The Cisco Catalyst 8200 Series Edge Platforms are compact 1RU branch routers for SD-WAN, SD-Routing, secure Internet access, cloud connectivity, multilayer security, voice, cellular WAN, and traditional IOS XE routing deployments.
The family contains two fixed-base models:
- C8200-1N-4T: Higher-throughput platform with an 8-core CPU, 8 GB default DRAM, embedded container support, higher tunnel scale, and integrated security features including NGFW, IPS/IDS, URL filtering, and advanced malware protection.
- C8200L-1N-4T: Lower-throughput platform with a 4-core CPU and 4 GB default DRAM. It supports SD-WAN, SD-Routing, ZBFW, SIG, and standard routing functions, but does not support embedded containerized security features.
Both models provide four integrated 1 Gigabit Ethernet WAN ports, consisting of two SFP ports and two RJ45 ports. Each platform includes one NIM slot and one PIM slot for Ethernet, LAN, WAN, voice, broadband, serial, asynchronous, ISDN, and wireless WAN expansion.
Product positioning and selection
The principal selection decision is whether the branch requires embedded container-based services and higher security or routing scale.
| Selection factor | C8200-1N-4T | C8200L-1N-4T |
|---|---|---|
| CPU | 8 cores | 4 cores |
| Default DRAM | 8 GB | 4 GB |
| DRAM upgrade options | 16 GB, 32 GB | 8 GB, 16 GB, 32 GB |
| Default M.2 storage | 16 GB | None |
| Maximum listed M.2 storage | 600 GB NVMe | 600 GB NVMe |
| SD-WAN IPsec throughput, 1400-byte traffic | Up to 1 Gbps | Up to 500 Mbps |
| SD-WAN IPsec throughput with IQDF, 1400-byte traffic | Up to 1 Gbps | Up to 460 Mbps |
| SD-WAN IPsec throughput, IMIX | 900 Mbps | 400 Mbps |
| SD-WAN IPsec throughput with IQDF, IMIX | 850 Mbps | 300 Mbps |
| SD-WAN overlay tunnels | 2,500 | 1,500 |
| IPv4 forwarding, 1400-byte traffic | Up to 3.8 Gbps | Up to 3.8 Gbps |
| Embedded containerized security features | Supported | Not supported |
| ThousandEyes baseline | Requires 8 GB DRAM and 8 GB bootflash/storage | Requires upgrade to at least 8 GB DRAM and 8 GB bootflash/storage |
| Best for | Branches requiring higher SD-WAN scale, integrated security, containers, or higher route and NAT capacity | Small branches requiring SD-WAN or routing with lower IPsec demand and no containerized security |
The C8200-1N-4T is the appropriate baseline where the design includes Snort IPS/IDS, URL filtering, Secure Malware Defense, Secure Malware Analytics, or KVM and Docker workloads. The C8200L-1N-4T is suited to branch routing and SD-WAN designs where these embedded containerized services are not required.
Interfaces, slots, and modularity
Each base platform provides four integrated 1 Gigabit Ethernet WAN interfaces. Two ports use SFP connectivity and two use RJ45 connectivity, allowing a combination of copper and fiber handoffs.
The chassis contains:
- One NIM slot.
- One PIM slot.
- Four integrated 1 Gigabit Ethernet WAN ports.
- Fixed internal AC power supply.
- Optional external PoE power supply for supported PoE modules.
- Onboard 8 GB flash that cannot be upgraded.
- Optional M.2 storage for additional flash capacity.
NIM modules can add Layer 2 switching, Layer 3 WAN connectivity, LAN/WAN convergence, PoE, voice, legacy WAN, broadband, serial, asynchronous, ISDN, and cellular capabilities. PIM support is used for pluggable wireless WAN modules.
For branch designs using PoE NIM modules, the external PWR-CC1-150WAC supply is required. The base internal power supply does not provide the stated PoE budget for NIM-installed PoE ports.
Performance and sizing rules
Performance values depend on packet size, enabled services, and traffic composition. The figures below should be treated as platform sizing reference points rather than as a single universal throughput number.
