OPNsense® DEC2687 – 19-inch 1U rack appliance with 5 Gbps and only 153 mm depth
Four 2.5-gigabit ports, 5000 Mbps firewall throughput, 600 Mbps IPsec, 8 GB DDR3 and 256 GB M.2 flash – in a 1U rack enclosure just 153 mm deep.
The DEC2687 uses an AMD G-Series SOC with four cores up to 1.8 GHz on the Netboard A8. OPNsense® is preinstalled and one year of the Business Edition is included. Deciso states up to 50 percent higher firewall throughput than the previous DEC2685. The appliance is developed, manufactured and shipped by Deciso in the Netherlands.
Six reasons for the DEC2687
5000 Mbps firewall throughput
420 kpps, 2.3 Gbps port to port, 125 µs round-trip latency.
Only 153 mm deep
Fits a shallow telecom cabinet in which standard 19-inch appliances do not.
Four 2.5-gigabit ports
4 × RJ45 at 100/1000/2500 Mbps, freely assignable, plus one USB and one console port.
13 watts in typical operation
Around 25 to 35 euros of electricity per year at common commercial tariffs.
7 million concurrent sessions
Limited by the available memory according to the manufacturer footnote, here 8 GB DDR3.
Made in EU, two-year warranty
Carry-in and return warranty direct from Deciso, including one year of OPNsense® Business Edition.
Typical applications
- Firewall and routing on connections up to 2.5 gigabit
- Branch offices and small sites with a shallow telecom cabinet
- IDS/IPS with Suricata and web proxy at around 540 Mbps
- IPsec site-to-site links at up to 600 Mbps
- Replacing an ageing DEC2685 with the same rack footprint
- Redundant operation with state synchronisation, two units required
Application scenarios are recommendations by inett based on the performance data, not statements by the manufacturer.
Full specifications
| Preinstalled software | OPNsense®, Open Source + 1 year Business Edition |
| Typical applications | Firewall / routing, VPN, IDPS and web proxy |
| Processor | AMD G-Series SOC, 4 cores, up to 1.8 GHz |
| Board | Netboard A8 |
| Memory | 8 GB DDR3 |
| Internal storage | 256 GB solid state flash |
| RJ45 ports (100/1000/2500 Mbps) | 4 × 2.5 GbE |
| USB ports | 1 |
| Console port | 1 |
| VLANs (802.1q) | 4,093 |
| Firewall throughput | 5000 Mbps |
| Firewall packets per second | 420 kpps |
| Port-to-port throughput | 2.3 Gbps |
| Port-to-port packets per second | 195 kpps |
| IPsec VPN throughput (AES256GCM16) | 600 Mbps |
| IPsec VPN packets per second | 50 kpps |
| Threat protection (IDS/IPS) | approx. 540 Mbps (50 kpps) |
| Concurrent sessions | 7,000,000 |
| New connections per second | 35,000 |
| Firewall latency (RTT) | 125 µs |
| Firewall rules (recommended maximum) | 10,000 |
| High availability | with state synchronisation, two units required |
| Form factor | 19-inch rack mountable, 1U |
| Dimensions (H × W × D) | 43.8 × 482.6 × 153 mm (excluding handles) |
| Weight | 2.1 kg |
| Power supply | 100–240 V AC, 50–60 Hz |
| Maximum current (AC) | 0.8 A |
| Power consumption | 13 W typical |
| Heat dissipation | 44 BTU/h |
| Operating temperature | 0 to +45 °C |
| Storage temperature | −20 to +70 °C |
| Humidity | 10–90 %, non-condensing |
| Certifications | CE, FCC part 15 Class A, RoHS |
Package contents
- 19-inch 1U rack appliance
- Matching power cord
- Configuration cable
- Quick start guide
Warranty and support
Two-year carry-in and return warranty from Deciso, including one year of the OPNsense® Business Edition with the commercial firmware repository, GeoIP database and the free professional plugins. inett supports sizing, commissioning and day-to-day operation, with monitoring and maintenance on request.
Frequently asked questions
Which internet connection can the DEC2687 serve?
Deciso states 5000 Mbps firewall throughput at 420 kpps and 2.3 Gbps port to port. Over IPsec with AES256GCM16 it is 600 Mbps, with threat protection around 540 Mbps.
How does the DEC2687 differ from the DEC2685?
Deciso lists the DEC2687 as the new model of the DEC2600 2.5GbE series and states up to 50 percent higher firewall throughput than the previous DEC2685. Enclosure and rack depth stay the same.
Is OPNsense already installed?
Yes. OPNsense® is preinstalled and one year of the Business Edition is included. That covers the commercial firmware repository, the integrated GeoIP database and the free professional plugins.
Can two units run redundantly?
Yes. Deciso lists high availability with state synchronisation. Two appliances are required for it.
Shall we check the sizing together?
We compare line speed, number of users, VPN load and planned services against the performance data. A short message is enough.
More throughput and SFP+ needed?
All measurements refer to TCP traffic unless stated otherwise. The maximum packet rate is a peak value measured with 500-byte packets. Port-to-port packets per second is the peak value with 1500-byte packets. Total firewall throughput is calculated from the maximum packet rate and 1500-byte packets. IPS performance was measured with approximately 35,000 rules enabled. IPsec VPN was measured with AES256GCM16 and SHA512. Concurrent sessions follow from the available memory, where one state occupies 1 KB and 1 GB is reserved for system tasks. Latency was measured with netperf. Source of all technical data: Deciso product page.