ISR4331-SEC/K9 - Cisco 4000 Family Integrated Services Router

ISR4331-SEC/K9 Security Bundle Boundary

ISR4331-SEC/K9 is Cisco's Cisco ISR 4331 Security Bundle with the SEC license. The SEC feature bundle adds Zone-Based Firewall, IPsec VPN, EZVPN, DMVPN and FlexVPN to IP Base; it is not the broader AX application-experience package.

Hardware platform underneath the bundle

Cisco specifies the ISR 4331 base with three onboard Gigabit Ethernet interfaces, two NIM slots, one ISC slot, one service-module slot, 4 GB Flash and 4 GB DRAM. Modules, transceivers and extra memory are separate unless listed on the received bill of materials.

Security entitlement acceptance

Confirm the installed IOS XE release and license state on the actual serial number. A chassis label alone does not prove that the SEC entitlement remains usable after resale, replacement or Smart Licensing migration. HSEC, voice, APP and performance-boost rights are not implied.

Performance is separately licensed

Cisco documents 100 Mbps base performance for ISR4331 and a performance-on-demand path to 300 Mbps; a separate boost license can change the ceiling. Measure encrypted traffic and enabled services before sizing because the SEC suffix does not establish the performance license.

Lifecycle and replacement

The exact PID reached end of sale on November 7, 2023. Cisco lists August 31, 2025 for routine software-maintenance releases and November 30, 2028 for vulnerability/security support and last hardware support. Cisco identifies C8200-1N-4T as the migration product.

When AX is required

Choose ISR4331-AX/K9 only when application-experience and advanced-networking capabilities are part of the approved design; do not pay for AX based on model similarity alone.

Official Cisco sources: ISR 4000 platform and bundle data sheet; exact PID lifecycle notice.