SD-WAN performance
| Metric | C8200-1N-4T | C8200L-1N-4T |
|---|---|---|
| IPsec, 1400-byte traffic | Up to 1 Gbps | Up to 500 Mbps |
| IPsec with IQDF, 1400-byte traffic | Up to 1 Gbps | Up to 460 Mbps |
| IPsec, IMIX | 900 Mbps | 400 Mbps |
| IPsec with IQDF, IMIX | 850 Mbps | 300 Mbps |
| Overlay tunnel scale | 2,500 | 1,500 |
IQDF combines IPsec, QoS, Deep Packet Inspection, and Flexible NetFlow. IMIX uses an average packet size of 352 bytes.
Embedded security performance
The documented multilayer security tests apply only to the C8200-1N-4T. The C8200L-1N-4T does not support the embedded containerized security features used for these tests.
| Security workload | C8200-1N-4T |
|---|---|
| 50 percent IQDF plus 50 percent DIA with NAT, NGFW, IPS, URL filtering, and AMP | 950 Mbps |
| DIA with NAT, NGFW, IPS, URL filtering, and AMP | 980 Mbps |
Autonomous routing performance
| Metric | C8200-1N-4T | C8200L-1N-4T |
|---|---|---|
| IPv4 forwarding, 1400-byte traffic | Up to 3.8 Gbps | Up to 3.8 Gbps |
| IPsec, 1400-byte traffic | Up to 1 Gbps | Up to 500 Mbps |
| IPsec, IMIX | 900 Mbps | 400 Mbps |
| IPsec SVTI tunnels | 2,500 | 1,500 |
| ACLs per system | 4,000 | 4,000 |
| IPv4 ACEs per system | 72,000 | 72,000 |
| Queues | 8,000 | 8,000 |
| Firewall sessions | 512,000 | 512,000 |
| VRFs | 4,000 | 4,000 |
Route and NAT capacity depends on DRAM.
| Resource | C8200-1N-4T | C8200L-1N-4T |
|---|---|---|
| IPv4 routes | 1.6 million with 8 GB; up to 4 million with 32 GB | 800,000 with 4 GB; up to 4 million with 32 GB |
| IPv6 routes | 1.5 million with 8 GB; up to 4 million with 32 GB | 800,000 with 4 GB; up to 4 million with 32 GB |
| NAT sessions | 1.2 million with 8 GB; up to 2 million with 32 GB | 600,000 with 4 GB; up to 2 million with 32 GB |
Presales sizing rules
- Size IPsec using the IQDF IMIX value when QoS, DPI, and Flexible NetFlow will operate simultaneously.
- Do not use the 3.8 Gbps IPv4 forwarding value as an IPsec or full-security throughput estimate.
- Select the C8200-1N-4T when embedded security services, containerized workloads, or higher overlay tunnel scale are required.
- Select additional DRAM when route scale or NAT session scale exceeds the default-memory figures.
- Treat the C8200L-1N-4T 500 Mbps IPsec value as the upper 1400-byte reference and use the lower IMIX and IQDF figures for conservative branch sizing.
- Confirm the number of WAN circuits and LAN devices against the single NIM slot and four integrated WAN ports.
- Reserve power capacity for NIM PoE modules and include the external PoE supply in the bill of materials.
Dynamic core allocation
The platforms support two core allocation modes.
Service plane heavy mode balances forwarding capacity with resources for service applications. It is the factory default. On the C8200-1N-4T, KVM and Docker applications can use up to three cores in this mode. On the C8200L-1N-4T, one core is earmarked for the ThousandEyes agent, but KVM and Docker container applications are not supported.
Data plane heavy mode repurposes multicore resources for traffic forwarding. On the 8-core platform, this mode completely removes resources allocated to containerized services. It is therefore appropriate when forwarding performance has priority and container-based services are not required.
This setting should be selected during design rather than changed after deployment without reviewing the impact on services and forwarding capacity.
Security, management, and software functions
The platforms support Cisco IOS XE software in autonomous routing deployments and Cisco IOS XE SD-WAN software in controller-managed deployments. Functions include:
- IPv4 and IPv6 routing.
- Static routing, RIP, OSPF, EIGRP, BGP, IS-IS, and MPLS.
- IPsec, GRE, Layer 2 and Layer 3 VPN, L2TPv3, and BFD.
- NAT, NAT64, NAT pools, overload/PAT, and Direct Internet Access.
