Cisco Catalyst 8000 · Selection Guide

Cisco Catalyst 8k Selection Guide

Cisco's Catalyst 8000 family spans a single firmware (IOS XE) across eight very different boxes — from a sub-$1,000 fanless branch router to a 100G-capable aggregation headend to a software image you spin up in a cloud VPC. Because every model runs the same SD-WAN feature set, the selection problem is almost never "which features?" and almost always "which form factor, how much encrypted throughput, and how much room to grow?" This guide lays the shipping SKUs side by side on the axes that actually drive that decision, and deliberately names no overall winner: the right model is the cheapest one whose role, crypto throughput, and interfaces clear the requirements of the specific site you are designing.

Comparison Intermediate 8 models 8 decision axes

The decision matrix

Click any column heading to sort. Quantitative columns highlight the leading cell. Hover an (i) for the caveat behind a number — most throughput figures are license-tier and packet-size dependent.

ModelPrimary Deployment RoleMax Aggregate Throughput (Gbps)Encrypted (IPsec/SD-WAN) Throughput (Gbps)Form FactorModular Expansion Slots (NIM + SM) (slots)Built-in High-Speed InterfacesHardware Redundancy (PSU / Fans)Deployment Medium
C8200L-1N-4Tsmall-branch3.8 Gbps0.5 Gbpsi~500 Mbps. License-tier dependent; the cost-optimized "L" CPU caps crypto here.1RU fixed1 slotsiA single NIM only; no SM service-module bay.1G onlynone (fixed single PSU)physical appliance
C8200-1N-4Tsmall-branch3.8 Gbps1 Gbpsi~1 Gbps. License-tier (DNA tier + HSECK9) dependent.1RU fixed1 slotsiA single NIM only; no SM service-module bay.1G onlynone (fixed single PSU)physical appliance
C8300-1N1S-6Tmid-branch19.7 Gbps1.9 Gbpsi1400-byte; license-tier dependent. The 17–18.8 Gbps "series" figures belong to higher-core 8300 SKUs, not the 1N1S.1RU modular2 slots1G onlydual / redundantiDual (field-replaceable) PSU supported, in a 1RU body.physical appliance
C8300-2N2S-6Tlarge-branch / regional-hub20 Gbps2 GbpsiHSECK9 + Tier 2 gated. Branch-class crypto despite the larger chassis.2RU modular4 slots1G onlydual / redundantphysical appliance
C8500L-8S4Xlarge-branch / regional-hub20 Gbps19 GbpsiTier 3 license. Tier 2 caps this box at ~2 Gbps.1RU fixed0 slots1G + 10Gdual / redundantphysical appliance
C8500-12Xaggregation / DC-edge118 Gbps51 GbpsiMeasured at 1400-byte packets. Drops to ~22.6 Gbps at IMIX.1RU fixed0 slots10Gdual / redundantphysical appliance
C8500-12X4QCaggregation / DC-edge197 Gbps96 GbpsiMeasured at 1400-byte packets. Drops to ~31.9 Gbps at IMIX.1RU fixed0 slots10G + 40/100Gdual / redundantphysical appliance
C8000V (virtual)virtual / cloud50 GbpsiTop licensed tier (T4 ~50 Gbps). Elastic and per-instance, not a fixed hardware ceiling.15 GbpsiPer-instance, license-tier + vCPU dependent. No single-instance 100G tier; scale out by adding VMs.software / VM0 slotsiVirtual — uses virtual NICs, no physical slots.virtual NICsn/a (host-managed)iAvailability comes from the hypervisor/cloud (VM HA, zones, redundant instances), not an onboard PSU.virtual only (VM / cloud)
leading value in a quantitative column i hover for a per-cell caveat

How these were scored

Scoring rubricQuantitative axes (throughput, crypto throughput, module slots) are judged purely on Cisco's published datasheet figures with higher being better; where Cisco lists throughput as a licensed/tiered maximum we use the top hardware-capable figure and note the license dependency. Categorical axes are judged by fit-to-role, not by a universal 'best' — a small-branch box scoring 'none' on redundancy is correct for its niche, not a failure. The guide deliberately declares no overall winner: the right model is the cheapest one whose role, throughput, and interfaces clear the requirements of the specific site being designed.

Model-by-model

Each model gets the same treatment: what it is, where it wins, where it doesn't, and the buyer profile it's the right answer for. No model is the winner everywhere.

C8200L-1N-4T

small-branch

Cost-optimized entry point of the family: fanless-class 1RU fixed router for very small branches and managed CPE where price-per-site beats raw performance.

The C8200L-1N-4T is for very small branches and managed-CPE fleets where price-per-site matters more than raw performance, trading crypto headroom, redundancy, and on-box services for the lowest entry cost in the family.

What it is

The C8200L-1N-4T is the cost-optimized "L" (lean) variant of the Catalyst 8200 small-branch edge platform, built around a 4-core Intel x86 CPU with 4 GB of DRAM by default (upgradeable to 8/16/32 GB) and 8 GB of fixed flash.14 It runs the same IOS XE SD-WAN (Catalyst SD-WAN) image as the rest of the family and supports both SD-WAN and SD-Routing, with a minimum of IOS XE 17.5.1.46 Cisco positions it for SASE-style branches that offload security to the cloud rather than running it on-box, and it explicitly does not support container-based apps or edge computing.16

Figure 1: C8200L-1N-4T in a small-branch SD-WAN deployment

flowchart LR
    LAN["Branch LAN devices"] --> C8200L
    subgraph C8200L["C8200L-1N-4T (single PSU)"]
        PORTS["4x 1 GbE WAN ports<br/>(2x RJ45 + 2x SFP)"]
        NIM["1 NIM slot<br/>(LTE / 5G / WAN module)"]
    end
    PORTS -->|"Broadband"| WAN(("WAN / Internet"))
    NIM -->|"LTE backup"| WAN
    WAN --> FABRIC["SD-WAN fabric (overlay tunnels)"]
    FABRIC --> HUB["Regional hub / data center"]

