The Cisco Catalyst C8300-1N1S-4T2X is a 1RU edge platform router with three module bays: one service module slot, one network interface module slot and one pluggable interface module slot. Cisco rates IPsec throughput on this platform at up to 16.9 Gbps, and 6.6 Gbps at IMIX. Software licenses, which do not transfer with used hardware, are not included.
Ports, interfaces and what this router presents
The fixed WAN face is six embedded Layer 3 Ethernet interfaces: two at 10 Gigabit and four at 1 Gigabit. Those are the ports the circuit terminates on before any module is fitted, and they are worth reading as two separate classes rather than as a single port count, because the two 10 Gigabit interfaces and the four 1 Gigabit interfaces are not interchangeable. On top of that face sit three bays of three different kinds, which is the property that actually distinguishes this chassis from a fixed branch router.
| Form-Factor | 1RU |
|---|---|
| WAN interfaces | 2 x 10-Gigabit Ethernet + 4 x 1-Gigabit Ethernet, embedded Layer 3 |
| Service module slots | 1 |
| Network interface module slots | 1 |
| Pluggable interface module slots | 1 |
| IPv4 forwarding throughput (autonomous mode) | up to 19.7 Gbps |
| IPsec throughput (autonomous mode, 1400 byte packets) | up to 16.9 Gbps |
| IPsec throughput at IMIX | 6.6 Gbps |
| SD-WAN IPsec throughput | up to 17 Gbps (1400 byte packets), 6.3 Gbps at IMIX, up to 6,000 overlay tunnels |
| DRAM | 8 GB default, up to 32 GB |
| Storage | 16 GB M.2 solid-state drive, default |
| Dimensions | 1.73 x 17.50 x 16.25 in |
| Typical power | 245 W, no modules fitted, single power supply |
| MTBF | 536,060 hours |
Cisco's test conditions for the throughput rows above are published with the figures and belong with them: "IMIX is average packet size of 352 Bytes packet size"; "IQDF traffic pattern: IPSec + Quality of Service (QoS) + Deep Packet Inspection (DPI) + Flexible Netflow (FNF)"; "Tested with IOS XE release 17.12.2." A throughput number quoted without the conditions it was measured under is not a specification, and we would rather print Cisco's conditions than leave you to find them.
Throughput: the figures Cisco publishes and what each one measures
Cisco publishes throughput for the Catalyst C8300-1N1S-4T2X in two separately labelled modes. In autonomous mode Cisco rates it at up to 19.7 Gbps of IPv4 forwarding and up to 16.9 Gbps of IPsec, falling to 6.6 Gbps on an IMIX traffic mix; in Cisco SD-WAN mode it rates IPsec at up to 17 Gbps, and 6.3 Gbps at IMIX, across up to 6,000 overlay tunnels.
IMIX is the figure to size a circuit on. It is a mixed packet-size profile with an average packet size of 352 bytes, and it is much closer to what a branch actually carries than a stream of 1400-byte packets is. The headline number and the IMIX number describe the same router under different traffic, and the gap between them is not a discrepancy: it is the cost of doing per-packet work, which rises as packets get smaller. A design sized on 16.9 Gbps and then run on real mixed traffic will not behave like a design sized on 6.6 Gbps.
The second thing worth knowing is that the mode labels are Cisco's, not ours. Cisco publishes an autonomous, non-SD-WAN performance table and a separate Cisco SD-WAN table for the same chassis, and names both. That matters when comparing our specification block to a competitor's, because a single unlabelled throughput number on a rival listing could be either mode, and the two do not describe the same software feature set or the same measurement.
Where this router sits in the Catalyst 8300 series
This is the 1RU member of the series with a service module bay, and the bay is the reason to choose it over a smaller branch platform. Within our range the natural comparison is the Cisco Catalyst C8200-1N-4T, which is the fixed-WAN member of the adjacent series.
| Catalyst C8300-1N1S-4T2X | Catalyst C8200-1N-4T | |
|---|---|---|
| Form-Factor | 1RU | 1RU |
| WAN interfaces | 2 x 10 GE + 4 x 1 GE | 2 x 1 GE RJ45 + 2 x 1 GE SFP |
| Service module slots | 1 | 0 |
| Network interface module slots | 1 | 1 |
| Pluggable interface module slots | 1 | 1 |
| IPv4 forwarding throughput | up to 19.7 Gbps | 3.8 Gbps |
| IPsec throughput | up to 16.9 Gbps | up to 1 Gbps |
| DRAM | 8 GB default, up to 32 GB | 8 GB default, up to 32 GB |
Both columns are populated on every row, so this is a comparison rather than a table with holes in it. The two platforms are sized for different jobs and the figures should be read that way rather than divided into one another: the two rows to look at are the service module slot and the WAN interface class, because those are structural and they do not change with a software subscription.
What actually goes in the three bays
A slot count tells you what the chassis has. What matters when specifying a used unit is what Cisco publishes as fitting each bay, and the three bays take three different families.
The service module bay takes modules such as the C-SM-16P4M2X, a 22-port Layer 2 switch module, or a compute module such as the UCS-E160S-M3/K9. The network interface module bay takes modules such as the C-NIM-1X, a single-port 10 Gbps SFP and SFP+ module with WAN MACsec, or the C-NIM-2T. The pluggable interface module bay takes wireless WAN modules such as the P-5GS6-GL or the P-LTEAP18-GL. Cisco also publishes a blank for each bay: C8300-SM-BLANK, C8300-NIM-BLANK and C8300-PIM-BLANK.