- QoS, CBWFQ, WRED, hierarchical QoS, PBR, NBAR, FEC, and per-tunnel QoS.
- ACLs, zone-based firewall, application visibility, and Flexible NetFlow.
- DHCP, DNS, HSRP, VRRP, RADIUS, AAA, SSH, SCP, SNMP, syslog, NETCONF over SSH, and NTP.
- Multicast, PIM, IGMPv3, multicast AAR, and IPv4-to-IPv6 multicast.
- CUBE, CUCME, SRST, SIP, SRTP, ISDN, and voice modules.
The C8200-1N-4T adds integrated end-to-end segmentation, Snort IPS/IDS, URL filtering, Secure Malware Defense, Secure Malware Analytics, and application-level gateway functions for the zone-based firewall. The C8200L-1N-4T includes segmentation, ZBFW, PKI, Cisco DNA Layer Security, and SIG, but not the embedded containerized security functions.
Management options include Catalyst SD-WAN Manager, Cisco DNA Center, and Cisco Security Cloud Control. Security Cloud Control can provide common policy objects, centralized visibility, and policy management across router-integrated and standalone Cisco NGFW deployments.
Memory, storage, and cellular options
Both platforms include fixed 8 GB onboard flash. The C8200-1N-4T includes 16 GB M.2 storage as standard. The C8200L-1N-4T has no default M.2 storage.
Available memory and storage options are listed below.
| Product number | Description | Best For |
|---|---|---|
| MEM-C8200-8GB | 8 GB DRAM | C8200L upgrade for ThousandEyes or higher scale |
| MEM-C8200-16GB | 16 GB DRAM | Higher route, NAT, or service scale |
| MEM-C8200-32GB | 32 GB DRAM | Maximum listed route and NAT scale |
| M2USB-16G | 16 GB M.2 USB SSD | Added platform storage |
| M2USB-32G | 32 GB M.2 USB SSD | Larger software and telemetry storage |
| SSD-M2SED-600G | 600 GB M.2 NVMe self-encrypted drive | High storage capacity with SED |
| C8200-RFID-1R | External RFID option | Asset and inventory management |
| C8200-NIM-BLANK | NIM blank | Unused NIM slot protection |
| C8200-PIM-BLANK | PIM blank | Unused PIM slot protection |
| C8200-RM-19 | 19-inch rack mount kit | Standard rack installation |
| C8200-RM-23 | 23-inch rack mount kit | 23-inch rack installation |
| C8200-WM-1R | Wall mount kit | Wall-mounted branch deployment |
ThousandEyes requires at least 8 GB DRAM and 8 GB bootflash/storage. Additional memory and storage are required when the ThousandEyes agent operates concurrently with containerized SD-WAN security services.
Comprehensive module matrix
Ethernet, LAN, and WAN modules
| Product number | Description | Best For |
|---|---|---|
| C-NIM-1M | 1-port 2.5/1 Gbps RJ45 WAN, 90W PoE, 802.3af/at/bt | High-speed routed WAN with PoE |
| C-NIM-2T | Two-port 100 Mbps/1 Gbps dual RJ45/SFP WAN with WAN MACsec | Flexible copper/fiber WAN and MACsec |
| C-NIM-8T | Eight-port 100 Mbps/1 Gbps switch with LAN/WAN MACsec and optional Layer 3 | Branch switching with security |
| C-NIM-8M | Eight-port 100 Mbps/1/2.5 Gbps switch with UPoE+, LAN/WAN MACsec, and optional Layer 3 | High-density mGig and powered devices |
| NIM-ES2-4 | Four-port Gigabit Ethernet LAN switch | Small wired branch LAN |
| NIM-ES2-8 | Eight-port Gigabit Ethernet LAN switch | Larger wired branch LAN |
| NIM-ES2-8-P | Eight-port Gigabit Ethernet LAN switch with PoE | LAN connectivity for powered devices |
Voice and legacy WAN modules
| Product number | Description | Best For |
|---|---|---|
| NIM-2FXO | Two-port FXO | Two analog trunk connections |