Where it wins

  • Lowest acquisition cost in the lineup: street pricing for new hardware (ex-license) runs roughly USD $800–$1,200, with refurbished SKUs seen near $808.151617
  • Adequate aggregate forwarding for a small site: up to 3.8 Gbps IPv4 forwarding throughput (1400-byte traffic), the same figure as the full C8200.111
  • Built-in WAN flexibility without add-ons: four 1 GbE WAN ports split as 2x RJ45 copper plus 2x SFP.1
  • Compact, fixed footprint: 1 RU appliance suited to a branch closet, with one NIM and one PIM slot available for an LTE/5G or WAN module.36
  • Same licensing model and SD-WAN feature set as the full C8200, so the SKU lowers capacity, not capability (excluding edge compute).6

Where it doesn't

  • Encrypted throughput is the binding limit: up to 500 Mbps SD-WAN/IPsec at 1400-byte traffic (~400 Mbps IMIX), half the 1 Gbps of the full C8200-1N-4T, and this figure is performance/license-tier dependent.14
  • Lower SD-WAN scale: up to 1500 overlay tunnels versus 2500 on the full C8200, limiting large multi-VPN or heavy-policy designs.4
  • No power-supply redundancy: the fixed 1 RU SKU ships with a single internal PSU, with no redundant-PSU option published — treat it as non-redundant.3
  • Limited modularity: one NIM plus one PIM slot only, with no full SM/SM-X service-module slot and no PoE option.6
  • No on-box services: container-based apps and edge computing are explicitly unsupported, and there is no native 10G interface.16

When to pick it

Choose the C8200L-1N-4T for a service provider or enterprise standing up many small branches as managed CPE, where per-site cost dominates, security is delivered from the cloud (SASE), and WAN circuits stay at or below roughly 500 Mbps of encrypted SD-WAN.

References

  1. Cisco Catalyst 8200 Series Edge Platforms Data Sheet. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/nb-06-cat8200-series-edge-plat-ds-cte-en.html
  2. C8200L-1N-4T datasheet (PDF). https://www.router-switch.com/pdf2html/pdf/cis:c8200l-1n-4t-datasheet.pdf
  3. Cisco Catalyst 8200 Edge Platforms overview (CPU/DRAM/tunnels/min IOS XE comparison). https://network-switch.com/blogs/routers/cisco-catalyst-8200-edge-platforms-routers
  4. Cisco Catalyst 8200 Series Edge Platforms FAQ (1 NIM + 1 PIM; no container/edge compute on L; feature parity). https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/catalyst-8200-series-edge-platforms-faq.html
  5. Catalyst 8200 datasheet PDF mirror (throughput/IPsec figures). https://comptek.ru/materials/cisco/catalyst/nb-06-cat8200-series-edge-plat-ds-cte-en.pdf
  6. Router-Switch street/clearance pricing. https://www.router-switch.com/cisco-catalyst-8200-edge-platforms-ucpe-price.html
  7. BuyRouterSwitch C8200L-1N-4T pricing ($869.38 new). https://buyrouterswitch.com/c8200l-1n-4t-price.html
  8. Zones refurbished pricing ($807.99, C8200L-1N-4T-RF). https://www.zones.com/site/product/index.html?id=111959014

↑ Back to matrix

C8200-1N-4T

small-branch

Small-branch SD-WAN/SASE edge: one NIM slot of modularity on top of the 8200L, for sites that need a single WAN module (LTE/5G/T1) without stepping up to the 8300.

For small and medium branches on sub-gig to roughly 1 Gbps circuits that need one slot of WAN modularity — typically an LTE/5G or T1 module — without moving up to the 8300. It trades the 8300's slot count, crypto headroom, and power redundancy for a compact, lower-cost 1RU chassis that still has real expansion and service capacity.

What it is

The C8200-1N-4T is a 1RU, x86-based Cisco IOS XE SD-WAN edge router positioned for small-to-medium enterprise branch offices, including SASE-aligned designs. It pairs an 8-core Intel CPU with 8 GB of default DRAM (expandable, commonly cited to 32 GB at the series level) and adds one NIM slot plus one PIM slot on top of the four built-in WAN ports. That extra core count and modularity are the main practical separators from the lower-end, fixed C8200L-1N-4T, including the ability to run on-box containerized security applications (NGFW/IPS/URL filtering/AMP) that the 8200L does not support.

Figure 1: C8200-1N-4T at a small/mid branch with cellular backup

flowchart LR
    LAN["Branch LAN<br/>(users / devices)"] --> C8200

    subgraph C8200["C8200-1N-4T (1RU)"]
        CPU["8-core x86 CPU<br/>IOS XE SD-WAN"]
        PORTS["4 x 1G WAN/LAN ports<br/>(2x SFP + 2x RJ-45)"]
        NIM["NIM slot:<br/>LTE/5G cellular module"]
        PSU["Single AC PSU"]
    end

    PORTS -->|"Primary WAN (Internet)"| ISP["ISP / broadband (~1 Gbps)"]
    NIM -->|"Cellular backup"| CELL["LTE/5G network"]

    ISP -->|"Encrypted IPsec tunnels"| FABRIC["SD-WAN fabric (overlay)"]
    CELL -->|"Encrypted IPsec tunnels"| FABRIC

Where it wins

  • Up to 1 Gbps SD-WAN/IPsec encrypted throughput at 1400-byte packets (~900 Mbps at IMIX), with QAT-accelerated crypto — enough to fully encrypt a 1 Gbps branch circuit.
  • Up to ~3.8 Gbps aggregate clear-text IPv4 forwarding (1400-byte packets), leaving headroom above its encrypted ceiling.
  • One NIM slot plus one PIM slot for WAN modularity: PIM-based LTE/5G (e.g., P-LTEAP18-GL Cat18 LTE and 5G pluggables) and Cat6 LTE NIMs (NIM-LTEA-EA / NIM-LTEA-LA), plus ISR4000-era xDSL, serial, voice PVDM, and LAN-switch NIMs.
  • 8-core CPU with default 8 GB DRAM gives meaningful headroom over the 8200L — notably the capacity to host on-box containerized security apps, which the 8200L lacks.
  • Scales to up to 2,500 SD-WAN overlay tunnels, covering most single-site branch topologies.

