Techguide · Cisco Catalyst 8000 Licensing
Overview
← Back to overview
Section 3 of 7

Anatomy of the License Stack: What You Actually Order

A Catalyst 8200/8300 license is not one SKU — it is a stack of layers, and the line items on your quote map to those layers in ways that are easy to get wrong. This section dissects what you are actually buying: the perpetual network base, the throughput tier riding inside it, the mandatory term subscription, and the export-controlled crypto license that a high tier silently pulls in.

The three stacked layers

Every 8200/8300 entitlement resolves to three logical layers. You order them as one or two line items, but Cisco's licensing backend fulfills them separately, and understanding the split is what lets you predict what survives a lapsed subscription.

LayerWhat it grantsLifecycleInternal fulfillment PID
Network StackAutonomous-mode (non-SD-WAN) feature set: routing, QoS, and the throughput entitlementPerpetual — never expiresNWSTACK-<tier>-<pkg>
Throughput tierPerformance cap (T0–T3), encoded inside both stack licensesRides with whichever layer is activetier field of the PID
Cisco DNA / software stackSD-WAN, Catalyst Center / vManage management, advanced software featuresTerm — 3/5/7 years, then lapsesDSTACK-<tier>-<pkg>

The critical property: the network stack is perpetual and the throughput tier is baked into it. When a DNA term expires, the DSTACK layer lapses but the NWSTACK layer — and its autonomous-mode throughput entitlement — remains. Cisco's own language is unambiguous: "even after a subscription term expires, the network stack will remain," and "a network-stack license is a perpetual or permanent license and has no expiration date." This is why traditional-routing deployments treat the DNA subscription as a day-one compliance gate rather than an ongoing operational dependency.

Figure 3.1: The three stacked license layers

flowchart TD
    DNA["Cisco DNA / software stack (DSTACK)<br/>SD-WAN, Catalyst Center, advanced features<br/>TERM: 3/5/7 years, then lapses"]
    NW["Perpetual network stack (NWSTACK)<br/>Autonomous-mode routing and QoS<br/>PERPETUAL: never expires"]
    TIER["Throughput tier T0-T3<br/>encoded inside the PID"]
    DNA -->|"sits on top of"| NW
    TIER -->|"baked into"| NW
    NW -->|"survives when term lapses"| KEEP["Router keeps running in autonomous mode"]
    DNA -->|"on expiry"| GONE["Software features lapse"]

Each stack comes in three packages, each a strict superset of the one below: Essentials → Advantage → Premier. Network Advantage adds voice and additional feature entitlements over Network Essentials; DNA Premier sits above DNA Advantage. The package letter (E/A/P) appears in the PID and must match across the network and DNA layers.

Perpetual network base and NPE

The perpetual network stack is the foundation. It is what you keep forever, and its package tier (E/A/P) sets the ceiling on which throughput tiers you are even allowed to order — more on that below.

A second, orthogonal distinction lives at the image level: NPE (Non-Payload-Encryption). This is not a license tier; it is a software image variant (k9 vs k9-npe) driven by U.S. export control. The Network-Essentials_npe package "includes all the features in the Network-Essentials technology package without the payload encryption functionality, to fulfill export restriction requirements." Concretely, the NPE image strips IPsec and Secure VPN payload encryption. Customers in export-restricted destinations receive k9-npe images that cannot do payload encryption at all.

Do not confuse NPE with HSEC. They pull in opposite directions: NPE removes encryption capability at the image level for restricted destinations; HSEC enables high-rate encryption where it is legally permitted. A given router runs one image variant and, separately, may or may not carry an HSEC authorization.

Throughput tiers

Throughput on these platforms is a license attribute, not a hardware fuse. The tier — T0, T1, T2, or T3 — is encoded directly in the license PID, and out of the box the router is throttled hard (roughly 10 Mbps on most platforms) until a tier license is applied.

The single most important thing to understand about tiers: the Mbps values are platform-specific, not universal. There is no single T0–T3 table that applies to every SKU. Worse, Cisco mixes two conventions across its documentation — a per-direction "nominal" figure and an "aggregate, both directions" figure — so the same tier can appear as "25M" in one table and "2G aggregate" in another. The PID value is the per-direction nominal figure; the platform aggregate cap is roughly double it.

The two reference platforms diverge as follows:

TierC8300-2N2S-4T2X / 1N1S-4T2XC8200-1N-4T
T0up to 25Mup to 15M
T1up to 100M (HSECK9 auto-included)up to 100M (requires HSECK9)
T2up to 2G aggregate (Advantage/Premier only)up to 1G aggregate (Advantage/Premier only)
T3up to 20G aggregate (Advantage/Premier only)not offered

Two constraints fall out of this table. First, the C8200 has no T3 — the single-slot platform tops out at T2 (~1G aggregate). Do not quote a C8200 at T3; the SKU does not exist. Second, there is a tier-package interaction: the top tiers are not available with Essentials. T2 and T3 require Network/DNA Advantage or Premier. If procurement specs an Essentials package, the high-throughput tiers are off the table regardless of hardware.

