Cisco ISR4351-SEC/K9 Security Bundle Router – w/3 Gigabit Ethernet Ports, 3 NIM

The Cisco ISR4351-SEC/K9 is a high-performance, enterprise-class Integrated Services Router from the Cisco 4000 Series, pre-bundled with IP Base, Advanced Security, and Unified Communications licenses to deliver a comprehensive, all-in-one networking solution for medium to large enterprise branch offices and WAN edge deployments. Running Cisco IOS XE Software, this modular 2U router converges routing, security, voice, and WAN optimization services into a single powerful platform, reducing infrastructure complexity while providing the scalability to support evolving business requirements.

High-Performance WAN Aggregation

The ISR4351-SEC/K9 delivers aggregate throughput of 200 Mbps to 400 Mbps with a multi-core processor architecture that separates the data and control planes for consistent, predictable performance even under heavy service loads. Three onboard Gigabit Ethernet WAN/LAN ports (RJ45) and three Gigabit Ethernet SFP uplink ports provide exceptional flexibility for connecting to diverse WAN services including MPLS, broadband internet, Metro Ethernet, and fiber circuits. The dedicated 1 Gbps management port ensures out-of-band management access is always available, independent of data plane traffic.

Modular Expansion for Future-Proof Networking

The defining advantage of the Cisco 4351 platform is its extensive modularity. Three NIM (Network Interface Module) slots accommodate a wide range of interface cards including T1/E1, DSL, serial, additional GE, and cellular modules, enabling the router to support virtually any WAN connectivity type. Two SM-X (Enhanced Service Module) slots support high-performance service modules with up to 10 Gbps data throughput per slot — ideal for installing Cisco UCS-E blade servers, WAN optimization (WAAS), or high-density voice DSP modules. The onboard PVDM4 slot and ISC (Internal Service Card) slot further expand capabilities for voice processing and internal services.

Advanced Security Bundle Included

The SEC/K9 bundle ships with Cisco’s Advanced Security license pre-installed, providing an enterprise-grade security suite from day one. Zone-Based Firewall (ZBFW) delivers stateful, application-aware traffic inspection at the network edge. IPsec VPN technologies including DMVPN, FlexVPN, GET VPN, and EzVPN provide flexible, scalable site-to-site and remote access encryption with up to 1,750 concurrent VPN sessions and 300 Mbps encrypted throughput. The integrated Snort-based IPS/IDS engine provides real-time threat detection and prevention, while URL filtering, Advanced Malware Protection (AMP), and Cisco Umbrella integration deliver multi-layered defense against modern threats.

Unified Communications Ready

The ISR4351-SEC/K9 bundle includes the PVDM4-64 DSP module (supporting 64 concurrent voice channels) and CUBE-25 (Cisco Unified Border Element for 25 concurrent SIP/H.323 sessions), making this router immediately ready for enterprise VoIP deployments. Support for SRST (Survivable Remote Site Telephony) ensures branch office phones continue operating during WAN outages. Full compatibility with SIP, H.323, MGCP, and SCCP protocols guarantees interoperability with all major IP PBX and UC platforms.

SD-WAN and Intelligent WAN Ready

The ISR4351-SEC/K9 is fully compatible with Cisco’s SD-WAN solutions, supporting Cisco vManage controller-based SD-WAN and Cisco DNA Center autonomous mode management. Application-aware routing, SLA-based path selection, and zero-touch provisioning capabilities enable organizations to transition from traditional WAN to intelligent, cloud-optimized SD-WAN without replacing hardware. The router also supports Cisco IWAN (Intelligent WAN) with PfR (Performance Routing) for optimizing application performance across hybrid WAN links.

Comprehensive Routing & Switching

A full suite of enterprise routing protocols — OSPF, BGP, EIGRP, RIP, and IS-IS — ensures compatibility with any network architecture. MPLS, VPLS, and L2/L3 VPN support enables seamless integration with carrier MPLS services. Policy-Based Routing (PBR) provides granular application-based traffic steering, while advanced QoS features including LLQ, CBWFQ, DSCP marking, and traffic shaping ensure optimal performance for voice, video, and critical data applications. IPv4/IPv6 dual-stack support future-proofs network design for continued growth.

Memory and Storage Scalability

The default configuration includes 4 GB DDR3 ECC DRAM and 4 GB flash storage, with upgrade paths to 16 GB DRAM and 16 GB flash respectively. This memory headroom supports running multiple concurrent services — including firewall, VPN, IPS, voice processing, and routing — at full capacity without performance degradation. Two USB 2.0 ports provide additional external storage options for configuration backups, software images, and logs.

