Cisco CISCO3945E-SEC/K9
Cisco 3945E Security Bundle
Product Highlights
What's Included
256MB Flash (1x MEM-CF-256MB)
(1) PWR-3900-AC
(1) AC Power Cord
(1) Rackmount Kit (ACS-3900-RM-19)
Enterprise branch offices demand a single platform that can route traffic at scale, enforce security policies, and support voice and video — without sprawling into a rack full of point solutions. The CISCO3945E-SEC/K9 is the Cisco 3945E Security Bundle, a top-of-the-line Integrated Services Router from the Cisco 3900 Series (ISR G2) that ships with the Security (SEC) technology license PAK pre-included.
Powered by the Cisco Services Performance Engine 250 (SPE 250), the 3945E delivers the highest performance tier in the 3900 family, supporting highly secure data, voice, video, and application services for large branch office environments. The SEC license unlocks advanced security capabilities including Cisco IOS Zone-Based Firewall, IOS IPS (Intrusion Prevention), and hardware-accelerated IPsec/SSL VPN encryption — all running natively on the router without requiring a separate security appliance.
With 4 integrated 10/100/1000 Ethernet ports, 2 SFP-based ports, 4 service module slots, 3 Enhanced HWIC slots, and 3 onboard DSP slots, the CISCO3945E-SEC/K9 provides extensive modular expansion for WAN connectivity, unified communications, and application services. The field-replaceable SPE architecture protects your investment by allowing future performance upgrades without replacing the entire chassis. Whether you're consolidating branch infrastructure, deploying site-to-site VPN, or rolling out secure unified communications, this security bundle delivers enterprise-grade capability in a single 3RU platform.
Features & Benefits
Integrated Security Services
The SEC license PAK enables Cisco IOS Zone-Based Firewall, IOS IPS, and content filtering directly on the router. Combined with embedded hardware-based IPsec and SSL cryptography acceleration, the 3945E offloads encryption from the CPU so security services don't compromise routing performance. This eliminates the need for a standalone firewall or VPN concentrator at the branch.
Services Performance Engine 250
The SPE 250 is the highest-performance engine available in the Cisco 3900 Series, delivering maximum throughput for concurrent routing, security, and voice/video services. Because the SPE is field-replaceable, you can upgrade to future higher-performance engines without swapping the chassis — protecting your capital investment as branch demands grow.
Extensive Modular Expansion
With 4 service module (SM) slots, 3 Enhanced High-Speed WAN Interface Card (EHWIC) slots, and 3 onboard DSP slots, the 3945E supports a wide range of WAN, voice, and application modules. EHWIC slots are backward-compatible with legacy HWICs, WICs, VICs, and VWICs, letting you reuse existing interface cards from prior-generation routers.
High-Speed LAN/WAN Connectivity
Four onboard 10/100/1000 Ethernet RJ-45 ports and two SFP-based Gigabit Ethernet ports provide flexible copper and fiber connectivity out of the box. This allows direct connections to campus switches, WAN handoffs, and management networks without consuming expansion slots.
Enterprise Manageability & Resilience
The Cisco 3945E supports Cisco IOS Software with a universal image, enabling feature activation via license keys rather than image swaps. Two external USB 2.0 ports provide secure token and storage capabilities, and the platform supports Cisco EnergyWise for network-wide energy monitoring and control.
Deployment Scenarios
Secure Enterprise Branch Gateway
Deploy the CISCO3945E-SEC/K9 as the primary WAN gateway at large branch offices. The integrated SEC license enables site-to-site IPsec VPN tunnels back to headquarters, Zone-Based Firewall enforcement, and IPS — consolidating router, firewall, and VPN concentrator into a single managed device.
Multi-Service Branch Consolidation
Leverage the 4 service module slots and 3 EHWIC slots to integrate WAN connectivity (T1/E1, xDSL, fiber), voice gateway services (with optional PVDM3 DSPs and UC license), and application hosting on a single platform. This reduces hardware sprawl, power consumption, and operational complexity at the branch.
Regulated Industry Compliance
Organizations in healthcare, finance, or retail can use the 3945E Security Bundle to segment sensitive traffic with Zone-Based Firewall policies and encrypt data in transit with hardware-accelerated VPN. The integrated security stack simplifies audit evidence collection for PCI DSS, HIPAA, and similar compliance frameworks.
General
Interfaces & Ports
Expansion Slots
Memory
Security
Physical
Power
Compatibility Notes
Platform: Cisco 3900 Series Integrated Services Routers (ISR G2)
Services Performance Engine: Ships with C3900-SPE250/K9. The SPE 250 is supported only on Cisco 3945/3945E chassis.
Memory: Ships with 1 GB DDR2 ECC DRAM (MEM-3900-1GB), upgradeable to 2 GB max. 256 MB CompactFlash (MEM-CF-256MB), upgradeable to 4 GB per slot (two external CF slots).
Power Supply: Ships with one PWR-3900-AC. Supports redundant AC power supply configuration.
Expansion Compatibility: EHWIC slots support legacy HWIC, WIC, VIC, and VWIC modules. Service module slots support SM-series modules (e.g., SM-SRE-700, SM-SRE-900, SM-ES3-16-P). DSP slots support PVDM3 modules for voice/video.
Rack Mount: Includes ACS-3900-RM-19 for standard 19-inch EIA rack installation (3RU).
Downloads & Resources
Frequently Asked Questions
| Part Number | Product | Key Difference |
|---|---|---|
| CISCO3945E/K9 | Cisco 3945E (IP Base) | Same hardware platform but ships with IP Base license only — no SEC license PAK for firewall/VPN/IPS features. |
| CISCO3945-SEC/K9 | Cisco 3945 Security Bundle | Uses SPE 150 instead of SPE 250, has 3 onboard GE (vs. 4 GE), and 4 EHWIC slots (vs. 3) — lower performance tier with different slot layout. |
| CISCO3925E-SEC/K9 | Cisco 3925E Security Bundle | Uses SPE 200 with only 2 SM slots (vs. 4) — suited for medium branches needing fewer service modules. |
| C3945E-VSEC/K9 | Cisco 3945E Voice Security Bundle | Includes both SEC and UC licenses plus a PVDM3-64 DSP module — ideal when voice gateway services are also required. |