Cisco 2901 Integrated Services Router Generation 2 (ISR G2) Full Product Description

1. Short Overview

Naming & Variant Breakdown

• CISCO2901/K9: Standard AC-powered base router with IP Base universal IOS image, embedded K9 crypto acceleration
• CISCO2901-SEC/K9: Pre-bundled Security license variant with Zone-Based Firewall, IOS IPS, and full IPsec support
• CISCO2901-V/K9: Unified Communications bundle with CME/SRST voice licensing
• CISCO2901-VSEC/K9: Combined Voice + Security all-in-one branch bundle
• CISCO2901-AX/K9: Advanced services bundle with SRE/WAAS application optimization support
• CISCO2901-AC-IP/K9: Integrated PoE power supply variant to feed IP phones via switch EHWICs

Core Differentiators vs Cisco 2801 (First-Gen ISR)

1. Multi-core CPU architecture, up to 75 Mbps multi-service throughput vs 30 Mbps on the 2801
2. New EHWIC high-performance WIC standard (backward compatible with legacy HWIC/WIC/VIC/VWIC)
3. 1 dedicated ISM (Internal Service Module) slot for virtualized apps, WAAS, storage, or CUE voice mail (2801 has no ISM slot)
4. Dual onboard Gigabit Ethernet ports (2801 only has Fast Ethernet)
5. Two onboard PVDM DSP slots native to motherboard, improved voice/video codec support
6. Larger memory ceiling: Max 2GB DRAM / 8GB CompactFlash vs 384MB DRAM / 256MB CF on 2801
7. Modern IOS universal licensing model with separate Data, Security, UC feature licenses
8. Two USB 2.0 ports (USB 1.1 on 2801) for storage and authentication tokens
9. No external RPS redundant power support (unlike 2911/2921/2951); internal non-hot-swappable power supply

2. Hardware Interface & Physical Specifications

Modular Expansion Architecture

1. 4 × EHWIC (Enhanced High-Speed WAN Interface Card) rear universal slots
   Each slot supports single-wide EHWIC, double-wide EHWIC-D, legacy HWIC, WIC, VIC, VWIC voice cards; two slots accept double-wide high-bandwidth modules:
   • EHWIC: ADSL2+, VDSL2, G.SHDSL, serial, 4-port GE switch, cellular wireless WAN cards
   • WIC: ISDN BRI, synchronous/asynchronous serial, analog modem dial backup WICs
   • VIC/VWIC: FXS/FXO/E&M analog voice, fractional T1/E1 multi-flex trunk voice cards
2. 2 × Onboard motherboard PVDM3 DSP slots
   Host Packet Voice Digital Signal Processor modules to handle VoIP codecs, wideband G.722 audio, G.168 echo cancellation, T.38 fax relay, and multi-party conferencing without consuming external EHWIC slots.
3. 1 × ISM (Internal Service Module) internal slot
   Supports SRE (Services Ready Engine) virtualization modules, WAAS wide-area optimization, AIM-CUE voice mail storage, and embedded application services to offload CPU workloads.

Fixed Built-in Rear Panel Ports

1. 2 × Auto-MDI-X 10/100/1000BASE-T Gigabit Ethernet (GE0/0, GE0/1)
   Auto-negotiates 10/100/1000 Mbps full/half duplex; fully supports IEEE 802.1Q VLAN trunking, inter-VLAN routing, LACP link aggregation for isolating corporate, finance, guest, and payment subnets.
2. RJ45 Serial Console port (115.2 kbps max baud) – local out-of-band CLI management
3. RJ45 AUX port – remote emergency access via external PSTN analog modem
4. 2 × USB 2.0 Type-A ports– high-speed offline config/log storage, crypto authentication tokens
5. Removable external CompactFlash (CF) slot – primary persistent storage for IOS universal images, full configurations, persistent event logging
6. IEC AC power inlet (2901 has no DC power variant)
7. Chassis ground lug + Kensington anti-theft lock slot for physical rack security

