Network Equipment Vendors L1-L7
Equipment — 17 vendors and operators, each broken down by layer L1 to L7: what they sell at that layer, and which layer is their home turf.
Cisco
Home turf: L2 / L3
L1 Physical
Cisco's L1 portfolio runs from coherent optical transport (NCS) through optics, nanosecond-class layer-1 switching (Nexus 3550), branch CPE (Catalyst 8000) and wireless radios (Catalyst 9100 / Meraki MR).
L2 Data Link
L2 is Cisco's revenue and technology core: Nexus for the data center and Catalyst for the campus cover the switching needs of most enterprises. The biggest fork in the road here is the fabric architecture — ACI (policy-driven, whitelist by default, deeply tied to Cisco) versus standard VXLAN EVPN on NX-OS (multi-vendor capable, operations on you).
L3 Network
Cisco runs two parallel L3 portfolios: the IOS-XR platforms for carriers and hyperscale (Cisco 8000 / NCS / ASR 9000) and the IOS-XE platforms for enterprises (Catalyst 8000 plus SD-WAN).
L4 Transport
This layer requires an honest statement of a gap: Cisco discontinued the ACE (Application Control Engine) application delivery line back in the 2010s and has not built a standalone load balancer since.
L5 Session
Two things here exist in no other vendor domain. First, the collaboration and voice portfolio (CUCM, Webex Calling, CUBE session border controller) — establishing and maintaining SIP calls is session-layer work by definition, and Cisco has long led that market.
L6 Presentation
Cisco's focus at this layer is not selling cryptography products but keeping certificates working across a large device and collaboration estate — which is also where Cisco operations most often fails: expired certificates on ISE, CUCM and Expressway cause outages practically every year.
L7 Application
Cisco's L7 strengths concentrate in two areas: egress security and experience observability. Umbrella's DNS-layer blocking is one of its most effective security assets, and AppDynamics plus ThousandEyes cover both the application and network sides of user experience.
Cross-layer · Management & Operations
This is where Cisco has invested most recently and where an honest assessment matters most: acquiring Splunk in 2024 filled long-standing SIEM and observability gaps while also creating portfolio overlap.
Arista
Home turf: L3 / L4
L1 Physical
Arista's L1 positioning is clear: Ethernet switching hardware and radio access only, with no optical transport of its own (DWDM and coherent optics are left to third-party pluggables and optical vendors).
L2 Data Link
L2 is Arista's core market and technical foundation. Its central differentiation is not a hardware specification but EOS itself: one image across every platform, built on an unmodified Linux kernel with SysDB for state sharing — an architecture that directly produces advantages in configuration consistency, programmability and upgrade smoothness.
L3 Network
Arista's L3 position is unusual: it does not sell routers but uses deep-buffer, large-FIB switching platforms (7280R/7500R/7800R) to do a router's job — FIBs reaching 2M+ routes can hold a full internet table for peering and metro DCI. The practical payoff is architectural simplification: one 7500R acting as both spine and border removes a network tier.
L4 Transport
Two gaps need stating at this layer: Arista has no load balancer or ADC (and no in-switch traffic distribution feature comparable to Cisco ITD), and no stateful firewall. So L4 forwarding and permitting rely on ECMP/Anycast plus third-party load balancers and firewalls.
L5 Session
Arista's position needs stating honestly at this layer: it is a network infrastructure vendor, with no VPN client, no MFA or identity platform, no PAM and no collaboration products.
L6 Presentation
Arista's own content at this layer concentrates in two areas: line-rate MACsec link encryption (including MKA key agreement, with no extra licence — a cost advantage over some vendors) and the certificate system for devices and CloudVision.
L7 Application
This layer needs stating honestly: Arista has almost no application-layer products. No WAF, no CDN, no DNS security, no email security, no SWG/SASE, no API security, no APM. Only two of its own assets touch this layer — Arista NDR can detect anomalies in some application-layer protocols, and DANZ/DMF can feed traffic to third-party analysis tools.
Cross-layer: Management & Operations
This is Arista's comparatively strongest layer and its core pitch against Cisco: the entire portfolio runs one EOS image (not several coexisting kernels like IOS/IOS-XE/NX-OS/IOS-XR), management converges largely onto CloudVision alone, most routing and EVPN features carry no licence tiers, and the AVD toolchain is open source.