| NIM-4FXO | Four-port FXO | Four analog trunk connections |
| NIM-2FXSP | Two-port FXS | Two analog endpoint connections |
| NIM-4FXSP | Four-port FXS | Four analog endpoint connections |
| NIM-2FXSP/4FXOP | Two-port FXS and four-port FXO | Mixed analog voice |
| NIM-4E/M | Four-port E/M | E and M signaling |
| NIM-2BRI-NT/TE | Two-port BRI NT/TE | Small ISDN voice deployment |
| NIM-4BRI-NT/TE | Four-port BRI NT/TE | Higher-density ISDN voice |
| NIM-PVDM-32 | 32-channel voice DSP | Small voice media workload |
| NIM-PVDM-64 | 64-channel voice DSP | Medium voice media workload |
| NIM-PVDM-128 | 128-channel voice DSP | Larger voice media workload |
| NIM-PVDM-256 | 256-channel voice DSP | Highest listed voice DSP capacity |
| NIM-1MFT-T1/E1 | One-port multiflex T1/E1 voice or clear-channel data | Single T1/E1 circuit |
| NIM-2MFT-T1/E1 | Two-port multiflex T1/E1 voice or clear-channel data | Two T1/E1 circuits |
| NIM-4MFT-T1/E1 | Four-port multiflex T1/E1 voice or clear-channel data | Four T1/E1 circuits |
| NIM-8MFT-T1/E1 | Eight-port multiflex T1/E1 voice or clear-channel data | High-density T1/E1 |
| NIM-1CE1T1-PRI | One-port channelized T1/E1 or PRI | Single PRI or channelized circuit |
| NIM-2CE1T1-PRI | Two-port channelized T1/E1 or PRI | Two PRI or channelized circuits |
| NIM-8CE1T1-PRI | Eight-port channelized T1/E1 or PRI | High-density legacy voice/WAN |
| NIM-1T | One-port high-speed serial WAN | Single serial circuit |
| NIM-2T | Two-port high-speed serial WAN | Two serial circuits |
| NIM-4T | Four-port high-speed serial WAN | Multiple serial circuits |
| NIM-16A | 16-port asynchronous module | Async terminal and device aggregation |
| NIM-24A | 24-port asynchronous module | Higher-density async aggregation |
Broadband and ISDN data modules
| Product number | Description | Best For |
|---|---|---|
| NIM-VAB-A | Multimode VDSL2/ADSL/ADSL2/ADSL2+, Annex A | Annex A broadband access |
| NIM-VA-B | Multimode VDSL2/ADSL/ADSL2/ADSL2+, Annex B | Annex B broadband access |
| NIM-VAB-M | Multimode VDSL2/ADSL/ADSL2/ADSL2+, Annex M | Annex M broadband access |
| NIM-4SHDSL-EA | Multimode G.SHDSL | Symmetric DSL access |
| NIM-2BRI-S/T | Two-port ISDN BRI WAN interface for data | Small ISDN data deployment |
| NIM-4BRI-S/T | Four-port ISDN BRI WAN interface for data | Higher-density ISDN data |
Wireless WAN modules
| Product number | Description | Best For |
|---|---|---|
| P-5GS6-R16SA-GL | 5G Sub-6 GHz pluggable, 5G SA global | 5G standalone cellular WAN |
| P-5GS6-GL | 5G Sub-6 GHz pluggable, global | General 5G branch connectivity |
| P-LTEAP18-GL | CAT18 LTE Advanced Pro pluggable, global | High-throughput LTE |
| P-LTEA7-NA | CAT7 LTE Advanced pluggable, North America | North American LTE |
| P-LTEA7-EAL | CAT7 LTE Advanced pluggable, EMEA, APAC, and LATAM | Regional LTE deployment |
| P-LTEA7-JP | CAT7 LTE Advanced pluggable, Japan | Japan LTE deployment |
| P-LTEA-EA | CAT6 LTE Advanced pluggable, North America and EMEA | Regional CAT6 LTE |
| P-LTEA-LA | CAT6 LTE Advanced pluggable, APAC, ANZ, and LATAM | Regional CAT6 LTE |
| NIM-LTEA-EA | CAT6 LTE Advanced, North America and EMEA | NIM-based regional LTE |
| NIM-LTEA-LA | CAT6 LTE Advanced, APAC, ANZ, and LATAM | NIM-based regional LTE |
Modules marked in the source material as requiring IOS XE release 17.12.2 are P-5GS6-R16SA-GL, P-LTEA7-NA, P-LTEA7-EAL, and P-LTEA7-JP.
