Cisco 7200 Simulator

From IPFlow Netflow Collector

Table of contents


I started in August 2005 a project to emulate a Cisco 7200 on a traditionnal PC. Now, it also supports Cisco 3600 series (3620, 3640 and 3660), 3700 series (3725, 3745) and 2600 series (2610 to 2650XM, 2691).

The goals of this emulator are mainly:

  • To be used as a training platform, with software used in real world. It would allow people to become more familiar with Cisco devices, Cisco being the world leader in networking technologies ;
  • Test and experiment the numerous and powerful features of Cisco IOS ;
  • Check quickly configurations to be deployed later on real routers.

Of course, this emulator cannot replace a real router: you should be able to get a performance of about 1 kpps (depending on your host machine), to be compared to the 100 kpps delivered by a NPE-100 (the oldest NPE model). So, it is simply a complementary tool to real labs for administrators of Cisco networks or people wanting to pass their CCNA/CCNP/CCIE exams.

Current status

At this time, the emulator I have programmed is able to boot a large number of Cisco IOS releases available for the 7200, 3600, 3700 and 2600 platforms, including the latest 12.2S and 12.4T.

The following devices are emulated in the current release (0.2.7):

  • MIPS64 and PowerPC CPU processors. The instruction sets are not completely emulated now (MIPS FPU support is lacking, TLB support is not finished and other minor things), but it is sufficient for IOS ;
  • DRAM and Packet SRAM memory ;
  • Non-Volatile Memory (NVRAM) ;
  • Signetics SCN 2681 DUART (C7200 Console and AUX ports) ;
  • National Semiconductors NS16552 DUART (C3600/C3700/C2600 Console and AUX ports) ;
  • Dallas DS1620 Temperature Sensors and Voltage Sensors, allowing the C7200 Environmental Monitor to work properly ;
  • NMC93C46 Serial EEPROM ;
  • Bootflash of 8 Mb (Intel 28F016SA) ;
  • Galileo GT64010/GT64120/GT96100 PCI controllers, DEC 21x50 PCI bridges and so ;
  • PCMCIA ATA disk emulation (C7200 only at this time).
  • ...

The following Cisco 7200 Port Adapters (PA) are currently supported:

  • FastEthernet cards "C7200-IO-FE" and "PA-FE-TX" based on DEC21140 chip
  • FastEthernet cards "C7200-IO-2FE" and "PA-2FE-TX" based on Intel i8254x chips
  • GigabitEthernet cards "C7200-IO-GE-E" and "PA-GE" based on Intel i8254x chips
  • Ethernet cards "PA-4E" and "PA-8E" based on AMD Am79c97x chips
  • ATM card "PA-A1" based on Texas Instruments Tneta1570 chip
  • Serial cards "PA-4T+" and "PA-8T"
  • POS (Packet over Sonet) card "PA-POS-OC3" (experimental, only works with recent IOS images)

The following Cisco 3600 (3620,3640,3660) Network Modules (NM) are currently supported:

  • Ethernet cards: "NM-1E", "NM-4E" and "NM-1FE-TX", all based on AMD Am79c97x chips
  • Ethernet switching module: "NM-16ESW"
  • Serial card "NM-4T"

The following Cisco 2691/3725/3745 Network Modules (NM) are currently supported:

  • FastEthernet cards: "NM-1FE-TX"
  • Ethernet switching module: "NM-16ESW"
  • Serial card "NM-4T"

The following Cisco 2600 Network Modules (NM) are currently supported:

  • Ethernet cards: "NM-1E", "NM-4E" and "NM-1FE-TX"
  • Ethernet switching module: "NM-16ESW"

You can also get development info and beta versions on my technical blog (

To run at a decent speed, the emulator uses a JIT (Just In Time) compiler, which is working on x86 CPU (like Pentium) and x86_64 CPU (AMD64/Intel EM64T). It is also possible to run the emulator without the JIT support on non-x86 machines, but it is slower.

You can find some information about the C7200 hardware on the Cisco Web site (

Lab simulation / "Hypervisor" mode

With the introduction of the 0.2.5 release, it is now possible to run the emulator as an "hypervisor" to start and control many virtual router instances simultaneously.

Dynagen (, by Greg Anuzelli, is a front-end (written in Python) that makes lab simulation with the hypervisor very easy: it uses an INI-like configuration file to provision Dynamips emulator networks. It takes care of specifying the right port adapters, generating and matching up those pesky NIO descriptors, specifying bridges, frame-relay, ATM switches, etc. It also provides a management CLI for listing devices, suspending and reloading instances, etc. You can also distribute virtual instances across different servers to set up complex labs. To begin with Dynagen, you can consult this very complete tutorial (

Dynagui ( is a graphical front-end written by Yannick Le Teigner. It uses Dynagen to communicate with the hypervisor.

