Gateway add-ons (archetype B — no box)
Before you can afford a dedicated box, you can switch security features straight on your router: a better firewall, basic intrusion-blocking, a little flood-absorb. No extra box, no cabling — but running them slows the router down. They are the early-game answer; graduate to a dedicated edge box when the slowdown starts to bite.
Detailed explanation
Archetype B: a security function folded into the gateway with no rack footprint and no cabling, fitted via SetGatewayAddon. It contributes mitigation like an appliance, but while active it multiplies the gateway's fabric by its throttle factor (IPS on a router collapses throughput, ~0.35x). Every gateway also ships an always-on built-in firewall baseline below these. The pre-box rung: cheap and immediate, but the throttle caps your WAN — which is exactly the pressure to move protection onto a dedicated box with its own ASIC.