Juniper
Home turf: L3
L1 Physical
Juniper's own content at the physical layer concentrates in hardware platforms and pluggable optics: PTX (backbone), MX (edge and aggregation), QFX (data center), EX (campus), ACX (metro and mobile backhaul) and Mist APs (wireless radio) cover form factors from access to core.
L2 Data Link
Layer 2 is one of Juniper's traditional strengths, centred on EVPN-VXLAN: the Junos EVPN implementation is mature and arrived early, and ESI-LAG multihoming is better standardized than any vendor's proprietary stacking, making it Juniper's most convincing technical asset in the data center.
L3 Network
Layer 3 is Juniper's strongest layer and where it differs most from Arista. The MX series is an industry-classic service edge router with complete carrier-grade coverage of BNG (broadband subscriber management), CGNAT, MPLS/L3VPN and NG-MVPN — precisely the capabilities Arista lacks entirely.
L4 Transport
Juniper has two strengths at this layer: SRX's stateful protection (session table, NAT, connection tracking), a clear contrast with Arista having only stateless ACLs; and MX's hierarchical QoS (HQoS), scheduling by subscriber, service and port, which is the basis of billing for broadband and leased-line services and depends on Trio silicon rather than softwa…
L5 Session
Juniper is far thicker than Arista at this layer: Arista has three outright gaps here (no VPN, no NAC, no ZTNA) while Juniper covers all three — Juniper Secure Connect for remote access VPN, Mist Access Assurance for cloud-hosted admission, and Juniper Secure Edge for SSE/ZTNA.
L6 Presentation
Juniper's own content at this layer covers three areas: MACsec line-rate link encryption, the SRX IPsec implementation with hardware acceleration, and the certificate system for devices and cloud management.
L7 Application
Juniper is thicker than Arista at this layer but clearly behind specialist security vendors. What it has: SRX application identification (AppSecure) and IDP intrusion prevention, ATP cloud threat analysis, Secure Edge egress web control, and the application experience visibility of Mist and Marvis (the SLE framework being genuinely differentiated).
Cross-layer: Management & Operations
This is Juniper's most distinctive layer, holding two assets others cannot easily copy: Apstra's intent-based fabric management (crucially, it supports multiple vendors including Cisco, Arista and SONiC, which is rare among vendor platforms) and Mist's cloud AI operations (the SLE framework and Marvis root cause analysis).
Extreme Networks
Home turf: L1 / L2
L1 Physical
This layer is its hardware line-up, and understanding that line-up starts from one fact: it was assembled almost entirely through acquisition, not grown organically. The four lines each have their own origin: campus switching (from Enterasys, itself a descendant of Cabletron), wireless (bought from Zebra Technologies in 2016, though that business originally…
L2 Data Link
This layer is the other half of this domain's star feature, because it has a technology-lineage story no other equipment domain on this page has: Fabric Connect (built on 802.1aq Shortest Path Bridging), a structured Ethernet fabric technology that originated at Nortel, was sold to Avaya as part of Nortel's enterprise networking assets after Nortel's 2009 ba…
L3 Network
This layer has one specific capability from the Brocade lineage worth remembering: the SLX series (data center and carrier-grade switching/routing platforms) supports a large-capacity FIB that can hold a full internet routing table, giving it a clear position in mid-size data center peering/border-routing scenarios — "cheaper and more open than the majors."…
L4 Transport
This layer is thin: the mechanics are industry-standard QoS and traffic control, already fully covered in this page's other equipment domains, and not repeated here. There is no standalone ADC/load-balancing product — consistent with most pure switching/wireless equipment domains on this page; that need should be routed to a dedicated ADC vendor or an in-clo…
L5 Session
This layer's focus is wireless session management: roaming handoff as clients move between multiple access points, and the mechanism still follows a "controller/cloud management plus access point" architecture — the controller can be on-premises hardware, or it can be the ExtremeCloud IQ cloud management covered in L7.
L6 Presentation
This layer needs one thing stated up front: it is not a deep security vendor. There is no next-generation firewall or deep threat-protection product line — that need should be routed to this page's Palo Alto domain.
L7 Application
This layer is what the domain most wants customers to remember in recent years: ExtremeCloud IQ — a cloud network management platform that tries to unify the four acquisition lineages covered in L1 at the management level.