Power and PoE planning
The standard internal AC supply has a maximum rating of 100 W, 85 percent efficiency, 1.5 A maximum input current, and a 12 V, 8.4 A output. It accepts 90 to 264 VAC at 47 to 63 Hz. Input uses an IEC 320 C14 receptacle, and the power cord rating is 10 A.
The optional PWR-CC1-150WAC is an external PoE-only supply. It is rated at 150 W and provides a 150 W PoE budget, with average efficiency of 89 percent, 2 A maximum input current, and a 54 V, 2.78 A output.
Typical power consumption without modules is listed as:
- C8200-1N-4S: 35 W.
- C8200L-1N-4S: 33 W.
The power table uses the 4S identifiers shown above, while the platform ordering identifiers are C8200-1N-4T and C8200L-1N-4T. PoE module selection must include the external supply and the total endpoint load.
Physical and environmental specifications
| Specification | Value |
|---|---|
| Supported models | C8200-1N-4T and C8200L-1N-4T |
| Dimensions, H x W x D | 1.73 x 17.25 x 11.8 inches |
| Metric dimensions | 4.39 x 43.81 x 29.97 cm |
| Rack height | 1RU |
| Chassis weight | 10 lb, 4.54 kg |
| Input voltage | 90 to 264 VAC |
| Operating temperature | 32 to 104 F, 0 to 40 C |
| Storage temperature | -40 to 150 F, -40 to 70 C |
| Operating humidity | 5 to 85 percent, noncondensing |
| Nonoperating and storage humidity | 5 to 95 percent, noncondensing |
| Operating altitude | 0 to 10,000 feet, 0 to 3050 meters |
| MTBF | 692,577 hours |
| Sound pressure, typical/maximum | 54 dBA / 69 dBA |
| Sound power, typical/maximum | 68 dBA / 80 dBA |
The acoustic levels should be considered in branch offices, retail rooms, and other locations where the chassis may be installed near personnel. The stated temperature range is operational, not a storage or transportation range. Installation sites should also account for module heat, PoE load, rack airflow, and the maximum stated altitude.
The platforms carry the listed UL, CSA, EN, IEC, AS/NZS, laser safety, FCC, CISPR, VCCI, CNS, KN, ETSI, and IEC immunity certifications and compliance markings.
Licensing, warranty, and support
The platforms are offered with a Cisco DNA Software subscription, Enterprise Agreement, or Managed Service Licensing Agreement. Listed Cisco DNA subscription options are:
- Catalyst Routing Essentials.
- Cisco DNA Essentials.
- Cisco DNA Advantage.
A valid ThousandEyes agent license is required to activate ThousandEyes. Existing ThousandEyes subscriptions can be used on eligible platforms, subject to the memory and storage requirements.
The supplied product material does not state a separate limited hardware warranty term. Support service options are described separately:
- Cisco Solution Support is the default and recommended support service for Catalyst 8000 platforms and Cisco DNA Software for SD-WAN and Routing. It is optional and may be replaced by another Cisco or partner support service.
- When Solution Support is selected, it must be ordered for both the hardware platform and the Cisco DNA Software for complete entitlement to the premium service.
- Solution Support provides a primary point of contact, product and interoperability expertise, coordinated support across Cisco and alliance partners, and a 30-minute service response objective for Severity 1 and Severity 2 cases.
- Cisco Subscription Embedded Software Support provides online troubleshooting, web case submission, TAC access at all times, and access to Cisco software resources. It covers the Cisco DNA Software, not the Catalyst 8000 hardware.
- Hardware support must be purchased separately when embedded software support is used. Cisco Smart Net Total Care is identified as the recommended hardware support option in that scenario.
- Software maintenance releases and updates for Cisco DNA SD-WAN and Routing are covered by the applicable software support. Catalyst 8000 operating system and network stack support are covered by the hardware platform support contract.
A complete proposal should therefore list the hardware support entitlement, Cisco DNA subscription, optional ThousandEyes license, required software level, memory and storage upgrades, NIM or PIM modules, rack or wall mounting hardware, and any external PoE supply.