority inside the SpeedFusion profile, so the tunnel ignores it for both bonding and failover until you explicitly add and prioritize it. This is the classic Synergy-mode surprise (e.g., a Balance 380 synergizes a BR1 Pro 5G, the broadband fails, and nothing fails over because the 5G was never enrolled in the tunnel). Adding a WAN to the device is not the same as adding it to the tunnel — every time you add a link, open each SpeedFusion profile’s WAN list, add the interface, enable its priority, and test by pulling the primary. (Part Twenty-One.)

The tunnel is up but certain applications hang. What is it? Classic MTU/MSS. The tunnel adds overhead, so traffic assuming a full 1500-byte MTU stalls (“ping works, real traffic hangs”). Lower the MSS clamp (~40 bytes), check the packet DF flag, confirm fragmentation is handled, not blackholed. (Parts Twenty and Twenty-One.)

When should I bridge Layer 2 across sites instead of routing Layer 3? Only when devices genuinely need to be on the same segment, remote printers and APs, a shared NAS, server-to-server traffic that assumes one LAN. Bridge a single VLAN on a dedicated sub-tunnel, enable STP on it, and keep OSPF off it. Route everything else at Layer 3, and never enable global L2 and per-VLAN L2 at once. (Part Twelve.)

Do I need my own FusionHub, or can I use SpeedFusion Connect? FusionHub when you want to own and control the endpoint (your cloud, your config, your licensing). SpeedFusion Connect when you want Peplink to host it and you want the easy path, the SFC App, hosted endpoints in many countries, on-demand 5G/LTE. SFC is usually the right answer for smaller, temporary, or mobile deployments; FusionHub for enterprises that want control. (Parts Fifteen and Sixteen.)

What actually makes Peplink scale to hundreds of sites? InControl 2 and Zero Touch. You stage configuration centrally, ship devices, and they self-configure on first boot, identically and correctly. The organization-versus-group model lets a central team enforce security and firmware while delegating local choices. For many customers the manageability, not any single SpeedFusion feature, is the deciding factor. (Parts Seventeen and Eighteen.)

Appendix: Companion Documents

Two companion documents sit alongside this paper, and the team should treat them as the next level of detail.

The first is Peplink’s own SpeedFusion Whitepaper (ver 02.1), “How to Get the Most Out of SpeedFusion Technologies.” It is the authoritative source for the technology numbers used here, the WAN Smoothing multipliers (Normal 2×, Medium 3×, High 4×, Maximum scaling with active links), the FEC figures (13.3% Low, 26.7% High), the 80-bytes-per-packet overhead and IMIX measurement, and the security model (per-link AES-256 with perfect forward secrecy). It also carries deeper best-practice sections this paper only summarizes: calculating bonding overhead, measuring tunnel capacity, and application-specific tuning for cellular (windowing / time-slicing), Starlink/LEO, and fixed-line deployments, plus fine-tuning the Dynamic Weighted Bonding algorithm. When a sizing or tuning question goes beyond what is here, that guide is the next stop.

The West Networks Visio Reference Library

The diagrams embedded in this paper are a small sample. The full West Networks Visio Samples (2023) library, kept alongside this document, holds roughly eighty real deployment drawings, the actual designs we have built, annotated with interfaces, subnets, VLANs, ports, and routing. It is the best place to find a worked example close to whatever a customer is asking for. The diagrams group into the following themes:

• Mobile fleets and SIM injectors — vehicles, vessels, and high-capacity mobile units (HD4 MBX, Balance 580X “SDWAN power house”) bonding 4–8 cellular links, often fed by an 8-SIM injector and 5G domes, back to a FusionHub or hosted endpoint.
• FusionHub and the cloud endpoint — designs landing SpeedFusion on a FusionHub VM (AWS and other clouds), with the customer-firewall port and routing annotations.
• BGP and public IP — advertising a public /24 or /29 to an upstream (e.g., GRU fiber) over SpeedFusion, dual-ISP /30 designs, and “direct access to public IP over SpeedFusion” patterns.
• OSPF and dynamic routing — OSPF area 0.0.0.0 across SpeedFusion into enterprise cores and switches; one EIGRP-to-data-center example.
• High availability — VRRP master/slave pairs, Synergy mode, and seamless SpeedFusion-hub failover designs.
• Layer 2 bridging — stretched-VLAN Layer 2 bridges over SpeedFusion (e.g., VLAN 3103 across sites) and mixed L2/L3 builds.
• SpeedFusion Connect / SFC Protect — hosted-endpoint and SFC Protect designs with quota and mission-critical lane annotations.
• Starlink and LEO — Starlink-as-WAN cabling and bonding designs, including weather-resilient single-link builds.
• Broadcast and media — boat/encoder telemetry, SRT over bonded N25+N41+N77, and large-venue (Olympics-scale) bonding-server designs.
• Retail, enterprise, and scale — multi-site store designs (PoS/VoIP critical apps), Palo Alto integration (parallel and serial), private 5G / CBRS / Celona, and 1000+-remote-site fabrics.

When designing or explaining a deployment, pull the closest match from this library as a starting point rather than drawing from scratch, the annotations already encode the port, routing, and addressing decisions covered in this paper.

Closing note

The Networking Fundamentals paper ended on the observation that the cloud emptied the building: when the servers and the people left for the cloud and for everywhere, the wide-area network became the most important and most fragile part of the network, and SD-WAN exists to make that part dependable. This paper is the detail behind that claim. SpeedFusion is how Peplink makes the WAN dependable, bonding diverse links into one resilient whole, surviving the loss of any single connection, and recovering loss without retransmits. FusionHub and SpeedFusion Connect give every deployment, fixed, single-WAN, or fully mobile, somewhere for the tunnel to land. OSPF and BGP let it drop into a serious routed network without disruption. And InControl with Zero Touch is what makes a thousand of these as manageable as one.

None of it replaces the fundamentals. Every SpeedFusion deployment still rests on clean addressing, sane subnets, correct VLANs, disciplined spanning tree, and the MTU math, the same fundamentals, recognized in Peplink clothing. Master the fundamentals in the first paper, understand how Peplink implements and improves them here, and you can design, deploy, defend, and explain the modern Peplink network with confidence, including answering the customer who only has one WAN and wants to know what error correction will really buy them.

Prepared by West Networks for the Peplink Summit. The companion to Networking Fundamentals. Overhead percentages are lab and catalog baselines for sizing, not guarantees; always measure in the deployed environment. For configuration specifics and current capabilities, consult Peplink’s official documentation, the firmware release notes, and Peplink University.