ISR 4000 to Catalyst 8000: the Model Mapping, and the Licence That Decides Your Throughput
Written and maintained by Haink's network infrastructure team · Verified against Cisco bulletins, data sheets and ordering guides, 22 August 2026 · authorized-channel, serial-verified
On the ISR 4000, a licence unlocked performance the box already had. On the Catalyst 8000, the licence is the performance — and it is a subscription. That single change is the whole migration. A C8300-2N2S-4T2X will do 18.9 Gbps of IPsec in hardware, and it will hand you 400 Mbps if the subscription tier says 400 Mbps, no matter what the data sheet promised.
This page covers the model mapping, what carries over and what does not, and how the licensing tiers work — including a deadline in January 2027 that quietly removes the cheap option.
Where the ISR 4000 stands
| Milestone | ISR 4221 / 4321 / 4331 / 4351 / 4431 / 4451 | ISR 4461 |
|---|---|---|
| End-of-sale | 7 November 2023 | 20 January 2025 |
| End of software maintenance | 31 August 2025 — passed | 20 January 2026 — passed |
| End of new service attachment | 6 November 2024 — passed | 20 January 2026 — passed |
| End of service contract renewal | 5 February 2028 | 17 April 2029 |
| Last date of support | 30 November 2028 | 31 January 2030 |
Hardware support runs to late 2028, which sounds comfortable. The software position does not. Cisco's release notes are explicit: "Starting with Cisco IOS XE 17.15.x, only the ISR4461 platform is supported; the last supported software release for all other ISR4K series routers is 17.12.x." The rest of the family is frozen on 17.9.x or 17.12.x for its remaining life.
For most branch estates the practical consequence arrives before 2028. Any project that needs a capability shipped after 17.12 — a newer SD-WAN feature, a TLS or cipher change, a compliance-driven hardening default — stops at the platform. And because end of new service attachment passed in November 2024, an uncovered ISR 4000 bought on the secondary market today can never be placed under a Cisco contract.
Model mapping
Cisco's bulletin gives a per-model migration, not a per-family one:
| ISR 4000 | Catalyst 8000 replacement |
|---|---|
| ISR4221 | C8200L-1N-4T |
| ISR4321, ISR4331 | C8200-1N-4T |
| ISR4351 | C8300-2N2S-6T |
| ISR4431 | C8300-1N1S-4T2X or C8300-1N1S-6T |
| ISR4451 | C8300-2N2S-4T2X or C8300-2N2S-6T |
| ISR4461 | C8300-2N2S-4T2X |
Performance, and why the data sheets do not compare
A caution before the numbers. Cisco publishes different metrics for the two generations: the ISR 4000 data sheet gives aggregate CEF forwarding by licence level and contains no IPsec figures at all, while the Catalyst 8000 data sheets give separate tables for autonomous and SD-WAN mode, each with IPsec at 1400 bytes and at IMIX. Anyone putting the two side by side in a single table is comparing different measurements.
What the ISR 4000 data sheet actually says, as aggregate CEF throughput:
| Model | Default | Performance licence | Boost (CEF only) |
|---|---|---|---|
| ISR4321 | 50 Mbps | 100 Mbps | 1.5 Gbps |
| ISR4331 | 100 Mbps | 300 Mbps | over 2 Gbps |
| ISR4351 | 200 Mbps | 400 Mbps | over 2 Gbps |
| ISR4431 | 500 Mbps | 1 Gbps | over 4 Gbps |
| ISR4451 | 1 Gbps | 2 Gbps | over 4 Gbps |
And the Catalyst 8000 in autonomous mode:
| Model | IPv4 forwarding | IPsec @ 1400 B | IPsec @ IMIX |
|---|---|---|---|
| C8300-2N2S-4T2X | up to 19.7 Gbps | up to 18.9 Gbps | 9.3 Gbps |
| C8300-1N1S-4T2X | up to 19.7 Gbps | up to 16.9 Gbps | 6.6 Gbps |
| C8300-2N2S-6T | up to 19.7 Gbps | up to 1.9 Gbps | 1.9 Gbps |
| C8300-1N1S-6T | up to 19.7 Gbps | up to 1.9 Gbps | 1.9 Gbps |
| C8200-1N-4T | up to 3.8 Gbps | up to 1 Gbps | 900 Mbps |
| C8200L-1N-4T | up to 3.8 Gbps | up to 500 Mbps | 400 Mbps |
The ten-fold IPsec gap between the 4T2X and 6T variants of the same C8300 is not a different crypto engine — both have Intel QuickAssist. It is the ports: the 4T2X carries 2×10G interfaces where the 6T has only gigabit. If the branch has or will have a multi-gigabit circuit, that suffix is the decision, and it is easy to lose in a spreadsheet where both rows read "C8300".
Licensing: the tier is the product
The Boost licence is gone. Cisco's documentation states that "a Cisco DNA license subsumes all performance, boost, and technology package licenses (securityk9, uck9, and appxk9)" — everything that used to be a separate line on an ISR order is now inside the subscription.
