Cisco ASR 1000 ESP Architecture and 20–200 Gbps Throughput

Cisco ASR 1000 Series Embedded Services Processors (ESPs) are data-plane processing modules for ASR 1000 Series Aggregation Services Routers. They perform packet forwarding, queuing, traffic management, encryption, firewall, NAT, QoS, NetFlow, and other network services in parallel while maintaining high forwarding rates. The product family includes integrated ESP implementations and field-replaceable ESP modules with nominal forwarding classes of 20, 40, 100, and 200 Gbps, plus ESP-X variants.

Product role and architecture

The ESP handles the router data plane. The route processor provides control-plane functions, while the ESP performs packet classification, forwarding, service processing, and queuing. The architecture is based on the Cisco Flow Processor (FP), which consolidates up to 256 customized packet-processing cores operating from 900 MHz to 1.5 GHz.

The FP architecture is designed to process multiple services concurrently rather than requiring separate service blades for each function. Supported functions include:

• Layer 2 and Layer 3 forwarding
• MAC address classification
• QoS classification, shaping, policing, and queuing
• NetFlow packet accounting
• IPsec encryption
• Zone-based firewall
• Network Address Translation
• Carrier-Grade NAT
• Application Visibility and Control
• Performance Routing
• Locator ID Separation Protocol
• Ethernet over MPLS
• Virtual Private LAN Services
• Overlay Transport Virtualization
• Virtual Extensible LAN Services
• AppNav
• Deep-Packet Inspection
• Distributed denial-of-service detection and prevention
• Control-plane protection
• Cisco Session Border Control
• Multicast VQE and video Call Admission Control

The architecture provides centralized shared memory and parallel processing for low-latency forwarding. The family supports system throughput up to 200 Gbps and packet processing up to 130 million packets per second in the general feature description. Individual platform and ESP performance varies according to chassis, software, enabled services, packet size, and traffic profile.

Deployment scenarios

Service provider broadband aggregation

ASR 1000 routers with ESP processing can terminate broadband subscriber sessions, support L2TP tunnels, and apply per-user security policies. The published platform scaling ranges from thousands of sessions on smaller integrated platforms to 58,000 broadband sessions on several high-end ESP configurations.

Presales sizing must distinguish between subscriber count, concurrent sessions, session setup rate, NAT translations, firewall sessions, and aggregate throughput. These are separate limits. A design that meets a bandwidth target may still fail a session or setup-rate requirement.

Managed CPE and WAN aggregation

The platforms support high-density Gigabit Ethernet and 10 Gigabit Ethernet aggregation, Layer 2 and Layer 3 VPN services, multicast, and encrypted WAN connectivity. These capabilities suit managed customer-premises deployments, enterprise WAN headends, and service-provider aggregation points.

For managed WAN designs, calculate:

1. Aggregate ingress and egress bandwidth.
2. Peak packet rate, not only average throughput.
3. IPsec throughput at the expected packet size.
4. Number of VRFs, GRE tunnels, and QoS policies.
5. Required interface adapters and compatible SIP or Ethernet line cards.
6. Whether hardware redundancy is required.

Multimedia provider edge

The ESP can combine data forwarding with voice and video services at the provider edge. The listed Cisco Unified Border Element scaling reaches 64,000 sessions on several service-provider ESP configurations. The published session definition represents a complete voice call with 14 SIP messages: two SBC call legs, two media legs for bidirectional media flow, and seven SIP messages per call leg.

Enterprise WAN and Internet gateway

Enterprise deployments can combine IPsec, firewall, NAT, QoS, and routing functions in one ASR platform. Published encryption throughput ranges from 4 Gbps on the integrated ASR 1002-X configuration to 183 Gbps on the ESP200-X configuration, with the figures based on plain IPsec using 1400-byte packets where stated.

Firewall and NAT limits must be evaluated independently. For example, the ESP200-X lists 32 million firewall sessions, 32 million NAT sessions, 52 million Carrier-Grade NAT sessions, and a NAT setup rate of 78,000 sessions per second. These figures are not interchangeable with forwarding bandwidth.

Data center interconnect

The ESP family supports encrypted interconnection between data centers and cloud-connected environments. A DCI design should validate the selected ESP against encryption throughput, route scale, VRF count, multicast requirements, queue requirements, and failover architecture. Dual ESP and dual route processor configurations are required for the documented ISSU design on supported chassis.

Platform selection and performance

The following table consolidates the main published performance figures. Forwarding performance is variable when services are enabled. All performance figures are stated under the datasheet test methodology unless otherwise noted.

The ESP100-X and ESP200-X deployment profile requires validation before final configuration. Their published service limits are materially different from the standard ESP100 and ESP200, particularly for IPsec, firewall, NAT, and CGN.

QoS, routing, and security scale

Common scale values across the family include:

• Up to 4,000 unique ACLs on the listed platforms.
• Up to 400,000 IPv4 ACEs on the ASR 1002-HX, ESP100, ESP200, and ESP200-X.
• Up to 380,000 IPv4 ACEs on the ESP100-X.
• Up to 232,000 queues on the ASR 1002-HX, ESP100, and ESP100-X.
• Up to 464,000 queues on the ESP200 and ESP200-X.
• Three levels of QoS hierarchy.
• Two LLQ queues per policy.
• Up to 4,000 QoS policies on most listed platforms.
• Up to 1,000 QoS policies on the ASR 1001-X.
• 8-kbps policing and queuing granularity on the platforms where specified.
• High-priority application latency below 100 microseconds on the listed scalable platforms.
• Up to 8,000 VRF instances on most modular and high-end configurations.
• Up to 4,000 GRE tunnels on the published platforms.

