Cisco 3925 Integrated Services Router (ISR Generation 2 / 3900 Series) Full Product Description

1. Short Overview

Naming & Variant Breakdown

• C3925/K9: Standard AC-powered base router with universal IOS IP Base image and embedded K9 crypto hardware
• C3925-AC-IP/K9: AC PoE power supply variant with inline power distribution for 802.3af IP phones via switch EHWICs
• C3925-DC/K9: 24–60V negative DC autoranging telecom-grade power model for central office cabinet deployments
• -SEC/K9: Pre-bundled Advanced Security license with zone-based firewall, IOS IPS, full IPsec/SSL/DMVPN enabled
• -VOICE/K9: Unified Communications bundle pre-licensed for CME/SRST embedded voice call processing
• -VSEC/K9: All-in-one integrated Voice + Security converged branch bundle
• -AX/K9: Advanced services bundle supporting SRE virtualization, WAAS wide-area optimization
• -AXV/K9: AX + full UC voice bundle with PVDM DSP capacity pre-provisioned
• -HSEC/K9: High-security bundle optimized for massive concurrent IPsec tunnel deployments, FIPS 140-2 compliant with optional security shield kit

Core Differentiators vs Cisco 2951 & Cisco 3845

vs Cisco 2951 (Top 2900 ISR G2)

1. Dual dedicated SM service module slots (2951 has zero SM slots, only one ISM slot) for high-density T1/E1 trunk, IDS, storage, and virtualization modules
2. Dual DIMM symmetric ECC DRAM architecture supporting full 2GB total memory (2951 single DIMM slot max 2GB asymmetric)
3. 3U taller chassis, dual internal hot-swappable redundant power supplies (2951 single internal power with external RPS only)
4. 3 onboard Gigabit ports with dual SFP fiber uplinks (2951 only 2 GE + single shared SFP)
5. Higher aggregate 150 Mbps multi-service throughput vs 170 Mbps for 3945 / 130 Mbps for 2951
6. Field-upgradeable SPE service engine for future performance scaling (2900 series SPE non-upgradeable)

vs Cisco 3845 (Flagship 3800 ISR Gen1)

1. Multi-core CPU with native embedded crypto FPGA vs single-core processor with separate AIM-only crypto on 3845
2. New EHWIC high-speed WAN card standard (backward compatible with legacy HWIC/WIC/VIC/VWIC)
3. Onboard PVDM3 DSP slots integrated on motherboard (3845 PVDM2 only, limited codec support)
4. Removable CompactFlash storage (3800 series single CF with smaller max capacity)
5. Universal IOS software licensing (3800 series separate IOS image bundles)
6. Dual USB 2.0 ports + mini-USB secondary console (3845 USB 1.1, single RJ45 console only)
7. Dual redundant internal power supplies built-in, no external RPS required for high availability

2. Hardware Interface & Physical Specifications

Modular Expansion Architecture

1. 2 × SM / SM-D Double-Wide Service Module slots (Exclusive to 3925/3945)
   Two side-by-side rear high-density service module slots supporting single-wide SM or paired double-wide SM-D high-bandwidth modules for voice trunking, security, and virtualized workloads:
   • SM-2T1/SM-4E1 multi-port channelized T1/E1 PRI voice trunk modules for large PBX interconnection
   • SRE900 virtualization modules for Windows/Linux application hosting, WAAS wide-area deduplication optimization
   • SM-CIDS dedicated inline intrusion detection modules
   • SM-CUE storage modules for Unity Express voice mail, auto-attendant, and persistent log archiving
2. 4 × Rear Universal EHWIC/WIC/VIC/VWIC slots
   Each slot accepts single-wide EHWIC, double-wide EHWIC-D, legacy HWIC, analog VIC, multi-flex VWIC voice cards; two slots support double-wide high-bandwidth EHWIC-D modules:
   • EHWIC: ADSL2+, VDSL2, G.SHDSL, synchronous serial, 4-port GE switch EHWICs
   • WIC: ISDN BRI, synchronous/asynchronous serial, analog modem WICs for Dial-on-Demand Routing (DDR) backup failover
   • VIC/VWIC: FXS/FXO/E&M analog station/trunk cards, multi-port fractional T1/E1 multi-flex voice trunks
3. 4 × Motherboard PVDM3 DSP slots
   Dedicated onboard Packet Voice Digital Signal Processor modules to handle VoIP codecs, G.168 echo cancellation, wideband G.722 audio, T.38 fax relay, and multi-party audio conferencing without consuming external expansion slots; quadruple DSP capacity enables up to 384 concurrent VoIP calls for large IP phone deployments.
4. 1 × Internal ISM (Internal Service Module) slot
   Auxiliary internal slot for auxiliary storage, crypto acceleration, or lightweight application offloading to complement SM service modules.

