The Cisco Catalyst C8200-1N-4T is a 1RU edge platform router with one network interface module slot and one pluggable interface module slot. Cisco rates it at 3.8 Gbps of IPv4 forwarding throughput and up to 1 Gbps of IPsec, across 2 x 1G RJ45 and 2 x 1G SFP WAN ports. As on every Catalyst 8000, software licenses are a separate order line.
Ports, interfaces and what this router presents
The WAN face is fixed and it is deliberately mixed: two 1 Gigabit RJ45 copper ports and two 1 Gigabit SFP ports. Cisco states it plainly, that two of the Ethernet ports are Small Form-Factor Pluggable and two are RJ45. That pairing is the whole point of the chassis. A branch that takes a copper handoff from one carrier and a fibre handoff from another terminates both on the same router without an adapter or a media converter in the path, and without spending the module bay on the problem.
| Form-Factor | 1RU |
|---|---|
| WAN interfaces | 2 x 1G RJ45 + 2 x 1G SFP |
| Network interface module slots | 1 |
| Pluggable interface module slots | 1 |
| IPv4 forwarding throughput | 3.8 Gbps |
| IPsec throughput | up to 1 Gbps |
| IPsec throughput at IMIX | 900 Mbps |
| DRAM | 8 GB default, up to 32 GB |
| Storage | 16 GB M.2 solid-state drive |
| Dimensions | 1.73 x 17.25 x 11.8 in |
| Typical power | 35 W |
| MTBF | 692,577 hours |
Cisco publishes the throughput figures above under stated test conditions and they belong with the numbers: "IMIX is average packet size of 352 Bytes packet size", and "Tested with IOS XE release 17.12.2." The internal power supply is not published as a separate orderable part number on this chassis; Cisco's own table heads that column "Default" with a 100 W maximum rating and no part number against it. The one power part number Cisco does publish for the platform is the external PWR-CC1-150WAC, which exists to provide a 150 W Power over Ethernet budget and is not the supply the router ships with.
Throughput: three figures, and the one a branch should size on
Cisco publishes three throughput figures for the Catalyst C8200-1N-4T: 3.8 Gbps of IPv4 forwarding throughput, up to 1 Gbps once IPsec is applied, and 900 Mbps of IPsec on an IMIX traffic mix.
Those three numbers measure different work on the same router, and the drop between them is the cost of encryption and of small packets rather than a discrepancy in the specification. A branch running plain routed traffic is described by the first figure. A branch running an encrypted overlay to a data centre or a cloud edge is described by the third, and that is the one a circuit should be sized against. This is a clearer set of figures than most platforms in this class publish, because Cisco states all three rather than a single headline, and we would rather print the awkward number alongside the flattering one.
These figures belong to this platform and should not be set against another platform's. Different routers are measured in different modes on different software, and a number carried across from one chassis to another stops being a specification.
What Cisco's module table for this series does and does not contain
This is the fact that actually decides between this router and a larger one, and it is stronger than a slot count. Cisco's module table for this series lists 56 part numbers, and there is no service-module tier anywhere in it. Cisco publishes no service-module blank for the platform either: the blanks it lists are the C8200-NIM-BLANK and the C8200-PIM-BLANK, and there is no third one.
The absent blank is independent confirmation of the absent bay. A vendor does not publish a filler panel for a slot that does not exist, so the two facts corroborate each other from opposite directions. A slot count tells a buyer what the chassis has today; the module table tells them what the chassis can ever be made into, and on this platform the answer is bounded and knowable in advance.
That is a positive property rather than a criticism. A fixed WAN face with one network interface module bay and one pluggable interface module bay is a simpler purchase, a simpler spares position and a simpler thing to standardise a branch estate on. Cisco's own Ethernet Layer 3 network interface modules for this platform are the C-NIM-1M and the C-NIM-2T. Wireless WAN goes in the pluggable bay.
Where this router sits in the Catalyst 8200 series and against the ISR 4000
Two comparisons are useful, and they are useful for opposite reasons. The Cisco Catalyst C8300-1N1S-4T2X is the same subscription platform one step up, with a service module bay and a faster WAN face. The Cisco ISR 4321 is the platform many branches are replacing, and its figures below are taken from its own listing rather than from memory.
| Catalyst C8200-1N-4T | Catalyst C8300-1N1S-4T2X | Cisco ISR 4321 | |
|---|---|---|---|
| Form-Factor | 1RU | 1RU | 1RU |
| WAN interfaces | 2 x 1G RJ45 + 2 x 1G SFP | 2 x 10 GE + 4 x 1 GE | 2 onboard Gigabit Ethernet |
| Service module support | None published for the series | 1 bay | 0 slots |
| Network interface module slots | 1 | 1 | 2 |
| Pluggable interface module slots | 1 | 1 | Not applicable |
| IPv4 forwarding throughput | 3.8 Gbps | up to 19.7 Gbps | 50 Mbps default, 100 Mbps with the Performance license |
| DRAM | 8 GB default, up to 32 GB | 8 GB default, up to 32 GB | 4 GB combined, default |
The ISR 4321 column is the most useful one on this page, and not because of the hardware. Its throughput is gated by which license is loaded, which is why its row reads as a default figure and a licensed figure rather than a single number. That is a genuinely different commercial model from the one this router sits in, and a branch estate moving between the two is changing how it buys software as much as what it racks. Read the service-module row as structural: it does not move with a subscription level.
