Cisco 1921 (CISCO1921/K9) EoL: Migrate to the ISR 4221

The Cisco 1921 Integrated Services Router (CISCO1921/K9) was a workhorse of the small-branch WAN edge for the better part of a decade: a compact, two-port modular router from the ISR Generation 2 1900 family that paired dual Gigabit Ethernet with a pair of EHWIC slots for serial, T1/E1, or xDSL connectivity. If you still have these humming in closets at remote sites, the lifecycle clock has not just expired — it ran out years ago. The platform reached End-of-Sale on 2018-09-29, stopped receiving software maintenance on 2019-09-29, and hit its Last Day of Support (LDoS) on 2023-09-30. As of today, a 1921 in production is unsupported, unpatched, and unreplaceable through Cisco. This guide explains exactly what that means and how to migrate cleanly to the Cisco ISR 4221, the replacement named in Cisco's own end-of-life bulletin.

Why a past-LDoS 1921 is a liability, not just an old box

There is a meaningful difference between "old but working" and "out of support." The 1921 is the latter. After Last Day of Support, three things stop simultaneously, and each one matters to a regulated buyer.

• No more PSIRT security fixes. Cisco's Product Security Incident Response Team stopped issuing patched IOS 15.x maintenance releases for the 1900 ISR G2 family. New CVEs that affect the IKE/IPsec stack, SNMP, HTTP server, or IOS parser on this platform will simply never be remediated. You are frozen on the last image you can obtain.
• No TAC and no RMA. You cannot open a hardware support case, and a dead 1921 cannot be replaced under contract. A power-supply or motherboard failure at a branch becomes an outage with no Cisco-backed recovery path.
• Audit and compliance exposure. Running gear past LDoS routinely fails CDM, FISMA, FedRAMP, HIPAA, PCI-DSS, and CMMC control reviews that require vendor-supported, patchable infrastructure. An unsupported branch router is a documented finding waiting to happen.

What each milestone date actually means

End-of-Sale (2018-09-29) is the last day Cisco accepted new orders for the CISCO1921/K9 — after this you could only buy through inventory and the secondary market. End of Software Maintenance (2019-09-29) is the harder cutoff: the last date Cisco released bug-fix and security maintenance images. Anything discovered after that date is unpatched on this platform. Last Day of Support (2023-09-30) ends all Cisco-delivered service entirely — TAC, RMA, and SmartNet renewals all close. You can find the full milestone breakdown and a quote path on the CISCO1921/K9 end-of-life detail page, and browse other affected models on our Cisco EoL hub.

The replacement: Cisco ISR 4221 (ISR4221/K9)

Cisco's migration target for the 1921 is the ISR 4221, the entry point of the ISR 4000 series. It is not a cosmetic refresh — it is a generational jump from IOS to IOS-XE, from a single-core PowerPC-class processor to a multicore x86 data-plane architecture, and from the legacy PAK/feature-set licensing of the G2 era to modern Smart Licensing with Cisco DNA subscriptions.

What concretely improves

• Throughput and forwarding architecture. The 1921 realistically delivered roughly 25 Mbps of aggregate throughput once you turned on IPsec, NAT, ACLs, and QoS. The ISR 4221 ships with a 35 Mbps default aggregate rate and lifts to 75 Mbps with a Performance license/boost — and crucially it does that work in hardware with a separate control and data plane, so enabling services no longer collapses your throughput the way it did on the G2.
• IOS-XE, not classic IOS. IOS-XE brings a Linux-based control plane, in-service software upgrades, a real YANG/NETCONF/RESTCONF programmable interface, and application hosting (containers/IOx) directly on the router — useful for edge telemetry agents or a lightweight branch service.
• Native SD-WAN. The same hardware runs Cisco Catalyst SD-WAN (formerly Viptela vManage) by loading the controller-mode image. The 1921 had no comparable fabric story. If branch consolidation onto SD-WAN is on your roadmap, the 4221 is already the right chassis.
• Modern slots and crypto. Two NIM slots replace the EHWIC slots (NIMs cover serial, T1/E1, LTE, and more), 2 GE ports (one RJ45, one SFP/RJ45 combo) provide fiber or copper uplink flexibility, and hardware-accelerated IPsec/crypto is built in rather than software-bound. Base config is 4 GB DRAM and 8 GB flash, dwarfing the 1921's CF-card storage.
• Licensing modernization. You move from purchasing perpetual feature sets (SEC, Data, etc.) tied to a Product Activation Key to Smart Licensing with a Cisco DNA Essentials or Advantage subscription. License entitlement now lives in your Smart Account, which makes fleet-wide compliance and true-forward far easier to manage across many branches.

