I have had the pleasure of working with a ZyWALL USG60W and I have to say that it's a very powerful and quite impressive device. It packs TONS of features into one box which was very surprising to me.
I'm never one for brand loyalty unless I am so struck by something that a given brand offers or does very well, and even so, if that were to change, I'd drop them immediately. With that being said, I cannot stand people that cling to Cisco like its mother goose. While without question Cisco is the top of the networking food chain, there are other options out there. Don't be tunnel visioned and just cling. Evaluate your needs, budgets, etc and feature requirements and make your decision from there. What I like best about ZyWALLs are that programming them is entirely object oriented. You create objects and groups and assign them to different things in the interface. Coming from s background in Java programming I understood this very well.
As far as a secure remote connection, I've always stuck with port forwarding and just set very strong passwords on my NVRs and also enable HTTPS in the firmware. It'll throw up self signed certificate errors but at least it's encrypted if it's that much of a worry to you.
I do have to agree with
@DigitalPackrat on the IPSec note. From experience, IPSec is, and for the time being, will only ever work reliably with Cisco everything on both ends. While the ZyWALL supports IPSec and it seems to do ok, we have had a few notable drops that create a giant finger pointing game between MaddenCo (the company with the very expensive Cisco router hosting the VPN), Buckeye Cable, and ZyXEL) that makes sorting out the problem a mess. OpenVPN is definitely a better option if you're looking to VPN (actually because of these experiences I frown upon IPSec anymore) but with the ZyWALL L2TP over IPSec is a lot easier to work with and still overall very secure. However, for convenience reasons, be sure that you're okay with flipping on a VPN each time you want to dial in your NVR. In my case I can't justify it,
But that might be doable for you if it means a higher level of security. Again, weigh things out. But to answer your initial question as far as is a full fledged security gateway is concerned, no it is not necessary. There are many other options out there that are likely significantly cheaper or even free.
Sent from my iPhone using Tapatalk
