[c-nsp] ASR 1002-HX IPSec throughput

Šturmankin Miroslav miroslav.sturmankin at swan.sk
Mon Feb 11 10:42:01 EST 2019

Hello everybody,

I am looking for an advice regarding IPSec throughput on ASR1102-HX. According to datasheet about ESP, the router can do up to 39Gbps IPSec with integrated ESP (ESP100 sort-of) see table 15:

According to other datasheet, 1002-HX supports embedded hardware-based encryption up to 25Gbps (see table 5):

When I check the router through commerce estimates, for 1002-HX I can order crypto HW module and software licenses:
ASR1002HX-IPSECHW - Cisco ASR1002-HX Crypto Module with no default throughput
FLSA1-2HXIPS8G - Crypto throughput License for ASR1002-HX 8G
FLSA1-2HX8G16G - Crypto throughput upgrade from 8G to 16G for ASR1002-HX
FLSA1-2HX8G25G - Crypto throughput upgrade from 8G to 25G for ASR1002-HX

Seems to me that you need at least 8G license for HW module to start with.

What about declared throughput of 39Gbps for IPSec in the first datasheet? Is it a typo or the integrated ESP can do this throughput on IPSec without crypto HW module? Is the crypto module mandatory?

Thank you all for any insight and hands-on experience.

Regards/S pozdravom,

Miro Sturmankin

More information about the cisco-nsp mailing list