Solved: CISCO ISR 4331 low WAN Speed

sergeykaw0w · ‎03-28-2018

Hello,

The provider delivers a speed 200 mbps, and the ISR 4331 delivers a maximum of 100 mbps.

sh run:

!
!
!
interface GigabitEthernet0/0/0
 ip address 123.456.789.149 255.255.255.252
 ip nat outside
 negotiation auto
 crypto map VPN
!
interface GigabitEthernet0/0/1
 ip address 192.168.3.249 255.255.255.0
 ip nat inside
 negotiation auto
!
interface GigabitEthernet0/0/2
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/1/0
 switchport access vlan 2
!
interface GigabitEthernet0/1/1
!
interface GigabitEthernet0/1/2
!
interface GigabitEthernet0/1/3
!
interface Cellular0/2/0
 no ip address
 shutdown
!
interface Cellular0/2/1
 no ip address
 shutdown
!
interface Service-Engine0/4/0
!
interface GigabitEthernet0
 vrf forwarding Mgmt-intf
 no ip address
 shutdown
 negotiation auto
!
interface Vlan1
 no ip address
 shutdown
!
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
no ip http server
no ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 123.456.789.149
ip ssh version 2
!
!
ip access-list standard SSH
 permit 192.168.0.0 0.0.255.255
!
ip access-list extended NAT
 deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
 permit ip 192.168.3.0 0.0.0.255 any
 permit ip 192.168.2.0 0.0.0.255 any
ip access-list extended VPN
 permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255
 permit ip 192.168.3.0 0.0.0.255 192.168.12.0 0.0.0.255
 permit ip 192.168.3.0 0.0.0.255 192.168.15.0 0.0.0.255
 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
 permit ip 192.168.2.0 0.0.0.255 192.168.12.0 0.0.0.255
 permit ip 192.168.2.0 0.0.0.255 192.168.15.0 0.0.0.255
 permit ip 192.168.3.0 0.0.0.255 192.168.13.0 0.0.0.255
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
line con 0
 logging synchronous
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 access-class SSH in
 logging synchronous
 login local
 transport input ssh
line vty 5 97
 access-class SSH in
 logging synchronous
 login local
 transport input ssh
!
!
end

sh int gi 0/0/0

GigabitEthernet0/0/0 is up, line protocol is up
  Hardware is ISR4331-3x1GE, address is 501c.b07f.7e80 (bia 501c.b07f.7e80)
  Internet address is 123.456.789.0/30
  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 2/255
  Encapsulation ARPA, loopback not set
  Keepalive not supported
  Full Duplex, 1000Mbps, link type is auto, media type is RJ45
  output flow-control is on, input flow-control is on
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:54:04, output 00:00:22, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 114512
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 11151000 bits/sec, 1067 packets/sec
  5 minute output rate 2433000 bits/sec, 574 packets/sec
     42894597 packets input, 49050095063 bytes, 0 no buffer
     Received 3697 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     24015266 packets output, 8710495611 bytes, 0 underruns
     0 output errors, 0 collisions, 3 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     4 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out

P.S. Sorry for my English :)

HADES2001 · ‎03-29-2018

Well the throughput is the issue

If I understand correctly from the cisco page it should be the command

platform hardware throughput level 300000

Assuming the license you have supports that, if that doesnt work you might have to activate/register the license but i dont have any experience in that part

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-o1.html#wp3800310030

platform hardware throughput level

To change the maximum throughput level on the virtual router, use the platform hardware throughput level command in global configuration mode. To return the platform throughput level to the default value, use the no form of this command.

Cisco IOS XE Release 3.9S:

platform hardware throughput level { 10000 | 25000 | 50000 | eval-only }

Cisco IOS XE Release 3.10S and Later:

platform hardware throughput level MB { 10 | 100 | 1000 | 25 | 250 | 50 | 500 }

Syntax Description

Cisco IOS XE Release 3.9S:
10000	Sets the maximum throughput to 10,000 Kbps (10 Mbps).
25000	Sets the maximum throughput to 25,000 Kbps (25 Mbps).
50000	Sets the maximum throughput to 50,000 Kbps (50 Mbps).
eval-only	Specifies to use the maximum throughput for the evaluation license only.
Cisco IOS XE Release 3.10S:
10	Sets the maximum throughput to 10 Mbps.
100	Sets the maximum throughput to 100 Mbps.
1000	Sets the maximum throughput to 1 Gbps.
25	Sets the maximum throughput to 25 Mbps.
250	Sets the maximum throughput to 250 Mbps.
50	Sets the maximum throughput to 50 Mbps.
500	Sets the maximum throughput to 500 Mbps.

Command Default

The default maximum throughput level is determined by the installed base license.