Where it doesn't

  • No SM (Service Module) bay. Expansion is limited to 1 NIM + 1 PIM; the 8300 adds SM slots and more NIM/PIM density for heavier service or interface needs.
  • Single AC PSU on this model — no dual/redundant power subsystem. Redundancy must be designed at the site level, whereas the 8300 supports redundant PSUs. Fan redundancy is not published.
  • 1G-only built-in ports: 4 × 1 GbE (2 × 1G SFP fiber + 2 × 1G RJ-45 copper). No native 10G uplinks; higher-speed access depends on module type.
  • ~1 Gbps encrypted ceiling. For >1 Gbps SD-WAN, multi-Gbps IPsec, or dual active/active circuits, the 8300 (up to 2–5 Gbps SD-WAN, ~9.3 Gbps IPsec) is the intended step-up.
  • SD-WAN feature depth and SASE/security integration are license-tier dependent (mandatory Cisco DNA subscription; Essentials/Advantage/Premier), and the exact per-tier feature split is not fully detailed in the datasheets.

When to pick it

Choose the C8200-1N-4T for a single ~1 Gbps Internet branch running full SD-WAN with standard services, where you want one WAN module (LTE/5G/T1) and optional on-box containerized security but don't need SM slots, dual circuits, multi-Gbps crypto, or PSU redundancy.

References

  1. Cisco Catalyst 8200 Series Edge Platforms data sheet. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/nb-06-cat8200-series-edge-plat-ds-cte-en.html
  2. Cisco Catalyst 8200 secure routers data sheet. https://www.cisco.com/site/us/en/products/collateral/networking/sdwan-routers/8000-secure-routers/8200-series-secure-routers-ds.html
  3. C8200-1N-4T data sheet (memory, slots, PSU, throughput). https://www.router-switch.com/pdf2html/pdf/cis:c8200-1n-4t-datasheet.pdf
  4. Cisco Catalyst 8200 Series Edge Platforms FAQ — LTE/5G PIM & NIM support, slots, modules. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/catalyst-8200-series-edge-platforms-faq.html
  5. Cisco Catalyst 8300/8200 Series architecture white paper — QAT crypto, cores. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/catalyst-8300-8200-series-edge-platforms-architecture-wp.html
  6. 8200 vs 8300 SD-WAN comparison. https://www.servnetuk.com/compare/vs/cisco-c8200-sdwan/cisco-c8300-sdwan
  7. Cisco Catalyst 8300/8200 ordering guide — PSU redundancy. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/cat-8300-8200-series-edge-plat-og.html
  8. C8200-1N-4T unboxing/overview — DNA license, 2,500 tunnels. https://www.youtube.com/watch?v=ROq8DD6wdHc

↑ Back to matrix

C8300-1N1S-6T

mid-branch

Mid-size branch workhorse and ISR 4400 successor: 1RU modular chassis with one NIM + one SM slot for mixed access and on-box services.

For mid-size to large branch sites that have outgrown a fixed small-branch router but do not need a 2RU chassis, the C8300-1N1S-6T trades raw slot density and native 10G for a compact, modular 1RU footprint that still supports on-box services.

What it is

The C8300-1N1S-6T is a 1RU modular branch edge router in Cisco's Catalyst 8300 Series, positioned by Cisco as the evolution and replacement for the ISR 4400 Series for SD-WAN and SASE branch use cases.12 Its naming encodes its expansion layout: "1N1S" means one NIM slot plus one SM slot (alongside one PIM power/inline-power slot), and "6T" means six built-in 1-Gigabit Ethernet front-panel ports.23 It runs Cisco IOS XE with full SD-WAN capability, zero-touch provisioning, and API-based automation.4

Figure 1: C8300-1N1S-6T modular chassis layout

flowchart TD
    CHASSIS["C8300-1N1S-6T 1RU chassis (IOS XE SD-WAN)"]
    CHASSIS --> NIM["NIM slot (1x): WAN access modules"]
    CHASSIS --> SM["SM service-module slot (1x): on-box services and compute"]
    CHASSIS --> PORTS["Built-in ports: 6x 1GbE (2x SFP + 4x RJ-45)"]
    CHASSIS --> PSU["Power: dual-PSU-capable (AC redundancy)"]
    NIM --> WAN["WAN options: LTE / 5G / T1"]
    SM --> SVC["Hosted services: app compute, security, L2/L3 and 5G options"]

Where it wins

  • Aggregate forwarding capacity of up to ~19.7 Gbps IPv4 (1400-byte) gives substantial headroom for clear-text and mixed branch traffic well beyond typical branch WAN circuit speeds.1
  • An SM service-module slot allows higher-bandwidth on-box services and compute (including newer Layer 2/Layer 3 and 5G options), with a backplane that provides 10G connectivity to the service-module slots.5
  • Six built-in 1GbE ports (2 x SFP + 4 x RJ-45) provide flexible copper and fiber WAN/LAN connectivity out of the box without consuming a module slot.36
  • Dual AC power supply support for PSU redundancy, per product listings, suiting branches with availability requirements that a single-PSU fixed router cannot meet.5
  • Integrated security services under IOS XE — zone/stateful firewall, Snort IPS/IDS, URL filtering, AMP, and SSL proxy — let a single box act as the branch SD-WAN and security edge.4

Where it doesn't

  • Encrypted SD-WAN/IPsec throughput is only up to ~1.9 Gbps (1400-byte; ~1.75 Gbps IMIX) for this SKU, and that figure is license-tier dependent — far below the headline 17–18.8 Gbps series numbers, which belong to higher-core 8300 SKUs such as the 2N2S-4T2X, not the 1N1S-6T.17
  • No dedicated native 10G WAN ports. The "-6T" is a 1G WAN-class SKU; the 10G front-panel option (2 x 10G SFP+) belongs to the sibling "-4T2X" variant.7
  • Only one NIM and one SM slot, half the modular expansion of the 2RU C8300-2N2S, which can constrain sites needing multiple WAN modules plus on-box compute.7
  • Exact CPU core count is not published in available datasheet excerpts, making precise capacity planning against the 2N2S harder.4
  • Subscription licensing (Cisco DNA Essentials/Advantage plus security add-ons) gates throughput tiers and advanced features, an ongoing cost rather than a one-time permanent license.4

When to pick it

Choose the C8300-1N1S-6T for a medium-to-large branch on 1G WAN circuits that needs modular expansion (one WAN module plus one service/compute module) and on-box security in a space-constrained 1RU footprint — but step up to the 2N2S or a -4T2X variant if you need more module slots or native 10G.