Accton / Edgecore
Home turf: L1
L1 Physical
This layer needs this company's position in the entire supply chain explained first, because it almost never appears directly in front of the end user: it is one of the world's largest ODM (original design manufacturer) makers of networking hardware, headquartered in Hsinchu, Taiwan — a large number of switches sold under other companies' brand names are act…
L2 Data Link
This layer needs one thing stated up front that differs from every other equipment domain on this page: the hardware itself provides no L2 functionality — capabilities like VLAN, STP and link aggregation are determined by whichever network operating system is installed on the hardware, not by this company itself.
L3 Network
This layer's logic is exactly the same as L2's and the mechanics are not repeated here: L3 routing capability (BGP scale, routing-table capacity, MPLS/SR support) depends entirely on the chosen network operating system, not on any property of the hardware itself.
L4 Transport
This layer follows the same hardware/software division of labor: queue depth and buffer size are physical properties of the hardware (different merchant-chip models have different buffer architectures, which has a real impact under bursty traffic), while QoS policy configuration method and granularity depend on the installed network operating system.
L5 Session
This layer is explicitly empty — no product or service. This domain sells bare hardware with no network operating system; session-layer capability, if any, is entirely determined by whichever third-party NOS the customer chooses, not a product of this company itself — L2, L3 and L6 already explain this hardware/software split repeatedly, and it holds here to…
L6 Presentation
This layer's capability likewise splits into two halves: for line-rate encryption like MACsec to achieve lossless hardware performance, the merchant switching chip itself must have a crypto-processing unit — a physical hardware capability; this page's Arista domain L6 mentions that MACsec can achieve ASIC line rate with almost no added latency, and the same…
L7 Application
This layer needs to explain the most practical cost of the disaggregated model: when something breaks, "who do you call" is no longer a single answer. The hardware and the network operating system come from two different companies, so the first thing to do when a problem occurs is determine whether it's a hardware fault or a software/configuration problem —…
Huawei
Home turf: L1 / L3 / OPS
L1 Physical
This is one of this domain's starred layers, because its physical-layer breadth is in the site's top tier. Three product lines run in parallel: optical transport (WDM and OTN equipment in the OptiX series, for metro and long-haul backbone), fixed access (PON line terminals and subscriber units covering GPON, XGS-PON and newer generations) and wireless access…
L2 Data Link
This layer is the switching portfolio, in two lines: the CloudEngine series for data centres (high density, with VXLAN and EVPN for stretched layer 2 and multi-tenant isolation) and the S series for campus (a wider range of port forms and features, deployed alongside wireless and access control).
L3 Network
This is the domain's second starred layer. The product line is the NetEngine (NE) series of routers, spanning carrier backbone and edge through to enterprise egress. The general mechanics and hard constraints of layer 3 forwarding are already covered on the site — longest-prefix matching depends on expensive TCAM, so table capacity is a hard budget fixed at…
L4 Transport
This layer is the transport-layer part of the security appliance line (the HiSecEngine / USG firewall series): stateful session tracking and access control by five-tuple, which is a firewall's most basic and most used capability.
L5 Session
This layer is explicitly empty — no product or service. This domain has no distinct session-layer product line. Two clarifications for accuracy: the stateful session tracking in its firewalls is already recorded at L4 (that is transport-layer five-tuple state, not an application session), and the encryption and tunnelling in its IPsec and SSL VPN gateways be…
L6 Presentation
This layer has real content, and it bears directly on a long-running conclusion on this site. Most foreign-vendor domains end their L6 saying they do not implement China's SM algorithms, whereas this domain — like the site's H3C and Ruijie domains — provides SM2/SM3/SM4 support and a domestic-compliance position.
L7 Application
This layer is the management and controller stack: the iMaster NCE family, split by scenario into campus, wide-area, data centre and other branches, providing configuration push, telemetry collection, fault analysis and so-called intent-driven automation.
Cross-layer: Vertical Integration, Supply Chain and Availability
This is the domain's third starred layer and the one most relevant to procurement decisions, with three parts. First, the vertically integrated in-house route: the merchant-silicon model documented in the site's Broadcom domain unbundled the network equipment industry into separately purchasable layers (silicon, hardware and operating system bought independe…
H3C
Home turf: L2
L1 Physical
This layer is its hardware lineup, and the coverage is broad by the standards of Chinese vendors. Four pieces. Campus switching hardware: the S-series from access to core — this is its highest-volume line by installed base, and where this domain's weight actually sits.
