Zyxel SCR 50AXE Secure Cloud-managed Router Review – A Nebula cloud-managed WiFi 6E router with advanced security

It has been a while since I reviewed any Zyxel Nebula devices, but for the past few years, they have been the main cloud-managed networking ecosystem I have used, though I have flip-flopped between this, EnGenius, Netgear Insight and Ubiquiti.

The Zyxel SCR 50AXE is the latest product that works with Nebula, and it is the most affordable router/gateway that Zyxel has for Nebula, yet it comes with an impressive specifications including WiFi 6E built in.

Specification

• CPU: Dual-core, 1.00GHz, Cortex A53
• RAM / FLASH: 1GB / 256MB
  • 10/100/1000 Mbps RJ-45 ports
  • 1 x WAN: 1 GbE RJ45 port
  • 4 x LAN: 1 GbE RJ45 ports
• SPI firewall throughput LAN to WAN (Mbps): 900
• Throughput with threat Management on (Mbps): 900
• WiFi: 6E 2.4 / 5 /6 GHz
• SSID number: 4
• No. of antenna: 4(internal)
• Antenna gain:
  • 2.0 dBi @ 2.4 GHz
  • 3.0 dBi @ 5 GHz
  • 3.5 dBi @ 6 GHz
• Wireless speed
  • 6 GHz: 2402 Mbps
  • 5 GHz: 2402 Mbps
  • 2.4 GHz: 574 Mbps
• Security Features
  • Ransomware / malware protection
  • Intrusion blocker
  • Dark Web Blocker
  • Stop mail fraud & phishing
  • Block Ads
  • Block VPN proxy
  • Web Filtering
  • Firewall
  • Country Restriction (GeoIP)
  • Allowlist / Blocklist
  • Traffic Management (applications & clients)
  • Real-time threat intelligence
  • Web Filtering (DNS)
• Site-to-site VPN : IPSec

Initial Set Up

The initial setup is easy. You have a couple of options, you can manually add the router via Nebula using the MAC address and serial number, or you can use the Nebula app and scan the QR code.

I then rebooted my router, which allowed the SCR 50AXE to be assigned a DHCP IP. As I integrated this into my full network, I then needed to change the LAN IP to match my old one and this is easily done under Sitewide> Configure > Security Router > Interface.

Zyxel Nebula Cloud Management

I have been using Zyxel Nebula on and off for the past few years and have always been a big fan of it. I am a fan of cloud-managed networks in general, as it simplifies everything into one unified, easy-to-manage interface.

Switching from EnGenius Cloud back to Zyxel Nebula and integrating the SCR 50AXE, I have been impressed with the amount of data I can get. I have covered the device-specific features for access points and switches in previous reviews, but I don’t think I appreciated the amount of data you could see for the network as a whole

For the main dashboard, you can customise the widget to see an overview of your entire network.

You can then view all the clients and rename them to easy-to-remember names. Going into the individual client, you can view what applications they have used (with Application identification enabled), the traffic they consume and some basic data on what was blocked through threat management.

You can then view summary reports for both access points and switches. With the cost of electricity, I am particularly fond of the fact you can see the power usage of the switches.

Teething Problems

I experienced a few issues getting some of the advanced features to work properly. I suspect this is either a user error or perhaps something on my network causing a problem.

After I applied the SCR Pro Pack licence to the router, I was able to set up all the advanced features. However, none of the reports were working, and it didn’t really seem like Threat Management was doing anything.

I ended up temporarily giving up and moving back to my EnGenius ESG510 while I reviewed something else. When I switched back to the Zyxel, it just started working. It is quite possible that switching it on and off again fixed the problem.

Threat Management

Under the settings part of the threat management, you have toggles for:

• Ransomware / Malware Prevention
• Intrusion blocker
• Dark Web blocker
• Stop mail fraud & phishing
• Block Ads
• Block VPN Proxy

You can then set up exception lists and custom allowed/blocked domains.

With these features enabled, you should be able to see what gets blocked under the threat management report.

For me, ransomware/malware prevention seems to work well. At the time of writing, I have 288 hits spread across four devices. You can then break down the report and see what malware was blocked.

The ad blocking doesn’t seem to be working or working well for me. This is another thing that is likely due to my network. I have a lot of devices where I have manually set the DNS to either my PiHole IP or NextDNS, and this will bypass the adblocking of the Zyxel (because it is DNS based).

Traffic Management

Traffic management is broken down into three sections:

• Application identification & control
• Custom allowed/blocked domain – this is the same as the feature within threat management
• Content Filter

Application Identification & Throughput Reduction

Application identification is a powerful feature that monitors the traffic on your network and identifies the application, and this is part of the free-to-use Nebula service.

You can then view the usage of services and applications and break this down by the clients on your network.

It gives you an incredible amount of insight into how your network is being used, which you could then use to make network-wide security policies.

The downside to enabling this is that it has a massive impact on the throughput you will see. I Virgin Media Broadband Gig1, and I can get about 1100Mbps down with my EnGenius ESG510. This then reduces to about 800Mbps with the Zyxel SCR 50AXE and other gigabit routers.

With application identification, the throughput drops down to 200Mbps.

For me, that would make it hard to justify using it permanently, but if I had an office with staff, I’d probably enable it intermittently to make sure there wasn’t excessive usage by unwanted apps and services.

Traffic Management

You can apply traffic management policies even if you have application identification disabled, but this is walled off into the SCR Pro Pack features.

This is basically network-wide parental control, but you can customise it how you want. In my test, I assigned the parental control category to the entire network, and this blocked out the usual things like gaming, adult content, anything illegal, and dating.

You can assign content filters based on specific clients, and you can customise which categories you want to block.

It seems to work effectively, I browsed to some sites that should be blocked, including adult, dating and tobacco, and the browser returned, unable to resolve DNS errors.