Flexible Management and Automation

Multiple management interfaces cater to all operational models. The embedded WebUI provides intuitive browser-based configuration without CLI expertise. SSH-secured CLI enables advanced configuration and automation scripting. SNMP v1/v2c/v3 integrates with enterprise network management systems, while NETCONF/YANG and RESTful API support modern NetDevOps workflows and infrastructure-as-code deployments. Cisco Smart Licensing simplifies license tracking and compliance across distributed deployments.

Robust Power and Redundancy Options

The platform supports internal AC, DC, and PoE power supply options with a maximum AC power draw of 430W (990W with PoE PSU). Optional redundant power supply configurations and dual-power architectures ensure business continuity for mission-critical deployments. The 2U rackmount form factor fits standard 19-inch racks and includes front-panel LED indicators for at-a-glance status monitoring of all interfaces and system health.

Ideal Applications: Medium to large enterprise branch offices, WAN aggregation sites, MPLS network edge deployments, enterprise campus edge routing, carrier-grade VoIP deployments, distributed retail and banking networks, healthcare and government networks requiring FIPS-compliant security, managed service provider CPE platforms, and any organization requiring a modular, high-performance routing platform with integrated security and UC capabilities.

Backed by Cisco’s global support infrastructure, extensive partner ecosystem, and a 1-year limited hardware warranty, the ISR4351-SEC/K9 is the proven choice for enterprise-grade branch office networking.

—

Technical Specifications

Performance

• Aggregate Throughput: 200 Mbps – 400 Mbps
• Forwarding Rate: Up to 400 Mbps (IMIX traffic)
• IPsec VPN Throughput: Up to 300 Mbps (encrypted)
• Concurrent VPN Sessions: Up to 1,750
• NAT Sessions: Up to 64,000 concurrent
• CPU Architecture: Multi-core (separate data/control plane)
• DRAM (Default/Max): 4 GB / 16 GB DDR3 ECC
• Flash (Default/Max): 4 GB / 16 GB

Onboard Interfaces

• GE WAN/LAN Ports: 3x Gigabit Ethernet RJ45 (10/100/1000 Mbps, auto-sensing, auto-MDI/MDIX)
• GE SFP Ports: 3x Gigabit Ethernet SFP (shared with RJ45 ports on some configurations)
• Management Port: 1x Gigabit Ethernet RJ45 (dedicated, out-of-band)
• Console Ports: 1x RJ45 serial, 1x Mini-USB Type B
• AUX Port: 1x RJ45
• USB Ports: 2x USB 2.0 Type-A (storage, flash)

Expansion Slots & Modularity

• NIM Slots: 3x NIM (Network Interface Module / EHWIC-compatible)
• Supports T1/E1, Serial, ADSL2+, VDSL2, GE, cellular, voice NIM modules
• SM-X Slots: 2x Enhanced Service Module slots
• Up to 10 Gbps data throughput per slot
• Supports Cisco UCS-E blades, WAAS, NIM-SSD, high-density voice
• ISC Slot: 1x Internal Service Card slot
• PVDM4 Slot: 1x onboard PVDM4 (DSP module)
• Onboard PVDM4-64: Included in SEC/K9 bundle (64-channel DSP)

Bundle Inclusions (SEC/K9 Specific)

• IP Base License: Included
• Advanced Security License: Included
• Zone-Based Firewall (ZBFW)
• IPsec, DMVPN, FlexVPN, EzVPN, GET VPN
• IPS/IDS (Snort engine)
• URL filtering, AMP
• Unified Communications License: Included
• PVDM4-64: Included (64-channel DSP module)
• CUBE-25: Included (25-session Cisco Unified Border Element)

Security Features

• Firewall:
• Zone-Based Firewall (ZBFW)
• Stateful inspection, application awareness
• DoS/DDoS protection
• TCP normalization
• VPN Technologies:
• IPsec IKEv1/IKEv2
• DMVPN (Dynamic Multipoint VPN)
• FlexVPN
• GET VPN (Group Encrypted Transport)
• EzVPN (Easy VPN)
• SSL VPN
• GETVPN
• VPN Encryption:
• AES 128/192/256-bit
• 3DES
• SHA-1, SHA-2 (256/384/512)
• RSA, ECDSA key management
• Perfect Forward Secrecy (PFS)
• IPS/IDS:
• Snort-based engine
• Signature-based and behavioral detection
• Custom signatures
• IPS Micro-Engine (IME)
• Threat Defense:
• Advanced Malware Protection (AMP)
• URL filtering (Cisco Web Security)
• Cisco Umbrella SIG/SASE integration
• DNS-layer security
• ClamAV antivirus integration
• Access Control:
• 802.1X port-based authentication
• ACLs (IP, MAC, IPv6)
• RADIUS, TACACS+
• AAA (Authentication, Authorization, Accounting)
• PKI certificate management
• Compliance:
• FIPS 140-2 Level 2 (with HSEC license)
• Common Criteria (EAL4+)
• Management Security: SSH v2, HTTPS, SNMPv3, NETCONF over SSH