L2 Data Link
This layer is this domain's center of gravity, and the one it flags as its standout — the software capability of both campus and data-center switching lands here. Three pieces. The Comware operating system: the software foundation running through its switching and routing lines — the key thing to understand is "one system spans switching and routing," which…
L3 Network
The feature list at this layer is fairly complete, and three things are worth calling out individually. First, routing protocols and scale: OSPF, BGP, IS-IS, MPLS and L3VPN are all supported, which is enough within the scale that enterprise and industry customers need — but the carrier-grade, large-scale service edge is not its home turf (see the Nokia domai…
L4 Transport
One thing is worth saying up front at this layer, because it is a substantive difference between this domain and most equipment domains on this site: it has its own load-balancing product.
L5 Session
This layer boils down to two questions — "who can establish a session" and "who is in control" — and for this domain that lands as three product areas. VPN: site-to-site IPsec and remote-access SSL VPN, running on SecPath and the routers — the capability is standard, and what needs stating plainly at this layer is its fundamental difference from the approach…
L6 Presentation
This is the layer that carries the most weight for this domain, because it fills a gap this site has long had. More than a dozen domains on this site have each written some version of the same line at this layer: "for SM cryptography (SM2 / SM3 / SM4), the only domain on this site that fills the gap is Alibaba Cloud" — this domain, the Huawei domain and the…
L7 Application
There is one fact at this layer that has to be stated plainly: its management platform is not singular — there are several. iMC (the long-established network-management platform), U-Center (the newer unified-operations direction), Lvzhou (Oasis, cloud-managed), and SeerEngine (the fabric controller, see L5) — these platforms target different scenarios and di…
Ruijie
Home turf: L1 / L2
L1 Physical
This is the layer most worth reading first for this domain, and it's exactly where the contrast with the H3C domain on this site begins. Three pieces. Wireless hardware and per-room coverage: this is this domain's most distinctive offering, and what sets it apart from other Chinese vendors — it turned "one antenna per room" into a packaged product (the Smart…
L2 Data Link
This layer is a co-equal center of gravity with L1 for this domain, with three pieces. RGOS and Layer 2 fundamentals: its own network operating system, running through the switching and gateway product lines — the same value proposition as Comware in the H3C domain on this site (one system spans multiple device types, operational experience migrates), though…
L3 Network
This layer's weight needs stating plainly first, because it's thinner than L1 and L2, and being upfront about thinness is more useful than padding it out. Three pieces. Campus Layer 3 design: its Layer 3 capability mainly lives on Layer 3 switches, not dedicated routers — in typical scenarios like campus networks, hotels and chain stores, cross-subnet forwar…
L4 Transport
One thing needs stating plainly first at this layer, because it's a substantive difference between this domain and the H3C domain on this site: it has no server load-balancing product line.
L5 Session
This is the strongest software layer for this domain, because its home market has pushed authentication to a depth rarely seen elsewhere. Three pieces. Authentication, billing and admission: its most distinctive software line — in Chinese universities, its authentication client is a shared memory across generations of students, and behind it is a system stri…
L6 Presentation
At this layer, this domain is the second in a thread that started with the H3C domain on this site, so the mechanics aren't repeated here — only the differences. State the common ground first: it, the Huawei domain and the H3C domain are this site's three equipment-vendor domains that make SM cryptography and domestic-stack compliance a core selling point —…
L7 Application
This is the thinnest layer for this domain, and being upfront about that thinness is the most useful part of this section. Three pieces. Management and operations platforms: device management, topology, alerting, configuration push, and a cloud-managed form factor — adequate for day-to-day operations in its home scenarios, but there is again more than one pl…
Ubiquiti
Home turf: L1 / L7
L1 Physical
This layer is the entry point for understanding this company, because the reason its hardware is cheap is not subsidy but a radically lean business model: no traditional enterprise direct-sales team, distribution mainly through online and reseller channels, very low marketing spend, and founder Robert Pera (a former Apple wireless engineer) remains CEO to th…
L2 Data Link
This layer covers UniFi switches' standard capability: VLAN segmentation, link aggregation, PoE power — the mechanics are no different in kind from this page's other equipment domains, just priced an order of magnitude lower.