Then within the reporting system, you can see an overview of what categories were blocked and the clients that had blocked content.

If you click on the category for blocked content, you can see the specific website that was blocked.

Firewall

The firewall feature falls within the free-to-use features and works like the firewall feature on most security routers. You can apply policies to allow or deny traffic based on protocol, source and destination.

Site to Site VPN

I don’t have multiple sites to test the Site-to-Site VPN, but you have a decent range of options. Looking at the none-nebula sitewide settings, it uses the  IKEv2 (or IKEv1) protocol.

If you have the Nebula Pro Pack, you can also use the VPN orchestrator for easier VPN management.

WiFi Settings & Performance

Unlike most security gateways, the Zyxel SCR 50AXE has WiFi built-in, and you have the benefit of the latest WiFi 6E with the 6GHz network.

It is possible to run both the 5GHz and 6GHz using the 160Mhz channel width, though in my case, you can’t apply the 160MHz setting under the network-wide radio settings. I had to set it via the individual AP settings.

This router only has gigabit ports which is a bit disappointing because WiFi 6E can easily surpass this speed.

With 160MHz 6GHz, my internet speeds matched the wired speeds and were limited to a bit over 800Mbps. This is also what I achieved with the FRITZ!Box 4060 and AVM FRITZ!Box 7590 AX.

For LAN speeds, using iPerf, I was able to achieve a throughput of 949 Mbits/sec, which saturates the gigabit connection.

Results were about the same with 160MHz 5GHz, and this dropped down to 800 Mbits/sec when switching to 80MHz.

While I would have liked 2.5GbE ports, most people are still on gigabit connections, and this router is priced accordingly.

Zyxel Nebula Subscription Pricing and Features

Zyxel Nebula is free to use, and you get a lot of functionality in this mode. However, to make the most of this cloud management ecosystem, you can pay a yearly fee per device for a Pro pack. You don’t need to apply a licence for all the devices on the network, so for me, I only have the Pro pack applied to the SCR 50AXE.

With the Pro pack, I get real-time threat intelligence, DNS-based web filtering, and the Nebula Pro Pack advanced feature set.

For switches and access points, you have the choice of:

• Nebula Plus Pack License, 1YR: £13.92
• Nebula Professional Pack License, 1YR: £34.6

Then for access points, you can also apply:

• Connect & Protect Plus License, 1Y: £33.23

For the security router I have reviewed today, the licence is:

• SCR Series, SCR Pro Pack, 1YR: £48.03

Looking at competing network security features from consumer routers, you have:

• Netgear Armor 1yr: £84.99
• TP-Link HomeShield Pro 1yr: $54.99

Price and Alternative Options

The Zyxel SCR 50AXE is currently available for £175.

Buy from Ebuyer

The next cheapest option for Zyxel Nebula would be the Zyxel USG FLEX 50 at £305.

This is the cheapest WiFi 6E router that sites like broadbandbuyer.com sell, which seems bizarre when you consider this is orientated to business/prosumers and would, therefore, normally incur a premium.

From the consumer side of things, there are at least a couple of other routers at a similar price point. You have:

• Google WiFi Pro for around £190, it lacks the security features but is more user-friendly for consumers, works as a hub for Matter and Thread and can be paired up to form a mesh system.
• The Archer AXE75 has an RRP of £200 but is available for around £140. It supports OneMesh, so it can be turned into a mesh system.

For competing cloud management services:

• The Ubiquiti UDR UniFi Dream Router WiFi 6 Router is likely the closest option which has WiFi 6 and is available for £240.
• The EnGenius ESG510 lacks WiFi but has 2.5GbE ports, with one being POE for an AP. It is superb but a lot more expensive at £780.

Overall

I think the Zyxel SCR 50AXE is excellent, but it does seem like it is a bit of a confused product.

You have a mixture of some high-end features that are held back somewhat by some of the generic specs (gigabit Ethernet), but you have a low price point which makes up for it. I would prefer to pay a bit more money and have 2.5GbE so I could make the most of the WiFi 6E.

Then, to make the most of it, you will want to pay the yearly subscription. However, the subscription isn’t very expensive, and it’s actually more affordable than some consumer options.

I would guess this would work best in a small office where you have a small number of users where you can apply network-wide security policies.  

It would work well in a home environment, especially if you have kids and want to apply parental filters, but the consumer products that offer subscription-based security features on the router (TP-Link HomeShield & Netgear Armor) may be more appealing.

It worked well in my home as it cut out the need for an additional access point in the same room as my router.

For existing Zyxel Nebula users, this is a no-brainer as it integrates within Nebula perfectly, eliminates the need for an access point and is significantly cheaper than the USG FLEX security gateways. Having everything under Nebula gives you an incredible amount of insight into your network usage and a superb level of control.

James Smythe( Editor-in-chief )

I am James, a UK-based tech enthusiast and the Editor and Owner of Mighty Gadget, which I’ve proudly run since 2007. Passionate about all things technology, my expertise spans from computers and networking to mobile, wearables, and smart home devices.

As a fitness fanatic who loves running and cycling, I also have a keen interest in fitness-related technology, and I take every opportunity to cover this niche on my blog. My diverse interests allow me to bring a unique perspective to tech blogging, merging lifestyle, fitness, and the latest tech trends.

In my academic pursuits, I earned a BSc in Information Systems Design from UCLAN, before advancing my learning with a Master’s Degree in Computing. This advanced study also included Cisco CCNA accreditation, further demonstrating my commitment to understanding and staying ahead of the technology curve.

I’m proud to share that Vuelio has consistently ranked Mighty Gadget as one of the top technology blogs in the UK. With my dedication to technology and drive to share my insights, I aim to continue providing my readers with engaging and informative content.