Cisco 8000 Series Secure Routers Frequently Asked Questions (FAQ)

Q. What is Cisco adding to its portfolio of MX platforms?

A. Cisco is expanding its MX portfolio with a new high-performance, AI/ML and PQC ready secure WAN Appliance that is purpose-built for the network edge of campuses, large enterprises or service providers. They are specifically designed to meet the emerging needs of high-speed Ethernet WAN deployments driven by increasing adoption of distributed AI and cloud connectivity. Featuring dual 25Gbps WAN interfaces, this router boosts integrated security performance to beyond 10Gbps and efficiently aggregates multiple traffic streams. In addition, it delivers a robust suite of capabilities—including advanced routing, enhanced application experience, assurance, deep network insights, and comprehensive security—making it an ideal solution for demanding edge environments.

Q. What are the key differences between the current MX portfolio and the Cisco® 8000 Series Secure Router (with MX OS)?

A. The Cisco Cisco® 8000 Series Secure Router platforms adapts the equivalent IOS-XE model to run MX OS, thus providing the following key benefits

Q. Can you list the benefits of MX OS on the Cisco Secure 8000 Series MX platform?

A. The Cisco 8000 series leads the industry delivering advanced security, AI-powered automation, performance enabled by post-quantum cryptography (PQC), and seamless cloud management to future-proof your WAN. MX OS can therefore use the following capabilities:

• Post Quantum (PQC)
  • Some models include Secure Boot to verify software and hardware authenticity, and can detect and react to tampering attempts 
  • Future proofed to support Commercial National Security Algorithm (CNSA 2.0) mandates
• AI /ML Engine built into the Secure Networking Processor for
  • Performance acceleration
  • Enhanced Security (eg: Exploit Detection)
• Inline crypto engine to speed up encryption/decryption of data-in-flight
• Integrated HW accelerators to improve forwarding performance using the for entire data-path

And finally, the Cisco 8000 Series Secure Routers are built with sustainable packaging in mind

Q. What is the naming convention for the Cisco® 8000 Series Secure Routers (MX OS) platform?

A. The product is named as C8455-G2-MX, C8355-G2-MX, C8121-CW-G2-MX. Each part of the product ID is outlined as follows:

• C = Standard Product ID (PID) prefix. In this case, “C” for Cisco.
• 8400, 8300, 8100 = Platform series.
• G2= Second Generation of the Cisco 8000 Series.
• CW = Integrated interfaces like "C" for Cellular and "W" for Wi-Fi
• MX = A reference to the product using MX OS (vs IOS-XE)

Q. How many WAN ports do the different Cisco® 8000 Series Secure Routers have?

A. At launch the C8455-G2-MX, C8355-G2-MX, C8111-G2, and C8121-G2 will have 2 x WAN ports. Beginning with MX26.1, these devices will have for support for up to 4 WAN ports.

Q. Can we switch the operating system on the Cisco® 8000 Series Secure Routers (MX OS) to IOS-XE?

A. All Cisco® 8000 Series Secure Routers models continue throughout their life with the same OS personality that they were ordered with. It is NOT possible to convert the Operating System (OS) on the Cisco® 8000 Series Secure Routers from MX OS to IOS-XE.

Q. Will the Cisco® 8000 Series Secure Routers ship with optics in-built when ordered? 

A. The Cisco® 8000 Series Secure Routers do not ship with optics (SFP28/ SFP+/ SFP) built in by default. You may order these optics when ordering the Hardware or as a spare at a later time as needed. You will need to manually install the optics.

All supported optics are listed in the MX family datasheet and available on the ordering tool (CCW). 

Q. Are all optics supported on the IOS-XE based Cisco® 8000 Series Secure Routers supported on the MX OS. Are the supported optics hot-swappable?

