Zyxel USG Lite 60AX WiFi 6 Security Router Review

If the name didn’t give it away, this is a lighter version of the USG line which has been the backbone of the Nebula-powered networks for years. And by light, I don’t mean that it weighs less, although it does since the router is now made of plastic instead of metal, but about Zyxel’s attempt at simplifying things for the SMBs and power users.

The USG Lite 60AX continues to use the Nebula Cloud platform and, just like the SCR 50AXE, there is no local management platform which I found a bit curious. This means that this router makes sense when used alongside multiple access points and switches, otherwise, the Nebula platform is definitely overkill.

At the same time, I noticed the similarities between it and the ASUS TUF-AX4200, so there is a chance that you can install OpenWRT in case Zyxel decides not to support this device anymore. The USG Lite 60AX does have a couple of 2.5GbE ports, a clear improvement over the WiFi 6E SCR 50AXE, but no, there is no support for the 6GHz radio. Does it matter? I don’t think it’s a deal breaker especially considering the current state of 6GHz adoption which is not that great.

MLO is barely supported on some mobile devices. Could it have been a future-proof feature? Maybe. But then again, I am sure a new WiFi 7 USG security router will become available when the new standard matures a bit. Some other features include a Subscription-free ransomware protection, as well as other security-focused features including an Ad-blocker. These seem to be getting more popular nowadays. I wonder why is that, Google? Anyway, let’s get a closer look at the Zyxel USG Lite 60AX.

Design and Build Quality

The USG Lite 60AX has a different form factor than let’s say the USG FLEX 200HP which was designed to sit in a rack. It follows a similar design to the SCR 50AXE, so it sits vertically and it relies on a rotating piece of plastic for stability.

It does work, but I am worried about its longevity. The case is made of plastic and Zyxel says that it used 95% post-consumer-recycled (PCR) plastics in the construction of the device which is a step in the right direction. The frame of the router is white, like the rest of the case, but there is a red portion which is a sort of characteristic for the Zyxel USG routers and gateways.

From underneath it, there is a single status LED which shined through and you do need to consult the manual to know what each color means. The individual status LEDs are just not cool anymore. Sigh. Flip the router around and we can see the ports area. The first four are Gigabit LAN ports, followed by a couple of 2.5GbE ports, one for LAN, the other for WAN.

Underneath them, there’s the Reset button and the 12V Power port. If you have a closer look above the ports, we can see a removable cover which hides a Console port and you can see the schematics here.

The Heat Management

After seeing that the USG Flex 200HP relied on passive cooling, I had no doubts that the Lite 60AX would take the same road and indeed, there are no fans. Ubiquiti seems to be the only one adamant on normalizing it, but other manufacturers found other ways to keep their hardware cool.

As you can see from the video I took with a thermal camera, the USG Lite 60AX does not heat up and the temperature remains within reasonable limits even while I was running some of the more heavier tests.

Zyxel USG Lite 60AX Teardown

Dust may accumulate in time and perhaps the thermal paste needs to be changed, so it’s important to know if it’s easy to get into the USG Lite 60AX. I only had to remove the two screws at the bottom and then using a prying tool, I detached the two vertical parts. Then, I could see the antennas and after taking out the heat spreaders, I could see the main components. I did make a dedicated teardown video if you want to see it in more detail. And I also added a comparison table.

The Wireless Test (5GHz)

Now let’s get on with the tests and we’re going to start by checking the single client throughput using three different client devices. One is WiFi 6 and two are WiFi 5.

The throughput is more than expected, going above 1.7Gbps upstream when using the 160MHz channel bandwidth.

It’s actually second to the ASUs TUF-AX4200 which does share the same platform with the UG Lite AX60, so it’s not a coincidence.

Using the 80MHz channel width, there are better routers out there, but the Lite AX60 is still performing really well, going close to one gigabit.

The throughput remains excellent even downstream, but let’s also have a look at the range of the wireless router.

We are the most interested in the spot where the signal attenuation is -85dB and we can see that the WiFi 6 client had no trouble sustaining a decent throughput, while one WiFi 5 was a bit less impressive and the other dropped out completely.

And this is true both upstream and downstream. So, to get the maximum out of this router, use WiFi 6 devices.

I have also added a longer-term performance graph which included a comparison with the ASUS TUF-AX4200.

The Wireless Test (2.4GHz)

Let’s now check out the throughput when using the 2.4GHz radio band since it’s going to be used quite a lot considering the ever growing number of client devices.

I used the 40MHz channel bandwidth to get a better throughput, but it’s most likely wiser to use 20MHz for a better signal penetration. That being said, upstream, it’s a decent performance, especially when using the WiFi 6 client, while the two WiFi 5 clients results were less interesting.

The range test shows that we will get goo results quite far and at 70 feet in my house, the signal attenuation was -74dB. When compared to other wireless routers, the USG Lite AX60 is slightly above average.

The Multi-Client Tests (5GHz)

Let’s move on and see how the Zyxel USG Lite AX60 handles various types of traffic ran on more than one client devices at the same time. And I used the same computers as before which you can see here. And I have also added the signal attenuation that I measured at the client level.

