Cisco 3845 Integrated Services Router (Flagship 3800 ISR Series) Full Product Description

1. Short Overview

Naming & Variant Breakdown

• CISCO3845/K9: Standard AC-powered flagship router with IP Base IOS universal multi-service image and embedded K9 crypto hardware
• CISCO3845-AC-IP/K9: AC PoE power supply variant with integrated inline power distribution for 802.3af IP phones via compatible switch HWIC/VWIC modules
• CISCO3845-DC/K9: 24–60V negative DC autoranging telecom-grade power model for central office cabinet deployments
• -SEC/K9: Pre-bundled Advanced Security license variant enabling zone-based firewall, IOS IPS, full IPsec/SSL/DMVPN encryption
• -VOICE/K9: Unified Communications bundle pre-licensed for CME/SRST embedded voice call processing
• -VSEC/K9: All-in-one integrated Voice + Security converged branch bundle
• -HSEC/K9: High-security bundle factory-equipped with dual AIM-VPN/EPII PLUS high-performance encryption modules
• -FIPS/K9: Government regulated variant with physical security shield kit for FIPS 140-2 Level 2 compliance

Core Differentiators vs Cisco 3825

1. 4 NME/NME-XD enhanced network module slots(only 2 slots on 3825) supporting up to four independent T1/E1 PRI trunk, IDS, or storage modules simultaneously
2. Larger chassis power budget supporting fully loaded four NME, four HWIC, four PVDM, and dual AIM expansion modules
3. Double capacity for NMD/NME-XD double-wide high-density trunk modules (max 2 double-wide NME-XD vs 1 on 3825)
4. Identical core internal resources: 4 motherboard PVDM DSP slots, 2 independent AIM acceleration slots, four rear universal HWIC slots, dual Gigabit Ethernet + shared SFP fiber port, dual USB 1.1 ports, single CompactFlash storage
5. Same high-speed multi-task CPU architecture, maximum 1GB ECC DRAM, 256MB max CompactFlash capacity, native RPS redundant power connector
6. 3U taller rack chassis vs 2U for the 3825 to house four NME service modules and high-wattage power supply

2. Hardware Interface & Physical Specifications

Modular Expansion Architecture

1. 4 × NME / NME-XD Enhanced Network Module slots (Flagship exclusive upgrade)
   Four side-by-side universal rear slots that support single-wide NME or pair together to host double-wide NME-XD high-density modules for voice trunking, security, and storage:

• NM-2T1/NM-4E1 multi-port channelized T1/E1 PRI voice trunk modules for large PBX interconnection
• NM-CIDS-K9 dedicated inline intrusion detection modules
• AIM-CUE storage modules for Unity Express voice mail, auto-attendant, and local log retention
• EtherSwitch NME modules with multi-port Fast Ethernet switching for on-site IP phone access

1. 4 × Rear Universal HWIC/WIC/VIC/VWIC slots
   Each slot accepts single-wide HWIC, double-wide HWIC-D, legacy WIC, analog VIC, and multi-flex VWIC voice cards; two slots support double-wide high-bandwidth HWIC-D modules:

• HWIC: ADSL2+, VDSL2, G.SHDSL, synchronous serial, 4-port Fast Ethernet switch HWICs
• WIC: ISDN BRI, synchronous/asynchronous serial, analog modem WICs for Dial-on-Demand Routing (DDR) backup failover
• VIC/VWIC: FXS/FXO/E&M analog station/trunk cards, fractional T1/E1 multi-flex voice trunks

1. 4 × Motherboard PVDM2/PVDM3 DSP slots
   Dedicated onboard Packet Voice Digital Signal Processor slots to handle VoIP codecs, wideband G.722 audio, G.168 echo cancellation, T.38 fax relay, and multi-party audio conferencing without consuming external expansion slots; quadruple DSP capacity enables up to 384 concurrent VoIP calls for large IP phone deployments.
2. 2 × Internal AIM (Advanced Integration Module) daughtercard slots
   Dual independent parallel acceleration slots for simultaneous multi-workload offloading: AIM-VPN/EPII PLUS high-speed IPsec/SSL encryption, AIM-ATM SAR processing, AIM-COMPRESS data compression to reduce CPU overhead for massive multi-site VPN and WAN traffic.

