- ◆The right tier is decided by where the gateway sits and how it will grow — edge, regional aggregation, or core — then confirmed against the numbers.
- ◆ISG 7010 (1RU): up to 3,000 IPsec tunnels, 1,000 tunnels/sec setup, 100 Gbps — the compact choice for edge and distributed sites.
- ◆ISG 7015 (2RU): up to 10,000 tunnels, 3,000 tunnels/sec setup, 400 Gbps — the regional-aggregation and cloud-native choice.
- ◆ISG 7030 (2RU): up to 1,000,000 tunnels, 3,000 tunnels/sec setup, 800 Gbps, plus built-in DDoS mitigation and N+1 power — the core / high-resilience choice.
- ◆The three specs do not scale together: throughput rises up to 8×, tunnel capacity rises far more steeply, and setup rate plateaus after the 7015. Size against whichever one actually binds your deployment.
Buying a security gateway usually starts the wrong way: someone lines up datasheets, compares the biggest number, and picks the winner. That's how networks end up over-provisioned at one site and under-provisioned at another six months later. All three Nybsys Aegis tiers — the ISG 7010, 7015, and 7030 — are carrier-grade security gateways (SecGW) that terminate IPsec at the boundary in front of your Evolved Packet Core or 5G core. What separates them is fit. This guide is about choosing the right fit — and reading the specs the right way.
Start With Fit — Then Read How the Specs Actually Scale
A security gateway isn't a generic appliance you size by one metric, and it isn't just a bigger VPN box. The most useful thing to understand before you compare this family: the three headline specs don't scale in step with each other.
- ▸Encrypted throughput climbs 100 → 400 → 800 Gbps — up to 8× from the 7010 to the 7030.
- ▸Concurrent tunnel capacity climbs far more steeply: 3,000 → 10,000 → 1,000,000. The jump from 7015 to 7030 is two orders of magnitude, while throughput only doubles across the same step.
- ▸Tunnel setup rate climbs once and then plateaus: 1,000/sec on the 7010, 3,000/sec on both the 7015 and 7030.
That asymmetry is the whole decision. Because the curves differ, the tier you need is set by whichever spec binds your deployment first — and it often isn't the one you'd assume. A site with modest bandwidth but heavy churn (nodes constantly connecting and reconnecting) can be pushed to the 7015 by setup rate alone, long before throughput matters. A core boundary holding an enormous tunnel table needs the 7030 for the 1M capacity, even though its throughput is only double the 7015's. Find your binding constraint first; the tier follows.
Match the Tier to Where It Sits in Your Network
ISG 7010 — Compact Edge and Distributed Sites (1RU)
The 7010 is the compact, 1RU member of the family, built for the edge and distributed sites where rack space and power are constrained. It handles up to 3,000 IPsec tunnels at a 1,000 tunnels/sec setup rate with 100 Gbps of encrypted throughput — sized for aggregating a cluster of small cells, macro sites, and distributed radio units close to where traffic originates, at the radio edge. Choose it when the site count per gateway is moderate and footprint matters more than headroom.
ISG 7015 — Regional Aggregation and Cloud-Native Scale (2RU)
The 7015 is a 2RU, dual-blade platform that lifts every axis: up to 10,000 tunnels, a 3,000 tunnels/sec setup rate, and 400 Gbps of encrypted throughput. The setup-rate jump is the one people overlook — it's 3× the 7010's, which is what makes the 7015 the right answer for churny, high-reconnect environments even when raw bandwidth wouldn't demand it. It's also built for operators running security as a virtualized or cloud-native function, supports mainstream hypervisors and hybrid cloud, and is engineered to Network Equipment-Building System (NEBS) expectations.
ISG 7030 — Core and DDoS-Exposed Boundaries (2RU)
The 7030 shares the 2RU dual-blade architecture and the 3,000 tunnels/sec setup rate of the 7015, and doubles throughput again to 800 Gbps — but its defining number is tunnel capacity: up to 1,000,000 concurrent IPsec tunnels, two orders of magnitude beyond the 7015. Add built-in DDoS attack mitigation, N+1 power, and public-cloud deployment support, and it's the tier for the core itself: the largest tunnel tables, the strictest availability, and real volumetric attack exposure.
The Comparison That Matters
These are the selection-deciding figures; full specifications — NIC/line-card modules, routing, interfaces, and test conditions — are in each datasheet.
| ISG 7010 | ISG 7015 | ISG 7030 | |
|---|---|---|---|
| Form factor | 1RU | 2RU, dual-blade | 2RU, dual-blade |
| Best-fit position | Edge / distributed sites | Regional aggregation | Core / high-resilience |
| Concurrent IPsec tunnels | up to 3,000 | up to 10,000 | up to 1,000,000 |
| Tunnel setup rate | 1,000 tunnels/sec | 3,000 tunnels/sec | 3,000 tunnels/sec |
| Encrypted throughput | 100 Gbps | 400 Gbps | 800 Gbps |
| Deployment model | Appliance | Appliance / virtualized / hybrid cloud | Appliance / virtualized / public cloud |
| DDoS mitigation | — | — | Built-in |
| Standout | Compact footprint for the edge | 3× setup rate and 4× throughput over the 7010 | 1M tunnel scale + DDoS + N+1 resilience |
The key read: each step up buys a different thing. 7010 → 7015 is the balanced jump — 3× the setup rate, 4× the throughput, 3.3× the tunnels — which is why it's the upgrade most growing regional footprints actually need. 7015 → 7030 is a specialist jump: throughput only doubles and setup rate doesn't move, but tunnel capacity goes up 100× and you gain DDoS mitigation and N+1 power. Pay for the 7030 when you need tunnel-table scale or core resilience — not when you simply need more bandwidth.
