Chapter 2: Hardware Architecture and Models

Catalyst 8200 Hardware

8200 and 8200L models

The Catalyst 8200 series is the entry point into the Catalyst 8000 Edge family, engineered for small and medium branch offices where the WAN is typically sub-gigabit and most heavy security processing is offloaded to the cloud. There are two members of the family: the C8200-1N-4T (the full-power model) and the C8200L-1N-4T, almost always referred to simply as the 8200L (the cost-optimized model).

The headline difference between the two is the processor and the memory it feeds. The C8200-1N-4T ships with an 8-core Intel x86 CPU, while the 8200L is built on a 4-core Intel x86 CPU. Those cores are general-purpose: on the 8200 there is no separate forwarding ASIC, so the same x86 silicon handles packet processing, encryption, and any on-box services or containers. Halving the core count, as the 8200L does, directly halves the budget available for all of that work.

Memory follows the same pattern. The C8200-1N-4T ships with 8 GB of DRAM, upgradeable to 16 GB or 32 GB. The 8200L ships with just 4 GB of DRAM, but can also be upgraded up to 32 GB. Both models carry 8 GB of onboard soldered flash. The 8200 includes a 16 GB M.2 module by default and scales up to 600 GB M.2 NVMe (configurations up to 2 TB are noted), whereas the 8200L ships with no default M.2 but accepts the same optional storage modules. That extra storage matters when running application-hosting containers locally.

The practical takeaway is that the 8200L is not a different architecture; it is the same router with a smaller engine and an empty trunk. You choose it when the branch is small, the WAN is slow, and security lives in the cloud rather than on the box.

Form factor and interfaces

Both 8200 models occupy a compact 1RU (one rack unit) form factor. The fixed interface set is identical on both: four 1-Gigabit Ethernet ports, delivered as two SFP ports plus two RJ-45 copper ports running 10/100/1000. The "4T" in C8200-1N-4T refers to these four fixed ports.

Beyond the fixed ports, expansion comes from two module bays:

• One NIM slot. A NIM (Network Interface Module) is a hot-pluggable card that adds WAN or LAN connectivity the chassis does not have natively, such as a T1/E1 circuit, a serial link, or additional Ethernet ports. Think of it as an expansion card slot on a PC motherboard.
• One PIM slot. A PIM (Pluggable Interface Module) on the 8200 is typically a 4G/5G/LTE cellular modem, letting a small branch use a wireless carrier link as backup or even primary transport.

This "4 fixed + 1 NIM + 1 PIM" layout is the signature of the 8200 family and a quick way to recognize it on a data sheet.

Figure 2.2: Catalyst 8200 chassis interface layout

Performance and scale targets

Because the 8200 forwards and encrypts packets entirely on its general-purpose CPU, its throughput tracks core count. The C8200-1N-4T delivers up to roughly 1 Gbps of IPsec SD-WAN throughput, while the 8200L, with half the cores, delivers up to roughly 500 Mbps. For context, the related uCPE variant (C8200-UCPE-1N8) is rated for up to 1.85 Gbps routed but about 500 Mbps SD-WAN IPsec, illustrating how much encryption subtracts from raw routing capacity.

A worked example: a retail chain with 300 stores, each on a 300 Mbps broadband circuit with LTE backup, mandated to send all internet traffic to a cloud security service (SASE). The branch router only builds SD-WAN tunnels and steers traffic; it runs no heavy on-box firewall. The 8200L fits: its ~500 Mbps ceiling exceeds the 300 Mbps circuit, the PIM slot takes the LTE module, and the extra cores/storage of the full 8200 are unnecessary. If those stores instead needed an on-box security container and 700–900 Mbps of encrypted traffic, the 8-core C8200-1N-4T would be correct.

Key Takeaway: The 8200 family is a compact 1RU branch router with four fixed 1 GbE ports, one NIM slot, and one PIM slot for cellular. The 8200L is a cost-optimized version with half the cores (4 vs 8) and about half the encrypted throughput (~500 Mbps vs ~1 Gbps), best suited to small, cloud-secured branches.