Fixed Built-in Rear Panel Ports

1. 2 × Auto-MDI-X 10/100/1000BASE-T Gigabit Ethernet (GE0/0, GE0/1) + 1 shared SFP mini-GBIC fiber slot
   The SFP port shares hardware with GE0/0; activating the SFP disables the corresponding RJ45 port. All Gigabit ports fully support IEEE 802.1Q VLAN trunking, inter-VLAN routing, LACP link aggregation to isolate corporate, finance, engineering, guest, and sensitive POS payment subnets.
2. RJ45 Serial Console port (115.2 kbps max baud) – primary local out-of-band CLI management
3. RJ45 AUX port – remote emergency IT access via external PSTN analog modem
4. 2 × USB 1.1 Type-A ports– offline configuration/log backup storage, two-factor crypto authentication tokens
5. Removable external CompactFlash (CF) slot – primary persistent storage for IOS universal images, full running configurations, and persistent event logging
6. Power inlet: Standard IEC AC socket (DC variant uses 24–60V negative terminal block telecom input)
7. Dedicated RPS redundant power supply connector for mission-critical high-availability branch deployments
8. Chassis ground lug + Kensington anti-theft lock slot for physical rack security

Memory & Performance Benchmarks

• Processor: High-speed multi-task PowerQUICC RISC core with dedicated embedded hardware crypto FPGA acceleration (Safenet crypto chip)
• DRAM: 3.3V ECC SDRAM; factory default 512MB, maximum expandable to 1024MB (1GB) single DIMM slot
• Flash memory: Single CompactFlash slot; default 64MB, maximum supported Flash: 256MB 3.3V CompactFlash card
• Multi-service mixed voice/data/security throughput: Up to 100 Mbps aggregate wire-speed performance under full converged service load
• Hardware crypto acceleration: Native AES-256, 3DES, DES IPsec, SSL/TLS, GRE VPN offloading; scalable via dual AIM-VPN/EPII PLUS modules for hundreds of concurrent site-to-site tunnels
• Maximum concurrent site-to-site IPsec tunnels: Up to 350+, expandable with full 1GB DRAM and dual AIM encryption hardware
• Supported IOS releases: Cisco IOS 12.3T, 12.4 mainline / 12.4T universal multi-service maintenance images; feature functions unlocked via permanent chassis-bound software licenses (IP Base, Advanced Security, Unified Communications)
• Voice capacity: PVDM2/PVDM3 DSP modules support up to 384 concurrent VoIP calls, multi-party audio conferencing, T.38 real-time fax relay; Cisco CME embedded call processing for up to 250 IP phones, SRST survivable remote branch telephony, Unity Express voice mail hosted via AIM-CUE storage modules

Physical & Power Parameters

• Form factor: 3U standard 19-inch rack-mount metal chassis with integrated rack ears
• Standard AC power supply: 100–240V 50/60Hz universal autoranging internal power supply (hot-swappable with external RPS support)
• DC variant (C3845-DC): 24–60V negative DC telecom input for central office cabinet deployments
• PoE variant (C3845-AC-IP): Integrated inline power distribution delivering up to 360W PoE budget, expandable with external PoE boost accessories
• Typical chassis power consumption: ~555W under fully loaded four NME, four HWIC, four PVDM, dual AIM module configurationCisco
• Front panel status LEDs: System power, fault alarm, CompactFlash activity, dual USB port status, PVDM/AIM health indicators, four HWIC slot link/activity, four NME slot status, dual Gigabit Ethernet + SFP link/activity
• Operating environment
  • Operating temperature: 0°C to +40°C below 1800m altitude; 0°C to +25°C above 1800m up to 3000m
  • Relative humidity: 5–95% RH non-condensing
• Dimensions (H × W × D): 13.3 × 43.4 × 37.3 cm (5.25 × 17.1 × 14.7 inches)
• Fully loaded weight: ~13.6 kg (30 lbs) with complete expansion modules
• No native chassis PoE output except for dedicated -AC-IP power supply variant.

