Cisco ISR 1100 Series Router Architecture with 4GB DRAM and SD-WAN

The Cisco ISR 1100 and ISR 1100X Series are compact branch routers that combine WAN connectivity, SD-WAN, routing, security, management, and optional LTE in a fixed hardware platform. The ISR 1100 Series provides 4 GB of fixed DDR4 ECC DRAM, while the ISR 1100X Series provides 8 GB. The product family is intended for remote offices, branch offices, campus edge deployments, and other sites requiring secure connectivity over broadband, MPLS, Ethernet, fiber, or cellular transport.

The platforms operate with either the Viptela operating system or the IOS XE SD-WAN operating system. They participate in secure virtual overlay networks and can be managed centrally through Cisco vManage. Hardware selection is primarily determined by the required IPsec throughput, overlay tunnel scale, SFP connectivity, LTE coverage, and available security services.

Product family and model selection

The product family consists of six primary hardware SKUs.

The four integrated Ethernet ports on each model can be assigned for WAN or LAN use. The 6G models add two Ethernet interfaces that support SFP-based connectivity in addition to RJ-45 connectivity. This allows the interface design to accommodate copper or fiber access without changing the router platform.

The LTE models provide four copper Ethernet interfaces and an embedded CAT4 cellular modem. They use a single Micro 3FF SIM socket and support one included multiband swivel-mount dipole antenna. A second antenna is identified as part of the supported antenna configuration.

Throughput and scale

The published SD-WAN performance values are as follows:

The throughput values are specified for IOS XE SD-WAN operation. The 6G hardware provides substantially higher published IPsec throughput and tunnel scale than the 4G hardware. The ISR 1100X models provide higher overlay tunnel capacity than their ISR 1100 counterparts, while the 4G and 6G throughput values shown in the specification table are the same for corresponding form factors.

Sizing should use the IMIX value when the expected traffic profile includes a mixture of packet sizes and application types. The 1400-byte value is useful for a large-packet test profile but should not be treated as a universal application throughput figure. Actual performance depends on enabled features. Firewalling, application inspection, URL filtering, intrusion prevention, malware protection, traffic classification, encryption, and other services can affect delivered performance.

Recommended presales sizing rules are:

• Select the ISR1100-4G when the requirement is within 411 Mbps of IMIX IPsec traffic and the site requires no more than 250 overlay tunnels.
• Select the ISR1100-6G when fiber or SFP connectivity is required, or when the site requires up to 1500 overlay tunnels.
• Select the ISR1100X-4G when the 4G physical interface design is adequate but the deployment requires up to 500 overlay tunnels or the additional memory headroom of the X platform.
• Select the ISR1100X-6G when SFP connectivity and up to 3000 overlay tunnels are required.
• Do not size from raw interface count alone. Validate aggregate encrypted traffic, tunnel count, security services, application inspection, and failover behavior.
• Treat the published figures as platform reference values, not guaranteed application throughput under every feature combination.
• Use a remote-performance, on-demand license upgrade when the required IPsec capacity can be increased through licensing rather than hardware replacement.

The datasheet does not provide separate throughput values for the LTE interfaces, firewall-only operation, IPS, URL filtering, Advanced Malware Protection, or individual routing protocols.

WAN, LAN, SFP, and LTE connectivity

All models provide four integrated 10/100/1000 Ethernet ports. These ports can operate as WAN or LAN interfaces, allowing the same hardware to support multiple deployment patterns:

• Single-WAN branch router with local LAN connectivity.
• Dual-WAN or multi-WAN branch with redundant transports.
• Internet and MPLS combination.
• Broadband primary transport with LTE backup on the LTE models.
• SD-WAN edge with separate transport and service-side interfaces.
• Copper access with optional SFP connectivity on the 6G models.

The 6G platforms include two additional Ethernet interfaces that can use SFP transceivers or RJ-45 connections. Supported 1GE transceivers include:

The LTE variants are differentiated by modem and supported band set:

The theoretical LTE download and upload rates are 150 Mbps and 50 Mbps respectively. These are CAT4 theoretical values and are dependent on the carrier, radio conditions, network configuration, and operator support for the listed bands.

LTE capabilities include selectable RF bandwidths of 1.4 MHz, 3 MHz, 5 MHz, 10 MHz, 15 MHz, and 20 MHz, WCDMA fallback, a last-resort circuit function, and SIM-based carrier firmware selection for Verizon, AT&T, or Generic operation. Operator and geographic validation is required before ordering an LTE SKU. Band support alone does not guarantee service availability.

Operating systems and network services

The Viptela operating system provides a broad SD-WAN feature set, including OMP, OSPF, BGP, eBGP, iBGP, static and connected routing, VRRP, MPLS, IPv4, transport-side IPv6, NAT, NAT pools, NAT64, NAT/PAT, NAT traversal, DHCP, DNS, VLANs, bridge domains, IRB, and multi-VRF operation.

Its traffic-management capabilities include QoS, class-of-service marking, per-tunnel QoS, WRED, app-aware routing, loss, latency and jitter monitoring, route policies, control policies, data policies, ACL policies, VPN membership policies, performance routing, packet duplication, traffic shaping, policing, scheduling, and service insertion.

The IOS XE SD-WAN operating system supports IPv4, IPv6, static routing, OSPF, EIGRP, BGP, IS-IS, BFD, VRRP, Layer 3 VPN, DHCP, DNS, NAT, IPsec, multicast functions, 802.1Q, OMP, SNMP, SD-AVC, and TCP optimization using BBR. Its traffic controls include QoS, WRED, hierarchical QoS, policy-based routing, NBAR, app-aware routing, multi-VRF support, traffic shaping, policing, and application visibility.

