4000 series isr performance licensing & hsec vs sec licensing

[wayfaring]

For a 4331 with SEC & FL-4330-PERF-K9 which claims to increase throughput from 100Mbps to 300Mbps, is ipsec tunnel throughput still limited to only 85Mbps unless additional FL-4330-HSEC-K9 license is purchased or does it also increase to 300Mbps?  If hsec is required, is it necessary to have both SEC and FL-4330-HSEC-K9 licenses purchased to use all ipsec/vpn features or would just the the FL-4330-HSEC-K9 alone take care of this?

The wording on hsec info vs Cisco marketing material for the performance licensing upgrade is somewhat confusing -

http://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/datasheet-c78-732542.html -

The Cisco 4000 Series has a performance-on-demand license to increase the base forwarding throughput with no hardware changes. Also present is the High Security (HSEC) license, which removes the curtailment enforced by the U.S. government export restrictions on the encrypted tunnel count and encrypted throughput. The HSECK9 license is a separately required license for a feature to have full crypto functionality. Without the HSECK9 license, only 225 secure tunnels and 85 Mbps of crypto bandwidth would be available.

[manuel-rocha]

ipsec tunnel throughput still limited to only 85Mbps unless additional FL-4330-HSEC-K9 license is purchased?

Yes, security and performance license are two different things.

or does it also increase to 300Mbps?

No

If hsec is required, is it necessary to have both SEC and FL-4330-HSEC-K9 licenses purchased to use all ipsec/vpn features?

Yes, SEC license is a prerequisite for HSEC

or would just the the FL-4330-HSEC-K9 alone take care of this?

No

[chamaraw07]

hi

to increase throughtput on a cisco 4331 router , do we have to install

both FL-4330-PERF-K9 and FL-4330-HSEC-K9 licenses ? or is one enough

thanks

[steveperez1]

Manuel is correct.   Here is information from the FAQ document at:   Hopefully this answers your question: http://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/qa_c67-728261.html

Q.    Is a High Security (HSEC) license offered on the Cisco 4000 Series to achieve greater cryptographic tunnel count and throughput?

A.     Yes, an HSEC license is required to achieve more than 225 cryptographic tunnel count and 170 Mbps of total IP Security (IPsec) throughput (bidirectional traffic).

Q.    What is an HSEC license?

A.     An add-on license above the Security (SEC) technology package license, known as HSEC, provides export controls for strong levels of encryption. HSEC is available to customers in all currently nonembargoed countries as listed by the U.S. Department of Commerce. Without an HSEC license, SEC performance is limited to 225 tunnels and a total of 170 Mbps of IPsec throughput. An HSEC license removes this limitation. Because of these export control requirements, the HSEC license is the only license on the Cisco 4000 Series that requires installation of a license key file to activate. In other words, HSEC is not an RTU license.

[zzunic]

Q: How much is ipsec tunnel throughput on ISR4321 with SEC and HSEC licence?

According to HSEC licence explanation it removes 85 Mbps limit - but performance limit on 4321 is 50 Mbps? It seems that HSEC license doesn't have sense on 4321 without PERF license?

[timhl]

The ISR4321 base performance is 50 Mbps, which can be increased to 100 Mbps with the performance on demand license. Without the additional HSEC license, it would be limited to 85 Mbps of encrypted traffic.