Catalyst 8300 Hardware

8300 1N1S and 2N2S variants

The Catalyst 8300 series steps up to larger, high-performance branches and campus edges, keeping the same IOS XE experience while adding more cores, 10 GbE uplinks, and richer modularity. The two branch chassis you encounter most are the C8300-1N1S-4T2X (the 8300-1N1S) and the C8300-2N2S-4T2X (the 8300-2N2S). The naming directly encodes modular capacity: "N" stands for NIM slots and "S" stands for SM-X service-module slots. So the 1N1S has 1 NIM + 1 SM-X, and the 2N2S has 2 NIM + 2 SM-X.

The "4T2X" suffix describes the fixed ports, identical on both: four 1-Gigabit Ethernet copper ports (4T) plus two 10-Gigabit Ethernet SFP+ ports (2X). Those two 10G ports are the defining hardware upgrade over the 8200. The variants differ in compute: the 1N1S carries an 8-core x86 CPU; the 2N2S steps up to a 12-core x86 CPU.

NIM and SM-X module support

The 8300 accepts both new Catalyst 8000-class NIMs and most legacy ISR 4000 NIMs, protecting module investments for ISR migrations. The new C-NIM family adds MACsec (line-rate Layer 2 encryption) across the board:

Cisco states the 8300 supports "all the NIM modules supported on the 4000 ISR models" with a few exceptions such as the NIM-1GE-CU-SFP. That legacy list includes serial/async modules (NIM-1T/2T/4T, NIM-16A/24A), ISDN BRI, T1/E1 multiflex trunks, voice and PVDM modules, and the NIM-ES2 Ethernet switch modules.

The SM-X slots accept service modules in the larger SM-X form factor. An SM-X module can host compute, switching, or specialized functions. Options include the SM-X-64A high-density async module, Cisco UCS-E M3 server blades (UCS-E160S-M3, UCS-E1120D-M3, UCS-E180D-M3) that put a small x86 server inside the router for branch compute, and the C-SM-NIM-ADPT carrier card, an SM-X-format adapter that holds up to two NIMs in a single SM-X slot. Importantly, the 8300 does not use ASR 1000 SPA modules and has no SPA slots.

Onboard crypto and CPU offload

The 8300 still uses general-purpose x86 cores rather than a dedicated forwarding ASIC, but it allocates those cores intelligently and uses hardware crypto acceleration to keep encryption from monopolizing the CPU. Cisco's published allocation for the 12-core 2N2S model is illustrative: 1 core for the control plane, 2 cores for I/O, 4 cores for packet processing, and 5 cores for services (SD-WAN security and third-party apps).

Figure 2.3: 8300-2N2S 12-core CPU allocation

This split is the key to understanding why the 8300 can run a rich feature set at multi-gigabit speed. By reserving a dedicated pool of cores for services and another for forwarding, the platform avoids the contention that limits the 8200, where every function shares the same small pool. The result is multi-gigabit SD-WAN/IPsec throughput while still hosting security and application workloads on-box.

Key Takeaway: The 8300 is a modular branch and campus-edge router whose name encodes its slots: 1N1S means 1 NIM + 1 SM-X, and 2N2S means 2 NIM + 2 SM-X. It adds two 10 GbE SFP+ uplinks, 8 to 12 x86 cores, a broad NIM/SM-X ecosystem (including legacy ISR 4000 modules), and a deliberate core-allocation scheme that delivers multi-gigabit encrypted throughput while still running on-box services.

Catalyst 8500 Hardware

8500 and 8500L aggregation models

The Catalyst 8500 and 8500L are a different class of device. Despite sharing Catalyst 8000 branding and IOS XE software, they are aggregation and headend platforms, designed to terminate the SD-WAN tunnels coming from hundreds or thousands of branch routers. Where the 8200 and 8300 are the cars in the parking lot, the 8500 is the toll plaza they converge on.