References

  1. Cisco Catalyst C8300-1N1S-6T datasheet. https://www.scribd.com/document/900180341/c8300-1n1s-6t-datasheet
  2. Cisco Catalyst 8300 Series Edge Platforms datasheet. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/datasheet-c78-744088.html
  3. C8300-1N1S-6T datasheet PDF. https://www.router-switch.com/pdf2html/pdf/c8300-1n1s-6t-datasheet.pdf
  4. Cisco Catalyst 8300 Series Edge Q&A. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/cat-8300-series-edge-qa.html
  5. Catalyst 8300-1N1S-6T product listing. https://datasys.ee/toode/catalyst-8300-1n1s-6t/
  6. C8300-1N1S-6T quick-spec listing. https://www.layer23-switch.com/c8300-1n1s-6t.html
  7. Cisco Catalyst 8300/8200 ordering guide. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/cat-8300-8200-series-edge-plat-og.html

↑ Back to matrix

C8300-2N2S-6T

large-branch / regional-hub

Large-branch / regional-hub variant of the 8300: 2RU with double the module slots and CPU headroom of the 1N1S for the busiest branch sites.

For the large branch or regional hub that has outgrown a 1RU chassis and needs room to grow into on-box compute and cellular WAN, the C8300-2N2S-6T trades rack space and power draw for the most module slots and CPU headroom in the 8300 line. It is a branch-class platform, not an aggregation box, so its encrypted ceiling stays modest even as its expansion capacity doubles.

What it is

The C8300-2N2S-6T is a 2RU modular edge platform that Cisco positions for medium-to-large enterprise branches and regional hubs running SD-WAN with services and modular expansion.19 It carries 2 NIM slots plus 2 SM slots (and 1 PIM slot), a 12-core Intel x86 CPU, and 8 GB DDR4 DRAM upgradable to 32 GB.37 Built-in connectivity is six embedded Layer-3 Ethernet ports, all 1G (typically 2 SFP + 4 RJ-45).36 It shares the same throughput class as the 1RU C8300-1N1S-6T but doubles the module slots.7

Figure 1: C8300-2N2S-6T 2RU chassis as a regional hub

flowchart TD
    HUB["C8300-2N2S-6T (2RU) regional hub - IOS XE SD-WAN"]
    NIM["2x NIM slots (WAN / LTE / 5G cellular)"]
    SM["2x SM slots (UCS-E on-box compute)"]
    PORTS["6x 1G built-in L3 ports (2 SFP + 4 RJ-45)"]
    PSU["Dual redundant PSUs + field-replaceable fans"]
    B1["Branch tunnel 1"]
    B2["Branch tunnel 2"]
    B3["Branch tunnel N (up to 6000 overlay tunnels)"]

    NIM --> HUB
    SM --> HUB
    PORTS --> HUB
    PSU --> HUB
    B1 --> HUB
    B2 --> HUB
    B3 --> HUB

Where it wins

  • IPv4 (non-crypto) forwarding reaches roughly 19.7-20 Gbps in hardware and is effectively unthrottled for clear-text traffic, with the architecture doc citing about 10 Gbps CEF aggregation across the built-in ports.367
  • Four service-capable module slots (2 NIM + 2 SM, plus 1 PIM) give the most expansion in the 8300 family, including UCS-E M3 compute modules (6/8/12-core) for on-box virtualization.36
  • SM and NIM slots accept LTE/5G cellular WAN modules and a wide range of WAN/switch media, so a site can add transports later rather than forklift the box.69
  • Dual hot-swappable redundant power supplies (AC/DC options) and field-replaceable redundant fans support hub-class availability.59
  • Scales to up to 6000 SD-WAN overlay tunnels at the platform level.4

Where it doesn't

  • SD-WAN/IPsec encrypted throughput tops out at roughly 1.9-2 Gbps at 1400-byte and about 1.75-1.8 Gbps IMIX — branch-class crypto, well below the 8500-series aggregation platforms.1215
  • That crypto ceiling is license-tier dependent: reaching the platform maximum requires HSECK9 plus a Tier 2 (T2, ~2G) bandwidth license; without HSEC the router is capped at under 250 Mbps one-way and 1000 secure tunnels.1113
  • No native 10G on this SKU — the six built-in ports are all 1G; 10G comes only from the sibling 4T2X variant or from certain SM/NIM modules.36
  • The 2RU footprint and dual-PSU power draw cost more space and power than the equivalent-throughput 1RU C8300-1N1S-6T; the extra slots, not more performance, are what you pay for.7
  • Enabling the full DNA/SASE security stack (NGFW + IPS + URL filtering + AMP) significantly reduces usable SD-WAN throughput below the raw ~2 Gbps figure.15

When to pick it

Choose the 2N2S-6T for a busy large branch or regional hub that needs around 2 Gbps of encrypted SD-WAN plus headroom for on-box UCS-E compute and multiple WAN/cellular modules; step up to the 4T2X variant or the 8500 family if you need native 10G or higher crypto aggregation.

