Scope and Platform Selection
The Catalyst 8300 Series targets medium-sized and large enterprise branches requiring modular WAN connectivity, IPsec, integrated security, switching, voice, or local compute. The supplied datasheet identifies four modular chassis. It does not identify separate fixed-platform or compact-platform SKUs; those categories should not be added to the ordering matrix.
The principal selection variables are embedded WAN speed, module capacity, encrypted throughput, security workload, and rack space. A 10G interface does not establish usable throughput with every service enabled.
Chassis SKU Matrix
| Chassis SKU | Size | Embedded Layer 3 interfaces | SM slots | NIM slots | PIM slots |
|---|---|---|---|---|---|
| C8300-2N2S-4T2X | 2RU | 2 x 10G and 4 x 1G | 2 | 2 | 1 |
| C8300-2N2S-6T | 2RU | 6 x 1G | 2 | 2 | 1 |
| C8300-1N1S-4T2X | 1RU | 2 x 10G and 4 x 1G | 1 | 1 | 1 |
| C8300-1N1S-6T | 1RU | 6 x 1G | 1 | 1 | 1 |
All models include:
- 8 GB DRAM, upgradeable to 16 GB or 32 GB.
- 8 GB non-upgradeable onboard flash.
- Default 16 GB M.2 USB storage.
- Dual power supplies and a fan tray.
- Four RJ-45 connections and at least two ports supporting SFP or SFP+ connectivity.
Presales rule: Select 2RU when module density or double-wide switching is required. Select a 4T2X model when embedded 10G connectivity or higher encrypted throughput is necessary. Do not assume that additional interfaces increase the published forwarding capacity.
Throughput and Scale Engineering
The following table uses abbreviated chassis suffixes. All throughput values are Gbps. Large-packet figures marked “up to” in the datasheet remain upper bounds.
| Workload | 2N2S-4T2X | 1N1S-4T2X | 2N2S-6T | 1N1S-6T |
|---|---|---|---|---|
| SD-WAN IPsec, 1400 bytes, up to | 18.8 | 17 | 2 | 2 |
| SD-WAN IPsec with IQDF, 1400 bytes, up to | 18.8 | 17 | 2 | 2 |
| SD-WAN IPsec, IMIX | 7.6 | 6.3 | 1.8 | 1.8 |
| SD-WAN IPsec with IQDF, IMIX | 5.6 | 5.5 | 1.7 | 1.7 |
| 50% IQDF and 50% secured DIA | 5.9 | 3.3 | 2.8 | 2.6 |
| 100% secured DIA | 4.9 | 2.9 | 2.3 | 2.1 |
| Autonomous IPv4 forwarding, 1400 bytes, up to | 19.7 | 19.7 | 19.7 | 19.7 |
| Autonomous IPsec, 1400 bytes, up to | 18.9 | 16.9 | 1.9 | 1.9 |
| Autonomous IPsec, IMIX | 9.3 | 6.6 | 1.9 | 1.9 |
IMIX uses an average packet size of 352 bytes. IQDF combines IPsec, QoS, DPI, and Flexible NetFlow. Secured DIA includes NAT, NGFW, IPS, URL filtering, and Advanced Malware Protection. Security tests used IOS XE 17.12.2; NGFW and UTD tests used the Firewall EMIX profile.
The security narrative refers to three use cases, but the supplied table contains only two. No third benchmark can be reconstructed.
Sizing Rules
- Use IQDF IMIX rather than 1400-byte IPsec results when QoS, application inspection, and flow export are required.
- For security-heavy DIA, size against the secured-DIA row, not autonomous IPv4 forwarding.
- Do not apply autonomous-mode results to SD-WAN designs.
- Do not combine IMIX and Firewall EMIX results as equivalent measurements.
- Validate the intended traffic mix, feature combination, and software release before committing to production capacity.