The Criteria That Confirm the Choice
Once deployment position and your binding spec point at a tier, four questions confirm it:
- ✓Growth model. Size for where the site is heading. If a location's tunnel count is climbing toward the 7010's 3,000 ceiling — or its reconnect churn is brushing 1,000/sec — the 7015 is cheaper than a forced swap later, the same logic behind the signs a network has outgrown its gateway.
- ✓Operating model. If you're standardizing on virtualized or cloud-native network functions, that points to the 7015/7030 line rather than a fixed appliance.
- ✓Threat exposure. If the boundary is a realistic DDoS target, the 7030's built-in mitigation is a selection criterion, not a nice-to-have.
- ✓Manageability at scale. Across dozens or hundreds of gateways, consistent management, telemetry, and automation matter as much as raw capacity — plan for how the fleet is operated through your network management system, not just how one box performs.
Avoiding the classic evaluation errors is its own topic — see 5 security gateway deployment mistakes.
How to Size It: Bring Your Traffic Model, Not a Benchmark Request
Headline figures set the envelope, but they don't tell you how a tier behaves on your traffic. Encrypted throughput is a whole-pipeline outcome that degrades in ways a single line-rate number never shows — which is exactly why IPsec throughput breaks down under 5G load if you size on the wrong metric. A rating measured on large packets can look very different under small-packet, high-tunnel-count load.
So validate with a matrix, not one hero test: representative packet sizes (including small-packet stress), realistic active tunnel counts, re-key behavior under load, and failover. IPsec follows the IETF security architecture in RFC 4301[1], and in mobile networks the SecGW terminates those tunnels at the network-domain boundary described in 3GPP TS 33.210[2] — so test the tier the way it will actually run. And treat security assurance as a separate check from performance: ask whether the platform has been assessed against an independent baseline such as GSMA's NESAS[3].
See the Full Specs for Your Deployment
Once you know which tier fits, the datasheet gives you the complete specifications — NIC/line-card options, interfaces, and the test conditions behind the figures. Request the ISG datasheets or a demo and we'll help match the tier to your deployment.
Request the ISG datasheets or a demoFrequently Asked Questions
How do I choose between the ISG 7010, 7015, and 7030?+
Start with where the gateway sits, then identify which spec binds you. The 7010 (1RU — 3,000 tunnels, 1,000/sec setup, 100 Gbps) fits edge and distributed sites; the 7015 (2RU — 10,000 tunnels, 3,000/sec setup, 400 Gbps) fits regional aggregation and virtualized deployments; the 7030 (2RU — 1,000,000 tunnels, 3,000/sec setup, 800 Gbps, plus DDoS mitigation) fits the core and high-resilience boundaries.
Do the three tiers differ in throughput?+
Yes — significantly. Encrypted throughput scales 100 Gbps on the 7010, 400 Gbps on the 7015, and 800 Gbps on the 7030: up to 8× across the range. But throughput isn't the only axis that moves, and it isn't always the one that decides your tier — tunnel capacity and setup rate scale on different curves.
What is the main difference between the 7015 and the 7030?+
Tunnel scale and resilience, more than speed. Both share the 2RU dual-blade architecture and a 3,000 tunnels/sec setup rate. The 7030 doubles throughput (400 → 800 Gbps) but raises concurrent tunnel capacity from 10,000 to 1,000,000, and adds built-in DDoS mitigation plus N+1 power.
Which spec should actually drive my decision?+
Whichever one binds your deployment first. If you're bandwidth-constrained, throughput decides. If you hold a very large, stable tunnel table, capacity decides. If nodes constantly connect and reconnect, setup rate decides — and that can push a low-bandwidth site up to the 7015 (3,000/sec) even though the 7010's 100 Gbps would be plenty.
How should I size the gateway for my network?+
Test against your own traffic model — packet mix, active tunnel count, re-key behavior, and failover — not a single peak benchmark. Size for your growth curve, not just today's load, and validate security assurance separately from performance.
References
- IETF RFC 4301 — Security Architecture for the Internet Protocol — datatracker.ietf.org/doc/html/rfc4301
- 3GPP TS 33.210 — Network Domain Security; IP network layer security (Security Gateway role) — 3gpp.org/DynaReport/33210.htm
- GSMA — Network Equipment Security Assurance Scheme (NESAS) — gsma.com/security/network-equipment-security-assurance-scheme