Fixed Built-in Rear Panel Ports

1. 3 × Auto-MDI-X 10/100/1000BASE-T Gigabit Ethernet (GE0/0, GE0/1, GE0/2) + 2 independent SFP mini-GBIC fiber slots
   Two native SFP fiber uplinks without port sharing restriction; all Gigabit ports fully support IEEE 802.1Q VLAN trunking, inter-VLAN routing, LACP link aggregation to isolate corporate, finance, engineering, guest, and sensitive POS payment subnetsCisco.
2. RJ45 Serial Console port (115.2 kbps max baud) – primary local out-of-band CLI management
3. Mini-USB Type-B Console port – lightweight secondary local management without RJ45 cables
4. RJ45 AUX port – remote emergency IT access via external PSTN analog modem
5. 2 × USB 2.0 Type-A ports– high-speed offline configuration/log backup storage, two-factor crypto authentication tokens
6. Removable external CompactFlash (CF) slot – primary persistent storage for IOS universal images, full running configurations, and persistent event logging
7. Dual internal power supply bays (AC / DC / PoE variants available)
8. Dedicated external RPS redundant power supply connector for extended fault tolerance
9. Chassis ground lug + Kensington anti-theft lock slot for physical rack security

Memory & Performance Benchmarks

• Processor: Multi-task multi-core PowerQUICC CPU with dedicated embedded hardware crypto FPGA acceleration, field-upgradeable SPE service performance engine
• Default DRAM: 1024MB (1GB) dual symmetric 512MB ECC DIMMs; maximum expandable DRAM: 2048MB (2GB) via matching dual DIMM slotsCisco
• Default Flash memory: 256MB CompactFlash; maximum supported Flash: 4GB CF card
• Multi-service mixed voice/data/security throughput: Up to 150 Mbps aggregate wire-speed performance under full converged service load
• Hardware crypto acceleration: Native AES-256, 3DES, DES IPsec, SSL/TLS, GRE VPN offloading; scalable via SRE/SM security modules for hundreds of concurrent site-to-site tunnels
• Maximum concurrent site-to-site IPsec tunnels: Up to 400+, expandable with full 2GB DRAM and SM high-security modules
• Supported IOS releases: Cisco IOS 15.0(1)M through 15.7(3)M universal multi-service maintenance images; feature sets unlocked via permanent chassis-bound software licenses (SL-39-DATA-K9, SL-39-SEC-K9, SL-39-UC-K9)
• Voice capacity: PVDM2/PVDM3 DSP modules support up to 384 concurrent VoIP calls; Cisco CME embedded call processing for up to 300 IP phones, SRST survivable remote branch telephony, Unity Express voice mail for up to 1000 mailboxes hosted via SM-CUE storage modules

Physical & Power Parameters

• Form factor: 3U standard 19-inch rack-mount metal chassis with integrated rack ears
• Standard AC power supply: 100–240V 47–63Hz universal autoranging internal power supply, dual hot-swappable internal PSUs for native redundancy
• DC variant (C3925-DC): 24–60V negative DC telecom input for central office cabinet deployments
• PoE variant (C3925-AC-IP): Integrated inline power distribution delivering up to 360W PoE budget, expandable with external PoE boost accessories
• Typical chassis power consumption: ~620W under fully loaded dual SM, four EHWIC, four PVDM, ISM module configuration
• Front panel status LEDs: System power, dual PSU fault alarm, CompactFlash activity, dual USB port status, PVDM/ISM health indicators, four EHWIC slot link/activity, dual SM slot status, three Gigabit Ethernet + dual SFP link/activity
• Operating environment
  • Operating temperature: 0°C to +40°C below 1800m altitude; 0°C to +25°C above 1800m up to 3000m
  • Relative humidity: 5–85% RH non-condensing
• Dimensions (H × W × D): 133.35 × 438.15 × 476.25 mm (5.25 × 17.25 × 18.75 inches)Cisco
• Fully loaded weight: ~14.2 kg (31.3 lbs) with complete expansion modules
• No native chassis PoE output except for dedicated -AC-IP power supply variant.