References

  1. Cisco Catalyst 8300 Series Secure Routers datasheet. https://www.cisco.com/site/us/en/products/collateral/networking/sdwan-routers/8000-secure-routers/8300-series-secure-routers-ds.html
  2. C8300-2N2S-6T datasheet (CPU, DRAM, slots, ports, throughput). https://topparagonresource.com/wp-content/uploads/2023/12/C8300-2N2S-6T-Datasheet.pdf
  3. C8300-1N1S-6T datasheet (tunnel scale, forwarding). https://www.router-switch.com/pdf2html/pdf/c8300-1n1s-6t-datasheet.pdf
  4. Reseller specs (CPU, memory, ports, PSU/fan redundancy). https://www.layer23-switch.com/c8300-2n2s-6t.html
  5. Cisco Catalyst 8300/8200 Edge Platforms architecture whitepaper (CEF, crypto, port flexibility, UCS-E/modules). https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/catalyst-8300-8200-series-edge-platforms-architecture-wp.html
  6. Cisco Live BRKARC-2882 (6T vs 1N1S identical throughput; CEF/SD-WAN design numbers). https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2023/pdf/BRKARC-2882.pdf
  7. Cisco Catalyst 8300 Series hardware installation / overview (2RU, deployment role). https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/c8300/hardware_installation/b-catalyst-8300-series-edge-platforms-hig/m-overview.html
  8. Cisco licensing and throughput tier documentation (T0-T3, numeric, HSEC). https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/configure-licenses-throughput-catalyst-8000-platforms.html
  9. Cisco Catalyst 8300 family datasheet PDF (SD-WAN/IPsec figures). https://comptek.ru/materials/cisco/catalyst/datasheet-c78-744088.pdf
  10. Cisco Catalyst 8300/8200 ordering guide (T2 = max for 6T; HSEC interaction). https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/cat-8300-8200-series-edge-plat-og.html
  11. Cisco Catalyst 8300 Series datasheet (SD-WAN/IPsec throughput, security profiles). https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/datasheet-c78-744088.html

↑ Back to matrix

C8500L-8S4X

large-branch / regional-hub

Bridge between branch and aggregation: fixed 1RU with 8x1G + 4x10G for large regional sites, metro PoPs, and mid-scale SD-WAN hubs that don't need full 8500 throughput.

For teams that have outgrown a branch router but don't need a full QFP-based aggregation box, the C8500L-8S4X bridges the gap — trading modularity and raw scale for a fixed, native-10G platform at a lower entry point.

What it is

The C8500L-8S4X is the x86-based, entry-level member of the Catalyst 8500 edge family, slotting into the roughly 20 Gbps aggregation tier.12 It is a 1RU fixed-configuration chassis with 8x1G SFP and 4x1/10G SFP+ ports, positioned as a secure SD-WAN aggregation head-end for large branches, regional hubs, and small-to-medium aggregation sites.123 Unlike the QFP 3.0 ASIC used by the C8500-12X and 12X4QC, the 8500L runs an Intel x86 data plane with crypto offload via Intel QuickAssist, which means the CPU can become the limiting factor under heavy load.24

Figure 1: C8500L-8S4X as an entry-level SD-WAN aggregation hub

flowchart LR
    B1["Branch router 1<br/>(C8200 / C8300)"]
    B2["Branch router 2<br/>(C8200 / C8300)"]
    B3["Branch router N<br/>(C8200 / C8300)"]
    HUB["C8500L-8S4X regional hub<br/>1RU x86 data plane (QuickAssist crypto)<br/>8x1G SFP + 4x1/10G SFP+<br/>dual 400W PSU"]
    UP["10G SFP+ uplinks<br/>(~10-19 Gbps IPsec, Tier 3)"]
    DC["Data center / cloud<br/>(SD-WAN fabric)"]

    B1 -->|"SD-WAN IPsec tunnel"| HUB
    B2 -->|"SD-WAN IPsec tunnel"| HUB
    B3 -->|"SD-WAN IPsec tunnel"| HUB
    HUB --> UP
    UP --> DC

Where it wins

  • Native 10G uplinks on a fixed box: 4x1/10G SFP+ dual-rate ports plus 8x1G SFP, for 12 SFP/SFP+ ports total without external gear.12
  • Forwarding sized for entry-level aggregation: up to ~20 Gbps IPv4 forwarding in controller/SD-WAN mode (and up to ~39 Gbps in autonomous, non-SD-WAN mode).23
  • SD-WAN/IPsec head-end capacity up to ~19 Gbps (1400-byte clear text), with ~8.6–10 Gbps IMIX as the more conservative planning figure — both assume the Tier 3 performance license (see below).23
  • Optional power redundancy via dual 400 W PSUs (AC, DC, or HVDC options), plus field-replaceable fans — appropriate for hub and aggregation-site availability.1
  • Brings the full Catalyst 8500 IOS XE SD-WAN feature set down to a lower-cost, ~20 Gbps slot, with DRAM scalable from 16 GB default to 32 GB or 64 GB.23

Where it doesn't

  • Zero modularity: no NIM or SM service-module bays — only the fixed SFP/SFP+ interface ports, unlike the C8300/C8200 branch routers.25
  • Throughput is license-tier dependent: the headline figures assume Tier 3 (max platform throughput), while Tier 2 caps aggregate throughput at ~2 Gbps.6
  • Crypto is gated by HSEC licensing: HSEC is provided by default but device-enforced; without it, crypto is limited to 1000 tunnels and ~250 Mbps unidirectional.6
  • Far below the C8500-12X in scale: the 12X is a QFP-based ~100+ Gbps box with 12x10G ports, versus the 8500L's ~20 Gbps aggregate and only 4x10G.167
  • x86, not QFP: forwarding and crypto rely on the CPU plus QuickAssist rather than dedicated ASIC offload, so it scales less gracefully under heavy services load.24

When to pick it

Choose the C8500L-8S4X when you are designing a cost-sensitive regional SD-WAN hub or small-to-medium aggregation head-end where 4x10G uplinks and roughly 10–19 Gbps of encrypted throughput are sufficient, and where you do not need NIM/SM modularity or the 100+ Gbps scale of a QFP-based 8500.

