Choosing Your Device Type
SecureLink supports four device types, each designed for different deployment scenarios. This guide helps you choose the right one for your environment.
Device Comparison
| Feature | Dedicated Edge (DPDK) | Dedicated Edge (AF_PACKET) | MTGE (Shared Gateway) | Connector |
|---|---|---|---|---|
| Throughput | 10 Gbps+ (line-rate) | 1–5 Gbps | 10 Gbps+ (DPDK) or 1–5 Gbps (AF_PACKET) | Up to 1 Gbps |
| Hardware Requirements | Intel NICs, VT-d, SR-IOV | Any server, VM, or cloud instance | Same as dedicated edge | Any Linux server |
| VPP | Yes | Yes | Yes | No (Linux native) |
| Multi-Tenant | No (single tenant) | No (single tenant) | Yes (VRF isolation per tenant) | No (single tenant) |
| Deployment Complexity | High | Medium | High | Low |
| Minimum CPU / RAM | 4 cores / 8 GB | 2 cores / 4 GB | 4 cores / 8 GB | 1 core / 1 GB |
| Minimum NICs | 2 (WAN + LAN) | 2 (WAN + LAN) | 2 (WAN + LAN) | 1 |
Decision Tree
Dedicated Edge — DPDK Mode
Best for production hardware deployments where maximum throughput is required.
- You have physical servers or appliances with Intel NICs that support SR-IOV
- VT-d is available and can be enabled in BIOS
- You need 10 Gbps or higher throughput
- Single-tenant deployment
Dedicated Edge — AF_PACKET Mode
Best for virtual machines, cloud instances, or hardware that does not support DPDK.
- You are deploying on VMware, KVM, Hyper-V, or a cloud provider
- Your hardware does not have SR-IOV or VT-d support
- 1–5 Gbps throughput is sufficient
- Single-tenant deployment
- You want the full VPP feature set without special hardware requirements
MTGE (Multi-Tenant Gateway Edge)
Best for service providers or organizations that need to host multiple tenants on shared hardware.
- You need to serve multiple tenants from a single edge device
- Each tenant requires network isolation (VRF-based)
- You want shared infrastructure with per-tenant WireGuard instances and subnet allocations
- Can operate in either DPDK or AF_PACKET mode
Connector
Best for small branch offices or remote sites that need basic connectivity back to a hub edge.
- You need a lightweight presence at a remote site
- A hub edge is already deployed and configured with WireGuard
- You do not need VPP-level packet processing
- Minimal hardware resources are available
- You want the simplest possible deployment
Start with AF_PACKET mode
For testing and evaluation, start with a Dedicated Edge in AF_PACKET mode. It works on any VM or cloud instance with no special hardware requirements. Once validated, move to DPDK mode on production hardware for maximum throughput.