3. Cisco IOS Universal Image Multiservice Feature Suite

Core Routing & Multi-WAN Connectivity

• Full dual-stack IPv4 / IPv6 routing suite: Static routes, RIP v1/v2, OSPF, EIGRP, BGP, IS-IS, PIM multicast suite, BFD bidirectional forwarding detection
• WAN encapsulation support: PPP, HDLC, Frame Relay, ATM, ISDN, PPPoE/PPPoA for DSL, Dial-on-Demand Routing (DDR) for automatic backup failover, MPLS L2/L3 VPN, GETVPN
• HSRP/VRRP for router high availability redundancy; NHRP DMVPN hub-spoke multi-site overlay VPN architecture
• NAT services: Static NAT, dynamic NAT, PAT overloading, multi-address NAT pools, NAT64 IPv4-IPv6 transition support
• IEEE 802.1Q VLAN trunking, inter-VLAN routing, storm control, LACP link aggregation across three onboard Gigabit Ethernet ports and dual independent SFP fiber uplinks.

Unified Communications Voice & Fax Integration (Key Ultra-High-Density Voice Differentiator)

1. VoIP signaling protocols: H.323, SIP, MGCP, SCCP native support for large-scale Cisco Unified IP Phone deployments
2. Analog/digital telephony via VIC/VWIC + four PVDM DSPs + dual SM voice trunk modules: FXS station ports, FXO PSTN trunk lines, E&M PBX tie connections, multi-port T1/E1 PRI channelized trunk interworking with third-party PBX platforms (Avaya, Siemens, Nortel)
3. T.38 real-time fax relay over IP, fax passthrough, store-and-forward fax routing
4. DSP-accelerated voice codecs: G.711, G.719, G.729a, G.726, wideband G.722 high-fidelity audio, video conferencing codec support
5. Enterprise telephony tools: Scalable multi-site dial plans, voice hunt groups, toll bypass to eliminate expensive long-distance PSTN charges
6. CME embedded call manager, SRST survivable remote telephony, Unity Express voice mail/auto-attendant hosted via SM-CUE storage modules.

Enterprise QoS & WAN Optimization

• Base QoS tools: Weighted Fair Queuing (WFQ), CBWFQ, per-interface traffic shaping
• Advanced QoS (Data/UC license): Low Latency Queuing (LLQ), Frame Relay Traffic Shaping (FRTS), WRED congestion avoidance, DSCP/802.1p traffic marking
• Link Fragmentation and Interleaving (LFI), cRTP VoIP header compression to eliminate voice jitter on low-speed DSL/ISDN backup links
• NBAR2 next-generation deep packet inspection for application-aware traffic prioritization of business-critical software; SRE WAAS module for end-to-end WAN bandwidth deduplication and optimization.

Integrated Self-Defending Network Security Suite

1. Zone-Based Stateful Firewall (ZBFW): Deep application-layer inspection for HTTP, FTP, SIP, H.323 and all mainstream enterprise business protocols
2. IOS IPS inline signature-based intrusion prevention with real-time threat detection and automated connection blocking
3. Embedded hardware-accelerated VPN stack:
   • AES-256/3DES/DES IPsec site-to-site branch tunnels
   • Cisco Easy VPN Remote centralized security policy provisioning for remote branch locations
   • DMVPN scalable hub-spoke multi-site overlay networks
   • SSL VPN for browser-only remote worker access without client software
4. AAA security framework: PAP/CHAP, RADIUS/TACACS+ centralized authentication, authorization and complete audit logging
5. Standard/extended ACLs, dynamic ACLs, anti-DDoS traffic policing, security zone segmentation to isolate sensitive POS payment and finance subnets
6. FIPS 140-2 Level 2 certified with optional physical security shield kit for government regulated deployments.

