Cisco ISR 4000 Throughput Performance

[JohnTylerPearce]

How do you properly size Performance License and or not one with the Cisco ISR 4000 Series routers?

For example, say I have an ISR 4221, which can do 35Mbps to 75 Mbps. Now with the default License, you can only do 35Mbps. So, does that mean if I have a Metro E service at 30Mbps I should get 30Mbps ingress and 30Mbps egress at the same time, or that to get symmetrical throughput I would need to get something like a Metro E service for 15Mbps ingress and 15Mbps egress?

Although, I'm guessing that same logic may or may not apply for Security Performance licenses as well?

And, what exactly does the Boost Performance license do? It looks like if you go over the PERF license, it will then only come into play. Cisco can be a bit confusing on throughput as well as know, I'm just curious.

Thanks for any input!

[balaji.bandi]

If the product mentioned as example : 80MB (40 Mbps in each direction)

here is the comparision and support for reference :

https://www.cisco.com/c/en/us/products/routers/4000-series-integrated-services-routers-isr/models-comparison.html

[Joseph W. Doherty]

As I understand, the ISR 4K performance caps behave like a policy applied to all traffic crossing the backplane of the router. So, 35 Mbps performance limit would allow up to 35 Mbps to transit the router (which could appear as an aggregate of 35 Mbps ingress and an aggregate of 35 Mbps egress).

The security license appears to apply to traffic encrypted on the device. Unsure it applies to any decrypted traffic. It does not apply to transit encrypted traffic. (NB: BTW, recent IOS versions have increased the default security cap.)

The boost license appears to "uncap" the router, i.e. it will behave like former ISRs. You can obtain 100% of what the CPU can provide, which will vary greatly depending on your traffic mix and configuration.

[JohnTylerPearce]

Joseph, Thanks for the information, I really appreciate it. So if for example, I had a 35Mbps Internet Connection and used the 1Gbps physical interface at auto/auto, and let's say I had a rate-limiter setup to only allow 35Mbps in/out that LAN interface, I should be able to run an iPerf (under an ideal situation, no user traffic going ingress/egress), and gets 35 Mbps ingress and 35 Mbps Egress at the same time in theory?

[Joseph W. Doherty]

I believe that's the way it should work, Although, as the router will limit itself, there wouldn't be much advantage in implementing your own rate-limiter. Further, the router's performance should apply to the aggregate of all interfaces. So, for example, if you had two ingress interfaces, they would "share" the 35 Mbps, whereas an interface rate-limiter does not share with another interface.