References

  1. Cisco Catalyst 8500-L spec/listing — ports, forwarding, PSU. https://www.layer23-switch.com/c8500l-8s4x.html
  2. Cisco C8500L-8S4X datasheet PDF — throughput, DRAM, ports, architecture. https://www.router-switch.com/pdf2html/pdf/cis:c8500l-8s4x-datasheet.pdf
  3. Cisco Catalyst 8500 series edge platforms datasheet. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/datasheet-c78-744089.html
  4. Field discussion of x86 throughput limits. https://www.reddit.com/r/Cisco/comments/1damr8w/cisco_catalyst_8500l8s4x_throughput_problems/
  5. Cisco C8500L-8S4X hardware installation guide — overview/ports. https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/c8500l/b-catalyst-8500L-8S4X-edge-platform-hig/m-overview_85L.pdf
  6. Cisco Catalyst 8500 ordering guide — HSEC and tiered-license throughput. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/guide-c07-744092.html
  7. C8500-12X vs 12X4QC throughput comparison. https://www.networkgenetics.net/blog/choosing-the-right-core-cisco-catalyst-c850012x-vs-c850012x4qc/

↑ Back to matrix

C8500-12X

aggregation / DC-edge

Enterprise WAN-aggregation and SD-WAN headend: fixed 1RU with 12x10G SFP+ for data-center edge and high-scale IPsec termination, succeeding the ASR 1001-HX.

The C8500-12X is for teams building a data-center-edge or colocation SD-WAN headend that needs to terminate many encrypted tunnels at 10G port density; it trades all branch-style modularity for fixed, high-scale aggregation performance.

What it is

The C8500-12X is a 1RU fixed-chassis aggregation router built on Cisco's third-generation QuantumFlow Processor (QFP) ASIC for the data plane, paired with an Intel x86 multicore control-plane CPU.14 It runs IOS XE and IOS XE SD-WAN and is positioned by Cisco as the modern SD-WAN/IPsec successor to ASR 1000-class platforms, including the ASR 1001-HX.135 Cisco targets it at aggregation sites, data-center edge, and colocation environments where large numbers of encrypted SD-WAN tunnels terminate.17

Figure 1: C8500-12X as a data-center-edge SD-WAN headend

flowchart LR
    B1["Branch sites (thousands)<br/>SD-WAN edge routers"] -->|"IPsec overlay tunnels"| H
    B2["Remote / regional offices<br/>SD-WAN edge routers"] -->|"IPsec overlay tunnels"| H

    subgraph H["C8500-12X headend (1RU)"]
        QFP["QFP / QuantumFlow ASIC<br/>(hardware crypto, ~8000 tunnels)"]
        PORTS["12x 1/10GE SFP+ ports"]
        PSU["Dual redundant hot-swap PSU"]
    end

    H -->|"Decrypted, aggregated traffic"| CORE["Data-center core / fabric"]
    CORE --> CLOUD["Cloud & SaaS (IaaS / multicloud)"]
    CORE --> DC["DC services & apps"]

Where it wins

  • Twelve fixed 1/10GE SFP+ ports on the front panel, giving consistent 10G aggregation density without external breakout gear.14
  • High clear-text forwarding ceiling: up to ~118 Gbps IPv4 forwarding at 1400-byte packets.14
  • Substantial large-packet crypto headroom: up to ~51 Gbps SD-WAN IPsec and up to ~84 Gbps classic (non-SD-WAN) IPsec, both at 1400-byte clear-text measurement.4
  • Large encrypted-tunnel scale: up to ~8000 SD-WAN overlay tunnels and up to ~4000 traditional IPsec SVTI tunnels.43
  • Dual redundant hot-swappable power supplies (e.g., 2× 750W AC or 2× 950W DC, model-dependent) plus hot-swappable fans for hardware availability.16

Where it doesn't

  • Zero NIM or SM module bays — every interface is built in, so there is no path to add LTE/5G, T1/E1, or extra Ethernet later.1
  • No native 40G or 100G interfaces; the 12X is SFP+-only, and QSFP uplinks require stepping up to the C8500-12X4QC or C8500-20X6C.145
  • Crypto figures fall sharply with smaller packets: SD-WAN IPsec is ~22.6 Gbps at IMIX versus ~51 Gbps at 1400-byte, so realistic mixed-traffic headend sizing is much lower than the headline number.41
  • In SD-WAN controller mode, throughput can be capped by license tier — Tier 4 enforces 25 Gbps full-duplex / 50 Gbps aggregate and Tier 5 is unthrottled; effective throughput is the lower of QFP capability and the licensed tier.3
  • Fiber-only via SFP+ optics, so it assumes an optical data-center/colocation cabling environment rather than copper branch access.18

When to pick it

Choose the C8500-12X when you are a network team consolidating regional or enterprise SD-WAN tunnels into a 10G-density headend at a data-center edge or colocation facility, and you need redundant power and high IPsec tunnel scale rather than branch modularity or 100G uplinks.

References

  1. Cisco Catalyst 8500 Series Edge Platforms datasheet. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/datasheet-c78-744089.html
  2. Cisco 8500-Series Secure Routers datasheet (positioning). https://www.cisco.com/site/us/en/products/collateral/networking/sdwan-routers/8000-secure-routers/8500-series-secure-routers-ds.html
  3. Cisco Catalyst 8500 Series Q&A — SD-WAN license WAN-traffic tiers. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/q-and-a-c67-744086.html
  4. C8500-12X datasheet (reseller mirror) — ports, QFP, throughput, tunnel scale. https://www.router-switch.com/pdf2html/pdf/c8500-12x-datasheet.pdf
  5. Cisco Live BRKARC-2885 deep-dive — architecture and IMIX SD-WAN IPsec performance. https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKARC-2885.pdf
  6. Cisco Catalyst 8500 series router overview — PSU options and redundancy. https://infinian.net/cisco-catalyst-8500-series-router/
  7. Cisco 8000 secure routers — aggregation/edge platform positioning. https://www.cisco.com/site/us/en/products/collateral/networking/sdwan-routers/8000-secure-routers/8500-series-secure-routers-ds.html
  8. Choosing the right core — C8500-12X vs C8500-12X4QC (QSFP availability). https://www.networkgenetics.net/blog/choosing-the-right-core-cisco-catalyst-c850012x-vs-c850012x4qc/

↑ Back to matrix

C8500-12X4QC

aggregation / DC-edge

Highest-scale hardware aggregation in the family: adds 4x40/100G QSFP to the 12x10G for cloud-edge and fabric-border roles needing 100G uplinks.