Both operating-system options support GRE, IPsec, Ethernet, and 802.1Q VLAN encapsulations. The Viptela operating system also identifies CHAP and PAP for PPPoE.

Cryptographic functions include AES-256 encryption in CBC and GCM modes, IKE, AAA, RSA, ECDSA, HMAC, SHA-1, SHA-2, and related IPsec integrity functions. The Viptela feature set additionally identifies Cisco PKI, RSA 2048-bit authentication, ESP-256-CBC, Authentication Header, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512, and integrated QAT.

Security services

The security capability depends on the selected operating system, model family, and licensed functions.

For ISR1100-4G, ISR1100-6G, and ISR1100-4GLTE models using IOS XE SD-WAN, the listed security services include:

• Enterprise Firewall with Application Awareness.
• DNS Web Layer Security.

For ISR1100X-4G and ISR1100X-6G using IOS XE SD-WAN, the listed services include:

• Enterprise Firewall with Application Awareness.
• Intrusion Prevention System.
• URL Filtering.
• Advanced Malware Protection.
• Cisco Umbrella Integration.

The application-aware firewall uses the NBAR2 application detection engine and can detect more than 1400 applications. The Intrusion Prevention System uses Cisco Talos signatures and is deployed through a security virtual image. URL Filtering supports controls based on 82 categories and web reputation. Advanced Malware Protection uses threat intelligence, sandboxing, and real-time malware blocking, also through a security virtual image.

The Viptela operating system lists Enterprise Firewall and DNS Web Layer Security. Application-aware firewall support is also identified for Viptela operation. Presales proposals should specify the operating system and licensed services instead of describing all security functions as available on every SKU.

Management and deployment

Cisco vManage provides networkwide deployment, configuration, monitoring, and troubleshooting. It supports automated operation across multiple transports, including Internet and MPLS, and can apply networking and security services across physical or virtual SD-WAN platforms.

Zero-touch provisioning is supported through Cisco vManage and the NETWORK-PNP-LIC license. This is relevant for distributed branch deployments where local IT staff are limited. The platform also provides an RJ-45 console port for local management and troubleshooting.

Embedded management and telemetry functions include:

• Cisco IP Service-Level Agreements.
• SNMP.
• RMON.
• Syslog.
• CFlowd.
• IPFIX.
• NETCONF over SSH.
• CLI.
• REST through vManage.
• ACL application to SNMP.
• Device access policy for SNMP and SSH.
• CPE WAN Management Protocol for IOS XE SD-WAN.

The visible indicators include system status, OMP status, Ethernet link and traffic state, SFP status, and SIM state on LTE models. The SIM indicator is applicable only to the two LTE SKUs.

Memory, storage, USB, and security architecture

The ISR 1100 platforms use fixed 4 GB DDR4 ECC DRAM. The ISR 1100X platforms use fixed 8 GB DDR4 ECC DRAM. The memory is not described as field-upgradable.

All platforms include fixed dual 16 MB serial flash. Bulk storage is provided by eMMC pSLC:

• 8 GB eMMC pSLC with 5.8 GB usable storage for ISR 1100 Series and ISR1100X-4G.
• 16 GB eMMC pSLC with 13.1 GB usable storage for ISR1100X-6G.

A USB Type-A 3.0 port provides 4.5 W and supports externally connected USB flash memory. The USB interface should be treated as a supported storage and operational accessory interface rather than as a general-purpose expansion bus.

Embedded device protections include Cisco anticounterfeit functionality and UEFI secure boot.

Physical, environmental, and acoustic considerations

All ISR 1100 and ISR 1100X models use the same published dimensions:

• Width: 10.2 inches, 259 mm.
• Depth: 7 inches, 178 mm.
• Height: 1.1 inches, 28 mm.

Weights are:

• ISR1100-4G, ISR1100-6G, ISR1100X-4G, and ISR1100X-6G: 2.67 lb, 1.21 kg.
• ISR1100-4GLTENA and ISR1100-4GLTEGB: 2.69 lb, 1.22 kg.

The external power adapter is part number 341-100891-01. It accepts universal 100 to 240 VAC input at 50 to 60 Hz, provides a maximum output power of 30 W, and delivers +12 VDC to the system.

The operating temperature range is 0 to 40 degrees C at sea level. Temperature derating of 1.5 degrees C per 1000 feet applies up to a maximum altitude of 10,000 feet or 3000 m. The specified maximum operating altitude is 10,000 feet or 3000 m with 1 degree C derating per 1000 feet. Operating humidity is 0 to 95 percent relative humidity, noncondensing.

The supplied specifications do not state an MTBF value. They also do not state an acoustic-noise level, fan profile, sound-power rating, or sound-pressure rating. Acoustic planning therefore requires site validation if the router will be installed in a noise-sensitive office, residential area, or open workspace. The datasheet likewise does not identify a PoE capability or PoE power budget. The 30 W external adapter specification is system power and must not be interpreted as a PoE budget.

Safety certifications include UL 60950-1, CAN/CSA C22.2 No. 60950-1, EN 60950-1, CB to IEC 60950-1, AS/NZS 60950.1, IEC-62368, NOM-019-SCFI-1998, and GB4943. EMC emissions and immunity compliance includes the listed EN, CISPR, FCC, ICES, VCCI, AS/NZS, CNS, KN, TCVN, and IEC test standards.

Ordering, licensing, and service

Relevant software and accessory part numbers include:

Support is available through Cisco Smart Net Total Care for the Cisco ISR 1000 Series on one-time or annual contract terms. Service options range from help-desk assistance to proactive and onsite consultation. Cisco and certified partners can provide branch deployment assistance, technical support, and operational services.

Presales service proposals should identify the hardware SKU, operating system, security licenses, zero-touch provisioning requirement, SFP or LTE accessories, software support entitlement, and replacement or onsite service requirements.