L3 Network
This layer covers the UniFi gateway/router product line's standard capability, meeting routing needs for small and mid-size scenarios. For the larger-scale wireless ISP (WISP) scenario, there is a dedicated management platform — UISP — a sibling to the single-site-focused UniFi but with a different positioning: UniFi is for unified management of network and…
L4 Transport
This layer is thin: basic QoS and traffic priority marking are baseline capabilities, with mechanics matching this page's other equipment domains, and not repeated here. There is no standalone ADC/load-balancing product — that need should look at a dedicated ADC vendor or an in-cloud load balancer.
L5 Session
This layer covers UniFi wireless's roaming handoff capability, with mechanics matching standard industry practice: multiple APs are managed uniformly by the same UniFi controller, and the handoff experience as a client moves between APs depends on the controller version and AP hardware generation — it's recommended to run real-device roaming tests before for…
L6 Presentation
This layer needs two things stated plainly, both of which buyers should know before purchase rather than discover after the fact. First, the boundary of its security capability: there is no next-generation-firewall-level deep threat protection — that need should look at this page's Palo Alto domain; basic threat management and intrusion detection features ar…
L7 Application
This layer is the other half of this domain's star feature: UniFi OS — a software platform that unifies network, security cameras (UniFi Protect), access control (UniFi Access) and phone systems (UniFi Talk) under one console, a combination that's hard to find among competitors at this price point.
NETGEAR
Home turf: L1 / L7
L1 Physical
This layer needs its origin story told first, because this history is unusual: it started in 1996 as a business unit inside Bay Networks; Bay Networks was acquired by Nortel in 1998, and shortly after, co-founder Patrick Lo led a management buyout that spun it out as an independent company — Patrick Lo remains chairman and CEO to this day, an unusually long…
L2 Data Link
This layer covers NETGEAR for Business switches' standard capability: two tiers, Smart and Fully Managed, with VLAN, link aggregation and PoE power as baseline features. As with this page's TP-Link and Ubiquiti domains, there is a gap between feature names and enterprise-grade implementation depth, and spec ceilings need to be verified model by model — this…
L3 Network
This layer covers the standard L3 capability of consumer routers and business switches: the home product line's (Orbi, Nighthawk) routing function is aimed at a single-residence scenario, with NAT and basic firewall rules as baseline features; the business product line's L3 capability is closer to the small/mid-size-scenario routing covered in this page's Ub…
L4 Transport
This layer is thin: basic QoS and traffic priority marking (prioritizing gaming/video traffic) are baseline capabilities across both the consumer and business product lines, with mechanics matching this page's other equipment domains, and not repeated here.
L5 Session
This layer covers Orbi's core technical differentiator: a dedicated backhaul channel — beyond the usual 2.4GHz/5GHz traffic channels, some models carve out an additional, independent band dedicated to carrying mesh backhaul traffic between the router and satellite nodes, without consuming the traffic channels' bandwidth.
L6 Presentation
This layer needs to state plainly a problem shared across the entire consumer networking-equipment category, rather than treating it as a defect unique to this company: firmware-update support lifecycle is the thing most worth watching over long-term use, not today's feature list — the typical end state for a consumer router is often not hardware failure but…
L7 Application
This layer is the other half of this domain's star feature: Insight — a cloud management platform for NETGEAR for Business switches and wireless access points, a completely different piece of software from the Nighthawk/Orbi app used by the consumer product line.
Aruba
Home turf: L1 / L6
L1 Physical
This layer needs its brand-absorption direction explained first, because it runs opposite to the usual acquisition logic: after being acquired by HP in 2015 (the same year HP split into HP Inc.
L2 Data Link
This layer covers standard campus L2 capability: VLAN, link aggregation, PoE power — the mechanics are enterprise-grade baseline, no different in kind from this page's Cisco and Arista domains, and not repeated here.
L3 Network
This layer covers standard L3 routing capability for campus and branch scenarios, with mechanics matching this page's other enterprise equipment domains, and not repeated here. Large-capacity backbone routing is not a product focus for it — that need should look at this page's Juniper domain's PTX/MX series (now under the same HPE parent, but the product pos…
L4 Transport
This layer is thin: the mechanics are industry-standard QoS, already fully covered in this page's other equipment domains, and not repeated here. There is no standalone ADC/load-balancing product — that need should look at a dedicated ADC vendor or an in-cloud load balancer.
