Throughput Tiers, Performance Boost, and HSEC

On Gen 2 Catalyst routers, throughput is a licensed, software-enforced ceiling rather than a hardware property, and the old ISR "Boost" SKU no longer exists as a line item. This section maps the T0–T3 tier ladder to real Mbps, explains why those numbers are platform-specific, and dissects the one performance boundary you cannot buy your way around with a subscription alone: the 250 Mbps encrypted-throughput export gate that forces HSECK9.

The Tier Ladder and What the Numbers Mean

Catalyst 8000 platforms express licensed throughput two ways: a numeric value (10M, 100M, 1G) or a tier (T0–T5). Tier-based licensing is the recommended form from IOS XE 17.7.1a onward; numeric values remain supported. Throughput is set with a single configuration command:

platform hardware throughput crypto {T0 | T1 | T2 | T3 | <numeric>}
! e.g.
platform hardware throughput crypto T2
platform hardware throughput crypto 2.5G

A reload may be required for a new ceiling to take effect. The critical nuance: a tier is a cap, not a fixed rate, and it maps to a different numeric value on different platforms. The actual ceiling is the lower of the tier and the model's maximum platform throughput. Licensed numbers are also expressed per-direction — aggregate throughput is roughly double the licensed figure.

Figure 5.1: Throughput Tier Ladder (T0 to T3)

flowchart LR
    T0["T0: up to 25 Mbps / ~50 Mbps agg (all C8200 and C8300)"] --> T1["T1: up to 250 Mbps / ~500 Mbps agg (all C8200 and C8300)"]
    T1 --> T2["T2: 1 Gbps / ~2 Gbps agg (C8200 and 6T-class C8300 ceiling)"]
    T2 --> T3["T3: 10 Gbps / ~20 Gbps agg (4T2X-class C8300 only)"]

The practical reading: the C8200 has no T3. It, and the 1G-WAN 6T-class C8300 (C8300-1N1S-6T, C8300-2N2S-6T), top out at T2's ceiling of roughly 2 Gbps aggregate. T3 is only meaningful on the 10G-WAN 4T2X models (C8300-1N1S-4T2X, C8300-2N2S-4T2X), which sustain ~17–19 Gbps of IPsec at 1400-byte frames. Licensing T3 on any other box buys nothing.

The HSEC Export Gate

The single hard boundary in this whole scheme is a U.S. export-control rule, not a performance tuning knob. Any device under Smart Licensing Using Policy that must move encrypted throughput of 250 Mbps or more, in either direction, requires an HSEC (HSECK9) license authorized by a Smart Licensing Authorization Code (SLAC).

Figure 5.2: HSEC Export-Threshold Gate

flowchart TD
    Traffic["Traffic on the device"] --> Type{"Encrypted or clear-text?"}
    Type -->|"Clear-text IP/CEF"| Bypass["Governed by tier, gate bypassed"]
    Type -->|"Encrypted IPsec"| Rate{"Above 250 Mbps or over 1000 tunnels?"}
    Rate -->|No| Allowed["Permitted without HSECK9"]
    Rate -->|Yes| Gate["Gate: HSECK9 + SLAC required"]
    Gate --> Unlocked["Bounded only by tier / hardware, tunnel cap lifted"]

Two points architects routinely miss. First, the gate is on encrypted throughput only — clear-text IP/CEF up to the licensed tier flows without HSEC. Second, HSEC is a compliance gate, not a performance tier you buy per Mbps. The same HSECK9 unlocks full crypto regardless of whether you licensed T1 or T3; you do not buy a bigger HSEC for more bandwidth. Because Tier 2 (1 Gbps) inherently exceeds 250 Mbps of crypto, HSECK9 is required at T2 and above.

HSEC PIDs for the Catalyst 8000 family:

• C8000-HSEC — export-compliance license added with bundled DNA orders.
• C8000-HSEC-DNA — the same license when DNA subscriptions are ordered separately (e.g., with L-DNA-C8300 / L-DNA-C8200).

Crucially, HSEC is auto-populated at no additional cost when you order any bandwidth tier under Catalyst Routing Essentials, Cisco DNA Essentials, or Advantage. It is effectively free — but it must be present and SLAC-authorized on the device, or crypto stays pinned at 250 Mbps no matter what tier you paid for.

