We have a Cisco 2901 on the edge of a 100Mbps/100Mbps WAN link which is providing an endpoint for an IPSec VPN to a Juniper SSG 550M.

The problem is that we are seeing a max of 'only' 40Mbps over the IPSec VPN, and when the VPN is at capacity the CPU load on the Cisco is around 80-90%, and it stays there and does not drop at all.

The show proc cpu sorted command gives me the following:

CPU utilization for five seconds: 81%/80%; one minute: 77%; five minutes: 40%
 PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process
 101      188804    47594649          3  0.23%  0.22%  0.21%   0 Ethernet Msec Ti
  14      482964      385534       1252  0.23%  0.04%  0.05%   0 Environmental mo
   3        1460         585       2495  0.15%  0.04%  0.05% 388 SSH Process
 327       85280      280383        304  0.07%  0.01%  0.00%   0 SNMP ENGINE
 127       43608    11898639          3  0.07%  0.04%  0.05%   0 IPAM Manager
 142        5920     1510439          3  0.07%  0.00%  0.00%   0 SSS Feature Time
 131      114060      407605        279  0.07%  0.03%  0.00%   0 IP Input
 325      130836      561332        233  0.07%  0.02%  0.00%   0 IP SNMP

And for completeness, a history:

   90                *****
   80 *************************************************
   70 *************************************************
   60 *************************************************
   50 *************************************************
   40 *************************************************
   30 *************************************************
   20 *************************************************          *
   10 ************************************************************
               0    5    0    5    0    5    0    5    0    5    0
               CPU% per second (last 60 seconds)

I've tried many different combinations of encryption/hashing to try and squeeze out more performance but the best I've seen it is at 50Mbps and only just for a bit. This was DES/MD5 as expected.

I have also read that it may need a hardware encryption module to speed things up, however judging from what I can see, there is a built in encryption module:

    crypto engine name:  Virtual Private Network (VPN) Module
    crypto engine type:  hardware
                 State:  Enabled
              Location:  onboard 0
          Product Name:  Onboard-VPN
            HW Version:  1.0
           Compression:  Yes
                   DES:  Yes
                 3 DES:  Yes
               AES CBC:  Yes (128,192,256)
              AES CNTR:  No
 Maximum buffer length:  0000
      Maximum DH index:  0000
      Maximum SA index:  0000
    Maximum Flow index:  2800
  Maximum RSA key size:  0000

I also do not know if this is being used to it's capacity.

As far as ACLs are concerned, the only which would even be remotely intensive is an Outside Global -> Outside Local NAT Pool rule.

I've also tried with the MTU set to 1452 and adjust-mss set to 1400

I'm having a little trouble ruling out if this is a hardware limitation or a configuration issue.

The other side of the VPN seems to have no issue with resourcing.

Is the Cisco 2901 actually capable of pushing 100Mbps over an IPsec tunnel? I believe Cisco's documentation state that it can go up to 170Mbps or something similar.
Cisco had actually quoted me the following:
As for the 2801 (and eol model that is replaced by the 2901) can support up to 160Mbps.

In the case that the router is not suitable, what model would be able to sustain 100Mbps in the same circumstances?

Would adding an additional hardware encryption module help also?

Any other tips to squeeze the most out of an IPsec VPN?


To your first question - 40mbps sounds about right on tested specification for 2901 ipsec performance with features enabled (ACL + NAT).

All the ISR G2 platforms include hardware encryption that is enabled automatically. You wouldn't be getting anywhere near 40mbps without the hardware module kicking in :)

If you're looking for a router that can push 100 mbps of ipsec with services you're right in between either the 2951 or the 3925 platform. I'd go with the 3925 and give yourself some headroom.

Also you'll need the HSEC (HIGH security license) in the US because export controls don't allow encryption past 85 mbps without that license, regardless of hardware capability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.