3. Cisco IOS Universal Image Multiservice Feature Suite

Core Routing & Multi-WAN Connectivity

• Full dual-stack IPv4 / IPv6 routing suite: Static routes, RIP v1/v2, OSPF, EIGRP, BGP, IS-IS, PIM multicast suite, BFD bidirectional forwarding detection
• WAN encapsulation support: PPP, HDLC, Frame Relay, ATM, ISDN, PPPoE/PPPoA for DSL, Dial-on-Demand Routing (DDR) for automatic backup failover, MPLS L2/L3 VPN, GETVPN
• HSRP/VRRP for router high availability redundancy; NHRP DMVPN hub-spoke multi-site overlay VPN architecture
• NAT services: Static NAT, dynamic NAT, PAT overloading, multi-address NAT pools, NAT64 IPv4-IPv6 transition support
• IEEE 802.1Q VLAN trunking, inter-VLAN routing, storm control, LACP link aggregation across two onboard Gigabit Ethernet ports and shared SFP fiber uplinks.

Unified Communications Voice & Fax Integration (Flagship High-Density Voice Differentiator)

1. VoIP signaling protocols: H.323, SIP, MGCP, SCCP native support for large-scale Cisco Unified IP Phone deployments
2. Analog/digital telephony via VIC/VWIC + four PVDM DSPs + four NME voice trunk modules: FXS station ports, FXO PSTN trunk lines, E&M PBX tie connections, multi-port T1/E1 PRI channelized trunk interworking with third-party PBX platforms (Avaya, Siemens, Nortel)
3. T.38 real-time fax relay over IP, fax passthrough, store-and-forward fax routing
4. DSP-accelerated voice codecs: G.711, G.719, G.729a, G.726, wideband G.722 high-fidelity audio, video conferencing codec support
5. Enterprise telephony tools: Scalable multi-site dial plans, voice hunt groups, toll bypass to eliminate expensive long-distance PSTN charges
6. CME embedded call manager, SRST survivable remote telephony, Unity Express voice mail/auto-attendant hosted via AIM-CUE storage modules.

Enterprise QoS & Bandwidth Optimization

• Base QoS tools: Weighted Fair Queuing (WFQ), per-interface traffic shaping
• Advanced QoS (Data/UC license): Low Latency Queuing (LLQ), Frame Relay Traffic Shaping (FRTS), WRED congestion avoidance, DSCP/802.1p traffic marking
• Link Fragmentation and Interleaving (LFI), cRTP VoIP header compression to eliminate voice jitter on low-speed DSL/ISDN backup links
• NBAR2 next-generation deep packet inspection for application-aware traffic prioritization of business-critical software; WAAS wide-area deduplication and optimization supported via AIM storage modules.

Integrated Self-Defending Network Security Suite

1. Zone-Based Stateful Firewall (ZBFW): Deep application-layer inspection for HTTP, FTP, SIP, H.323 and all mainstream enterprise business protocols
2. IOS IPS inline signature-based intrusion prevention with real-time threat detection and automated connection blocking
3. Dual AIM hardware-accelerated VPN stack:
   • AES-256/3DES/DES IPsec site-to-site branch tunnels
   • Cisco Easy VPN Remote centralized security policy provisioning for remote branch locations
   • DMVPN scalable hub-spoke multi-site overlay networks
   • SSL VPN for browser-only remote worker access without client software
4. AAA security framework: PAP/CHAP authentication, RADIUS/TACACS+ centralized access control and complete audit logging
5. Standard/extended ACLs, dynamic ACLs, anti-DDoS traffic policing, security zone segmentation to isolate sensitive POS payment and finance subnets
6. FIPS 140-2 Level 2 certified with optional physical security shield kit for government regulated deployments.