Route scale depends on route processor memory and ESP model. The ESP200-X supports up to 4 million IPv4 or IPv6 routes with 16-GB RP2 or RP3 memory, and up to 8.5 million IPv4 or 7.5 million IPv6 routes with 32-GB RP3 memory.

Chassis and software compatibility

Integrated ESP platforms include:

The ASR 1002-X supports 1+1 redundancy when configured with two 10-Gbps ESP modules. Modular chassis redundancy options include:

• ASR 1006 with two 20-Gbps ESP modules
• ASR 1006, ASR 1006-X, ASR 1009-X, or ASR 1013 with two 40-Gbps ESP modules
• Supported high-end chassis with dual 100-Gbps or 200-Gbps ESP modules as listed in the compatibility tables

Software requirements vary by platform:

• Cisco IOS XE Software Release 2.1 or later for 5- and 10-Gbps ESPs
• Release 2.2 or later for 10-N- and 20-Gbps ESPs
• Release 3.1.0S or later for 40-Gbps ESP support
• Release 3.2.0S or later for 40-Gbps ESP support on ASR 1004
• Release 3.7.1S or later for 100-Gbps ESP
• Release 3.10.0S or later for 200-Gbps ESP
• Release 17.2.1r or later for ESP100-X and ESP200-X
• Release 16.2.S or later for the ASR1002-HX integrated ESP
• Release 16.3.S or later for the ASR1001-HX integrated ESP

The broader ASR 1000 feature set requires Cisco IOS XE Software Release 2.4 or later. The ASR 1001-X requires Release 3.12 or later for its newly added platform support.

Memory and hardware characteristics

Integrated modules share control memory with the route processor. The ASR 1002-HX integrated ESP has 4-GB FP resource memory, 80-Mb TCAM, and 1-GB packet buffer memory. The ASR 1001-HX has 4-GB FP resource memory, 40-Mb TCAM, and 512-MB packet buffer memory. The ASR 1002-X integrated module has 1-GB FP resource memory, 40-Mb TCAM, and 512-MB packet buffer memory.

Physical, environmental, and acoustic specifications

Field-replaceable 10-, 10-N-, 20-, 40-, and 100-Gbps ESP modules measure 0.92 x 16.7 x 14.19 inches, or 0.023 x 0.428 x 0.369 meters. The 200-Gbps ESP measures 2.44 x 16.7 x 14.19 inches, or 0.062 x 0.428 x 0.369 meters. Integrated ESP dimensions and power are included in their respective chassis specifications and are not separately applicable.

The module power requirements are:

Environmental operating limits are:

• Storage temperature: -40 to 70 C
• Nominal operating temperature: 5 to 40 C
• Short-term operating temperature: -5 to 55 C
• Storage humidity: 5 to 95 percent relative humidity
• Nominal operating humidity: 5 to 85 percent relative humidity
• Short-term operating humidity: 5 to 90 percent relative humidity
• Operating altitude: -60 to 4,000 meters
• Operation up to 2,000 meters conforms to IEC, EN, UL, and CSA 60950 requirements

The supplied specifications do not state an MTBF value. Acoustic noise is also not specified for the ESP module. Noise and MTBF must therefore be taken from the applicable ASR chassis documentation when preparing a facilities plan. For integrated ESP platforms, physical, acoustic, thermal, and reliability values are chassis-level characteristics rather than separate ESP-module values.

The module specifications list UL60950, CAN/CSA-C22.2 No. 60950, AS/NZS 60950, IEC/EN 60950, FCC Class A, EN55022 Class A, CISPR standards, VCCI, CNS-13438, GR1089, GR-63-CORE, GR-1089-CORE, and applicable ETSI requirements.

Availability and operations

The ESP family supports Online Insertion and Removal, Nonstop Forwarding, and Stateful Switchover where specified. Modular 10-, 10-N-, 20-, 40-, 100-, and 200-Gbps ESP configurations support 1+1 high availability in supported dual-ESP chassis. ISSU is supported with ASR 1006, ASR 1006-X, ASR 1009-X, and ASR 1013 when dual route processors and dual ESPs are installed.

Management is provided through the route processor using:

• Telnet CLI
• Console CLI
• SNMP, RFC 2665
• RFC 2737-compliant MIB support

Presales designs should include dual route processors and dual ESPs when the service-level requirement includes control-plane maintenance, ESP failover, or ISSU. A single integrated ESP provides software redundancy features where stated but does not provide hardware ESP redundancy.

Ordering SKU matrix

ESP modules

Compatible chassis, processors, and interface components

Power supplies

The 100-Gbps standard ESP requires the ASR1000 1600 W AC or DC power supply identified by SKU in the compatibility data. Power planning must use maximum ESP draw, chassis draw, interface-card draw, and redundancy configuration rather than typical ESP consumption alone.

Services, warranty, and commercial planning

Cisco Services are described as covering technical support and advanced services intended to protect the network investment, optimize operations, and prepare the network for additional applications. The datasheet does not define a single universal service entitlement for every ESP SKU.

Warranty terms are not specified in the product tables. Warranty information is provided through the Cisco warranty finder associated with the product. During procurement, the warranty entitlement should be checked against the exact chassis, ESP, power supply, and service bundle being quoted.

A complete proposal should therefore identify:

• ESP SKU and compatible chassis
• Route processor and interface processor requirements
• Port adapters and licensing
• AC or DC power requirements
• Single or dual ESP configuration
• Route processor redundancy
• IOS XE software requirement
• Required security and NAT session scale
• IPsec throughput at the expected packet size
• Environmental and rack power limits
• Support and warranty coverage for the complete bill of materials