Command Modes

Global configuration (config)

Command History

Release	Modification
Cisco IOS XE Release 3.9S	This command was introduced on the Cisco CSR 1000V Series Cloud Services Router.
Cisco IOS XE 3.10S	The command was updated to change the keywords to units in Mbps, and support for maximum throughput values of 100 Mbps, 250 Mbps, 500 Mbps, and 1 Gbps was added.

Usage Guidelines

The Cisco CSR 1000V requires the installation of base licenses that set the maximum throughput of the platform.

Depending on the configuration and the licenses installed, you may need to manually increase or decrease the maximum throughput level on the Cisco CSR 1000V. The maximum throughput on the router before the license is activated, or if the license is invalidated, is 2.5 Mbps. When you install the base subscription license and accept the EULA, the maximum throughput on the Cisco CSR 1000V will increase to the level allowed by the license.

You may need to manually change the maximum throughput level in the following cases:

If you are using an evaluation license. When the evaluation license is first installed, the maximum throughput is limited to 2.5 Mbps before the license is activated. You must accept the EULA and enter the platform hardware throughput levelcommand to increase the maximum throughput. When the 60-day evaluation license expires, the maximum throughput level reverts to 2.5 Mbps.
If you want to reduce the maximum throughput level from the maximum permitted by the installed licenses. For example, if you have the 50-Mbps license installed and you want to reduce the maximum throughput to 25 Mbps. You must enter the platform hardware throughput level command to reduce the maximum throughput.
If you previously changed the maximum throughput using the platform hardware throughput level command. When you enter the command, it becomes part of the configuration file. You must enter the command again to change the maximum throughput level.

When changing the maximum throughput level, you do not need to reboot the Cisco CSR 1000V for the change to take effect. If you try to increase the throughput level higher than what the installed license supports, you will receive an error message.

Examples

The following example changes the maximum throughput level to 500 Mbps:

Router(config)# platform hardware throughput level MB 500

The following example changes the maximum throughput level to the default level supported by the installed license:

Router(config)# no platform hardware throughput level

Related Commands

Command	Description
show platform hardware throughput level	Displays the current maximum throughput level for a virtual router.

View solution in original post

HADES2001 · ‎03-28-2018

The specifications also mention that the base throughput is 100 for the Cisco 4331.

You can upgrade it with a license up to 300.

For more on the specifications please see

https://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/datasheet-c78-732542.html

Do you have the extra license?

sergeykaw0w · ‎03-28-2018

I think I have a extra license.

branch_vpn_ala#sh vers
Cisco IOS XE Software, Version 03.16.04b.S - Extended Support Release
Cisco IOS Software, ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.5(3)S4b, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Mon 17-Oct-16 20:23 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2016 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON

branch_vpn_ala uptime is 2 days, 19 hours, 38 minutes
Uptime for this control processor is 2 days, 19 hours, 40 minutes
System returned to ROM by reload
System image file is "bootflash:isr4300-universalk9.03.16.04b.S.155-3.S4b-ext.SPA.bin"
Last reload reason: PowerOn

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Suite License Information for Module:'esg'

--------------------------------------------------------------------------------
Suite Suite Current Type Suite Next reboot
--------------------------------------------------------------------------------
FoundationSuiteK9 FoundationSuiteK9 Permanent FoundationSuiteK9
securityk9
appxk9

AdvUCSuiteK9 AdvUCSuiteK9 Permanent AdvUCSuiteK9
uck9
cme-srst
cube

Technology Package License Information:

-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
appxk9 None None appxk9
uck9 None None uck9
securityk9 None None securityk9
ipbase ipbasek9 Permanent ipbasek9

cisco ISR4331/K9 (1RU) processor with 3696789K/6147K bytes of memory.
Processor board ID FLM2152V1HP
7 Gigabit Ethernet interfaces
2 Cellular interfaces
32768K bytes of non-volatile configuration memory.
8388608K bytes of physical memory.
7057407K bytes of flash memory at bootflash:.

Configuration register is 0x2102

HADES2001 · ‎03-28-2018

can you try the following command?

sh platform hardware throughput level

This should give the current throughput level

The command

show license feature

Should give a good overview of all licenses

sergeykaw0w · ‎03-28-2018

sh platform hardware throughput level

The current throughput level is 100000 kb/s

show license feature

branch_vpn_ala#sh license feature
Feature name             Enforcement  Evaluation  Subscription   Enabled  RightT                                                                                                 oUse
appxk9                   yes          yes         no             yes      yes                                                                                                    
uck9                     yes          yes         no             yes      yes                                                                                                    
securityk9               yes          yes         no             yes      yes                                                                                                    
ipbasek9                 no           no          no             yes      no                                                                                                     
FoundationSuiteK9        yes          yes         no             yes      yes                                                                                                    
AdvUCSuiteK9             yes          yes         no             yes      yes                                                                                                    
cme-srst                 yes          yes         no             no       yes                                                                                                    
hseck9                   yes          no          no             no       no                                                                                                     
throughput               yes          yes         no             no       yes                                                                                                    
internal_service         yes          no          no             no       no

HADES2001 · ‎03-29-2018

Well the throughput is the issue

If I understand correctly from the cisco page it should be the command

platform hardware throughput level 300000

Assuming the license you have supports that, if that doesnt work you might have to activate/register the license but i dont have any experience in that part

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-o1.html#wp3800310030

platform hardware throughput level

To change the maximum throughput level on the virtual router, use the platform hardware throughput level command in global configuration mode. To return the platform throughput level to the default value, use the no form of this command.

