Cisco ISM-VPN-19
3DES/AES/SUITE-B VPN Encryption module
Product Highlights
What's Included
As branch offices and remote sites demand ever-increasing encrypted throughput, software-only VPN processing can quickly saturate your router's CPU — degrading voice quality, slowing application delivery, and creating bottlenecks across the network.
The Cisco ISM-VPN-19 VPN Internal Service Module solves this by providing dedicated, hardware-accelerated IPsec and SSL VPN encryption for the Cisco 1941 Integrated Services Router (ISR G2). Equipped with a multicore processor that operates independently of the host router's CPU, the ISM-VPN-19 offloads computationally intensive cryptographic operations so your router can focus on routing, firewall inspection, voice, and other critical services without compromise.
Supporting the full range of modern encryption standards — including DES, 3DES, AES (CBC and GCM in 128-, 192-, and 256-bit key lengths), and NSA-regulated Suite-B cryptography — the ISM-VPN-19 delivers up to 140 Mbps (IMIX) and 500 Mbps (1400-byte packets) of IPsec throughput on the Cisco 1941 platform. It supports up to 500 IPsec tunnels, making it ideal for hub-and-spoke VPN architectures, DMVPN deployments, and secure remote-access scenarios.
The module installs directly into the internal ISM card slot of the Cisco 1941, requiring no additional rack space, power cables, or external hardware. For IT teams looking to maximize encrypted application performance at the branch while keeping infrastructure simple and consolidated, the ISM-VPN-19 is a proven, cost-effective solution.
Features & Benefits
Dedicated Hardware Encryption Engine
The ISM-VPN-19 features a multicore processor that handles all cryptographic operations independently of the host router's CPU. This dedicated offload ensures that encrypted VPN traffic does not compete with routing, firewall, or voice services for processing resources — delivering consistent application performance even under heavy encryption loads.
Comprehensive Cryptographic Standards
Supports DES, 3DES, AES-CBC, and AES-GCM encryption (128-, 192-, and 256-bit), along with SHA-1, SHA-2, MD5 hashing, RSA and ECDSA digital signatures, and Diffie-Hellman / ECDH key exchange. Full Suite-B cryptography compliance meets the most stringent government and enterprise security mandates.
High-Performance IPsec Throughput
On the Cisco 1941 platform, the ISM-VPN-19 delivers up to 140 Mbps with IMIX traffic and up to 500 Mbps with 1400-byte packets. This hardware-accelerated performance is two to three times greater than software-only encryption, enabling bandwidth-intensive encrypted applications at the branch.
Scalable Tunnel Capacity
With support for up to 500 IPsec tunnels on the Cisco 1941, the ISM-VPN-19 is well-suited for hub-and-spoke topologies, DMVPN overlays, and multi-site enterprise deployments. Certificate-based authentication support further simplifies scaling secure connections across large networks.
Compact Internal Form Factor
The ISM-VPN-19 installs directly into the ISM card slot inside the Cisco 1941 chassis. Its small physical footprint — just 102 × 155 × 22 mm and 206 g — means no additional rack space, power connections, or cabling. This reduces energy costs, hardware support overhead, and deployment complexity.
SSL VPN Hardware Acceleration
Beyond IPsec, the VPN ISM also accelerates SSL VPN encryption using DES, 3DES, and AES. This enables hardware-offloaded secure remote access for clientless and thin-client VPN sessions. Note: DTLS is not supported on the VPN ISM.
Deployment Scenarios
Branch Office Site-to-Site VPN
Deploy the ISM-VPN-19 in a Cisco 1941 at each branch to establish high-throughput IPsec tunnels back to headquarters. By offloading encryption to dedicated hardware, the router CPU remains available for WAN routing, QoS, and voice services — ensuring a seamless user experience across all applications.
Hub-and-Spoke DMVPN Architecture
With support for up to 500 IPsec tunnels, the ISM-VPN-19 enables the Cisco 1941 to serve as a DMVPN hub or spoke in medium-scale overlay networks. Hardware-accelerated encryption ensures that tunnel setup and data forwarding remain fast even as the number of spokes grows.
Secure Remote Access VPN
Leverage the module's SSL VPN and IPsec acceleration to provide encrypted remote access for mobile and home-office workers. The dedicated crypto engine ensures that adding remote-access sessions does not degrade performance for on-site users or other router services.
Government and Compliance-Driven Networks
Organizations subject to FIPS, Suite-B, or other regulatory encryption mandates can deploy the ISM-VPN-19 to meet NSA-regulated cryptographic requirements. Support for AES-GCM, ECDSA, ECDH, and SHA-2 ensures compliance with the most current federal security standards.
General
Performance
Encryption & Security
Compatibility
Physical
Environmental
Compliance
Compatibility Notes
Compatible Platforms:
- Cisco 1941 Integrated Services Router
- Cisco 1941W Integrated Services Router
- Cisco ONE ISR 1941
Slot Requirement: Requires one available ISM (Internal Service Module) card slot.
Minimum Software: Cisco IOS Software Version 15.2(1)T1 or later.
Licensing: SEC-K9 license is required. The Cisco 1941 does not require the HSEC-K9 license as its maximum encryption capacity is within export compliance limits.
Module Limit: One VPN ISM encryption module per router.
Note: The VPN ISM does not support DTLS.
Downloads & Resources
Frequently Asked Questions
| Part Number | Product | Key Difference |
|---|---|---|
| ISM-VPN-29 | Cisco VPN ISM for 2900 Series | Designed for Cisco 2901/2911/2921/2951 routers — delivers up to 900 Mbps IPsec throughput and up to 2,000 tunnels |
| ISM-VPN-39 | Cisco VPN ISM for 3900 Series | Designed for Cisco 3925/3945 routers — highest throughput and up to 3,000 IPsec tunnels for large enterprise deployments |
| CISCO1941-HSEC+/K9 | Cisco 1941 HSEC Bundle | Cisco 1941 router bundled with the ISM-VPN-19 pre-installed — ideal for new deployments requiring encryption out of the box |