What replaces it is a bandwidth tier, and the tier is a hard ceiling:
| Tier | Nominal | Aggregate |
|---|---|---|
| T0 | up to 25 Mbps | up to 50 Mbps |
| T1 | up to 200 Mbps | up to 400 Mbps |
| T2 | up to 1 Gbps | up to 2 Gbps |
| T3 | up to 10 Gbps | up to 20 Gbps |
Three consequences that shape a quote:
- Out of the box the router is throttled. Default throughput is 10 Mbps in autonomous mode and 250 Mbps in controller mode until the licence level is configured. More than one migration has "failed" in a maintenance window for exactly this reason.
- Essentials caps at T2. Cisco documents that "Tier 3 (T3) or higher tiers are not supported with the Network Essentials and DNA Essentials licenses." A ten-gigabit branch requires Advantage or above — the licence tier and the feature tier are coupled.
- In SD-WAN mode the tier overrides the hardware entirely. The customer "is only entitled to the Cisco DNA bandwidth tier purchased, irrespective of the underlying platform supporting higher throughput." An 18.9 Gbps-capable C8300 on a T1 subscription is a 400 Mbps router.
Encryption has its own gate. Without an HSEC licence a Catalyst 8300 will not exceed 250 Mbps of encrypted throughput and 1,000 tunnels. HSEC is included at no additional cost with T1 subscriptions and above, but it must be present on the order and requires a Smart Licensing Authorization Code — it is not something you can enable later in a hurry.
One more line that gets missed in TCO models: the DNA subscription does not cover IOS-XE software updates for the perpetual network stack. That is Smart Net Total Care, and it is a separate purchase.
The cheap option closes on 25 January 2027
Catalyst Routing Essentials is end-of-life.
On 27 July 2026 Cisco announced end-of-life for the Catalyst Routing Essentials licences — the seven-year, lower-cost alternative to a DNA subscription, ordered as ROUT-P-C8200-E-7Y and ROUT-P-C8300-E-7Y. End-of-sale and last ship is 25 January 2027, end of change and renewal 25 January 2029, last date of support 31 January 2030. The bulletin states: "There is no replacement available."
For anyone planning an ISR 4000 refresh, this changes the sequencing. Routing Essentials is the licence that makes an autonomous-mode Catalyst 8200 or 8300 affordable over seven years without a DNA subscription — and it can only be ordered for another five months. If the migration was scheduled for the 2027 budget year, the licence decision has moved ahead of the hardware decision. One caveat: Routing Essentials is not compatible with controller mode, so it only helps if the branch is staying autonomous.
What carries over, and what does not
Cisco's ordering guide claims reuse of "over 70% of the ISR4000 platform family's modules," which is broadly true and worth checking line by line anyway.
Carries over — NIM modules across both C8200 and C8300: NIM-ES2-4/-8/-8-P, NIM-1T/2T/4T, NIM-16A, NIM-24A, the xDSL NIMs, the T1/E1 and BRI NIMs, the analogue voice NIMs (FXO/FXS/E&M), NIM-PVDM-32/64/128/256, and the LTE-Advanced NIMs. SM-X service modules carry over to the C8300 only — the C8200 has no service-module slots at all.
Does not carry over, per Cisco's own FAQ documents:
- All EHWIC modules from ISR G2 — "will not work"
- ASR 1000 SPA cards — "SPAs are not compatible"
- The switching service modules SM-X-ES3-16-P, -24-P and -48-P
- SM-X-6X1G and SM-X-4X1G-1X10G
- NIM-1GE-CU-SFP and NIM-2GE-CU-SFP
- UCS-E M1 and M2 blades (M3 and later are supported, and require IOS-XE 17.11+)
- All DRAM, flash and storage — the part numbers are new (MEM-C8300-*, MEM-C8200-*, M.2 modules), and on the Catalyst 8000 the 8 GB of flash is soldered to the board and cannot be expanded
Where a module has a successor, it is a new part rather than a compatible one: SM-X-16G4M2X becomes C-SM-16P4M2X, SM-X-40G8M2X becomes C-SM-40P8M2X. Cisco notes these "are not compatible with Cisco 4000 Series ISRs" — the substitution runs one way only. On the useful side, the C-SM-NIM-ADPTR adapter lets two NIMs occupy a single C8300 service-module slot, which has no ISR 4000 equivalent.
Three capabilities disappear entirely rather than migrating: Performance Routing (PfR), on-box Call Manager Express, and WAAS as a native container. If any branch depends on those, the migration is an architecture change, not a hardware swap.
Autonomous, SD-WAN, or SD-Routing — decide before you configure
The Catalyst 8000 runs in more than one management model, and the choice is not casually reversible.
- Autonomous mode is the default and the direct equivalent of what an ISR 4000 does today: classic IOS-XE, CLI, SNMP, NETCONF, no controller required. A straight lift from an ISR 4000 running classic IOS-XE stays here, and the configuration transfers conceptually one to one. It needs a Network stack licence.
- Controller mode (SD-WAN) requires a DNA stack licence and a Catalyst SD-WAN Manager at version 20.3.2 or later.