For example, a 5 Gbps IQDF IMIX requirement is below the published figures for both 4T2X models but above both 6T models. A 4 Gbps secured-DIA requirement is below the 2N2S-4T2X result but above the other three results. These comparisons identify candidates, not guaranteed application performance.
Published Scale
All four models support 6,000 SD-WAN overlay tunnels. Autonomous-mode limits are common across the chassis:
| Resource | Published scale |
|---|---|
| IPsec SVTI tunnels | 4,000 |
| ACLs / IPv4 ACEs | 4,000 / 72K |
| IPv4 routes | 1.6M at 8 GB; up to 4M at 32 GB |
| IPv6 routes | 1.5M at 8 GB; up to 4M at 32 GB |
| NAT sessions | 1.2M at 8 GB; up to 2M at 32 GB |
| Firewall sessions | 512K |
| Queues / VRFs | 8K / 4,000 |
No intermediate scale is supplied for 16 GB. The individual maxima are not a statement that every limit can be reached simultaneously.
Compute Allocation and Service Architecture
Service-oriented allocation is the factory default. It balances forwarding with containerized services and supports KVM and/or Docker applications on up to five cores, depending on platform.
Data-plane-heavy allocation prioritizes throughput. On eight-core platforms, it removes resources for containerized services. On the 12-core C8300-2N2S-4T2X, it reduces service-plane resources from five cores to four.
Engineering rule: Establish application-hosting requirements before selecting core allocation. The datasheet recommends data-plane-heavy allocation when container services are unnecessary, but does not identify the allocation used for every performance result.
UCS-E modules provide a separate branch-compute option. The M6 description specifies a 3 GHz, 10-core processor and two 10G connections internally and externally. Slot occupancy must be checked alongside switching and voice requirements.
Supported Module SKU Matrix
The following matrices retain every module product number in the supplied text. Descriptions identify functions, not unrestricted compatibility across every release or chassis configuration.
Ethernet, Switching, and Compute
| SKU | Function |
|---|---|
| C-NIM-1X | 1-port 10G SFP/SFP+ NIM; WAN MACsec |
| C-NIM-1M | 1-port 1/2.5G RJ-45 WAN NIM; 90W PoE, 802.3af/at/bt |
| C-NIM-2T | 2-port 100M/1G dual-mode RJ-45/SFP NIM; WAN MACsec |
| C-NIM-4X | 4-port 1/10G SFP/SFP+ switch NIM; optional Layer 3; LAN/WAN MACsec |
| C-NIM-8T | 8-port 100M/1G switch NIM; optional Layer 3; LAN/WAN MACsec |
| C-NIM-8M | 8-port 100M/1/2.5G switch NIM; UPoE; optional Layer 3; LAN/WAN MACsec |
| NIM-ES2-4 | 4-port Gigabit Ethernet switch NIM |
| NIM-ES2-8 | 8-port Gigabit Ethernet switch NIM |
| NIM-ES2-8-P | 8-port Gigabit Ethernet switch NIM with PoE |
| C-SM-16P4M2X | 22-port UADP-based Layer 2 switch module |
| C-SM-40P8M2X | 50-port UADP-based Layer 2 switch module |
| UCS-E160S-M3/K9 | Single-wide; Broadwell 6-core; up to 64 GB RAM; 1-2 HDD |
| UCS-E180D-M3/K9 | Double-wide; Broadwell 8-core; up to 128 GB RAM; 1-4 HDD |
| UCS-E1120D-M3/K9 | Double-wide; Broadwell 12-core; up to 128 GB RAM; 1-4 HDD |
| UCS-E1100D-M6/K9 | Double-wide; Icelake 10-core; up to 128 GB RAM; 1-4 SSD |
| C-SM-NIM-ADPT | Single-wide SM-X carrier for two NIMs |
The 22-port switch is single-wide and supported on 1RU and 2RU platforms. The 50-port switch is double-wide and supported on 2RU platforms. LANWAN modules support LAN MACsec in Layer 2 mode and WAN MACsec in Layer 3 mode.