Figure 3.2: Throughput tier ladders, C8300 versus C8200

flowchart TD
    subgraph C8300["C8300 (4T2X)"]
        A0["T0 up to 25M"]
        A1["T1 up to 100M (HSECK9 auto)"]
        A2["T2 up to 2G aggregate"]
        A3["T3 up to 20G aggregate"]
        A0 --> A1 --> A2 --> A3
    end
    subgraph C8200["C8200-1N-4T"]
        B0["T0 up to 15M"]
        B1["T1 up to 100M (needs HSECK9)"]
        B2["T2 up to 1G aggregate"]
        B3["T3 not offered"]
        B0 --> B1 --> B2 --> B3
    end
    GATE["T2 and T3 require Advantage or Premier<br/>Essentials cannot order these tiers"]
    GATE -.-> A2
    GATE -.-> B2

The HSEC crypto license

HSECK9 is the High Security license — export-controlled, and pulled in automatically by higher tiers. It "authorizes the use of full cryptographic functionality and throughput greater than 250 Mbps." The 250 Mbps figure is not arbitrary: the U.S. Department of Commerce requires that "the aggregate encrypted throughput of all incoming and outgoing interfaces not exceed 250 Mbps (in each direction)" absent HSEC authorization.

Practically, HSECK9 is required whenever encrypted throughput exceeds 250 Mbps — i.e., T2 and above — and whenever the tunnel count exceeds the non-HSEC cap (roughly 1000 tunnels). On the C8300 ordering tables, HSECK9 is auto-included starting at T1. When bundled with a subscription it appears as C8000-HSEC; ordered separately it is C8000-HSEC-DNA.

HSEC is not just a line item — it has an enablement gate. It requires a SLAC (Smart Licensing Authorization Code) to be installed on the device before the high tier can be configured, and the whole mechanism is enforced through Smart Licensing Using Policy. Ordering the tier is necessary but not sufficient; the SLAC must be pulled down and installed for the crypto entitlement to activate.

Minimum required to order a working router

Cisco will not ship these platforms bare. Per the FAQ, "a software subscription is mandatory for Cisco Catalyst 8000 Series Edge Platforms at the initial time of purchase of the hardware," and the ordering guide states the 8300/8200 "must be ordered with a mandatory Cisco DNA subscription license or Catalyst Routing Essentials license." There is no hardware-only SKU path. The mandate exists to guarantee that both the perpetual base and a valid software entitlement are present on day one.

There are two ways to satisfy the mandate:

  1. A Cisco DNA subscription (Essentials / Advantage / Premier), term-based — grammar DNA-C-<TIER>-<PKG>-<TERM>, e.g., DNA-C-T2-A-3Y (Cloud-managed, Tier 2, Advantage, 3-year). Terms: Essentials and Advantage offer 3Y/5Y/7Y; Premier offers 3Y/5Y.
  2. Catalyst Routing Essentials — ROUT-P-C8300-E-7Y / ROUT-P-C8200-E-7Y, 7-year only. A traditional-routing entitlement with no SD-WAN/DNA software that "unlocks maximum platform throughput capability for IP-CEF and Crypto traffic throughput up to 2 Gbps."

Figure 3.3: Minimum-order decision flow to a shippable BOM

flowchart TD
    HW["Hardware PID (C8300 or C8200 chassis)"]
    HW --> CHOICE{"Satisfy mandatory<br/>software entitlement"}
    CHOICE -->|"DNA subscription"| DNA["DNA-C-TIER-PKG-TERM<br/>(3/5/7 year)"]
    CHOICE -->|"Traditional routing"| ROUT["Catalyst Routing Essentials<br/>ROUT-P-C8300-E-7Y (7 year)"]
    DNA --> TIER{"Select throughput tier"}
    ROUT --> TIER
    TIER -->|"T0"| NOHSEC["No HSEC required"]
    TIER -->|"T1 and above"| HSEC["HSECK9 auto-pulled<br/>C8000-HSEC"]
    NOHSEC --> BOM["Shippable BOM"]
    HSEC --> BOM

You then choose one of two ordering approaches. Option 1 (recommended): bundle the subscription under the platform SKU and select tier/term at purchase. Option 2: order hardware and subscription separately via the software ATOs L-DNA-C8300 or L-DNA-C8200.

A minimal, shippable bill of materials for a C8300 under Option 1:

PID                 Description                                   Type
------------------  --------------------------------------------  -----------
C8300-2N2S-4T2X     Chassis, CPU, interfaces (base IOS-XE image)  Hardware
DNA-C-T2-A-3Y       Tier 2, Advantage, 3-year subscription        Subscription
C8000-HSEC          High Security crypto (auto-included at T2)     Perpetual

That subscription line resolves internally to NWSTACK-T2-A (perpetual network stack) plus DSTACK-T2-A (term software stack). The single DNA-C-... line you see on the quote is carrying both the perpetual base and the term software — which is exactly why, when the term lapses, the router keeps running at T2 in autonomous mode: the NWSTACK-T2-A entitlement never expired.

References