The routers in our catalog run four different operating systems. Ubiquiti's EdgeRouters run EdgeOS, MikroTik's routers run RouterOS, Juniper's SRX firewalls run Junos and Cisco's ISR 2921 runs IOS. Which one you pick decides what you'll learn, so start there. Then look at the ports, whether it has a fan, and how long the software keeps coming.
EdgeRouter X and EdgeRouter 4
Ubiquiti announced its EdgeMAX routers in September 2012, and the EdgeRouter X followed in 2015 as the small, cheap one. It's a palm-sized, fanless box with five gigabit ports, a dual-core 880 MHz chip and 256 MB of RAM, and it draws 5 W at most. EdgeOS gives you static routes, OSPF, RIP and BGP, a zone-based firewall, IPsec and OpenVPN, with no license to buy. Port eth0 takes 24 V passive PoE in and eth4 can pass it on. There's no SFP cage and no console port, so the reset button is your way back in. Ubiquiti warns that its small storage can make a firmware upgrade fail, and deleting the backup image fixes it.
The EdgeRouter 4 came in Ubiquiti's second wave, with its first public firmware in 2017. It has a 4-core 1 GHz MIPS64 chip, 1 GB of RAM and 4 GB of eMMC storage, three gigabit ports, one SFP port and an RJ45 serial console. It's fanless with the power supply inside, takes a plain C13 cord and draws 13 W at most. The console makes it the friendlier lab router of the two when you lock yourself out. Both got EdgeOS 3.0.0 in July 2025, which added WireGuard and a new web UI, and 3.0.1 followed in October 2025.
MikroTik hEX, hAP ac², RB4011 and CCR1009
MikroTik has been writing RouterOS in Riga since the late 1990s, and every MikroTik ships with it licensed. RouterOS has had OSPF and BGP since version 2 in 2001, and the first stable v7 arrived in December 2021 with WireGuard, containers and VXLAN. MikroTik runs its own certifications, starting with the MTCNA, which you need before engineer-level courses like the MTCRE.
The hEX (RB750Gr3) is where a lot of people first meet RouterOS. It came out in 2016 with a dual-core 880 MHz MediaTek chip, 256 MB of RAM, five gigabit ports, a USB port and a microSD slot. It's fanless, runs on anything from 8 to 30 V, has IPsec hardware encryption and carries a Level 4 license. Like the ER-X it has no console port.
The hAP ac² from 2018 puts dual-band AC1200 Wi-Fi in the same kind of fanless box, with five gigabit ports, a USB port for storage or an LTE modem and a Level 4 license. It has no console port. The US version is locked to US channels, and that lock can't be removed.
The RB4011iGS+RM is the step up for ten ports and a 10G uplink without a fan. Its quad-core Cortex-A15 chip has 1 GB of RAM, and it gives you ten gigabit ports, one SFP+ cage, IPsec hardware acceleration, passive PoE out on port 10 and a Level 5 license. The RJ45 console is the Cisco-style type, at 115200 baud with a rollover cable, and the rack ears come in the box.
The CCR1009-7G-1C-1S+ is the big one. Its seven gigabit ports connect straight to a 9-core, 1.2 GHz Tilera CPU, and it adds a combo port, an SFP+ cage, 2 GB of RAM, two AC power supplies and the top Level 6 license. It also has two fans, and its console is RS232, so you'll need a null-modem cable. MikroTik lists it as discontinued but still builds RouterOS v7 for its chip.
Juniper SRX300, SRX210 and SRX240
The SRX300 is the smallest model in Juniper's SRX300 line of branch firewalls. It's a fanless desktop box with six gigabit ports, two SFP ports, 4 GB of memory and 8 GB of flash, and it averages 24.9 W. Juniper rates it for up to 1 Gbps of firewall traffic and 300 Mbps of IPsec VPN. The Standard tier that comes with it covers routing, firewall, switching, NAT, VPN and MPLS. Juniper hasn't announced end of life for it, and it has RJ-45 and mini-USB consoles. It runs the same Junos as Juniper's bigger SRX firewalls, so JNCIA students can practice policies, NAT and IPsec on it.
The older SRX firewalls are out of support. The SRX210H-P-MGW has two gigabit and six Fast Ethernet ports, PoE on four of them and two fans, and it runs from an external adapter Juniper no longer sells. The SRX240H-POE is a 1U rack box with 16 gigabit PoE+ ports sharing 150 W, four Mini-PIM slots and six fans, so in a lab it's a firewall and a PoE switch in one. Junos 12.3X48 support for the SRX200 line, which includes both, ended on November 30, 2024.
Cisco ISR 2921
The ISR 2921 is the pick if you want Cisco IOS. It has three gigabit ports, one of which takes an SFP, and four EHWIC slots that home-labbers fill with serial cards for WAN links. It runs one universal IOS image, with IP Base, Data, Unified Communications and Security packages turned on by licenses tied to its serial number, and it has onboard crypto for IPsec labs. It's a 2U box rated at 54.4 dBA typical and 60 W, so it belongs in a rack. Support ended on December 31, 2022.
Picking one
To start small and silent, get an EdgeRouter X or a hEX. Both are fanless, both have five gigabit ports and neither has a console. If you'd like a console and an SFP port, the EdgeRouter 4 adds both. For ten ports and a 10G link to a switch, the RB4011 does it without a fan. If you want Wi-Fi in the same box, the hAP ac² covers routing, firewall rules and Wi-Fi for MTCNA practice.
For Junos, the SRX300 is the one still supported and it's silent. The SRX240 suits you if you want 16 PoE ports and don't mind six fans in a rack. For Cisco IOS and serial links, the ISR 2921 is the choice. The CCR1009 gives you the most cores and the top license, along with the fan noise of a rack router.
Before it goes on the edge
If the router will face the internet, update it first. EdgeOS updates are free downloads, and MikroTik updates are free for the life of the product or at least five years from purchase. Unpatched MikroTik routers were hit by VPNFilter in 2018 and by the Meris botnet from June 2021, so reset and update any used one. Keep the out-of-support SRX210, SRX240 and ISR 2921 on the lab side of your network. Our license guide explains what end of support means, the quiet gear guide has the noise and power figures, and the checking guide covers resets and console cables.