L5 Session
This layer covers Aruba EdgeConnect — its SD-WAN product line, which came from Silver Peak, acquired by HPE in 2020. The mechanics resemble the managed SD-WAN covered in this page's carrier domains, and the core questions are still the same three: whose technology is underneath, how is the boundary drawn, and how long does a change take — the answer here is…
L6 Presentation
This is the other star layer of this domain: ClearPass — a product that has long stood as one of the two dominant enterprise network access control (NAC) platforms (the other being Cisco ISE).
L7 Application
This layer covers Aruba Central — unifying wired switches, wireless access points and SD-WAN (EdgeConnect, see L5) into one cloud management interface, paired with AI-driven fault analysis.
Calix
Home turf: L1 / L7
L1 Physical
This layer's underlying technical mechanics — the fiber-to-the-home PON architecture, the division of labor between the carrier-end OLT and the household-end ONT, and the GPON-to-XGS-PON generational progression — are already fully covered in this page's Nokia domain L1, with identical mechanics, and are not repeated here.
L2 Data Link
This layer covers the standard Ethernet aggregation capability on the access-network side, with mechanics matching this page's Nokia domain, and not repeated here: user traffic from multiple PON ports is aggregated at the carrier-end equipment into upstream Ethernet, handed off to the operator's own core network for processing.
L3 Network
This layer is thin: the mechanics are standard L3 capability for access-network equipment — IP address assignment, basic routing — matching this page's other access-equipment domains, and not repeated here.
L4 Transport
This layer is thin: the mechanics are standard bandwidth-management capability for access-network equipment, already fully covered in this page's other equipment domains, and not repeated here. There is no standalone ADC/load-balancing product — that need is outside this domain's product scope.
L5 Session
This layer is explicitly empty — no product or service. This domain's product focus has always been last-mile access hardware and the operator's subscriber-engagement platform (see L7) — no managed SD-WAN or remote-access product for enterprises, since its customers are broadband operators, not enterprises needing to network their own sites.
L6 Presentation
This layer's situation matches most access-equipment domains on this page: there is no next-generation-firewall-level deep threat protection — that need should look at this page's Palo Alto domain.
L7 Application
This layer is where this domain's strategic pivot in recent years has landed: from "selling access hardware" to "selling the operator's business-operations platform" — this pivot is different in nature from the cloud management platform stories told by this page's other equipment domains, and is worth explaining on its own.
F5
Home turf: L4 / L6 / L7
L1 Physical
This layer is thin, stated plainly: its hardware is the BIG-IP line of integrated ADC appliances (i-series, rSeries), and the differentiation isn't in the physical layer itself but in the dedicated SSL/TLS crypto silicon and forwarding engine built into the box — that's covered in full at L6 and L4, not repeated here.
L2 Data Link
This layer is explicitly empty — no product or service. It doesn't do layer-2 switching — a BIG-IP device's role in the traffic path is always layer-3 and above (GSLB, layer-4 load balancing, layer-7 application processing), with no standalone Ethernet switching/VLAN product; that need should look to switch vendors like this page's Cisco and Arista domains.
L3 Network
This layer is centered on BIG-IP DNS (formerly GTM) — DNS-response-based Global Server Load Balancing (GSLB), the classic approach for active-active local data centers. It links with local LTM, sensing real backend health rather than doing static DNS resolution alone — that's its real advantage over pure DNS-provider GSLB products.
L4 Transport
This is one of this domain's star layers: core load balancing (LTM) and layer-4 protection (AFM). LTM is its original product and still its most central one today — L4-L7 traffic distribution, health checks and session persistence, with iRules programmability letting it handle custom logic that standard load-balancing algorithms can't reach — this is the dir…
L5 Session
This layer covers session persistence — whether a given user's subsequent requests keep landing on the same backend server. This is a hard requirement for stateful applications (shopping carts, login sessions cached in local memory); the mechanics themselves are standard, but the choice of implementation affects reliability and how flexibly you can scale the…
L6 Presentation
This is this domain's earliest, and most enduring, core differentiator: SSL/TLS hardware offload. It originally built its market position on a specific performance pain point — 'servers doing their own TLS crypto is too slow, offload it to dedicated hardware' — and the crypto performance edge dedicated silicon provides remains, to this day, its most direct s…
L7 Application
This is this domain's third star layer: application-layer security and its modern API/cloud-native product lines. On the traditional hardware side there's Advanced WAF (formerly ASM), which integrates seamlessly with existing BIG-IP deployments and supports custom policy; after acquiring NGINX in 2019 it simultaneously gained a cloud-native/API-first softwar…
A10 Networks
Home turf: L3 / L4
L1 Physical
This layer is thin, stated plainly: its hardware is the Thunder line of integrated appliances, covering three product lines — ADC, DDoS protection (TPS) and carrier-grade NAT (CGN) — sharing the same hardware platform.