Routing Features

• Routing Protocols:
• Static routing (IPv4/IPv6)
• OSPF v2/v3 (multi-area)
• BGP v4 (with route reflector)
• EIGRP (Enhanced IGRP)
• RIP v1/v2
• IS-IS
• ODR (On-Demand Routing)
• MPLS:
• MPLS L2/L3 VPN
• VPLS (Virtual Private LAN Service)
• RSVP-TE (Traffic Engineering)
• LDP, TE FRR (Fast ReRoute)
• Multicast:
• PIM-SM, PIM-DM, PIM-SSM
• IGMP v1/v2/v3
• MSDP (Multicast Source Discovery Protocol)
• IPv6:
• Full dual-stack IPv4/IPv6
• IPv6 routing (OSPFv3, BGP4+, IS-IS for IPv6)
• 6to4, ISATAP, Teredo tunneling
• Policy-Based Routing (PBR): Application and source-based steering
• IP SLA: Active monitoring, path selection

WAN Technologies

• Supported WAN Types: Ethernet, MPLS, DSL (ADSL2+/VDSL2), T1/E1, Serial, 4G LTE (via NIM), broadband
• WAN Failover: IP SLA-based, floating static routes, BFD
• Load Balancing: Per-session, per-packet, ECMP
• SD-WAN: Cisco vManage (controller mode), Cisco DNA Center (autonomous mode)
• IWAN: Cisco Intelligent WAN (PfR performance routing)
• Broadband Aggregation: Multiple ISP load balancing

QoS Features

• Classification: DSCP, IP Precedence, 802.1p, NBAR2 (application-based)
• Queuing: LLQ (Low Latency Queuing), CBWFQ, WFQ, FIFO, PQ
• Policing/Shaping: Per-class, per-interface traffic shaping and policing
• Marking: DSCP, IP ToS, 802.1p CoS re-marking
• Admission Control: Resource Reservation Protocol (RSVP)
• AVC: Application Visibility and Control (NBAR2)

Voice & Unified Communications

• PVDM4-64: 64-channel DSP module (included)
• Supports G.711, G.722, G.729, G.723, G.726, iLBC, OPUS
• Hardware-based transcoding, conferencing, MTP
• CUBE-25: 25-session Cisco Unified Border Element (included)
• SIP-to-SIP, H.323-to-SIP trunking
• TLS/SRTP media security
• CAC (Call Admission Control)
• Trunk-side recording
• SRST: Survivable Remote Site Telephony (fallback call control)
• Voice Protocols: SIP, H.323, MGCP, SCCP (Skinny)
• Voice QoS: DSCP marking, jitter buffer, VAD, echo cancellation
• Gateway Services: T1/E1 CAS/PRI PSTN gateway support (with NIM)
• Max PVDM4 DSP Channels: Up to 256 (with additional PVDM4 in SM slots)

Switching Features

• VLAN: 802.1Q tagging, 4,096 VLANs
• Spanning Tree: STP, RSTP, MSTP
• Link Aggregation: 802.3ad LACP
• Bridging: IRB, BVI (Bridge Virtual Interface)

Management & Automation

• OS: Cisco IOS XE
• Web Interface: Embedded WebUI (HTTP/HTTPS)
• CLI: SSH v2, Telnet, console, AUX
• SNMP: v1/v2c/v3, RMON
• Syslog: Local and remote (syslog server)
• APIs:
• RESTful API (RESTCONF)
• NETCONF/YANG
• gRPC streaming telemetry
• OnePK (Open Network Environment Platform Kit)
• Automation: Python, Ansible, Terraform, Puppet/Chef
• Network Management:
• Cisco DNA Center
• Cisco vManage
• Cisco Prime Infrastructure (legacy)
• Cisco NSO (Network Services Orchestrator)
• Third-party NMS (SNMP)
• Zero-Touch Provisioning: PnP (Plug and Play), ZTP
• Licensing: Cisco Smart Licensing
• Discovery: CDP, LLDP