Management, Automation & Operations

• Dual out-of-band management interfaces: Serial Console and AUX modem port for emergency offline IT maintenance
• Secure remote management: SSHv2, HTTPS, SNMP v1/v2c/v3, TR-069 automated remote provisioning
• Graphical configuration utility: Cisco Configuration Professional (CCP) for simplified zero-touch mass branch deployment
• AutoInstall automated remote IOS image and configuration download over WAN links for nationwide branch rollouts
• Removable CompactFlash storage for easy IOS upgrades, configuration backup, and centralized log archiving
• Persistent syslog event logging, NTP time synchronization for consistent audit timestamps
• Dual USB 1.1 ports for offline config storage and two-factor authentication security tokens.

4. Typical Deployment Scenarios

1. Large regional enterprise headquarters multi-service edge gateway: Four NME-XD multi-T1/E1 PRI voice trunk modules connected to corporate PBX, dual fiber Metro Ethernet primary/secondary WAN uplinks via SFP slot, VDSL2 HWIC copper backup link, four PVDM DSP modules supporting over 350 concurrent VoIP calls, dual Gigabit Ethernet ports to segregate finance, engineering, staff, and guest VLANs, dual AIM-VPN encryption modules for hundreds of DMVPN IPsec tunnels to corporate headquarters, integrated ZBFW/IPS security stack for enterprise compliance.
2. National multi-chain retail headquarters voice gateway: ADSL2+ HWIC primary broadband WAN, ISDN BRI WIC dial backup, CME embedded call processing for 200–250 on-site IP phones, NME-CIDS intrusion detection module for PCI DSS payment security, AIM-CUE voice mail storage module for multi-location unified messaging.
3. Global carrier managed high-capacity enterprise CPE: Universal dual-standard DSL HWIC copper broadband access, DC power variant for central office rack deployment, multiple NME storage/optimization modules for tenant log retention and bandwidth control, DMVPN overlay to carrier central service hub, integrated firewall/IPS for tenant threat isolation and network segmentation.
4. Advanced enterprise networking high-density training lab flagship core router: Universal four NME/HWIC/WIC/VIC modularity to teach multi-port T1/E1 PRI voice trunking, fiber SFP uplinks, quadruple DSP VoIP gateway, hardware-accelerated high-volume IPsec VPN, and full unified communications gateway labs; full 1GB DRAM and large CF capacity fully support feature-rich IOS 12.4T images unavailable on all lower-tier 3825 and 2800 series routers.

5. Standard Package Contents of CISCO3845 / 3845-DC / 3845-AC-IP

Separately Sold Optional Accessories

• HWIC/WIC/VIC/VWIC WAN and analog/digital voice interface cards
• NME / NME-XD enhanced network modules (multi-T1/E1 trunk, IDS, Unity Express storage, EtherSwitch switching)
• PVDM2/PVDM3 DSP voice compression modules for VoIP, wideband audio and T.38 fax relay
• AIM daughtercards: AIM-VPN/EPII PLUS encryption, AIM-ATM SAR processing, AIM-COMPRESS data compression, AIM-CUE voice mail storage
• DRAM memory expansion DIMMs (512MB / 1GB)
• CompactFlash memory upgrades (64MB / 128MB / 256MB)
• CAT5e/CAT6 Gigabit Ethernet patch cords, RJ11 DSL/ISDN telephone line cables
• External PoE injectors for non-PoE IP cameras and wireless access points
• External redundant power supply units (RPS) for high-availability branch deployments
• FIPS physical security shield kit for FIPS 140-2 Level 2 certification

Software Licensing Information

1. IP Base License: Core routing, dual-stack IPv6, MPLS, basic QoS, NBAR2 application classification
2. Advanced Security License: Zone-based firewall, IOS IPS, full IPsec/SSL/DMVPN encryption, advanced threat mitigation, anti-DDoS policing
3. Unified Communications License: CME/SRST embedded voice call processing, Unity Express voice mail, full VoIP codec support for PVDM DSP modules
   Embedded K9 crypto hardware complies with US ITAR export regulations for global shipments. All licenses are permanent with no recurring subscription fees.

Short Commercial Catalog Summary