The blanks matter more on second-hand hardware than they do on new. A used router arrives configured the way its previous owner ran it, so a bay may hold a module, a blank or nothing at all, and airflow through the chassis assumes the bay is closed. Tell us what you need fitted and we will confirm what the specific unit carries before it ships.
Power supplies, and the substitution a used buyer should expect
Cisco records that the 400-watt PWR-CC1-400WAC was shipped as a temporary substitute for the 250-watt PWR-CC1-250WAC on the 1RU platforms in this series during a period of component shortage, that it is no longer supplied with them, and that it retains the same support as the 250-watt supply.
That is a supported condition stated by the vendor, not a defect and not a downgrade, and it is precisely the kind of thing a procurement team asks about a second-hand unit. A used 1RU chassis in this series can legitimately arrive with either supply. The full 1RU set Cisco publishes is PWR-CC1-250WAC, PWR-CC1-400WAC, PWR-CC1-500WAC, PWR-CC1-400WDC and PWR-CC1-400WHV. Cisco splits its power tables by form factor, so that list is specific to the 1RU chassis and does not carry across to the taller members of the range.
Buying refurbished while Cisco still ships new
Same part number, same hardware. Every unit is tested on receipt, then disassembled, cleaned, inventoried, picked, assembled, configured and tested again before it ships. Whole systems, this router included, carry a 2-year Enterasource warranty, and delivery is free FedEx Ground to the lower 48 states. No Cisco warranty transfers to a second-hand unit and we do not suggest that it does.
Because Cisco still ships this platform new, the refurbished case here is a narrow and specific one and we would rather state it than dress it up: identical hardware, a shorter lead time, a different price, and our warranty in place of the vendor's. That suits an expansion, a spare, a lab or a staged branch rollout. It suits a first deployment under a warranty-led procurement policy less well. The subscription question below is the same either way, which is the part most buyers underestimate.
Licenses, subscriptions and what ships with the unit
Software licenses and subscriptions are not included unless the listing states otherwise. Cisco states that the Catalyst 8300 Series Edge Platforms are offered only with a Cisco DNA Software subscription, Enterprise Agreement or Managed Service Licensing Agreement, and a subscription bought by the original owner does not transfer to a second-hand unit. Cisco separately documents an autonomous, non-SD-WAN mode for this platform and publishes performance figures for it. Tell us which features your deployment depends on before you order and we will confirm, in writing, exactly what the specific unit we are shipping carries and what you will need to license separately.
We publish that disclosure prominently because discovering it after delivery is the single most common bad outcome on this platform, and because it is Cisco's own sentence rather than our interpretation of one. If your deployment is a straight replacement for an Cisco ISR 4000 branch box, the licensing model is the part of the move that will be unfamiliar, not the hardware.
Condition, testing and what is in the box
The router ships tested and configured to the state you ask for. Modules, blanks, power supplies, rails and antennas are separate line items unless the listing says they are included. We list what we have, we test what we ship, and if the unit we source differs in any respect from the one quoted we tell you before it leaves rather than after.
For the rest of the range, see Cisco routers or the wider catalogue at Cisco networking.
Frequently Asked Questions
Which throughput figure should I size a circuit on?
Size on the IMIX figure. Cisco publishes 6.6 Gbps of IPsec at IMIX for this platform in autonomous mode and up to 16.9 Gbps on 1400-byte packets, and IMIX is a mixed packet-size profile averaging 352 bytes that behaves far more like real branch traffic. The larger number is a valid measurement under the conditions Cisco states; it is not the number a capacity plan should be built on.
What is the difference between the two throughput modes Cisco publishes?
Cisco measures this chassis separately in an autonomous, non-SD-WAN mode and in Cisco SD-WAN mode, and publishes a table for each. Autonomous mode reaches up to 19.7 Gbps of IPv4 forwarding and up to 16.9 Gbps of IPsec; SD-WAN mode reaches up to 17 Gbps of IPsec across up to 6,000 overlay tunnels. The labels are Cisco's own, so a figure quoted without its mode is ambiguous by construction.
What can go in the service module, network interface module and pluggable interface module bays?
The service module bay takes modules such as the C-SM-16P4M2X 22-port Layer 2 switch module or a UCS-E160S-M3/K9 compute module. The network interface module bay takes modules such as the C-NIM-1X or C-NIM-2T. The pluggable interface module bay takes wireless WAN modules such as the P-5GS6-GL or P-LTEAP18-GL. Cisco publishes a blank panel for each bay so an unused slot can still be closed.
Which power supply will a used unit arrive with?
Either the 250-watt PWR-CC1-250WAC or the 400-watt PWR-CC1-400WAC, and both are supported. Cisco records the 400-watt unit as a temporary substitute shipped during a component shortage which retains the same support as the 250-watt supply. The wider set Cisco publishes for this chassis size also includes the PWR-CC1-500WAC, PWR-CC1-400WDC and PWR-CC1-400WHV. We confirm which supply is fitted at quote time.
Do I need a subscription, and does the previous owner's transfer to me?
A subscription does not transfer with second-hand hardware; it belongs to the account that bought it. Cisco states that these edge platforms are offered with a software subscription, an Enterprise Agreement or a Managed Service Licensing Agreement, so the entitlement is a separate purchase from the chassis. The three module bays are hardware capabilities; which features you may enable on them is the licensing question, and it is worth settling before you order.
How do pricing and lead time work on a router priced by quote?
Send us the specification you need, including which bays should be populated, the power supply and any wireless modules, and we will come back with availability and a price for that exact build. We source these units rather than holding every configuration in stock, so a meaningful answer on timing arrives with the quote. If what we can source differs from what was asked for, you hear it before anything is committed.