Cisco IOS XE Release 3.9S:

platform hardware throughput level { 10000 | 25000 | 50000 | eval-only }

Cisco IOS XE Release 3.10S and Later:

platform hardware throughput level MB { 10 | 100 | 1000 | 25 | 250 | 50 | 500 }

Syntax Description

Cisco IOS XE Release 3.9S:
10000	Sets the maximum throughput to 10,000 Kbps (10 Mbps).
25000	Sets the maximum throughput to 25,000 Kbps (25 Mbps).
50000	Sets the maximum throughput to 50,000 Kbps (50 Mbps).
eval-only	Specifies to use the maximum throughput for the evaluation license only.
Cisco IOS XE Release 3.10S:
10	Sets the maximum throughput to 10 Mbps.
100	Sets the maximum throughput to 100 Mbps.
1000	Sets the maximum throughput to 1 Gbps.
25	Sets the maximum throughput to 25 Mbps.
250	Sets the maximum throughput to 250 Mbps.
50	Sets the maximum throughput to 50 Mbps.
500	Sets the maximum throughput to 500 Mbps.

Command Default

The default maximum throughput level is determined by the installed base license.

Command Modes

Global configuration (config)

Command History

Release	Modification
Cisco IOS XE Release 3.9S	This command was introduced on the Cisco CSR 1000V Series Cloud Services Router.
Cisco IOS XE 3.10S	The command was updated to change the keywords to units in Mbps, and support for maximum throughput values of 100 Mbps, 250 Mbps, 500 Mbps, and 1 Gbps was added.

Usage Guidelines

The Cisco CSR 1000V requires the installation of base licenses that set the maximum throughput of the platform.

Depending on the configuration and the licenses installed, you may need to manually increase or decrease the maximum throughput level on the Cisco CSR 1000V. The maximum throughput on the router before the license is activated, or if the license is invalidated, is 2.5 Mbps. When you install the base subscription license and accept the EULA, the maximum throughput on the Cisco CSR 1000V will increase to the level allowed by the license.

You may need to manually change the maximum throughput level in the following cases:

If you are using an evaluation license. When the evaluation license is first installed, the maximum throughput is limited to 2.5 Mbps before the license is activated. You must accept the EULA and enter the platform hardware throughput levelcommand to increase the maximum throughput. When the 60-day evaluation license expires, the maximum throughput level reverts to 2.5 Mbps.
If you want to reduce the maximum throughput level from the maximum permitted by the installed licenses. For example, if you have the 50-Mbps license installed and you want to reduce the maximum throughput to 25 Mbps. You must enter the platform hardware throughput level command to reduce the maximum throughput.
If you previously changed the maximum throughput using the platform hardware throughput level command. When you enter the command, it becomes part of the configuration file. You must enter the command again to change the maximum throughput level.

When changing the maximum throughput level, you do not need to reboot the Cisco CSR 1000V for the change to take effect. If you try to increase the throughput level higher than what the installed license supports, you will receive an error message.

Examples

The following example changes the maximum throughput level to 500 Mbps:

Router(config)# platform hardware throughput level MB 500

The following example changes the maximum throughput level to the default level supported by the installed license:

Router(config)# no platform hardware throughput level

Related Commands

Command	Description
show platform hardware throughput level	Displays the current maximum throughput level for a virtual router.

gfield · ‎03-25-2019

I think it is pretty sad that you have bandwidth limitations built into the software now. I understand licensing for software that performs duties a normal router wouldn't do, and paying for a license to run it in the router IOS.

But I am purchasing a high end router that should be able to go to several hundred mb without issues. You can get that from a Best Buy router. To limit bandwidth to 50 mb <on the 4321> and have to buy a performance license for it to do 100 mb, but then, {oh, you really want it to do 100?}, because it is limited to 85 mb for ipsec, that is ANOTHER license to download and install. The router was purchased with advanced security already, which was also an extra cost. Having a router that doesn't fully function due to software limiting is just wrong and needs to be corrected.

Joseph W. Doherty · ‎03-26-2019

BTW, a reason for the 85 Mbps IPSec performance limitation is due to US export laws.

Yes, a "Best Buy" router likely doesn't have similar license performance restrictions, and our free market allows you to buy one rather than a Cisco router. If enough buyers did that, I suspect Cisco would change its licensing policy.

sergeykaw0w · ‎03-29-2018

TY!!!!!