Cisco ISM-VPN-39
3DES/AES/SUITE-B VPN Encryption module
Product Highlights
What's Included
As branch offices and remote sites demand ever-higher VPN throughput, the router CPU can quickly become a bottleneck — degrading performance for every service running on the platform. The Cisco ISM-VPN-39 solves this by providing a dedicated, hardware-accelerated VPN encryption module purpose-built for the Cisco 3900 Series Integrated Services Routers.
The ISM-VPN-39 features a multicore processor that operates independently of the host router's resources, offloading computationally intensive IPsec and SSL VPN encryption tasks. This frees the main CPU to handle routing, voice, application services, and other concurrent workloads without compromise. The module supports up to 3000 IPsec tunnels on the Cisco 3900 Series and delivers encrypted throughput of up to 1200 Mbps (1400-byte packets) on the Cisco 3945.
Designed for organizations that require strong, standards-compliant security, the ISM-VPN-39 supports 3DES, AES (CBC and GCM), Suite-B cryptography, RSA, ECDSA, SHA-1, SHA-2, and MD5. It installs directly into the ISM slot on the Cisco 3925, 3925E, 3945, or 3945E — no external interfaces or additional rack space required. With a compact 4" × 6.1" × 0.9" form factor and approximately 20W power draw, it delivers enterprise-grade VPN acceleration with minimal infrastructure impact. Cisco IOS Software Version 15.2(1)T1 or later is required, along with the SEC-K9 and HSEC-K9 licenses.
Features & Benefits
Hardware-Accelerated Encryption
The ISM-VPN-39 uses a dedicated multicore processor to handle IPsec and SSL VPN encryption independently of the host router CPU. This offload architecture ensures that encrypted traffic is processed at wire speed while routing, voice, and application services continue to perform at full capacity — eliminating the performance trade-offs common with software-based encryption.
Suite-B & Advanced Cryptography
Supports the full spectrum of modern cryptographic standards including AES-GCM, ECDSA, ECDH, SHA-2, 3DES, and DES. Suite-B compliance meets NSA-regulated requirements for classified and sensitive government communications, making this module suitable for federal, defense, and high-security enterprise deployments.
Massive Tunnel Scalability
The ISM-VPN-39 supports up to 3000 concurrent IPsec tunnels on the Cisco 3900 Series, enabling large-scale site-to-site and remote-access VPN architectures. Whether connecting hundreds of branch offices via DMVPN or supporting a large remote workforce over SSL VPN, this module scales to meet enterprise demands.
Compact Internal Form Factor
Installing in the router's internal ISM slot, the module requires no external interfaces, service-module bays, or additional rack space. At just 4" × 6.1" × 0.9" and 7.27 oz, it preserves all external expansion capacity for other modules while delivering dedicated encryption acceleration.
Simple Deployment & Licensing
The ISM-VPN-39 is ready to use with a straightforward physical installation. It requires Cisco IOS Software Version 15.2(1)T1 or later along with the SEC-K9 and HSEC-K9 licenses. One encryption module is supported per router, keeping the deployment model simple and predictable.
Deployment Scenarios
Multi-Site Enterprise VPN Hub
Organizations with hundreds of branch offices can deploy the ISM-VPN-39 in a Cisco 3925 or 3945 hub router to terminate thousands of IPsec tunnels. Hardware acceleration ensures consistent throughput even as tunnel counts scale, while the main CPU remains available for routing and application services.
Secure Remote Access Gateway
For enterprises supporting a distributed workforce, the ISM-VPN-39 accelerates SSL VPN sessions on the ISR 3900 platform. By offloading encryption to dedicated hardware, IT teams can support more concurrent remote users without degrading the router's performance for other critical services.
Government & Regulated Environments
With Suite-B cryptography support including AES-GCM and ECDSA, the ISM-VPN-39 meets the stringent encryption requirements of federal agencies and regulated industries. It enables compliant, high-performance VPN connectivity on a proven Cisco ISR G2 platform.
WAN Edge Encryption for High-Bandwidth Links
Branch offices connected via high-speed WAN links can leverage the ISM-VPN-39's throughput of up to 1200 Mbps to encrypt traffic at near-line rate. This eliminates the need to choose between performance and security on bandwidth-intensive connections.
General
Performance
Security & Encryption
Physical
Software Requirements
Environmental
Compliance
Compatibility Notes
Compatible Platforms
- Cisco 3925 (CISCO3925/K9)
- Cisco 3925E (CISCO3925E/K9)
- Cisco 3945 (CISCO3945/K9)
- Cisco 3945E (CISCO3945E/K9)
Software Requirements
- Minimum IOS Version: Cisco IOS Software Version 15.2(1)T1 or later
- Required Licenses: SEC-K9 (Security) and HSEC-K9 (High Security)
Slot Requirements
- Requires one available ISM slot
- One encryption module supported per router
Notes
- The ISM slot replaces the legacy AIM slot; existing AIM modules are not compatible with the ISM slot.
- VPN ISM does not support DTLS.
Downloads & Resources
Frequently Asked Questions
| Part Number | Product | Key Difference |
|---|---|---|
| ISM-VPN-29 | Cisco VPN ISM for 2900 Series | Designed for Cisco 2900 Series routers (2901, 2911, 2921, 2951) with up to 2000 IPsec tunnels — choose this for ISR 2900 deployments. |
| ISM-VPN-19 | Cisco VPN ISM for 1900 Series | Designed for the Cisco 1941 with up to 500 IPsec tunnels — a lower-scale option for small branch offices. |
| CISCO3925-HSEC+/K9 | Cisco 3925 HSEC Bundle | Pre-bundled Cisco 3925 router with HSEC license — consider if purchasing a new router with VPN capabilities included. |
| CISCO3945-HSEC+/K9 | Cisco 3945 HSEC Bundle | Pre-bundled Cisco 3945 router with HSEC license — ideal if deploying a new 3945 and want VPN acceleration out of the box. |