There are two tiers. The Catalyst 8500 (non-L) is the high-performance, modular tier for very high throughput and scale. The Catalyst 8500L is the compact, fixed, lower-cost tier for entry-level 1G/10G aggregation — "a lower-end version of the 8500," not a branch device. A representative 8500L, the 8500L-8S4X, is a fixed chassis with 8 × 1G SFP + 4 × 10G SFP+ ports and no modular slots. Higher-end models like the 8500-20X6C add far more density, including 10/25G and 40/100G interfaces for DC and colocation WAN edges.

QuantumFlow and x86 architectures

The single most important hardware distinction in the 8500 family is the data plane. The Catalyst 8500 uses Cisco's third-generation QuantumFlow Processor (QFP 3.0), a custom ASIC dedicated to the data plane. The QFP offloads packet forwarding, QoS, NAT, and VPN/crypto from the general-purpose CPU, leaving the route processor free to focus on control-plane work. This is the same architectural lineage as the venerable ASR 1000.

The Catalyst 8500L, by contrast, uses an x86-based architecture with hardware crypto accelerators rather than a discrete QFP. Its goal is the same software experience with a general-purpose CPU driving the data plane, trading peak performance for lower cost.

Figure 2.4: 8500 (QFP ASIC) vs 8500L (x86) data-plane architecture

The dedicated ASIC versus shared x86 distinction is analogous to a graphics card versus integrated graphics. A discrete GPU (the QFP) does its specialized job at high speed without taxing the main CPU, while integrated graphics (the 8500L's x86 crypto) shares the main processor and competes for its cycles. The operational consequence: on an 8500, crypto runs on dedicated silicon, so control-plane CPU stays relatively idle even at high tunnel counts. On an 8500L, crypto competes for x86 cycles even with hardware assist, so you reach throughput and scaling limits earlier as you add tunnels, QoS, NAT, and firewall features. For the same licensed bandwidth tier, the 8500 sustains higher encrypted throughput and more tunnels at lower CPU than an 8500L.

This drives monitoring practice: on an 8500L you watch route-processor CPU closely, because it reflects both forwarding and control-plane health. On an 8500 the primary saturation indicator is QFP utilization, not route-processor CPU, because the ASIC is where the forwarding work happens.

High-throughput WAN aggregation

The 8500 family is positioned squarely for WAN aggregation, and the two tiers map cleanly onto two deployment scales. The 8500 targets high-performance SD-WAN aggregation for enterprise data centers, colocation facilities, and large campuses, with aggregate throughput in the hundreds-of-Gbps class and thousands of SD-WAN tunnels. The 8500L is positioned as an entry-level 1G/10G aggregation router for regional hubs and large-branch aggregation, with throughput in the tens of Gbps.

• Global data-center hub. 4 × 100G uplinks to MPLS, DIA, and cloud on-ramps, 10+ 10/25G secondary links, thousands of IPsec tunnels with multi-tenant segmentation and a full feature set. The QFP 3.0 of the Catalyst 8500 handles the throughput and feature-rich forwarding without overloading the RP; high-density models like the 8500-20X6C supply the 10/25/40/100G ports. The 8500L would be undersized.
• Regional aggregation hub. A mix of 1G/10G circuits from 100–200 sites, hundreds (not thousands) of tunnels, and tight budget/power constraints. The 8500L-8S4X fits: its 8 × 1G + 4 × 10G fixed ports and x86-with-hardware-crypto design provide adequate performance at lower cost and footprint.

Key Takeaway: The 8500 and 8500L are aggregation platforms, not branch routers. The 8500 uses a dedicated QuantumFlow Processor (QFP 3.0) ASIC that offloads forwarding and crypto for hundreds-of-Gbps, thousands-of-tunnel headends; the 8500L uses a cost-optimized x86 data plane with hardware crypto for entry-level 1G/10G regional aggregation in the tens of Gbps. For equal licensed bandwidth, the QFP-based 8500 always sustains more encrypted throughput at lower CPU than the 8500L.

Master comparison