Physical Specifications

• Form Factor: 2U Rackmount (19-inch standard rack)
• Dimensions (W x D x H): 17.25″ x 18.5″ x 3.5″ (438 x 470 x 89 mm)
• Weight: Approximately 6.4 kg (14.1 lbs) base configuration
• Housing: Metal chassis (rack handles included)
• Cooling: Internal fans (active cooling)
• LED Indicators:
• System/Power
• Per-port Link/Activity/Speed
• Module slot status
• PoE status (if applicable)
• Mounting: Front-facing ports, standard 19″ rack ears included

Power

• AC Input: 100-240V AC, 50-60Hz (auto-ranging)
• Power Supply Options: Internal AC, DC, PoE
• Max Power (AC PSU): 430W
• Max Power (PoE PSU): 990W (platform + PoE budget)
• Redundant PSU: Optional dual-power configuration
• Power Consumption (Typical):
• Base (no modules): ~100W
• Fully loaded: Up to 430W

Environmental

• Operating Temperature: 0°C to 40°C (32°F to 104°F)
• Storage Temperature: -40°C to 70°C (-40°F to 158°F)
• Operating Humidity: 10% to 85% non-condensing
• Storage Humidity: 5% to 95% non-condensing
• Operating Altitude: Up to 3,000m (9,843 ft)
• MTBF: >200,000 hours (typical configuration)

Certifications & Compliance

• Safety: UL 60950-1, IEC 60950-1, EN 60950-1, CB
• EMC: FCC Part 15 Class A, CE (EN 55022 Class A), VCCI Class A, C-Tick
• Environmental: RoHS 6 compliant, REACH, WEEE
• Security: FIPS 140-2 Level 2 (with HSEC license), Common Criteria EAL4+
• IPv6: IPv6 Ready Logo Phase 2
• Government: TAA (Trade Agreements Act) compliant options available

Software & Licensing

• Operating System: Cisco IOS XE (latest release)
• Included Licenses (SEC/K9 Bundle):
• IP Base (routing fundamentals)
• Advanced Security (ZBFW, VPN, IPS, AMP)
• Unified Communications (voice, CUBE)
• Optional Additional Licenses:
• APP (Application Experience) — WAAS, AVC
• HSEC (Enhanced Security) — FIPS compliance
• Boost Performance License — up to 400 Mbps
• DNA Essentials / Advantage / Premier (SD-WAN)
• Additional CUBE sessions (beyond 25)
• Cisco Umbrella (cloud security)

Package Contents

• 1x Cisco ISR4351-SEC/K9 Router
• 1x PVDM4-64 DSP module (installed)
• 1x AC power cord (region-specific)
• 1x Console cable (RJ45 to DB9)
• 1x Rack-mount kit (ears + hardware)
• 1x Quick Start Guide
• 1x Warranty/Registration card
• Licenses pre-installed: IP Base + Advanced Security + UC

Warranty & Support

• Hardware Warranty: 1-year limited hardware warranty
• Extended Support: Cisco SMARTnet (1, 3, 5-year options)
• 8x5xNBD (Next Business Day replacement)
• 24x7x4 (4-hour on-site response)
• 24x7x2 (2-hour on-site response — mission-critical)
• TAC: Cisco Technical Assistance Center (24×7 with SMARTnet)
• Software Updates: IOS XE updates with valid SMARTnet
• RMA: Advance hardware replacement with valid SMARTnet

Optional Accessories & Modules

• NIM Modules: T1/E1, DSL, Serial, GE, 4G LTE, PoE injector
• SM-X Modules: UCS-E blade servers, WAAS, NIM-SSD, high-density voice
• PVDM4 Modules: PVDM4-32, PVDM4-64, PVDM4-128, PVDM4-256
• Power Supplies: DC PSU, PoE PSU, redundant PSU
• SFP Transceivers: 100BASE-FX, 1000BASE-T, 1000BASE-SX, 1000BASE-LX
• Rack Accessories: Cable management, rack blanks
• SMARTnet Contracts: Various term and service level options

Comparison & Positioning

• Smaller Model: ISR4331 (100-300 Mbps, 3 NIM, 1 SM-X slot)
• This Model: ISR4351 (200-400 Mbps, 3 NIM, 2 SM-X slots)
• Larger Model: ISR4431 (500 Mbps-1 Gbps, 4 NIM, 2 SM-X slots)
• Largest Model: ISR4451-X (1-2 Gbps, 4 NIM, 2 SM-X slots)
• Previous Generation: ISR3845 (superseded by this platform)