Buying refurbished while Cisco still ships new
Same part number, same hardware. Every unit is tested on receipt, then disassembled, cleaned, inventoried, picked, assembled, configured and tested again before it ships. Whole systems, this router included, carry a 2-year Enterasource warranty, and delivery is free FedEx Ground to the lower 48 states. No Cisco warranty transfers to a second-hand unit and we make no claim that it does.
Cisco still ships this platform new, so the refurbished case is narrow and worth stating precisely: identical hardware, a shorter lead time, a different price, our warranty instead of the vendor's. On a branch estate that is often exactly the right trade, because branch routers are bought in quantity, deployed to a template and replaced on a schedule, and a spare on a shelf is worth more than a warranty certificate in a drawer.
Licenses, subscriptions and what ships with the unit
Software licenses and subscriptions are not included unless the listing states otherwise. Cisco states that the Catalyst 8200 Series Edge Platforms are offered only with a Cisco DNA Software subscription, Enterprise Agreement or Managed Service Licensing Agreement, and a subscription bought by the original owner does not transfer to a second-hand unit. Cisco separately documents an autonomous, non-SD-WAN mode for this platform and publishes performance figures for it. Tell us which features your deployment depends on before you order and we will confirm, in writing, exactly what the specific unit we are shipping carries and what you will need to license separately.
On a fixed-WAN branch box the hardware variables are few, which puts almost all of the remaining variability into the subscription. That is the opposite of how these routers are usually shopped for, and it is the single most useful thing to settle before an order rather than after one. If you are moving from an older branch estate, this is the part of the change that will be unfamiliar.
Condition, testing and what is in the box
The router ships tested and configured to the state you ask for. Modules, blanks, rails, antennas and any external power supply are separate line items unless the listing says they are included. If the unit we can source differs in any respect from the one quoted, we say so before it ships rather than after.
For the rest of the range see Cisco routers, or the wider catalogue at Cisco networking.
Frequently Asked Questions
Which of the three published throughput figures should I size on?
Size an encrypted branch on the 900 Mbps IMIX figure. Cisco publishes 3.8 Gbps of IPv4 forwarding throughput for plain routed traffic, up to 1 Gbps once IPsec is applied, and 900 Mbps of IPsec on a mixed packet-size profile averaging 352 bytes. The IMIX figure is the closest of the three to what a branch actually carries once an encrypted overlay is running across it.
What does it mean that Cisco lists no service module for this series?
It means the platform cannot be extended with the class of module that adds switching or compute inside the chassis, and that this is a property of the series rather than of a particular configuration. Cisco publishes no service-module blank for the platform either, which corroborates it from the other direction. If a branch design depends on a module of that class, the decision is a different chassis and it should be taken at specification time.
What does a fixed WAN face mean for future upgrades?
It means the two copper and two fibre Gigabit ports are what the router presents to the circuits for its whole life. The network interface module bay and the pluggable interface module bay extend what the router can do behind that face, but they do not change the face itself. If there is a realistic prospect of a 10 Gigabit handoff at that site, that is a reason to specify a larger chassis rather than to plan an upgrade.
Do I need a subscription, and does the previous owner's transfer with the hardware?
It does not transfer; a subscription belongs to the account that bought it. Cisco states that these edge platforms are offered with a software subscription, an Enterprise Agreement or a Managed Service Licensing Agreement, so the entitlement is a separate purchase from the chassis. Because this chassis has so few hardware variables, the subscription is where nearly all of the specification decisions actually live.
How does this compare with keeping an ISR 4000 branch router?
They are different commercial models more than different boxes. On the ISR 4000 the forwarding throughput is gated by which license is loaded, so its published figures read as a default and a licensed value. This platform is bought as a subscription platform from the outset. Both are legitimate; the estates that struggle are the ones that move between them without re-planning how software is purchased.
What condition are these routers in, and how do you test them?
Each unit is tested on receipt, then disassembled, cleaned, inventoried, picked, assembled, configured and tested again before shipping. The part number and the hardware match what Cisco shipped. Whole systems ship with an Enterasource warranty, stated in full on the listing, and go free by FedEx Ground to the lower 48 states. We do not publish a burn-in duration, a pass rate or a certification name we cannot evidence.