L2 Data Link
This layer is explicitly empty — no product or service. It doesn't do layer-2 switching — a Thunder device's role in the traffic path is layer-3 and above (CGNAT, layer-4 load balancing, DDoS protection), with no standalone Ethernet switching/VLAN product; that need should look to switch vendors like this page's Cisco and Arista domains.
L3 Network
This is one of this domain's star layers: carrier-grade network address translation (CGNAT). After public IPv4 address exhaustion, carriers need large numbers of users to share a small pool of public addresses, and CGNAT is the core device that solves this problem — this product line is where it stands out relative to this page's F5 domain, and the direct re…
L4 Transport
This is another star layer for this domain: core ADC load balancing and dedicated DDoS protection (Thunder TPS). The ADC side's mechanics are similar to this page's F5 domain's LTM (L4-L7 traffic distribution, health checks, session persistence), typically at a more competitive price; Thunder TPS is a dedicated distributed-denial-of-service protection produc…
L5 Session
This layer is explicitly empty — no product or service. L7 already states plainly that it has no cloud-native software line comparable to this page's F5 domain's NGINX/Distributed Cloud, and the session layer is the same story — its core capability is concentrated in L3 CGNAT and L4 ADC/DDoS protection, and doesn't extend to session-layer services like manag…
L6 Presentation
This layer's focus is SSL Insight — a product purpose-built for centralised decryption, distributing plaintext traffic to other security tools for inspection, positioned similarly to the traffic-visibility platform covered in this page's Gigamon domain but implemented differently: Gigamon taps traffic out-of-band for analysis, while SSL Insight sits inline i…
L7 Application
This layer covers standard management and support, with mechanics no different in substance from this page's other equipment domains: a web management interface, a REST API, and a centralised management platform for multi-device scenarios (Harmony Controller).
Ciena
Home turf: L1
L1 Physical
This layer is the whole centre of gravity for this company, and this is the only domain on the site that covers optical transport equipment itself in depth. When the equipment domains here (see the Cisco, Juniper and Arista domains at L1) reach long-haul, complex WDM and optical-layer protection, they all point at 'you need a specialist optical transport ven…
L2 Data Link
This layer is much thinner than L1 and concentrates on one thing: putting Ethernet services into optical transport channels. What a customer hands over is an Ethernet port, while the network inside runs OTN and wavelengths, and the mapping and encapsulation in between is the whole substance of this layer. Three blocks.
L3 Network
This layer is thin, and the reason is clear: it is an optical transport vendor and routing is not its battlefield. Its packet products support IP/MPLS and segment routing for layer 3 forwarding in metro aggregation and mobile backhaul, but feature breadth, software maturity and ecosystem do not compare with the specialist routing vendors here (see MX/PTX in…
L4 Transport
This layer is explicitly empty — no product or service. This domain is an optical transport equipment maker whose business is lighting somebody else's fibre and wringing as much capacity out of it as possible — it makes no layer-4 session/connection-management or load-balancing product; that capability belongs to this page's switch-and-router domains and sec…
L5 Session
This layer is explicitly empty — no product or service. Same as L4: its centre of gravity is physical-layer optical transport hardware and its in-house coherent optical DSP; its packet/routing and software lines are real but far smaller than its optical transport core business, and it has no session establishment/maintenance product at this layer.
L6 Presentation
This layer has real products, and its position here is unusual: it puts encryption in the optical layer. Most domains on this site land encryption at IPsec on the end devices or TLS in the application (see the six or seven versions of the 'is not encryption' thread), whereas this domain sells wire-speed encryption between coherent transceivers — data is ciph…
L7 Application
This layer is its software line — far smaller than the hardware, yet weighty in a project, because a WDM network is close to unoperable without a graphical tool. Two blocks. Domain management (MCP): manages its own equipment for topology discovery, service turn-up, alarm correlation and performance collection — tools of this kind matter more in optical trans…
Cross-layer Ops & Governance
This layer covers three fundamental operational differences between buying this class of equipment and buying switches and routers. First, procurement is a project rather than an order: an optical transport project involves light path design, site survey, construction and commissioning, with timelines in months — the same rhythm as the carrier delivery cycle…
Nokia
Home turf: L1 / L3
L1 Physical
This is the widest physical layer on the site, because this company runs four businesses that elsewhere belong to different companies. Four blocks. Radio access equipment: base station hardware and radio units — but one thing must be cleared up first, because it is easily confused here.
