Before you run out and spend any hard earned money on routers, what exactly is the purpose of you acquiring one for. I say one because in a pentesting lab environment its pretty uncommon that you would be pentesting against these unless you're of course phenolit.
For the most part, a router just like any other machine runs a service on it. You either telnet, ssh or console to it for connectivity. Once you have that connectivity, it's free reign however, the attackability perspective is the same as it is for any machine. Enumerate services if you can (nmap -T0 is your friend) and go from there. Little will be gained from the penetration testing
LAB perspective unless you have a focus.
For example, you want to test/capture traffic between networks. Other than that, there are very little known remote exploits for any and most routers. So unless you're developing something router or switch specific. You'd treat the router from a pentest perspective the same as you would a server. Same tools, different variables.
As for spending, Cisco is the most affordable
USED router that is commonly used in the enterprise. Unless of course you want to fork out major bucks for a Juniper. I say though, you need not buy a router unless you have specifics for it. I have who knows how many routers lying around that at one point had a purpose (CCIE Security studies) which now collect dust. With that said, you could theoretically get by tinkering with Dynagen/Dynamips/GNS3 without having to spend on a router.
http://dynagen.org/http://dynagen.org/tutorial.htmhttp://www.gns3.net/
OSCP - Offensive Security Certified Professional : Class Scheduled 6/8 - Linux n00b