Memory & Performance Benchmarks

• Processor: Multi-core PowerQUICC RISC CPU with dedicated embedded hardware crypto FPGA acceleration
• Default DRAM: 512MB ECC SDRAM; maximum expandable DRAM: 2048MB (2GB) via dual DIMM slots
• Default Flash memory: 256MB CompactFlash; maximum supported Flash: 8GB CF card
• Multi-service mixed voice/data/security throughput: Up to 75 Mbps aggregate wire-speed performance
• Hardware crypto acceleration: Native AES-256, 3DES, DES IPsec, SSL/TLS, GRE VPN offloading, no mandatory AIM modules required
• Maximum concurrent site-to-site IPsec tunnels: Up to 200+, scalable with full DRAM and ISM security modules
• Supported IOS releases: Cisco IOS 15.0(1)M through 15.7(3)M universal multi-service images; feature functions unlocked via permanent chassis-bound software licenses (SL-29-DATA-K9, SL-29-SEC-K9, SL-29-UC-K9)Cisco
• Voice capacity: PVDM3 DSP modules support up to 96 concurrent VoIP calls; Cisco CME embedded call processing for up to 150 IP phones, SRST survivable remote telephony, Unity Express voice mail hosted via ISM storage modules

Physical & Power Parameters

• Form factor: 1U standard 19-inch rack-mount metal chassis with integrated rack ears
• Standard AC power supply: 100–240V 50/60Hz universal autoranging internal power supply (non-hot-swappable, no RPS support)Cisco
• PoE variant (C2901-AC-IP): Integrated inline power distribution to supply IP phones via compatible switch EHWIC modules
• Typical chassis power consumption: ~60W under fully loaded EHWIC/PVDM/ISM module configuration
• Front panel status LEDs: System power, fault alarm, CompactFlash activity, dual USB port status, PVDM/ISM health indicators, four EHWIC slot link/activity, dual Gigabit Ethernet link/activity
• Operating environment
  • Operating temperature: 0°C to +40°C below 1800m altitude; 0°C to +25°C above 1800m up to 3000m
  • Relative humidity: 10–85% RH non-condensing
• Dimensions (H × W × D): 44.5 × 43.2 × 8.9 cm (17.25 × 17 × 3.5 inches)
• Fully loaded weight: ~6.1 kg (13.4 lbs)
• No native chassis PoE output except for dedicated -AC-IP power supply variant.

3. Cisco IOS Universal Image Multiservice Feature Suite

Core Routing & Multi-WAN Connectivity

• Full IPv4 / IPv6 dual-stack routing stack: Static routes, RIP v1/v2, OSPF, EIGRP, BGP, IS-IS, PIM multicast suite, BFD bidirectional forwarding detection
• WAN encapsulation support: PPP, HDLC, Frame Relay, ATM, ISDN, PPPoE/PPPoA for DSL, Dial-on-Demand Routing (DDR) for automatic backup failover, MPLS L2/L3 VPN
• HSRP/VRRP for router high availability redundancy; NHRP DMVPN hub-spoke multi-site overlay VPN architecture
• NAT services: Static NAT, dynamic NAT, PAT overloading, multi-address NAT pools, NAT64 IPv4-IPv6 transition support
• IEEE 802.1Q VLAN trunking, inter-VLAN routing, storm control, LACP link aggregation across dual Gigabit Ethernet onboard ports.

Unified Communications Voice & Fax Integration

1. VoIP signaling protocols: H.323, SIP, MGCP, SCCP native support for Cisco Unified IP Phone deployments
2. Analog/digital telephony via VIC/VWIC + PVDM3 DSPs: FXS station ports, FXO PSTN trunk lines, E&M PBX tie connections, fractional T1/E1 multi-flex voice trunks
3. T.38 real-time fax relay over IP, fax passthrough, store-and-forward fax routing
4. DSP-accelerated voice codecs: G.711, G.729a, G.726, wideband G.722 high-fidelity audio, video conferencing codec support
5. Enterprise telephony tools: Scalable multi-site dial plans, voice hunt groups, toll bypass to eliminate expensive long-distance PSTN charges
6. CME embedded call manager, SRST survivable remote telephony, Unity Express voice mail/auto-attendant hosted via ISM-CUE storage modules.

Enterprise QoS & WAN Optimization

• Base QoS tools: Weighted Fair Queuing (WFQ), CBWFQ, per-interface traffic shaping
• Advanced QoS (Data/UC license): Low Latency Queuing (LLQ), Frame Relay Traffic Shaping (FRTS), WRED congestion avoidance, DSCP/802.1p traffic marking
• Link Fragmentation and Interleaving (LFI), cRTP VoIP header compression to eliminate voice jitter over low-speed DSL/ISDN backup links
• NBAR2 next-generation deep packet inspection for application-aware traffic prioritization of business-critical software; ISM WAAS module for WAN bandwidth optimization.

