Techguide · Cisco Catalyst 8000 Licensing
Overview
← Back to overview
Section 1 of 7

The Catalyst 8200/8300 Gen 2 Platforms and the Subscription Shift

This section establishes the hardware and commercial baseline for everything that follows: where the Catalyst 8200 and 8300 sit in Cisco's edge portfolio, what "Gen 2" actually denotes, and why the licensing decision — not the chassis — is the variable that drives the bill of materials. Understanding the two-stack model up front is a prerequisite to ordering these platforms correctly, because on an 8200/8300 you cannot buy hardware without simultaneously buying a subscription.

Where the 8200 and 8300 Sit in the Catalyst 8000 Edge Family

Both series run Cisco IOS XE, are managed identically (autonomous IOS XE or Catalyst SD-WAN Manager), and share an x86 multicore System-on-Chip architecture with dynamic core allocation that splits cores between the service plane and data plane. They diverge on scale, expansion, and redundancy. The 8200 is the entry-level, small-to-medium branch device — single PSU, no service-module slots. The 8300 targets medium-to-large branches and doubles as a regional head-end (aggregation) platform, adding dual-PSU support and Service Module (SM) slots.

AttributeCatalyst 8200Catalyst 8300
PositioningEntry / small-medium branchMedium-large branch, regional head-end
Gen 1 modelsC8200-1N-4T, C8200L-1N-4T (1RU)C8300-1N1S-6T, C8300-1N1S-4T2X (1RU); C8300-2N2S-6T, C8300-2N2S-4T2X (2RU)
CPU cores (x86 SoC)4 or 88 or 12
Module layout1 NIM + 1 PIM1 NIM + 1 SM + 1 PIM (1RU); 2 NIM + 2 SM + 1 PIM (2RU)
PowerSingle PSUDual PSU
IPsec / SD-WAN throughput~1 Gbps~2–5 Gbps
Unencrypted CEF forwardingup to ~4 Gbps (3.8 Gbps IMIX)up to ~20 Gbps (12 Gbps IMIX)
Crypto throughputup to 1 Gbpsup to 19 Gbps

DRAM defaults to 8 GB and is upgradeable to 16 GB or 32 GB across the line; the lower-cost C8200L-1N-4T is the exception, shipping with 4 cores and 4 GB bootflash. Both series carry one dedicated PIM (power/PoE) slot. The practical read: the 8200 is a fixed-function branch terminator, while the 8300's SM slots and dual PSUs make it the platform you specify when the interface mix or availability requirements will change after install.

Figure 1.1: Catalyst 8200/8300 positioning by branch size, throughput, and expansion

graph TD
    A["Catalyst 8200<br/>Entry / small-medium branch"] --> A1["1 NIM + 1 PIM, single PSU<br/>~1 Gbps IPsec"]
    B["Catalyst 8300 Gen 1<br/>Medium-large branch, regional head-end"] --> B1["1-2 NIM + 1-2 SM + 1 PIM, dual PSU<br/>~2-5 Gbps IPsec, up to 19 Gbps crypto"]
    C["Catalyst 8300 Gen 2 Secure Routers"] --> C1["C8355-G2 fixed and C8375-E-G2 modular<br/>~38 Gbps forwarding, 20 Gbps IPsec, PQC-ready"]
    A1 --> D{"Increasing throughput and expansion"}
    B1 --> D
    C1 --> D
    D --> E["C8355-G2 / C8375-E-G2 sit above the Gen 1 8300 line"]
    C1 --> E

Gen 1 to Gen 2: The -G2 Secure Routers

"Gen 2" is not a marketing gloss on the original 8300 — it is a distinct hardware refresh branded the Cisco 8300 Series Secure Routers, carrying a -G2 suffix: C8355-G2 (fixed) and C8375-E-G2 (modular). These sit above the original four-model Gen 1 8300 line, which remains on sale.

