Configuration of Resource Modes in IOS XE Cisco Secure Routers
Overview and Purpose
Platform resource mode lets administrators change how supported IOS XE-based secure routers allocate CPU resources between service-plane and data-plane workloads. Use Service plane heavy (SP Heavy) when on-box services, including container-based security inspection, need additional resources. Use Data plane heavy (DP Heavy) when packet-forwarding capacity is the priority. Dashboard shows the active mode, saves the selected mode, and reboots the router to activate the change. This guide covers requirements, feature dependencies, configuration, and verification.
How Resource Modes Work
IOS XE separates control, service, and data-plane processing. A feature can use more than one plane, but its primary workload determines which resource profile is appropriate.
- Control plane: Maintains routing adjacencies, route computation, and system control functions. Dashboard does not expose a Control Plane Heavy option through this control.
- Service plane: Hosts on-box services and containerized applications, including supported security inspection engines.
- Data plane: Processes and forwards packets, including forwarding and encryption work performed for each flow.
|
Mode |
Resource Emphasis |
When to Use and Feature Impact |
|
Service plane heavy (SP Heavy) |
Allocates more CPU to service-plane and related control processes, with fewer resources available for packet forwarding than DP Heavy. |
Use for on-box and containerized services. STS/TE-based IDS/IPS requires SP Heavy. Use SP Heavy when supported Threat Protection or Content Filtering services are needed. |
|
Data plane heavy (DP Heavy) |
Allocates more CPU to the data plane responsible for packet forwarding. |
Use when forwarding throughput or scale is the priority. Dashboard warns that Threat Protection and Content Filtering services are disabled. No named Dashboard feature is documented as requiring DP Heavy. |
Note: SP Heavy is not the same as a Control Plane Heavy template. If a deployment design specifically requires a CP Heavy profile, this Dashboard control cannot apply it. Follow platform-specific design guidance.
Feature and Mode Associations
- Service plane features: A feature qualifies as service-plane-heavy when it relies on an on-box service, hosted application, or containerized inspection engine. Supported IDS/IPS is the explicit example for managed IOS XE secure routers.
- Data plane features: A feature leverages the data plane when it performs packet-by-packet forwarding or encryption work. That does not by itself make DP Heavy mandatory; select the profile when capacity planning calls for additional forwarding resources.
- Separate configuration: Changing the resource mode does not enable, disable, or configure every dependent feature automatically. Configure and verify the feature separately after the router returns to Active.
Prerequisites and Limitations
Before configuring Platform resource mode, ensure the following requirements are met.
Licensing Requirements
Platform resource mode follows the licensing requirements of the managed router. Any feature that depends on a mode, including security services, retains its own licensing requirements.
Hardware Requirements
- Use a supported Generation 2 IOS XE secure router onboarded to Dashboard with Configuration Source: Cloud.
- Resource-mode support is capability-dependent and may expand separately from onboarding support.
- Confirm that Platform resource mode appears on the Appliance Status page. Dashboard hides the control when the router does not report the required capability.
- Hybrid-mode and Configuration Source: Device routers are not supported for this Dashboard workflow.
Firmware Requirements
- OS XE 26.2.1 or later. The latest stable release is recommended.
Access Requirements
- A Dashboard administrator account with write access to the network.
- Active management connectivity between Dashboard and the router.
- An approved maintenance window for the immediate reboot and temporary traffic interruption.
Limitations
- Dashboard exposes only Service plane heavy and Data plane heavy. Granular core allocation and Control Plane Heavy are not available in this workflow.
- The setting is available in Dashboard only; API is not supported.
- Every mode change saves the device configuration and initiates a reboot.
- The save operation captures the current running configuration. Do not change the mode while other firmware or configuration updates are in progress.
- DP Heavy disables Threat Protection and Content Filtering services. Review service impact before selecting it.
- The default mode is platform-dependent. Use the mode marked Active in Dashboard as the current state.
- The edit control for resource mode remains unavailable while a mode change is In progress.
Configuration Steps
Warning: Changing the mode saves the device configuration and immediately reboots the router. Schedule a maintenance window, notify affected users, and wait for any other firmware or configuration operation to finish.
Configure the Resource Mode
- Navigate to Security & SD-WAN > Monitor > Appliance Status. Select the target router and open Summary if it is not already selected.
- Locate Platform resource mode in the left-side device details panel. Dashboard displays the configured mode and an Active status when the configured and running modes match.
- Select the edit icon next to Platform resource mode. The CPU & platform resource mode dialog opens with the configured mode selected. Save remains unavailable until you choose a different valid mode.
- Review the warning in the dialog. Dashboard explains that it will save the device configuration and reboot the router. Use the affected-device scope displayed in your Dashboard version when planning the maintenance window.
- Select the required mode:
- Service plane heavy: Select for supported containerized security services and other service-plane workloads.
- Data plane heavy: Select when forwarding capacity is the priority. Review the warning that Threat Protection and Content Filtering services will be disabled.
- Select Save. After Dashboard accepts the update and reboot request, the dialog closes, the target mode shows In progress, and editing remains unavailable until the transition completes.
Verify the Resource Mode
- Wait for the router to reboot and reconnect to Dashboard. Temporary traffic interruption, device unreachability, or a transient Failed to load platform resource mode message is expected during the reboot.
- Refresh the Appliance Status page after management connectivity returns.
- Confirm that the requested mode is displayed with Active status. Active means the configured mode and the running mode match.
- Configure or verify any dependent feature separately. For SP Heavy, confirm that the intended security service is enabled and healthy. For DP Heavy, confirm that the disabled security-service behavior is expected.
- If Dashboard shows Update failed or the target mode does not become Active, refresh the page and check device connectivity. If the error persists, contact Cisco Meraki Support. A reboot failure can require a manual reboot after the configuration has been saved.