A. Not all optics supported on the Cisco® 8000 Series Secure Routers (that runs IOS-XE) are supported on the Cisco® 8000 Series Secure Routers (Secure router that runs MX OS). The Cisco ordering tool (CCW) and the datasheet will reflect additional optics as they are supported at launch or in future releases.  

Yes, the optics on the Cisco® 8000 Series Secure Routers are hot-swappable and maybe swapped when the appliance is powered on.

Q. Are there plans to discontinue the currently available MX security platforms or MX OS?

A. The introduction of the Cisco® 8000 Series Secure Routers reinforces Cisco’s continued investment into and expanding the existing MX OS security platforms as also into feature development on the MX Operating System (MX OS). The current generation of MX platforms, with many millions in use worldwide, is proof of the popularity of these platforms and will continue to fill their role as part of the larger family. 

All End of Sale (EoS) announced and MX platforms that will be EoS announced in future are located here. 

Q. Which firmware and feature set will the Cisco® 8000 Series Secure Routers be capable of running?

A. The Cisco® 8000 Series Secure Routers run MX OS. The C8455-G2-MX launched with MX 19.2. The C8355-G2-MX launched with MX 26.1.

Similarly, the C8100 models and their various combinations of Cellular, Wi-Fi launched with MX 19.2.

All features supported on the existing MX security platforms will be supported on the various C8100-G2-MX, C8455-G2-MX, and C8355-G2-MX models.

The new Cisco® 8000 Series Secure Routers will be able to operate in the same Organization as the existing MX platform. MX 26.1 version brings several new features and capabilities to the Cisco® 8000 Series Secure Routers and are documented here

Q. Where do I position the Cisco® 8000 Series Secure Routers in comparison to the current MX platforms?

A. The Cisco 8455-G2-MX Secure Router platforms provides Threat Management performance up to 8Gbps and Layer 3/ 7 Firewall performance up to 20Gbps. It provides up to 1.5-Million flows at launch with the capacity to scale further in upcoming software releases. The C8455-G2-MX is positioned for large enterprises and campuses that are required to aggregate multiple WAN connections as a head end with with high security performance and scale.

The Cisco 8355-G2-MX Secure Router provides Threat Management performance up to 4Gbps and Layer 3/ 7 Firewall performance up to 10Gbps allowing customers with needs for multiple 10Gbps interfaces and provide for upto 90W of UPoE+ (802.3bt) power to Cisco Cellular Gateways, Access Points, Phones, Cameras and Terminals at the Branch. 

The Cisco 8100-G2-MX Secure Router provides Threat Management performance up to 1.2Gbps and Layer 3/ 7 Firewall performance up to 2Gbps allowing customers with needs for multiple 2.5Gbps interfaces and provide for Power over Ethernet along the standards of 802.3at and 802.3bt to power to Cisco Cellular Gateways, Access Points, Phones, Cameras and Terminals at the Branch. Refer to the datasheet for details about specific options and PoE. 

A host of Security and SDWAN features allow customers to take advantage of new capabilities provided by the routers and are listed here. The new routers provide Improvements in performance and scale with the relevant metrics listed in the MX Sizing Guide and Principles. Both the Cisco 8455-G2-MX and Cisco 8355-G2-MX Secure Router platforms provide support for dual AC power supply by default while the C8355-G2-MX will allow customers to order the 230W power supply, supported as part of a future software upgrade. The C8100-G2-MX models provide support for single 150W/ 250 W external AC power adapter

Q. What licenses are needed to operate the Cisco® 8000 Series Secure Routers?

A. All the Cisco 8455-G2-MX, Cisco 8355-G2-MX, and Cisco 8100-G2-MX Secure Router platforms offer support for both Co-term and Subscription licenses apart from the option to support Enterprise Agreements

Please refer here for the different licensing options available on the Cisco 8455-G2-MX, Cisco 8355-G2-MX and Cisco 8100-G2-MX Secure Router platforms. Supporting documents listed will lead you to license guidelines and compliance needs. Please refer to the MX family datasheet for additional information on the licensing SKU’s. In general, License SKU’s will follow the terminology indicated below for each of subscription and co-term.