The generational jump is substantial and security-led:

Both Gen 1 and Gen 2 exist because both replace the ISR 4000 series (ISR 4200/4300/select 4400 end-of-sale November 7, 2023), running identical IOS XE on faster, more power-efficient hardware with native SD-WAN optimization.

The Two-Stack Licensing Model and the Rebrand

Every Catalyst 8000 edge platform is licensed with two stacks purchased together:

  1. Perpetual Network Stack — the on-box feature level you own forever. Network Essentials covers Layer 2 and basic Layer 3; Network Advantage is a superset adding full Layer 3 (BGP, full OSPF/EIGRP, IS-IS), VRF, VXLAN, and SD-Access. If the subscription lapses, the box keeps routing.
  2. Term subscription (DNA/Catalyst) Software Stack — the part that expires. DNA Essentials pairs only with Network Essentials; DNA Advantage pairs only with Network Advantage and adds automation, analytics, and Catalyst Center manageability.

Figure 1.2: The two-stack license model with the HSECK9 throughput gate

flowchart TD
    subgraph TERM["Term subscription stack (expires)"]
        T1["Catalyst / DNA Essentials"]
        T2["Catalyst / DNA Advantage<br/>automation, analytics, Catalyst Center"]
    end
    subgraph PERP["Perpetual Network stack (owned forever)"]
        P1["Network Essentials<br/>L2 and basic L3"]
        P2["Network Advantage<br/>full L3, VRF, VXLAN, SD-Access"]
    end
    P1 -->|"locked pairing"| T1
    P2 -->|"locked pairing"| T2
    T1 --> G["HSECK9 export add-on"]
    T2 --> G
    G --> H["Gates T2 (1/2 Gbps) and T3 (10/20 Gbps) crypto throughput<br/>T3 requires Advantage"]

The naming is mid-transition. Cisco DNA Center became Catalyst Center in 2023; DNA Essentials/Advantage were rebranded Catalyst Essentials/Advantage; DNA Premier for SD-WAN and Routing was discontinued in August 2024 alongside the launch of Catalyst Routing Essentials. The umbrella legal document is now the Cisco Networking Subscription Offer Description. Expect both "DNA" and "Catalyst" labels to appear interchangeably across data sheets, quotes, and ordering portals during the overlap.

Why Licensing Drives the BOM

The subscription is not an optional afterthought — per Cisco's ordering guide, all 8200/8300 platforms require a mandatory subscription license; there is no standard hardware-only order. The recommended path bundles the subscription with the hardware through the top-level platform SKU; the alternate path orders them separately via L-DNA-C8200 or L-DNA-C8300 license SKUs. Subscription start syncs to the hardware ship date, with an optional offset up to 90 days.

Recommended:  C8300-1N1S-6T platform SKU  →  bundles DNA/Catalyst subscription
Alternate:    C8300-1N1S-6T (hardware)  +  L-DNA-C8300 (subscription, ordered separately)

The decision cascades because the tiers are interdependent. Crypto throughput is gated into tiers T0–T3 (T0 = 25 Mbps nominal / 50 Mbps aggregate; T1 = 200/400 Mbps; T2 = 1/2 Gbps; T3 = 10/20 Gbps). T2 and higher require an HSECK9 export-control license; T3 and higher are unavailable with Essentials and demand the Advantage tiers. Network Essentials therefore caps a design at T0–T2 with DNA Essentials; anything faster forces Network Advantage + Catalyst Advantage + HSECK9. Note that "throughput" here means cryptographic throughput — unencrypted forwarding is unthrottled by default — and once T3 is configured you cannot downgrade the boot level to Essentials.

Because tier (Essentials vs Advantage), throughput tier (T0–T3), and the HSECK9 add-on are all selected at order time and locked to one another, the license selection determines feature set, achievable performance, export add-ons, and term cost across the entire bill of materials. On these platforms, the chassis is the cheap, static decision; the subscription is what you actually engineer.

References