! request and install the authorization code (online / smart account reachable)
license smart authorization request add hseck9 local
show license authorization
show license summary

Where "Boost" Went

On the ISR 4000 generation, Performance/Boost was a separately orderable SKU that raised the aggregate CEF and crypto ceiling. On Gen 2 that SKU is gone. Cisco's configuration guide is explicit: a Cisco DNA license subsumes all performance, boost, and technology-package licenses (securityk9, uck9, appxk9). Ordering a DNA network-stack or add-on license automatically adds the applicable performance/boost/tech-package rights to the order.

In practice, "boosting" an 8200/8300 means selecting a higher throughput tier inside the DNA subscription — moving T1→T2→T3 unlocks the platform's maximum IP/CEF and crypto throughput, subject to the HSEC gate for anything above 250 Mbps encrypted. There is no DNA-P-BOOST-style PID in the 8200/8300 ordering guide. Cisco further states the Catalyst 8200 does not technically throttle throughput beyond the licensed tier and hardware limit — there is no artificial cap to buy off.

Tier-to-PID Mapping and Entitlement Gating

Throughput is embedded directly in the DNA/Networking subscription PID; you do not purchase bandwidth separately from the subscription.

Suffix E/A/P denotes Essentials/Advantage/Premier; the term is 3Y/5Y/7Y. Two entitlement constraints bind the selection:

• T3 and above are unavailable on Network Essentials / DNA-Essentials. They require Network Advantage or Network Premier. If there is any chance a site will need T3, order Advantage or Premier up front — you cannot bolt a higher tier onto an Essentials subscription.
• HSECK9 is required at Tier 2 and above (auto-included with tier orders under Essentials/Advantage).

Rightsizing the Tier

Figure 5.3: Tier Rightsizing Decision Flow

flowchart TD
    Demand["Aggregate WAN demand"] --> Pick["Pick candidate tier (T0-T3)"]
    Pick --> Model{"Platform = 4T2X-class C8300?"}
    Model -->|"No (C8200 or 6T)"| Cap["Cap at T2 (~2 Gbps aggregate)"]
    Model -->|Yes| AllowT3["T3 available (~20 Gbps aggregate)"]
    Cap --> Crypto{"Over 250 Mbps encrypted?"}
    AllowT3 --> Crypto
    Crypto -->|No| Done["Order tier PID, no HSEC needed"]
    Crypto -->|Yes| HSEC["Confirm HSECK9 + SLAC present"]
    HSEC --> Done

• License to aggregate WAN demand, not line rate. The tier caps aggregate throughput at roughly 2× the per-direction figure. T1 (250 Mbps one-way / 500 Mbps aggregate) covers most branch sites; reserve T2/T3 for hub, aggregation, or 10G-uplink roles.
• Match the tier to the hardware ceiling. Never license T3 on a 6T-class C8300 or any C8200 — both top out at T2. T3 only pays off on 4T2X 10G models.
• Treat the 250 Mbps encrypted line as a design boundary. Any site above 250 Mbps of IPsec, or needing more than 1,000 tunnels, must carry a SLAC-authorized HSECK9. It is free with the tier but must be physically present and authorized.
• Start conservative and grow. Throughput is a runtime setting (platform hardware throughput crypto); you can raise it after loading a higher-tier license, subject to a reload. Verify the running ceiling against the entitlement with show platform hardware throughput crypto and show license summary.

References

• Cisco — Configure Licenses and Throughput for Catalyst 8000 Series Physical Platforms: https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/configure-licenses-throughput-catalyst-8000-platforms.html
• Cisco — Catalyst 8300/8200 Series Edge Platforms Ordering Guide: https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/cat-8300-8200-series-edge-plat-og.html
• Cisco — Catalyst 8200 Series Edge Platforms FAQ: https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/catalyst-8200-series-edge-platforms-faq.html
• Cisco — Catalyst 8300 Series Edge Platforms Data Sheet: https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/datasheet-c78-744088.html
• Cisco — Available Licenses (Catalyst 8300 Software Configuration Guide): https://www.cisco.com/c/en/us/td/docs/routers/cloud_edge/c8300/software_config/cat8300swcfg-xe-17-book/m-available-licenses.html
• Cisco — Install HSEC License in Catalyst 8300 (Autonomous Mode): https://www.cisco.com/c/en/us/support/docs/routers/catalyst-8300-series-edge-platforms/225417-install-hsec-license-in-catalyst-8300.html