Subscription Licensing SKU’s will follow the format LIC-CSR-(XL/L/S)-E

• LIC = Standard Licensing ID prefix. In this case, “LIC” for License.
• CSR = Cisco Secure Routers.
• S or L or XL= Product class where the specific hardware falls
• E or A = A reference to the license supporting Essentials or Advantage feature set

Refer to the link here for the latest feature set in each of Essentials and Advantage

Co-term Licensing SKU’s will follow the format LIC-C8455-ENT-5Y

• LIC = Standard Licensing ID prefix. In this case, “LIC” for License.
• C8455/ C8355/C8111/C8121 = Specific product that the license is applicable to
• Feature Set
  • ENT= Enterprise (ENT) Feature set.
  • Advanced Security (SEC) and
  • SD-WAN (SDW)
• XY = Where XY is the term that may vary from 1 year to 7 years

 Refer to the link here for the latest feature set in each of Enterprise, Advanced Security and SD-WAN

Q. I wish to use the Cisco® 8000 Series Secure Routers in warm-spare High Availability (HA) Mode. How do I order my licenses and (or) use them

A. High availability can be used to minimize downtime in the event of a hardware failure. Only one license is required for an HA pair in warn spare mode. The warm spare unit does not require a separate license. 

When ordering in Cisco Commerce Workspace, you may order (as an example) the first unit with a license followed by the second unit where you opt out of ordering the license

Q. I wish to use the Cisco® 8000 Series Secure Routers With Unified Branch solution. Is the platform supported? Do I need to use a specific license?

A. Yes, the platform is supported as a part of the Unified Branch / Branch as a Code solution. Licenses, as needed for the specific features and platforms need to be procured. Refer here for more details on the Co-Term OR Subscription Licenses to be procured for your devices.

Q. My Cisco® 8000 Series Secure Routers shows serial number as LLLYYWWXXXX and a Cloud ID as WWW-WWW-WWW. How should I claim a device into Dashboard

A. With the launch of the Cisco® 8000 Series Secure Routers, the “Meraki Serial Number” has been renamed to “Cloud ID”. This change will reflect on the Cisco Secure router label, packaging, QR Code etc. The “Cloud ID” is used to claim the device in the Meraki Dashboard device claim workflow.

The serial number will be of the format LLLYYWWXXXX. You will use the Cloud ID to claim the device into or perform all functions on the Dashboard. The existing MX devices will continue to use the QWW-WWW-WWW format for Meraki Serial Number and the Cloud ID will follow the same construct. In short, there is no functional change to how this is used and or claimed in Meraki Dashboard.

Customers who have an Organization that is a combination of current generation MX and Cisco® 8000 Series Secure Routers must be aware of this distinction.

Q. I have existing co-term or subscription licenses. Can I transition these licenses to the new Cisco® 8000 Series Secure Routers

A. Any existing licenses are not transferable to the new Cisco® 8000 Series Secure Routers. New licenses listed above will need to be procured.

Q. I want to buy the Cisco® 8000 Series Secure Routers but use it at a later point in time. Can I procure a license only when I begin using it

A. Yes, you may opt out of procuring a license at this time and procure the license when you are ready to use the device. Please note that the device will not work without a license.

Q. Default WAN ports are labeled "Internet" on current MX products. Will the same labeling continue on the Cisco® 8000 Series Secure Routers

A. The default WAN ports on the Cisco® 8000 Series Secure Routers are labeled as WAN 1 and WAN 2. These maybe used as Primary (WAN 1) and Secondary (WAN 2) WAN ports on the platform. In most cases, the WAN 1 will permanently remain WAN while the WAN 2 maybe converted from WAN to a LAN. Additional ports, based on the model maybe converted from LAN to WAN.