A practical migration plan

1. Assess and inventory

Pull a per-site inventory: chassis serials, the EHWIC modules installed (serial WICs, ADSL/VDSL, T1/E1 — these map to specific NIMs on the 4221, not all are one-to-one), DRAM/flash, the running IOS image and feature set, and current SmartNet status. Capture the running config and a `show tech-support` from each device. This is also your last chance to document anything before the box is gone.

2. License transition

Stand up (or reuse) a Cisco Smart Account and Virtual Account. Decide between DNA Essentials and DNA Advantage based on whether you need advanced routing/SD-WAN and application visibility. Order the right Performance tier if any site exceeds the 35 Mbps default. Legacy 1921 PAK licenses do not transfer — plan the subscription fresh.

3. Config and feature parity

Most IOS 15.x configuration translates closely to IOS-XE, but verify the gaps: IPsec/IKEv2 crypto map and tunnel syntax, zone-based firewall, NAT, NetFlow/Flexible NetFlow, and any EEM scripts. Interface naming changes (GigabitEthernet0/0/0 style). Convert and lab-test the candidate config on one 4221 before touching production. If serial/TDM circuits are involved, confirm the NIM equivalent supports your encapsulation.

4. Physical: rack, power, uplinks, optics

The 4221 is a 1RU desktop/rack chassis with internal AC power (PoE is not the relevant concern for this router class). Plan SFP optics if you use the combo port for fiber, confirm rack rails or shelf mounting, and stage NIMs before the cutover window. There is no stacking to worry about — these are standalone branch routers.

5. Phased cutover

Pilot one or two representative branches first. Pre-stage each 4221 with its tested config and Smart License, ship to site, and cut over in a maintenance window with the old 1921 kept on standby for fast rollback. Validate WAN reachability, tunnels, routing adjacencies, and throughput before declaring the site done. Then fan out the remaining branches in waves.

6. Secure decommission

Wipe each retired 1921 (`write erase`, reformat flash, clear any stored credentials and certificates) before it leaves the building. For DoD and federal sites, follow your media-sanitization policy (NIST SP 800-88) and document chain of custody. Do not let a decommissioned router with live configs and PSKs walk out the door.

Procurement notes for government and enterprise buyers

• TAA compliance. As an authorized Cisco partner, we source ISR4221/K9 units that are TAA-compliant and suitable for federal/DoD acquisition — important for GSA Schedule and FAR-governed buys.
• GPC and payment. We accept the Government Purchase Card (GPC) for in-threshold orders, which keeps small-quantity branch refreshes off a lengthy contracting cycle.
• Lead times. Plan ahead — entry ISR/Catalyst edge platforms can carry multi-week lead times depending on NIM and license configuration. Confirm availability before you commit a cutover date.
• Authorized sourcing. Buying ISR4221/K9 through an authorized partner protects warranty, license registration to your Smart Account, and genuine-hardware assurance — avoid gray-market gear for production WAN edge.

Ready to retire the 1921s? Browse the replacement in our catalog, then get a refresh quote and we will scope a TAA-compliant, GPC-payable ISR 4221 (or Catalyst 8200) build matched to each branch — config conversion, licensing, optics, and a low-risk cutover plan included.