Symptom
On a Cisco router running IOS-XE software with an IPsec throughput license, poor throughput may be observed for bursty traffic or TCP based applications. Packet drops due to OUT_CRYPTO_THRPUT_POLICY_DROP are seen with the command show platform hardware qfp active statistic drop when the issue occurs even though the average traffic throughput is below the licensed throughput limit.
Conditions
This issue is seen mostly with traffic that is bursty or with TCP based applications, and the problem is observed on the Cisco 1100, Catalyst 8300, and Catalyst 8500 series of routers.