For organizations terminating dense SD-WAN aggregation or fabric-border circuits at 40G and 100G, the C8500-12X4QC trades branch flexibility and low cost for the highest QSFP-class port speeds and forwarding scale in the fixed Catalyst 8000 lineup short of the 20X6C flagship.

What it is

The C8500-12X4QC is a 1RU fixed aggregation and SD-WAN headend router built on Cisco's 3rd-generation Quantum Flow Processor (QFP) data plane.17 It positions as the family's highest-scale 100G-capable hardware aggregation node, adding four QSFP-class ports (two 40G QSFP+ and two 40/100G QSFP28) on top of the same twelve 1/10G SFP+ found on the 10G-only C8500-12X.16 It targets cloud-edge, WAN fabric-border, and large enterprise or managed-service-provider edge roles where high-speed handoffs and high IPsec termination scale are the design drivers.1 The control plane runs an x86 multicore Intel CPU with 16 GB DRAM by default (upgradable to 32 GB or 64 GB).9

Figure 1: C8500-12X4QC as a 100G-capable aggregation/fabric border

flowchart LR
    SDWAN["Remote sites and cloud edge<br/>(high-volume encrypted SD-WAN)"] --> ACCESS["12x 10G SFP+ access<br/>(branch/peer aggregation)"]
    SDWAN --> QSFP["4x QSFP ports<br/>(2x 40G + 2x 40/100G, 240G cap)"]
    ACCESS --> QFP["QFP 3rd-gen data plane<br/>(hardware IPsec crypto)"]
    QSFP --> QFP
    QFP --> FWD["Forwarding and overlay<br/>(up to 8000 SD-WAN tunnels)"]
    PSU["Dual redundant PSU<br/>(hot-swappable)"] -.-> QFP
    FWD --> UP1["100G uplink to core (A)"]
    FWD --> UP2["100G uplink to core (B)"]
    UP1 --> CORE["Data center / WAN core fabric"]
    UP2 --> CORE

Where it wins

  • IPv4 forwarding up to roughly 197 Gbps at 1400-byte, with Cisco Live collateral citing about 200 Gbps CEF aggregate on IMIX — the top forwarding figure among the fixed C8500 models below the 20X6C.17
  • SD-WAN IPsec up to roughly 96 Gbps at 1400-byte clear-text, and non-SD-WAN IPsec up to about 135 Gbps at 1400-byte — roughly 30% more SD-WAN crypto headroom than the C8500-12X.111
  • Twelve 1/10G SFP+ plus four QSFP-class ports (2x 40G QSFP+ and 2x 40/100G QSFP28), with up to 240 Gbps of front-panel port bandwidth enabled at once and common mixes such as 2x 100G or 1x 100G + 12x 10G.14
  • Up to 8000 SD-WAN overlay tunnels and bay-configurable optics supporting up to eight documented front-panel mode combinations.311
  • Dual hot-swappable redundant AC power supplies and field-replaceable fans with front-to-back airflow, appropriate for hub-site availability targets.2
  • SD-WAN throughput is governed by bandwidth tiers rather than an ISR/ASR-style "Boost" throughput-unlock license; DNA-A versus DNA-P changes the feature set, not the raw ceiling.415

Where it doesn't

  • Zero NIM or SM modular service slots: the only "modularity" is the bay-configurable optics layout, so LTE/5G, T1/E1, and on-box compute are not options.1
  • Crypto figures fall sharply with smaller packets — SD-WAN IPsec drops to about 31.9 Gbps on IMIX versus the 96 Gbps 1400-byte figure, so the headline number overstates real mixed-traffic performance.111
  • Highest cost and power draw in the family, which is hard to justify outside genuine aggregation roles.6
  • Fiber-only SFP+/QSFP front panel with no built-in copper or branch access ports, making it overkill and a poor physical fit for branch sites.1
  • Bay interdependency adds planning friction: setting Bay 1 to 100G mode forces the Bay 0 ports admin-down, trading 10G density for a 100G port.3

When to pick it

Choose the C8500-12X4QC when you are building a cloud-edge or fabric-border hub that must terminate native 40G or 100G circuits and aggregate large volumes of encrypted SD-WAN traffic — and step up to the C8500-20X6C only if you need beyond ~100 Gbps of SD-WAN IPsec or 200 Gbps of forwarding.6

References

  1. Cisco Catalyst 8500 Series datasheet — https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/datasheet-c78-744089.html
  2. Cisco Catalyst C8500 Hardware Installation Guide (Router Overview) — https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/c8500/hardware-installation-guide/b_C8500_HIG/m_Router_Overview.pdf
  3. Cisco C8500-12X4QC bay configuration (software config guide) — https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/c8500/software-configuration-guide/c8500-software-config-guide/overview-of-c8500/bay-configuration-c8500-12x4qc.html
  4. Cisco Catalyst 8500 Q&A / FAQ — https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/q-and-a-c67-744086.html
  5. Cisco blog — 100G service edge in the Catalyst 8500 family — https://blogs.cisco.com/networking/cisco-introduces-100g-service-edge-to-the-catalyst-8500-family
  6. Cisco Live BRKARC-2885 (aggregate IMIX CEF/IPsec performance) — https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKARC-2885.pdf
  7. Cisco C8500-12X datasheet (CPU/DRAM/storage architecture) — https://www.router-switch.com/pdf2html/pdf/c8500-12x-datasheet.pdf
  8. Reseller listing — C8500-12X4QC port summary, 96/31.9 Gbps figures, 8000 tunnels — https://netmode.com/products/cisco-c8500-12x4qc-catalyst-8500-series-edge-platform-new
  9. Community thread — Catalyst 8500 Network Advantage licensing — https://www.reddit.com/r/Cisco/comments/1d40f4j/catalyst_8500_network_advantage_license/

↑ Back to matrix

Catalyst 8000V Edge Software

virtual / cloud

Software-only WAN edge: the same IOS XE SD-WAN feature set as a VM/cloud instance for multicloud on-ramp, NFV/uCPE, and virtual DC sites where there is no chassis to rack.