Voice and DSP
| SKU | Function |
|---|---|
| NIM-2FXO | 2-port FXO |
| NIM-4FXO | 4-port FXO |
| NIM-2FXSP | 2-port FXS |
| NIM-4FXSP | 4-port FXS |
| NIM-2FXSP/4FXOP | 2 FXS and 4 FXO ports |
| NIM-4E/M | 4-port E/M |
| NIM-2BRI-NT/TE | 2-port BRI, NT/TE |
| NIM-4BRI-NT/TE | 4-port BRI, NT/TE |
| SM-X-8FXS/12FXO | Single-wide; 8 FXS and 12 FXO ports |
| SM-X-16FXS/2FXO | Single-wide; 16 FXS and 2 FXO ports |
| SM-X-24FXS/4FXO | Single-wide; 24 FXS and 4 FXO ports |
| SM-X-72FXS | Double-wide; 72 FXS ports |
| NIM-PVDM-32 | 32-channel DSP NIM |
| NIM-PVDM-64 | 64-channel DSP NIM |
| NIM-PVDM-128 | 128-channel DSP NIM |
| NIM-PVDM-256 | 256-channel DSP NIM |
| SM-X-PVDM-3000 | 3,080-channel DSP module |
| SM-X-PVDM-2000 | 2,048-channel DSP module |
| SM-X-PVDM-1000 | 1,024-channel DSP module |
| SM-X-PVDM-500 | 768-channel DSP module |
| NIM-1MFT-T1/E1 | 1-port voice/clear-channel T1/E1 |
| NIM-2MFT-T1/E1 | 2-port voice/clear-channel T1/E1 |
| NIM-4MFT-T1/E1 | 4-port voice/clear-channel T1/E1 |
| NIM-8MFT-T1/E1 | 8-port voice/clear-channel T1/E1 |
Broadband, Legacy WAN, and Cellular
| SKU | Function |
|---|---|
| NIM-VAB-A | VDSL2/ADSL/2/2+, Annex A |
| NIM-VA-B | VDSL2/ADSL/2/2+, Annex B |
| NIM-VAB-M | VDSL2/ADSL/2/2+, Annex M |
| NIM-4SHDSL-EA | Multimode G.SHDSL |
| NIM-2BRI-S/T | 2-port ISDN BRI data WAN |
| NIM-4BRI-S/T | 4-port ISDN BRI data WAN |
| NIM-1CE1T1-PRI | 1-port voice/channelized T1/E1 |
| NIM-2CE1T1-PRI | 2-port voice/channelized T1/E1 |
| NIM-8CE1T1-PRI | 8-port voice/channelized T1/E1 |
| SM-X-1T3/E3 | 1-port clear-channel T3/E3 |
| NIM-1T | 1-port high-speed serial |
| NIM-2T | 2-port high-speed serial |
| NIM-4T | 4-port high-speed serial |
| NIM-16A | 16-port asynchronous |
| NIM-24A | 24-port asynchronous |
| P-5GS6-R16SA-GL | Global 5G SA Sub-6 GHz pluggable |
| P-5GS6-GL | Global 5G Sub-6 GHz pluggable |
| P-LTEAP18-GL | Global CAT18 LTE Advanced Pro |
| P-LTEA7-NA | CAT7 LTE; North America |
| P-LTEA7-EAL | CAT7 LTE; EMEA, APAC, LATAM |
| P-LTEA7-JP | CAT7 LTE; Japan |
| P-LTEA-EA | CAT6 LTE pluggable; North America, EMEA |
| P-LTEA-LA | CAT6 LTE pluggable; APAC, ANZ, LATAM |
| NIM-LTEA-EA | CAT6 LTE NIM; North America, EMEA |
| NIM-LTEA-LA | CAT6 LTE NIM; APAC, ANZ, LATAM |
C-NIM-8M, P-5GS6-R16SA-GL, and the three P-LTEA7 variants carry the IOS XE 17.12.2 support footnote. Integrated cellular and external gateways can operate together for active-active redundancy. Coverage and installation location remain selection inputs; no cellular throughput benchmark is supplied.