Refer to the specific device's datasheet for more details on the ports and capabilities of individual platforms.

Q. Where can I get additional details on the Cisco® 8000 Series Secure Routers and how it compares with current generation of MX platforms

A. The MX family datasheet details the specifications of the current generation and the new Cisco® 8000 Series Secure Routers. The MX Sizing Guide and Principles compares the measured values in performance and scale allowing you to position the new platform in relation to current generation of MX. Individual data sheets provide detailed specifications for the different models.

Q. What accessories are available with the Cisco® 8000 Series Secure Routers?

A. The 19-inch rack-mount kit is part of the default accessory kit and is shipped with the platforms. In addition, the package will contain a mechanical ground lug, shipping labels and any applicable regulatory and compliance document.

The C8455-G2-MX includes two fans as well as 2x 250WAC power supplies. Both the fans and power supplies are field replaceable and hot swappable.

The C8355-G2-MX, a fanless model, includes two field replaceable 110W AC power supplies. While the platform is capable of supporting UPoE+, customers will be able to order a UPoE+ capable 230W power supply and it's support will come in a future software upgrade. 

The C8100-G2-MX includes one external power supply, which can provide: 150WAC or 250WAC. The platform can support between two (for C8111 models) and four (for C8121 models) ports of PoE based on the 802.3at or 802.3bt specifications.

Q. With redundant power supplies, can we switch the power to primary when it fails and the router is running on the secondary power supply?

A. There is no concept of primary or secondary power supply for the Cisco® 8000 Series Secure Routers. The power supplies are simply redundant, so that when one fails the other Power-Supply Unit (PSU) takes over by transparently providing power to the entire system. No switching or intervention is required. Both share the load when running in the system; however, when one fails the other provides power to the complete unit. When the failed PSU is replaced with a new PSU in the system, the two power supplies are redundant.

Q. Does the Cisco® 8000 Series Secure Routers have support for Federal Licenses and Enterprise Agreements?

A. Yes, Federal Licensing and Enterprise Agreement licenses are available for the Cisco® 8000 Series Secure Routers hardware. Refer to the MX family datasheet and ordering guide for additional details.

Q. The Cisco® 8000 Series Secure Routers provides a console, management port, and front panel LED's for Alarms and Alerts. What purpose do these ports and LED's serve when operating with Meraki OS?

A. The Cisco® 8000 Series Secure Routers (as they share a common hardware with their IOS-XE counterparts) have a console port and a management port. Users can access the local status page using the management port to make local configuration changes to get the device connected to the internet, monitor device status, and perform local troubleshooting.

The console port and the USB-C 3.0 ports are not usable. Similarly, any M.2 ports cards plugged into the expansion slot will not be recognized.

As with the current generation of MX platforms, all products with MX OS will continue to use the Dashboard for Alarms and Alerts.

Q. What power cables work with the Cisco® 8000 Series Secure Routers?

A. Cisco Secure 8455-G2-MX Series Routers support high-efficiency power supply units. The product supports 80 PLUS Platinum Certified PSUs offering up to 94% efficiency at 50% load and titanium PSUs reaching up to 96% efficiency at 50% load at 230V input. Both power-supplies on the C8455-G2-MX use a standard IEC C13 connector.

Cisco 8300 Series Secure Routers support a variety of power supply configurations. The C8355-G2-MX is powered by 2 x 110W External power supplies that are field replaceable and externally accessible. Both power-supplies on the C8355-G2-MX use a standard IEC C5 connector.

Finally, the C8100 Series Secure Routers are powered by one external AC PSU, which can provide 150W (C8111 models) or 250W (C8121 models) and use a standard IEC C14 connector. These power supplies have the highest level of efficiency (6) as determined by the US Department of Energy.