L2 Data Link
The content here splits in two by buyer, and reading them together gets confusing. The carrier side is the bulk: delivery of Carrier Ethernet services (point-to-point and multipoint Ethernet, bandwidth profiles, performance monitoring, matching the MEF definitions) — this is how the services sold in AT&T L2, NTT L2 and GCX L2 are implemented on the equipment…
L3 Network
This is its strongest line after radio, and where this domain's second star sits. Its strength has two concrete sources. First, in-house forwarding silicon: its FP series routing chips are its own design — a third path alongside Ciena's in-house coherent DSP and Arista's use of merchant silicon — and owning it gives an independent cadence on routing table ca…
L4 Transport
There are two real blocks here, serving entirely different settings. First, layer 4 capability on the routing platforms: DiffServ marking and trust boundaries, hierarchical scheduling, and connection-level handling — the same set described in several equipment domains here, so the experience transfers directly (see Juniper L4, Cisco L4, Arista L4).
L5 Session
This is the most distinctive layer in the domain, because it covers something no other domain here does: the mobile core network. If base stations (see L1) get a handset onto the network, the core network handles who this subscriber is, what they may use, where they are and how they should be billed — it is the brain of a mobile network and the carrier's rea…
L6 Presentation
This layer is explicitly empty — no product or service. It spans four businesses — radio, optical transport, IP routing and fixed access — but has no standalone presentation-layer encryption product; PON downstream encryption and isolation (see L2) is a mechanism built into the access technology itself, not a separately sold presentation-layer capability.
L7 Application
This is its software and security line — far smaller than the hardware, yet weighty in a carrier project. Three blocks. Network management and automation: managing its own four lines of equipment — and this is harder here than at a single-line vendor, because radio, optical transport, routing and fixed access have inherently different management models, so h…
Cross-layer Ops & Governance
Three things here differ from the other equipment domains on this site and each deserves separate treatment. First, procurement runs on multi-year framework contracts: carrier network builds are planned by the year, and equipment is usually bought under a three-to-five-year framework with orders released annually — so the decisive moment for negotiation is t…
TP-Link
Home turf: L1 / L2
L1 Physical
This domain reads differently from every other equipment-vendor domain on this site, and the first section exists specifically to explain why. This site's other equipment-vendor domains (Cisco, Juniper, Arista, Nokia, Ciena, H3C, Ruijie) are all centred on carriers and enterprises, while this domain is centred on homes and small businesses — and that is exac…
L2 Data Link
All three sections in this layer cover different faces of the same thing: the feature name is the same, but the depth of the implementation isn't — and not knowing that leads to the wrong design.
L3 Network
This layer's third section is the one in this domain most worth reading, so it comes first here: firmware lifecycle and exposure. Its role at Layer 3 is a gateway, not a router: its main capability is NAT, and even where dynamic routing exists it shouldn't be used with an enterprise router's expectations; this section also has to explain the highest-frequenc…
L4 Transport
All three sections in this layer cover things that don't show up on a spec sheet but that you will actually run into — and the last two are two hidden bottlenecks specific to this tier of device.
L5 Session
This layer has two sections, and that's an honest count: this tier of device's session-layer capability is just these two areas, and padding it out would only dilute it. What its tunnels can really do: they're usable, and the limits sit in three places — throughput is CPU-bound (following on from L4's third section), concurrency is low, and certificate and k…
L6 Presentation
This layer has two sections, and it's honestly kept thin. Wireless encryption and the shared-password problem: once the choice between encryption generations and transitional modes is covered, the focus of this section is a management problem, not a technical one — one password shared by everyone, and after an employee leaves, a guest has visited, or a contr…
L7 Application
This layer has two sections, and the last point in the second one is the closing judgment for the entire domain, so it's the single thing most worth reading here. The limits of the management interface and observability: what you get is a status page, limited logging and basic statistics; what you don't get is historical trend data, packet capture, or per-fl…