my love affair with the drayteks could soon be coming to an end. yes they are great routers and i will continue to use them in small offices etc
but a head office? they just don't cut it. we've outgrown a 2950. the fact that they don't support 802.1q vlans is extremely limiting for what draytek call an enterprise router.
coupled with that, subnetting via variable length has some strange results in that the subnets can bypass the switch processor and go to the router processor (as they should) but the comunicate with each other if on a /24 subnet!!
incoming ipsec's cannot be limited to a specific port or vlan either which is a must for me.
what you get in a 3300 is taken away in another router.
so, i don't think i'll be investing in anything more than a 2820 for the forseeable future.

most of what you're saying goes over my head but it would be good/essential to limit access to ipsec VPN's to certain vlan's. ie one vlan can go out via lan-lan vpn to head office and one vlan can only get onto the internet.

jeff

I'm not sure how supporting 802.1q trunks would be required unless you were stuck with having to use a router on a stick implementation to route between VLAN's and would you really want to do this on a Draytek router?

I'm sorry I don't really know what you mean.

I want visitors to my offices to be able to only access the internet and staff to be able to access other offices across VPN's.

I thought that was Louis was talking about when he said "incoming ipsec's cannot be limited to a specific port or vlan"

jeff

Those features might not be supported but what product does the same plus those features which isn't twice the price ?

The Vigor3300V does do 802.1q tagging.