Q. What chassis ventilation considerations should I keep in mind when installing it in the network rack of a Data Center or campus

A. The C8455-G2-MX regulates chassis temperature with internal fans. The fans are always running when the device is connected to power and an onboard temperature sensor and pressure sensor dynamically controls the fan speed for the C8455-G2-MX.

The C8355-G2-MX leverages passive cooling through an external heat sink.

The C8100-G2-MX models use a fan and internal heat sinks to dissipate heat. At 100% fan speed, the fans Sound Pressure Level (SPL) is less than 36 dBa. The average home is approximately 40 dB.

For all rack mounted chassis, the air intake is on the interface side. When mounting Cisco® 8000 Series Secure Routers, ensure at least one rack unit (1RU) of vertical space between the router and other equipment. This ensures adequate heat removal, which in turn helps the local air temperature to stay within the specified operating conditions.

Q. Briefly describe the sustainability features on the Cisco® 8000 Series Secure Routers. Where can I get more information on these initiatives?

A. Cisco is embedding sustainability into the product lifecycle—from manufacturing to end of use. A non-exhaustive list of features includes:

• Powder-coating finish reducing the amount of harmful solvents used and volatile organic compounds.
• Bezel-free design reduces plastic usage.
• Packaged with corrugated and fiber flute materials, containing minimum 25% post-consumer recycled content.
• The Cisco Take back and Reuse program allows customers to return used equipment for responsible recycling and reuse.

Refer to Circular Design Principles and Cisco's Purpose Reporting Hub for more information on Cisco's Environmental, Social, and Governance (ESG) initiatives and performance.

Q. Where can I get the latest details of the Product approvals and compliance for different geographies and (or) standards?

A. The Product Approvals Database is a repository of information regarding the homologation status for given Cisco products in certain countries. Every customer should check the homologation status of the product(s) before placing any purchase order(s) for Cisco Product(s).

Q. Will the Cisco Secure Cisco® 8000 Series Secure Routers be supported with the AI Assistant for Networking?

A. Yes, the AI Assistant for Networking will support the new Cisco® 8000 Series Secure Routers. Refer to the AI Assistant for Networking page for details.

Q. Will the Cisco Secure Cisco® 8000 Series Secure Routers support Thousand Eyes to help monitor applications and network paths?

A. Yes, ThousandEyes integration is available for MX OS with either a Secure SD-WAN Plus or Advanced Security license.

Secure SD-WAN Plus customers receive entitlements for ThousandEyes test units to run tests as a part of the subscription, while Advanced Security customers can purchase ThousandEyes units separately.

Q. Where can I get the latest performance and scale numbers for the Cisco® 8000 Series Secure Routers?

A. The MX Sizing Guide and Principles document maybe used to compare the different models and select or design your network architecture. Performance and scale metrics are based on the most current firmware version defined in the guide.

Q. What is the default warranty that I get on the Cisco® 8000 Series Secure Routers. Is it the same as my current Meraki MX?

A. Cisco® 8000 Series Secure Routers come with a Cisco Limited 2-Year Return To Factory Hardware Warranty as standard. For more information, refer here

Q. Do I follow the current Meraki support procedure if there is a fault on the Cisco® 8000 Series Secure Routers? 

A. Yes, there is no change to the current support procedure for the new Cisco® 8000 Series Secure Routers. Please follow the current support and escalation path(s).   

Q. I am currently using the capabilities provided by Meraki Insights (Web App Health, WAN Health and VoIP Health) ? Does the Cisco® 8000 Series Secure Routers support these capabilities?

A. The features provided by Meraki Insights are targeted for an upcoming future release. As a result, you may not be able to monitor the performance of links, networks and applications associated with this device. 

Q. I wish to use Secure Connect/ Secure Access fabric with the Cisco® 8000 Series Secure Routers. What features or protocols may I use to connect?

A. The Cisco® 8000 Series Secure Routers, using the latest MX26.1 version supports both IPSec and AutoVPN as the means to connect to the Cisco Secure Connect/ Secure Access fabric.