How to pick a used router for a small office or branch

"Just get a router" sounds simple until you're staring at a used Cisco ISR, a Juniper SRX, or a MikroTik CCR on an auction site with no idea whether it'll actually handle your WAN link, your VPN tunnels, and your VLANs at the same time. Enterprise routers are built very differently from the consumer box your ISP gave you, and buying the wrong used unit means either paying for throughput you'll never touch or bottlenecking a small office's whole internet connection. Here's how to actually evaluate one before you buy.

Step 1: Know your actual throughput requirement first

The single biggest mistake is buying based on WAN port speed instead of routing throughput with features enabled. A router's rated forwarding rate almost always assumes plain IP forwarding with no services running. Turn on a site-to-site IPsec VPN, a stateful firewall ruleset, and NAT, and real throughput on older hardware can drop by 50-80%.

Work backward from your WAN circuit:

• Under 100 Mbps WAN (most small offices, many branch circuits) - almost any used enterprise router from the last 10-12 years handles this comfortably, even with VPN and firewall enabled.
• 100 Mbps to 1 Gbps WAN - you need to check the VPN throughput spec specifically, not just the routing throughput. This is where older ISRs (1900/2900 series without a crypto module) fall over.
• Over 1 Gbps - you're now looking at hardware with dedicated crypto ASICs (ISR 4000 series, ASA 5500-X with acceleration, MikroTik CCR with multi-core ARM/Tilera) or you're routing without full encryption load.

Step 2: Match the router class to the job

Cisco ISR (Integrated Services Router) - 1900/2900/3900/4000 series
The classic small-branch choice. 1900/2900 are IOS-based, well-documented, cheap used, fine for sub-100Mbps WAN with light VPN. The 4000 series (ISR4321, ISR4331) moved to IOS-XE and handles gigabit WAN with VPN much better thanks to onboard crypto acceleration - worth the premium if your WAN circuit is fast.

Cisco ASA (5505/5506-X/5508-X)
Technically a firewall, but small offices often run it as edge router + firewall + VPN concentrator in one box. Good VPN throughput for the price on used units, but EOL dates matter here - check whether it's still getting ASA software updates or whether you're buying into a dead-end OS version.

Juniper SRX (SRX210/220/240/300 series)
Similar dual-purpose role to the ASA. JunOS is a different config paradigm from Cisco IOS (worth factoring in if your team only knows Cisco), but SRX hardware tends to be well-built and shows up used at good prices from decommissioned enterprise networks.

MikroTik (RouterBOARD/CCR series)
Not "enterprise" in the traditional vendor sense, but RouterOS is extremely capable for the price, and the CCR line's multi-core CPUs give real VPN/firewall throughput well above what similarly-priced Cisco gear from the same era can do. Steeper learning curve if you've never used RouterOS.

pfSense/OPNsense on repurposed enterprise hardware
A used enterprise 1U or small-form-factor box (some resellers sell dedicated firewall appliances like Fortinet or SonicWall units specifically for this) running open-source firewall software gives you the most flexibility and the longest software-support runway, at the cost of doing your own integration work instead of buying a turnkey appliance.

Step 3: Check what actually wears out or gets orphaned

Used networking gear fails or becomes useless in specific, predictable ways - check these before paying:

• Capacitors and PSU - routers that ran 24/7 in a hot rack for 5+ years are the ones with capacitor issues. Ask for an uptime/environment history if the seller has it, or at minimum confirm it was bench-tested under load, not just powered on.
• Flash/NVRAM wear - heavy syslog or config-save cycles over years can degrade flash storage on older gear. A show diag or equivalent health check before shipping is worth asking for.
• License-locked features - Cisco routers in particular gate features (crypto, advanced routing protocols, security licenses) behind license tiers activated to the original owner's Smart Account. A used ISR with an expired or non-transferable Smart License can leave IPsec VPN or other features locked even though the hardware supports them. Confirm license status before buying, not after.
• End-of-support date - check Cisco's/Juniper's end-of-software-maintenance date for the exact model. A router past EOL still works, but you won't get security patches, which matters more for an internet-facing router than almost any other device on your network.
• Physical WAN interface type - confirm the used unit has the actual WAN interface your ISP hands off (RJ45 Ethernet vs. SFP vs. a specific WIC/HWIC module for older T1/serial circuits). This trips people up more than expected with older ISR chassis that expect a module you then have to source separately.

Step 4: Plan the redundancy question up front

Small offices often skip this and regret it. Decide before buying:

• Single router, ISP-provided failover (accept some downtime risk), or
• Two used routers in an HA pair (HSRP/VRRP on Cisco, VRRP on most others), which roughly doubles hardware cost but removes the single point of failure for the whole office's internet and VPN access.

If you're going the HA route, buy matched models and matched IOS/firmware versions - mismatched software versions between an HA pair is a common source of failover bugs that only show up during the actual failure you bought the redundancy to protect against.

Buying checklist

• [ ] WAN throughput requirement calculated with VPN + firewall overhead, not bare routing rate
• [ ] Router class matches office size (ISR 1900/2900 for small, 4000-series or MikroTik CCR for gigabit WAN)
• [ ] License status confirmed transferable or already unlocked
• [ ] EOL/end-of-support date checked for the specific model
• [ ] Physical WAN interface confirmed to match your ISP handoff
• [ ] Bench-tested/functional-tested by the seller, not just "powered on"
• [ ] HA pair uses matched hardware and firmware versions, if redundancy is in scope

If you'd rather skip the auction-site gamble on unknown history and license status, resellers who function-test and reset used gear before listing - like IT and Office - will tell you upfront whether licensing is clean and what condition the unit tested at, which saves you from finding out the hard way after it's already routing your office's traffic.

---

What's biting people most on used router deployments these days - is it still license lockouts, or has EOL software support become the bigger blocker?