Integrated Self-Defending Network Security Suite

1. Zone-Based Stateful Firewall (ZBFW): Deep application-layer inspection for HTTP, FTP, SIP, H.323 and all mainstream enterprise business protocols
2. IOS IPS inline signature-based intrusion prevention with real-time threat detection and automated connection blocking
3. Embedded hardware-accelerated VPN stack:
   • AES-256/3DES/DES IPsec site-to-site branch tunnels
   • Cisco Easy VPN Remote centralized security policy provisioning for remote branch locations
   • DMVPN scalable hub-spoke multi-site overlay networks
   • SSL VPN for browser-only remote worker access without client software
4. AAA security framework: PAP/CHAP authentication, RADIUS/TACACS+ centralized access control and complete audit logging
5. Standard/extended ACLs, dynamic ACLs, anti-DDoS traffic policing, security zone segmentation to isolate sensitive POS payment and finance subnets.

Management, Automation & Operations

• Dual out-of-band management interfaces: Serial Console and AUX modem port for emergency offline IT maintenance
• Secure remote management: SSHv2, HTTPS, SNMP v3 (backward compatible with SNMP v1/v2c), TR-069 remote provisioning
• Graphical configuration utility: Cisco Configuration Professional (CCP) for simplified zero-touch mass branch deployment
• AutoInstall automated remote IOS image and configuration download over WAN links for nationwide branch rollouts
• Removable CompactFlash storage for easy IOS upgrades, configuration backup, and centralized log archiving
• Persistent syslog event logging, NTP time synchronization for consistent audit log timestamps
• Dual USB 2.0 ports for offline config storage and two-factor authentication security tokens.

4. Typical Deployment Scenarios

1. Small multi-line retail branch office: ADSL2+ EHWIC primary broadband WAN, ISDN BRI WIC dial backup, dual PVDM3 DSP modules for store analog phones and fax machines, dual Gigabit Ethernet ports to isolate POS payment terminals from employee PC subnets, IPsec DMVPN tunnel to corporate HQ, integrated ZBFW firewall for PCI DSS compliance.
2. SMB small office converged voice/data gateway: VDSL2 EHWIC copper access, CME embedded call processing for 30–80 IP phones, LLQ QoS prioritization for business VoIP and video conferencing, ISM storage module for local voice mail and log retention, AUX modem port for remote IT out-of-band maintenance.
3. Remote industrial M2M site router: Serial EHWIC for SCADA leased-line connectivity, standard AC power variant for office cabinet deployment, encrypted IPsec tunnels for secure industrial data transmission, USB token authentication for site access control.
4. Entry-level networking training lab core router: Universal EHWIC/WIC/VIC modularity to teach DSL, ISDN, serial WAN connectivity, basic VoIP gateway, hardware-accelerated IPsec VPN and zone-based firewall labs; large DRAM/CF capacity supports full-featured IOS 15.x M images unavailable on legacy 2800 series routers.

5. Standard Package Contents of CISCO2901 / 2901-AC-IP

Separately Sold Optional Accessories

• EHWIC/WIC/VIC/VWIC WAN and analog/digital voice interface cards
• PVDM3 DSP voice compression modules for VoIP, wideband audio and T.38 fax relay
• ISM Internal Service Modules: SRE virtualization, WAAS optimization, CUE voice mail storage
• DRAM memory expansion DIMMs (512MB / 1GB / 2GB)
• CompactFlash memory upgrades (256MB / 1GB / 4GB / 8GB)
• CAT5e/CAT6 Gigabit Ethernet patch cords, RJ11 DSL/ISDN telephone line cables
• External PoE injectors for non-PoE IP cameras and wireless access points

Software Licensing Information

1. SL-29-DATA-K9: Base routing, IPv6, MPLS, QoS, NBAR2
2. SL-29-SEC-K9: Zone firewall, IOS IPS, full IPsec/SSL VPN, advanced security tools
3. SL-29-UC-K9: CME/SRST embedded voice call processing, Unity Express voice mail
   K9 crypto functionality is embedded hardware-based, compliant with US ITAR export regulations for global shipments. Licenses are permanent, no recurring subscription fees required.

Short Commercial Catalog Summary