Memory, Storage, and Accessory SKUs
| SKU | Description |
|---|---|
| MEM-C8300-8GB | 8 GB memory |
| MEM-C8300-16GB | 16 GB memory |
| MEM-C8300-32GB | 32 GB memory |
| M2USB-16G | 16 GB M.2 USB SSD |
| M2USB-32G | 32 GB M.2 USB SSD |
| SSD-M2SED-600G | 600 GB M.2 NVMe self-encrypted drive |
| SSD-M2NVME-2T | 2 TB M.2 NVMe self-encrypted drive |
| C8300-RM-19-1R | 1RU, 19-inch rack kit |
| C8300-RM-23-1R | 1RU, 23-inch rack kit |
| C8300-RM-19-2R | 2RU, 19-inch rack kit |
| C8300-RM-23-2R | 2RU, 23-inch rack kit |
| C8300-RM-4PT-1R | 1RU, 19-inch four-post rack kit |
| C8300-RM-4PT-2R | 2RU, 19-inch four-post rack kit |
| C8300-FAN-1R | 1RU fan tray |
| C8300-FAN-2R | 2RU fan tray |
| C8300-FAN-2R-R | 2RU reverse-airflow NEBS fan tray |
| C-RFID-1R | 1RU RFID |
| C-RFID-2R | 2RU RFID |
| C8300-SM-BLANK | SM blank |
| C8300-NIM-BLANK | NIM blank |
| C8300-PIM-BLANK | PIM blank |
RFID stores the serial number and product ID and can be removed or deselected when ordering. No individual optical-transceiver SKUs are supplied.
Power, PoE, and Redundancy
| PSU SKU | Chassis | Listed maximum | Input | Explicit PoE budget |
|---|---|---|---|---|
| PWR-CC1-250WAC | 1RU | 250W | 100-240 VAC, 50-60 Hz | Not stated |
| PWR-CC1-400WAC | 1RU | 250W in source table | 100-240 VAC, 50-60 Hz | Not stated |
| PWR-CC1-500WAC | 1RU | 500W | 100-240 VAC, 50-60 Hz | 250W |
| PWR-CC1-400WDC | 1RU | 400W | -40 to -72 VDC | Not stated |
| PWR-CC1-400WHV | 1RU | 400W | 240-380 VDC | Not stated |
| PWR-CC1-650WAC | 2RU | 650W | 100-240 VAC, 50-60 Hz | Not stated |
| PWR-CC1-1000WAC | 2RU | 1000W | 100-240 VAC, 50-60 Hz | 500W |
| PWR-CC1-650WDC | 2RU | 650W | -40 to -72 VDC | Not stated |
| PWR-CC1-650WDCR | 2RU | 650W | -40 to -72 VDC; reverse airflow | Not stated |
PWR-CC1-400WAC was a temporary substitute for PWR-CC1-250WAC. It is no longer shipped with 1RU platforms but retains equivalent support. Its product name and listed maximum differ; that discrepancy should not be silently corrected.
PoE activation on NIM or SM ports requires at least one PoE-capable PSU. The datasheet does not establish additive dual-PSU PoE budgets or the available PoE budget after a supply failure.
Typical consumption, measured without modules and with one PSU, is 275W for 2N2S-4T2X, 245W for 1N1S-4T2X, 89W for 2N2S-6T, and 82W for 1N1S-6T. These are not fully populated power-sizing figures.
For NEBS, the explicit configuration is a 2RU chassis with PWR-CC1-650WDCR, which automatically includes C8300-FAN-2R-R. Although an introductory statement broadly mentions reversed-airflow options on all models, the detailed NEBS configuration only establishes 2RU support.