The 8000V is for teams who need a Catalyst 8000 WAN edge where there is no chassis to rack: public cloud regions, NFV/uCPE platforms, and virtual data-center sites. It trades fixed, predictable hardware performance and physical interfaces for the elasticity of running as software on whatever host you give it.

What it is

Catalyst 8000V Edge Software is Cisco's software-only virtual and cloud router, and the successor to the CSR1000V and ISRv.2 It runs as a virtual machine on hypervisors (KVM is documented for Equinix Network Edge, with ESXi/Hyper-V positioned via the datasheet and ecosystem) and as a marketplace image in AWS, Azure, and GCP.56 It operates as a virtual SD-WAN WAN Edge managed by vManage/vSmart/vBond, or in IOS XE autonomous mode, and is sized from 1 to 16 vCPUs and 4 to 16 GB RAM per Cisco's VM profiles.8 Throughput is delivered through the Cisco DNA subscription rather than a hardware PID — there is no chassis SKU.9

Figure 1: Catalyst 8000V as a multicloud SD-WAN on-ramp

flowchart LR
    branches["SD-WAN branches & DC sites"] --> fabric["SD-WAN fabric (vManage / vSmart / vBond)"]
    fabric --> c8kv["Catalyst 8000V (software router VM, no physical chassis)"]
    host["Hypervisor (ESXi / KVM) or public cloud (AWS / Azure / GCP)"] --> c8kv
    c8kv --> vnics["Virtual NICs (host / instance supplied)"]
    vnics --> cloud["Cloud on-ramp into VPCs / VNets"]
    c8kv -. "scale out by adding instances (ECMP / service-chain)" .-> c8kv

Where it wins

  • No hardware to procure, rack, or maintain. It deploys as an OVA or cloud image, which makes it the only family member that fits a cloud region or a virtual DC site directly.25
  • Cloud on-ramp and multicloud. Native AWS, Azure, and GCP marketplace deployment lets it terminate SD-WAN fabrics inside the cloud provider's network for direct multicloud connectivity.54
  • NFV / uCPE / ENCS fit. As a VNF it slots into uCPE and ENCS platforms, and capacity is scaled out by running multiple instances (service-chained or ECMP) rather than swapping hardware.6
  • Tier-based throughput from small to large. The DNA throughput tiers span roughly T0 ~50 Mbps, T1 ~400 Mbps, T2 ~2 Gbps, T3 ~20 Gbps, up to T4 ~50 Gbps, so one image covers branch-scale through aggregation-scale licensing.56
  • Full IOS XE SD-WAN feature parity. With the matching DNA tier (Essentials or Advantage), it runs the same SD-WAN feature set — routing, app-aware policy, security, cloud-security integration — as the physical Catalyst 8000 WAN edge routers, subject to performance limits.25

Where it doesn't

  • No physical interfaces of its own. It uses virtual NICs supplied by the host or instance; interface speed and count depend entirely on the underlying platform.6
  • Practical per-instance encrypted throughput is modest. Independent testing measured roughly 5–15 Gbps per instance (about 14 Gbps IPsec and 11 Gbps SD-WAN IQDF+NAT on an AWS c5n.9xlarge); the AWS Marketplace listing advertises about 10 Mbps up to ~5 Gbps IPsec for common deployments.34
  • No single-instance 100 Gbps tier. Cisco publishes no 100 Gbps performance tier; reaching ~100 Gbps requires architecting multiple instances in parallel behind the physical underlay.31
  • HSECK9 gating above 250 Mbps. Any encrypted throughput beyond ~250 Mbps (T2 and above) requires an HSECK9/HSEC license plus a Smart Licensing Authorization Code, and T3 is not supported on DNA Essentials.15
  • Performance and resilience depend on the host. The licensed tier caps you only at or below what the vCPU/RAM/NIC can physically deliver, and there is no hardware PSU/fan redundancy — availability comes from the hypervisor, cloud platform, HA pairs, or scale-out.68

When to pick it

Choose the 8000V when the deployment target is a cloud region, an NFV/uCPE platform, or a virtual DC where no physical box can be installed, and when expected per-instance encrypted throughput sits in the low-tens-of-Gbps range or below — sizing the vCPU/instance and DNA tier together, and scaling out instances for higher aggregate capacity.

References

  1. Cisco — Configure Licenses and Throughput for Catalyst 8000V. https://www.cisco.com/c/en/us/td/docs/routers/C8000V/configure-licenses-throughput-c8000v.html
  2. Cisco — Catalyst 8000V Edge Software Data Sheet. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8000v-edge-software/catalyst-8000v-edge-software-ds.html
  3. Miercom — Cisco Catalyst 8000V Edge Router Performance Report. https://miercom.com/wp-content/uploads/2024/10/Miercom-Report-Cisco-Catalyst-8000v-Edge-Router-Performance-DR210226F-FINAL-2.pdf
  4. AWS Marketplace — Cisco Catalyst 8000V Edge Software. https://aws.amazon.com/marketplace/pp/prodview-rohvq2cjd4ccg
  5. Cisco — Catalyst 8000V Edge Software Ordering Guide. https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8000v-edge-software/nb-06-cat8000v-edge-sw-og-cte-en.html
  6. Equinix — Network Edge Cisco 8000V Specifications. https://docs.equinix.com/network-edge/vendors-devices/cisco/ne-cisco-8000v-specs/
  7. Cisco Live — BRKXAR-2003 (VM profiles: 1–16 vCPU, 4–16 GB RAM). https://www.ciscolive.com/c/dam/r/ciscolive/global-event/docs/2022/pdf/BRKXAR-2003.pdf
  8. Cisco — Configure Licenses and Throughput for Catalyst 8000 Platforms. https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/configure-licenses-throughput-catalyst-8000-platforms.html

↑ Back to matrix