Cisco VPN MPLS Recommendation


I am looking for a bit of advice on the best hardware for an upcoming upgrade.  We currently have a WAN with 4 locations connected via MPLS.  The main office has a Cisco 2821 and the remote sites have Cisco 2801s.  The MPLS handoffs are T1s and so each 28xx has a DSU/CSU WIC.  We are planning on moving to a VPN over fiber infrastructure for primary connections to the main office, (the remote offices don't need to communicate with each other.) while keeping the MPLS at 1.5mbps as a failover network.  
We're are going to invest in new hardware, but after doing a bunch of web research I'm seeing conflicting opinions and statements.  So, my question is this:  

Is upgrading to Cisco 29XX with the security bundle and DSU/CSU card the best approach?  Or should I be looking into ISRs or ASAs?

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jody LemoineNetwork ArchitectCommented:
The 2901 routers (which are ISRs, btw) with DSU/CSU cards are a good angle. ASAs are principally security appliances and don't have the routing flexibility for effective path control between the two connections, nor do they allow for an internal DSU/CSU interface. What kind of speeds are you looking at for your VPN over fibre infrastructure? 2901s are a reasonable upgrade for T1s, but if you're planning on 100Mb+ on the primary connection, you may want to look at a slightly higher end model in the 2900 series.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DMJorgensenAuthor Commented:
Thanks for the info.  I was thinking of 2901s for the remote sites and a 2911 or 2921 for the main office as all the remotes site connect there.  My vendor recommended ISR 4321s for all locations, but I'm not sure what the difference is.
Jody LemoineNetwork ArchitectCommented:
The 4300/4400 ISR units are the latest generation of Cisco routers, but may be overkill for this application. Again, it depends on the bandwidth provisioning on the fibre connection.
DMJorgensenAuthor Commented:
After doing a bit more research, we are going the ISR 4321/4331 models.  The VPN bandwidth on them is much higher than the 29xx series.  Thanks for the help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.