The tool that I used is net-hydra which was developed by Mr Jim Salter and you can use it for yourself since it’s available on GitHub. That being said, let’s see the latency when five client devices ran simultaneous 1080p traffic.

Unsurprisingly, we see the WiFi 6E and the 6 clients performing the best, with two of them remaining near 50ms for the entire duration of the test. The rest raised near and above 100ms which is a bit far from ideal performance. Moving on, it’s time to run simulated 4K traffic on the five client devices and, while there is definitely a latency increase, it’s not as radical as I expected.

It’s actually a very similar performance to what I saw when I tested the ASUS TUF-AX4200. It’s still not an ideal latency, so you should limit the number of clients or rely on cable if you absolutely need 5 devices to run 4K streaming at the same time.
After that, I included intense browsing traffic to run alongside 1080p streaming and the first graph shows if there was an impact on the former type of latency.

There obviously was, with the WiFi 6E client freaking out and going above 100ms for 10% of the time. The rest stayed near 100ms, with one client, the ZimaBoard going a bit past 100ms for the entire test.

The intense browsing graphic showed a decent performance, with one client going above 1s for 1% of the time, so it’s negligible. Overall, it’s a better performance than the TUF-AX4200.

Afterwards, I ran the intense browsing traffic alongside 4K streaming and, while it was a tight performance between the five client devices, the TUF-AX4200 did a bit better here.

The intense browsing graph does put the Lite 60AX in the advantage. Now it’s time to change things a bit and include a couple of downloading clients, leaving one for the 4K streaming and two for the intense browsing.

The performance of the downloading clients seems a bit different than what I saw on the TUF-X4200, even though one did stay near 100ms pretty much all the time. Also, the overall throughput for the downloading clients is 627.2Mbps.

Next, I removed one downloading client and replaced it with 4K streaming. One 4K streaming client gave up immediately, but the rest performed much better than expected, better than what I saw on the TUF-AX4200.

Let’s go even lighter on the USG Lite 60AX by running there types of simulated traffic on three client devices. The downloading client did a bit better than on the TUF-AX4200 and I suppose the other two clients shows a somewhat similar performance.

Let’s limit the stress even more by downloading a 1MB file this time alongside intense browsing and VoiP. I am going to compare the latency with the TUF-AX4200 once again and both the VoiP and the intense browsing and almost identical, but the downloading client seems a bit better on the Zyxel router. The downloading client throughput was 192.8Mbps.

Lastly, I ran the downloading traffic on the five client devices and the result is as expected. One client managed to go over 3s, so it’s best to not push the router this much. Also, the total throughput was 659.1Mbps.

The Standalone Platform

Just like the SCR 50AXE, the Zyxel USG Lite 60AX was developed with the Nebula Cloud platform at its core, so there was very little thought put in for the standalone software. There is one, but it’s severely bare-bones.

There are three main areas, one is the Dashboard which shows some status info, followed by the Network where you can adjust the WAN settings and lastly, there’s the Maintenance where you get some tools for checking out some network behaviors and a Log section. That’s all, but as I mentioned in the intro, I will attempt to install OpenWRT on it, so stay tuned for the next video.

The Nebula Cloud Controller

After adding the USG Lite 60AX to the Nebula Cloud Controller, I could see some status info on the Dashboard, but I initially couldn’t get some of the areas form the Security section to get populated. I found out later that this is because I had no accessed the controller for more than 30 days, so the Cloud Saving Mode was automatically enabled.

Disabling it did ensure that the previously unpopulated areas would now show the necessary info. That being said, the Monitor and the Configure sections work as intended and I could check the logs, the VPN connections and get a Threat report, while the Content Filter report was under a paid subscription. Under Configure, we get quite a few options. First, we are interested to set up the WiFi aspect which can be done under Radio and SSID settings.

And there are some Advanced settings as well for Rate-limiting, setting up an authentication method for guest clients and adjusting the way the clients will interact with the networks. We’re not done because this is a security router and it does have some powerful features to offer. You can see under Threat Management that you can enable the blocking of various types of intrusions, including ads, but it is possible to set an Exception list for IP address or clients, as well as block or allow certain domains.

Under Traffic management, we get some traffic shaping options, content filtering and more. We also get a Firewall with implicit rules and it’s possible to add a NAT virtual server. Lastly, we get some VPN settings and we can set up Site-to-Site VPNs, including for Non-Nebula peers and I have noticed that there is a Remote access VPN which seems to be in Beta right now. I saw that there were two 2.5GbE ports available and assumed that perhaps we would get some dual-WAN options, but unfortunately I could not find it. Maybe in the future.

The Conclusion

This hands-off approach is very popular for a lot of clients because otherwise they would need a dedicated IT department, so the prospect that a remote team can handle all of their needs is the most appealing to them. Which is why the Cloud-only approach makes a lot of sense for most businesses, but it doesn’t for power users. So who is the Zyxel USG Lite 60AX for? Judging by the Cloud-focused software, I’d say that despite being called lite, it’s still designed with businesses in mind, most likely the smaller ones.