- SD-Routing, available from IOS-XE 17.12.1a, is the middle path: normal routing, centrally managed through SD-WAN Manager, without an SD-WAN overlay.
The mechanical warning: controller-mode enable erases the startup configuration and the certificates in NVRAM. Switching a configured router into SD-WAN mode is a full rebuild, not a toggle. Decide the mode before the device is staged, not after.
Software
Minimum releases are per-platform: 17.3.2 for all four C8300 models, 17.4.1 for the C8200-1N-4T, and 17.5.1 for the C8200L-1N-4T. Cisco's suggested releases at the time of writing are 17.12.8 or 17.15.6 for the Catalyst 8200 and 8300, against 17.9.10 or 17.12.8 for the ISR 4000 family.
The forward path diverges sharply. The Catalyst 8200 and 8300 have continued through 17.15.x and 17.18.x and into the renumbered 26.1.x series, while the ISR 4000 stopped at 17.12.x. One change worth flagging for anyone planning to land on the newest train: in 26.1.1 all insecure CLI commands are blocked by default, and legacy commands require system mode insecure. An upgrade from 17.x adds that automatically to avoid breaking a live service, but a fresh build will not have it.
How to sequence this
- Decide the management mode first. Autonomous, SD-Routing, or SD-WAN — it determines the licence stack and cannot be changed later without wiping the configuration.
- Size the bandwidth tier against the circuit, not the chassis. The tier is the ceiling; the hardware capability is irrelevant above it.
- Check the Essentials ceiling. If any site needs T3, Essentials is off the table for that site.
- Settle the licence before the hardware if staying autonomous, because Routing Essentials can only be ordered until 25 January 2027.
- Audit the modules against the carry-over list, and price replacements for what does not move.
- Pick the port variant deliberately — 4T2X versus 6T is a ten-fold IPsec difference on the same chassis.
Send us your ISR inventory
Send the router part numbers and the installed modules. We return the Catalyst 8000 mapping, which modules carry over, the licence tier your circuits actually need, and firm lead times — within one business day.
Frequently asked questions
Is there still a Boost licence on the Catalyst 8000?
No. Performance and Boost licences do not exist on the platform — the DNA subscription subsumes them along with securityk9, uck9 and appxk9. Throughput is set by the bandwidth tier instead.
Why is my new Catalyst 8300 only doing 10 Mbps?
Because that is the default until the licence level is configured. Autonomous mode ships throttled to 10 Mbps and controller mode to 250 Mbps. Configure the throughput level for the tier you bought.
Do I need SD-WAN to use a Catalyst 8000?
No. Autonomous mode is the default and gives you classic IOS-XE with no controller. SD-WAN is a deliberate choice that requires a DNA stack licence and an SD-WAN Manager, and switching into it erases the existing configuration.
Will my NIM modules move to the new router?
Most will. The common serial, analogue voice, T1/E1, xDSL and PVDM NIMs are supported on both the C8200 and C8300. The exceptions to check are NIM-1GE-CU-SFP and NIM-2GE-CU-SFP, all EHWIC modules, the SM-X-ES3 switching modules, SM-X-6X1G and SM-X-4X1G-1X10G, and all memory and storage — none of those carry over.
What is happening to Catalyst Routing Essentials?
It went end-of-life on 27 July 2026, with end-of-sale on 25 January 2027 and no replacement. It is the low-cost seven-year alternative to a DNA subscription for autonomous-mode deployments, so if that is the intended licensing model, the order has to be placed before that date.
How long can I keep running ISR 4000?
Hardware support runs to 30 November 2028 for the main family and 31 January 2030 for the ISR4461. Software is the tighter constraint: maintenance releases ended in August 2025 and the family is capped at IOS-XE 17.12.x. Note also that new service attachment closed in November 2024, so uncovered units cannot be brought under contract.
Related
- Cisco end-of-life guide — every family in migration, with the binding dates
- Catalyst 2960-X replacement — the same licensing shift on the switching side
- How to choose Cisco switches, routers and firewalls
- Enterprise routers · Networking overview · Cisco stock and lead times
- Gulf fintech network — 30-site Cisco and Fortinet rollout in six weeks
- Gray-market and channel risk · How to verify an in-stock claim
Sources
- Cisco — ISR 4200/4300/select 4400 end-of-life bulletin · ISR 4461 bulletin
- Cisco — ISR 4000 data sheet (CEF throughput by licence)
- Cisco — Catalyst 8300 data sheet · Catalyst 8200 data sheet
- Cisco — Catalyst 8300/8200 ordering guide (module carry-over, mandatory subscription)
- Cisco — Configure licences and throughput on Catalyst 8000 (DNA subsumes boost; default throughput)
- Cisco — DNA software for SD-WAN and routing ordering guide (tier definitions, HSEC)
- Cisco — Routing Essentials end-of-life bulletin
- Cisco — IOS-XE 17.15 release notes for ISR 4000 (17.12.x ceiling) · Catalyst 8300 FAQ (incompatible modules)