We're running GRE/IPSec transport over a point-to-point DS3. We're also doing some QoS. The traffic mix is voice; our average packet size can be as low as 250 bytes at times. We are seeing incredibly high CPU when the traffic levels approach 30Mb/s and around 11kpps in each direction, at times over 95%. We've seen packet loss as well in the priority queue. We recently forklifted the routers on a point-to-point DS3 from 3845s to 3945s, thinking we'd see an improvement in performance. We saw no such improvement, and some on our team argue it's worse. I'm assuming here that the packet rate coupled with the QoS and GRE is just killing the router's CPU. That said, are there any optimizations that we could consider before ripping this thing out completely? Yes, cef is enabled. I'm considering changing from GRE/IPSec to VTI, but I suspect this will still have the same actual switching behavior through the router, and may not change anything. One other possibility was to run IPSec tunnel mode and just exclude EIGRP from the tunnel, but that may be risky (IPSec fails == black hole). Our fall back plan is swap out the DS3 with an ethernet and get a L2 ethernet encryptor, but that can't happen until 2011-01-01. Any suggestions, wisdom? Thanks, -cjp