Environmental and Physical Specifications
| Specification | 2RU models | 1RU models |
|---|---|---|
| Dimensions, H x W x D | 3.5 x 17.25 x 18.52 inches | 1.73 x 17.50 x 16.25 inches |
| Weight, two AC PSUs and fan tray | 40 lb | 20 lb |
| MTBF | 710,300 hours | 536,060 hours |
| Sound pressure, typical/maximum | 59/73 dBa non-NEBS; 63/75 dBa NEBS | 49/71 dBa |
| Sound power, typical/maximum | 74/87 dBa non-NEBS; 77/89 dBa NEBS | 60/82 dBa |
The acoustic units above preserve the datasheet labeling.
Common installation limits are:
- Operating temperature: 0 to 40 C, or 32 to 104 F.
- Storage temperature: -40 to 70 C, listed as -40 to 150 F.
- Operating noncondensing humidity: 5% to 85%.
- Nonoperating/storage noncondensing humidity: 5% to 95%.
- Altitude: 0 to 10,000 feet, or 0 to 3,050 meters.
Site rule: Assess maximum noise, not only typical noise, for occupied-room installations. MTBF is a reliability metric, not a warranty duration or repair commitment.
The mechanical table lists 85-264 VAC and a DC range written as “-40 to 72V; 48V nominal,” while PSU tables provide different, SKU-specific ranges. Electrical design should resolve this source discrepancy against the selected supply documentation.
Listed compliance includes 60950-1 safety standards, laser safety, Class A emissions, IEC/EN immunity tests, and EN300 386 telecommunications EMC.
Software, Management, and Licensing
The minimum chassis software release is IOS XE 17.3.2. Module and feature support can require later software.
A common software image supports autonomous IOS XE and controller-based SD-WAN operation. Autonomous capabilities include IPv4/IPv6 routing, BGP, OSPF, EIGRP, IS-IS, MPLS, VPNs, NAT, QoS, and voice services. SD-WAN capabilities include OMP, application-aware routing, segmentation, per-tunnel QoS, FEC, Cloud onRamp for SaaS, and integrated security.
Voice support includes CUBE, SRST, CUCME, and voice modules. ThousandEyes integration provides underlay, overlay, and SaaS visibility. Hardware-anchored Secure Boot and SUDI support platform identity verification.
SD-Routing enables traditional routing management through Catalyst SD-WAN Manager. The text identifies on-premises controllers and describes cloud-delivered controllers as future availability, not established availability.
Listed subscriptions are Catalyst Routing Essentials, Cisco DNA Essentials, and Cisco DNA Advantage. The datasheet also identifies Enterprise Agreement and MSLA purchasing arrangements. It does not provide subscription SKUs, feature-tier mappings, or bandwidth entitlements. Smart Licensing requires a Smart Account in Cisco License Central.
Warranty and Service Entitlements
The supplied datasheet does not state a hardware warranty duration, replacement turnaround, return procedure, or warranty exclusions. These must remain uncommitted until separately verified.
Solution Support is the default support offer for both platform and software, but is optional. Complete Solution Support entitlement requires ordering it for both the Catalyst 8000 platform and Cisco DNA software.
Solution Support includes centralized multiproduct case ownership, interoperability assistance, coordination with support teams, and a 30-minute response objective for Severity 1 and 2 cases. This is a response objective, not a resolution guarantee.
Subscription Embedded Software Support includes 24×7 TAC access, online tools, and web case submission without additional products or fees. It does not cover hardware. The datasheet recommends Smart Net Total Care when separate platform support accompanies embedded software support.
Procurement rule: Separate software-subscription support from platform support. DNA software maintenance and updates belong to the software entitlement; platform OS, network-stack support, and OS updates belong to the platform support contract. Confirm both before approving the bill of materials.