Contributors are welcome ! :)

For people interested to contribute there is a TODO List.

There are many things to do: a more efficient JIT, network device emulation, new platforms...


The current release is 0.2.7, published May 26, 2007 (you can consult the README file (

You have to download only one binary file corresponding to your architecture:

If you are using the Windows version, you have to download and install the WinPcap library ( The minimum required version is 0.4. Thanks to WinPCAP, it is possible to access the Ethernet card of host machine to send/receive packets on the LAN.

You can also download the source code, published under the GNU General Public Licence (GPL):

Remark: the sources include 3 files which are not written by me: amd64-codegen.h and x86-codegen.h from the Mono project (, and base64.c from Fetchmail, all under GPL licence. Of course these files keep their licences and their copyrights.

How to use it ?

Very important remark: by default, an instance will take 100% of the host CPU. To avoid this, please read the "idle-pc" section in the README file (

To boot quickly, the preferred method is to decompress the IOS image with the "unzip" utility. It avoids to run the self-decompressing process in the emulator.

chris@portchris2:~/dynamips-0.2.5$ unzip -p c7200-advipservicesk9-mz.124-9.T.bin > image.bin
warning [c7200-advipservicesk9-mz.124-9.T.bin]:  27904 extra bytes at beginning or within zipfile
  (attempting to process anyway)
chris@portchris2:~/dynamips-0.2.5$ file image.bin
image.bin: ELF 32-bit MSB executable, cisco 7200, version 1 (SYSV), statically linked, stripped

You can ignore the warning, unzip has just skipped the self-decompressing code at the beginning of the image.

Now, you can boot the image (in this example, no network connections are defined):

chris@portchris2:~/dynamips-0.2.5$ ./dynamips image.bin -t npe-400 -p 1:PA-A1 -p 2:PA-8T -p 3:PA-4E -p 4:PA-POS-OC3 -p 6:PA-FE-TX
Cisco 7200 Simulation Platform (version 0.2.5-x86)
Copyright (c) 2005,2006 Christophe Fillot.

IOS image file: image.bin

CPU0: carved JIT exec zone of 64 Mb into 2048 pages of 32 Kb.
NVRAM is empty, setting config register to 0x2142
C7200 instance 'default' (id 0):
  VM Status  : 0
  RAM size   : 256 Mb
  IOMEM size : 0 Mb
  NVRAM size : 128 Kb
  NPE model  : npe-400
  Midplane   : vxr
  IOS image  : image.bin

Loading ELF file 'image.bin'...
ELF entry point: 0x80008000

C7200 'default': starting simulation (CPU0 PC=0xffffffffbfc00000), JIT enabled.
ROMMON emulation microcode.

Launching IOS image at 0x80008000...

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706

Cisco IOS Software, 7200 Software (C7200-ADVIPSERVICESK9-M), Version 12.4(9)T, RELEASE SOFTWARE (fc1)
Technical Support:
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Fri 16-Jun-06 17:27 by prod_rel_team
Image text-base: 0x60009084, data-base: 0x6308C000

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

If you require further assistance please contact us by sending email to

Cisco 7206VXR (NPE400) processor (revision A) with 245760K/16384K bytes of memory.
Processor board ID 4294967295
R7000 CPU at 150MHz, Implementation 39, Rev 2.1, 256KB L2, 512KB L3 Cache
6 slot VXR midplane, Version 2.1

Last reset from power-on

PCI bus mb0_mb1 (Slots 0, 1, 3 and 5) has a capacity of 600 bandwidth points.
Current configuration on bus mb0_mb1 has a total of 540 bandwidth points.
This configuration is within the PCI bus capacity and is supported.

PCI bus mb2 (Slots 2, 4, 6) has a capacity of 600 bandwidth points.
Current configuration on bus mb2 has a total of 500 bandwidth points
This configuration is within the PCI bus capacity and is supported.

Please refer to the following document "Cisco 7200 Series Port Adaptor
Hardware Configuration Guidelines" on <>
for c7200 bandwidth points oversubscription and usage guidelines.

4 Ethernet interfaces
2 FastEthernet interfaces
8 Serial interfaces
1 ATM interface
1 Packet over SONET interface
125K bytes of NVRAM.
Installed image archive

65536K bytes of ATA PCMCIA card at slot 0 (Sector size 512 bytes).
8192K bytes of Flash internal SIMM (Sector size 256K).

         --- System Configuration Dialog ---

Would you like to enter the initial configuration dialog? [yes/no]:

Questions & Answers

There is a "Frequently Asked Questions" page.

It is also recommended to consult the Hacki's forum ( Many tips, lab examples, ... are published on it.