ISR 4451 HSECK-9 License??

[Steven503]

Hi,
We have a DMVPN network with ISR4451 hubs and looking to remove the 85Mbps crypto bandwidth limitation that is
set on the securityk9 license. I have read that maybe the HSECK9 license is what i need to lift this limitation, but there is also the BOOST license which seems to be similar.

Can someone please advise the best way to go?

For example, we have a ISR4451 spoke and ISR4451 hub with 1Gb internet at each end and looking to get the most bandwidth over DMVPN as we can.

Thanks

[Georg Pauwen]

Hello,

Hello,

actually, you need both licenses (the HSECK9 to get rid of the 85Mpbs limit), and the Performance or Boost license (based on the model you have, check the table below).

The HSECK9 license does not increase the overall throughput.

Table 4.             Specifications of Cisco 4000 Family Integrated Services Routers

Technical Specifications	Cisco 4461	Cisco 4451	Cisco 4431	Cisco 4351	Cisco 4331	Cisco 4321	Cisco 4221
Aggregate Throughput (Default)	1.5Gbps	1 Gbps	500 Mbps	200 Mbps	100 Mbps	50 Mbps	35Mbps
Aggregate Throughput (Performance License)	3Gbps	2 Gbps	1 Gbps	400 Mbps	300 Mbps	100 Mbps	75 Mbps
Aggregate CEF Only[5] Throughput (Boost License)	Over 7Gbps	Over 4Gbps	Over 4Gbps	Over 2Gbps	Over 2Gbps	1.5Gbps

Add tags

[Georg Pauwen]

Table 4.             Specifications of Cisco 4000 Family Integrated Services Routers

Technical Specifications	Cisco 4461	Cisco 4451	Cisco 4431	Cisco 4351	Cisco 4331	Cisco 4321	Cisco 4221
Aggregate Throughput (Default)	1.5Gbps	1 Gbps	500 Mbps	200 Mbps	100 Mbps	50 Mbps	35Mbps
Aggregate Throughput (Performance License)	3Gbps	2 Gbps	1 Gbps	400 Mbps	300 Mbps	100 Mbps	75 Mbps
Aggregate CEF Only[5] Throughput (Boost License)	Over 7Gbps	Over 4Gbps	Over 4Gbps	Over 2Gbps	Over 2Gbps	1.5Gbps

[balaji.bandi]

Look at the data sheet, it durable with the right License :

https://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/data_sheet-c78-732542.html

preformance :

https://www.cisco.com/c/en/us/td/docs/routers/access/4400/software/configuration/guide/isr4400swcfg/bm_isr_4400_sw_config_guide_chapter_0101.html#concept_3F15D3B0CBA64CA9BADC3C84FE0C63FB

https://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.html

[Joseph W. Doherty]

Your Internet connections are full gig, both up and down?  If so, you'll want at least the performance license to support the possible 2 gig aggregate on your 4451.

Then, as Georg also notes, you'll want the security license to remove its caps (BTW, I believe the 85 Mbps cap has been raised in later IOS versions, but not to anything near full router rate).

Also BTW, you may find your 4451 being unable to provide a full 2 gig throughput for encrypted traffic (even with a boost license [NB: a boost license doesn't require you first have a performance license, I believe]).

You might find page 15 in: https://miercom.com/pdf/reports/20150817.pdf of interest.

[balepe]

Hello,

My understanding is that the limitation should exist on following model: ISR4221, ISR4321, ISR4321 and ISR4331 as well as ISR4351 and ISR4431.

In regard to ISR4451, I’m not sure if the limitation exists there.

Having say that, to overcome the limitation you need:

1. You first need the Seck9 licence to begin with, otherwise you can not even implement your VPN.
2. To overcome the limitation, you then need the hseck9. Which will allow you to exceed the limited number of secure tunnels and the 85Mbit/s of crypto bandwidth.