Management, Automation & Operations

• Triple out-of-band management interfaces: RJ45 Serial Console, Mini-USB Console, and AUX modem port for emergency offline IT maintenance
• Secure remote management: SSHv2, HTTPS, SNMP v1/v2c/v3, TR-069 automated remote provisioning
• Graphical configuration utility: Cisco Configuration Professional (CCP) for simplified zero-touch mass branch deployment
• AutoInstall automated remote IOS image and configuration download over WAN links for nationwide branch rollouts
• Removable CompactFlash storage for easy IOS upgrades, configuration backup, and centralized log archiving
• Persistent syslog event logging, NTP time synchronization for consistent audit timestamps
• Dual USB 2.0 ports for offline config storage and two-factor authentication security tokens
• Cisco EnergyWise power management for intelligent energy consumption control of attached network devices.

4. Typical Deployment Scenarios

1. Large regional enterprise headquarters multi-service edge gateway: Dual SM-D multi-T1/E1 PRI voice trunk modules connected to corporate PBX, dual fiber Metro Ethernet primary/secondary WAN uplinks via independent SFP slots, VDSL2 EHWIC copper backup link, four PVDM3 DSP modules supporting over 350 concurrent VoIP calls, three Gigabit Ethernet ports to segregate finance, engineering, staff, and guest VLANs, SRE900 virtualization module for local application hosting, high-volume DMVPN IPsec tunnels to corporate headquarters, integrated ZBFW/IPS security stack for enterprise compliance.
2. National multi-chain retail flagship voice gateway: ADSL2+ EHWIC primary broadband WAN, ISDN BRI WIC dial backup, CME embedded call processing for 200–300 on-site IP phones, SM-CIDS intrusion detection module for PCI DSS payment security, SM-CUE voice mail storage module for multi-location unified messaging.
3. Global carrier managed high-capacity enterprise CPE: Universal dual-standard DSL EHWIC copper broadband access, DC power variant for central office rack deployment, dual SM storage/optimization modules for tenant log retention and bandwidth control, DMVPN overlay to carrier central service hub, integrated firewall/IPS for tenant threat isolation and network segmentation.
4. Advanced enterprise networking high-density training lab core router: Universal dual SM/EHWIC/WIC/VIC modularity to teach multi-port T1/E1 PRI voice trunking, dual independent fiber SFP uplinks, quadruple DSP VoIP gateway, hardware-accelerated high-volume IPsec VPN, and full unified communications gateway labs; full 2GB DRAM and 4GB CF capacity fully support feature-rich IOS 15.xM images unavailable on all lower-tier 2900/3800 series routers.

5. Standard Package Contents of C3925 / 3925-DC / 3925-AC-IP

Separately Sold Optional Accessories

• EHWIC/WIC/VIC/VWIC WAN and analog/digital voice interface cards
• SM / SM-D double-wide service modules (multi-T1/E1 trunk, IDS, SRE virtualization, Unity Express storage)
• PVDM2/PVDM3 DSP voice compression modules for VoIP, wideband audio and T.38 fax relay
• DRAM memory expansion DIMMs (512MB / 1GB / 2GB symmetric matched pairs)
• CompactFlash memory upgrades (256MB / 1GB / 4GB)
• CAT5e/CAT6 Gigabit Ethernet patch cords, RJ11 DSL/ISDN telephone cables
• External PoE injectors for non-PoE IP cameras and wireless access points
• External redundant power supply units (RPS) for extended high-availability deployments
• FIPS physical security shield kit for FIPS 140-2 Level 2 certification

Software Licensing Information

1. SL-39-DATA-K9: Core routing, dual-stack IPv6, MPLS, advanced QoS, NBAR2 application classification, EnergyWise power management
2. SL-39-SEC-K9: Zone-based stateful firewall, IOS inline IPS, full AES/3DES IPsec/SSL/DMVPN encryption, advanced threat mitigation, anti-DDoS policing
3. SL-39-UC-K9: CME/SRST embedded voice call processing, Unity Express voice mail, full wideband VoIP codec support for PVDM3 DSP modules
   Embedded K9 crypto hardware complies with US ITAR export regulations for global shipments.

Short Commercial Catalog Summary