Hands on: Zyxel USG Lite 60AX review

SMBs and home offices seeking an affordable all-in-one security router will find Zyxel’s USG Lite 60AX a worthy contender. This diminutive desktop unit teams up a Wi-Fi 6 access point (AP) with an integral multi-gigabit switch, and the price includes a lifetime subscription to Zyxel’s Security Cloud.

This service includes a firewall, ransomware and malware prevention, VPN proxy, intrusion, dark web and ad blockers, application identification, GeoIP country restrictions, and mail fraud and phishing protection. The optional Elite Pack licence enables the Trellix-powered real-time threat intelligence and web category filtering services as well as a Nebula Pro Pack and costs £33 per year.

The router is designed to be desk-mounted, with the small and flimsy base stand rotated round to keep it upright. The switch has two 2.5GbE multi-gigabit ports for WAN and LAN connections and partners them with another four gigabit LAN ports, while the AX6000-rated AP claims speeds of 1,148Mbits/sec on the 2.4GHz radio and 4,804Mbits/sec for the 5GHz one.

The router’s local web interface provides only a basic status view and, to manage it, you assign it to your Nebula cloud account. This is easy enough to do: we used the Nebula iOS app on an iPad to scan the QR code on its base and add it to our site.

The device appears in the Nebula dashboard as a new security router, and the main view can be easily customized. Dedicated widgets are provided for the router’s uptime and firmware status, threat detection by category and client, the top ten apps discovered by the application identification service and an OS chart of connected clients.

For wireless services, you can create up to eight site SSIDs each with their own WPA2 or WPA3 authentication scheme and decide which radios are active on each one. Setting the guest option on an SSID enables L2 isolation so wireless clients can’t see each other. You can assign custom captive portals with your own logos and greeting messages, a walled garden and clickthrough, voucher, Facebook or Nebula authentication.

Wireless performance will depend on whether the application identification service is enabled – when testing Zyxel’s SCR 50AXE desktop router, we found it hit wireless speeds by up to 50%. Fortunately, the USG Lite 60AX has a more powerful quad-core 2GHz CPU so its impact was far less concerning.

We tested with a Lenovo Windows 11 Pro 24H2 client equipped with a TP-Link Archer TBE550E Wi-Fi 7 PCI-E adapter. With application identification disabled, we recorded close-range file copy speeds between the client and a server on the 2.5GbE LAN of 164MB/sec, which dropped by 16.5% to 137MB/sec with it turned on.

The six threat management components are accessed from the Nebula security router settings page and can be enabled or disabled using slider bars. Nebula’s threat report provides an activity graph, a map showing the countries they’re coming from and tables of threats by category and client, with the latter allowing you to instantly block systems if their hit rate is excessive.

Application identification provides options to apply custom app blocking lists and traffic shaping rules for selected clients. The Elite Pack licence is well worth considering as its web content filtering presents 103 URL categories and access can also be fine-tuned for clients or IP addresses.

The USG Lite 60AX is a great entry-level security router, and lifetime support for Zyxel’s Security Cloud service means there are no ongoing costs to worry about. Application identification does have a modest impact on performance but it delivers a fine range of security features, and businesses with remote workers will appreciate Zyxel’s Nebula cloud management.

We also compared the best routers for gaming.