The building blocks: what an ISE deployment requires

An ISE deployment needs three things: the appliance, the software license, and support. Appliances run on SNS 3800 hardware (small SNS-3815-K9, medium SNS-3855-K9, large SNS-3895-K9), on VMs (VMware, KVM, Hyper-V, Nutanix AHV, OpenShift), or as IaaS on AWS, Azure, or Oracle Cloud. Support splits by form factor — ISE hardware carries no complimentary basic support. Evaluate free with the built-in 90-day license (100 endpoints, all features); note it expires silently with no alarms. Extensions need an SCM case with the PANs' UDIs.

Essentials, Advantage, and Premier: the nested tier model

The tiers are nested: Advantage includes all Essentials features, and Premier includes everything in both. Size quantity to the maximum number of active endpoints expected to connect concurrently on any given day, not headcount. Consumption is measured through RADIUS sessions: a license is consumed when a session starts and released when it ends. Two traps: MAC randomization (privacy MAC) inflates counts, and where RADIUS sessions can't be counted, Cisco falls back to unique endpoint attributes. Under ISE 3.5 the tiers are unchanged, but tracking is visibility-only — monitor peak endpoints and expect non-disruptive Consumption Alerts until a future release enforces them.

Each endpoint consumes one license at the highest tier its authorization policy needs — an endpoint using several Advantage features still consumes a single Advantage license.

License SKUs: subscription, Device Admin, and VM

A-la-carte orders use three SKU roles: a subscription SKU for term and start date, product SKUs for tier and quantities, and a support SKU for the service level. The single subscription SKU, ISE-SEC-SUB, is unpriced on its own, ordered in quantity one (one subscription per customer), defaults to a 36-month term in Cisco Commerce, and provisions within up to 72 hours. Product SKUs order from quantity 50, in 1-, 3-, or 5-year terms, prepaid on a tiered model. The default start date is three days after purchase, adjustable up to 90 days out.

Beyond a-la-carte: Enterprise Agreements, embedded ISE Advantage in the Catalyst Subscription for Switching, or AWS/Azure marketplace private offers.

Smart Licensing: CSSM, SSM On-Prem, and SLR

Connected deployments register to the cloud Smart Software Manager (CSSM), directly or via proxy — Cisco's recommended default. Air-gapped sites with a local server use SSM On-Prem (sync automatic online, manual offline; offline recommended). Highly secured networks use Specific License Reservation (SLR), activating licenses without reporting usage — but SLR breaks nesting: reserve each tier separately, since a higher-tier license does not automatically cover lower tiers in SLR mode, and the total reserved must not exceed what was purchased. Mirror tiers and quantities on both PANs — 100 reserved on the primary but 1 on the secondary means a 30-day grace period on failover; 100/100 fails over cleanly. Over 100% of purchased endpoints, or expired licenses, triggers daily GUI alerts. Under ISE 3.5, use the Historical Peak License Consumption report (Reports > Audit > License Usage) to check usage before enforcement arrives in a later release.

Renewals, cancellations, and modifications

Subscriptions auto-renew for 12 more months by default — no new quote needed — with reminders from 120 days out. Cancel up to 60 days before the new term; miss it and the term renews, and mid-term cancellation for credit is never allowed. Manual renewals come in 12-, 36-, or 60-month terms via the Change Subscription quote process, and products, quantities, and terms can change at any time — including tier upgrades.

Worked example: a subscription BOM for a 2,000-endpoint deployment

A university peaks at 2,000 concurrently connected endpoints — 1,400 core NAC only (AAA, 802.1X, guest), 450 needing profiling, BYOD, TrustSec, and pxGrid with its SIEM, and 150 needing posture with MDM compliance — running on 6 virtual nodes with TACACS+ on 2 PSNs. The BOM: ISE-SEC-SUB × 1 — subscription anchor, 36-month term, start date aligned with the VM rollout; ISE-E-LIC × 1,400 — Essentials, 3-year term; ISE-A-LIC × 450 — Advantage, 3-year term; ISE-P-LIC × 150 — Premier, 3-year term; L-ISE-TACACS-ND= × 2 — perpetual Device Admin, one per TACACS+ PSN; SVS-ISE-SUP-E — Software Support Enhanced, the recommended level, consistent across all endpoints. Later growth goes through Change Subscription — never a second subscription, since each customer may hold only one.

Where to source

Most failed ISE orders come from the quiet rules — one subscription per customer, sizing to peak concurrent endpoints, one consistent support level, and reserving each tier separately under SLR. Validate the BOM against the official licensing tables before it reaches Cisco Commerce. ITMall engineers review Cisco ISE subscription license product page on ITMall configurations before quoting — see the full specifications for tier sizing and subscription pricing, or browse the current catalog at ITMall.

Source: this is an original guide rewritten from Cisco's official Cisco ISE Licensing Guide (no copyright year was shown in the fetched page text). Sourcing: https://www.itmall.sale/.

The family: four models and the 8500 vs 8500L naming rule

Cisco's naming note is worth learning first: "Catalyst 8500 Edge Platform" means the C8500-20X6C, C8500-12X4QC, and C8500-12X; "Catalyst 8500L Edge Platform" is the C8500L-8S4X alone; "Catalyst 8500 Series Edge Platforms" means all four together. All four run the same unified IOS XE image and support both traditional routing and Catalyst SD-WAN — what differs is port density and speed.

The C8500-20X6C is the flagship: 20×1/10GE plus 6×40/100GE ports, all allowed to run simultaneously, up to 800GE of enabled capacity. The C8500-12X4QC pairs 12×1/10GE with 2×40GE and 2×40/100GE ports, up to 240GE simultaneously — the aggregation pick when 100GE uplinks are needed.

Two ways to order: Option 1 vs Option 2

A Cisco DNA subscription is required for every Catalyst 8500 Series platform, and Cisco Commerce Workspace (CCW) offers two ways to build the order. Option 1 — the recommended path — orders the subscription together with the hardware through the top-level platform SKU, so the subscription start date syncs with the hardware shipment date (or an offset of up to 90 days). Option 2 orders the two halves separately — hardware through the platform SKUs and the subscription through the dedicated L-DNA-C8500 SKU — with the subscription start date delayed by up to 90 days; this path requires a Smart Account / Virtual Account (SA/VA).

Mandatory selections: software image, mode, and power

Three choices are mandatory on every hardware SKU. First, the software image: the unified Cisco IOS XE image (e.g. SC8KAEPUK9-173), which carries traditional and SD-WAN functionality in a single binary. NE, UNL, and NEL variants also exist but do not offer Catalyst SD-WAN functionality. Second, the software mode (next section). Third, the power supply: choose AC or DC, and select power cables — cable selection is mandatory with an AC supply. The platforms ship with two redundant power supplies; the C8500-20X6C ships with three (n+1) with a fourth optional.

Autonomous mode vs Controller mode

The unified image supports two modes in a single binary, and you can switch between them later — but the choice must be recorded at order time. Autonomous mode is for traditional routing (IOS XE) deployments; Controller mode is for Catalyst SD-WAN deployments managed by a Cisco Catalyst SD-WAN Manager controller. The order-time default is autonomous: select IOSXE-CTRL-MODE explicitly only when the platform will join an SD-WAN fabric.

The DNA subscription: tiers, terms, and the HSEC license

Every 8500 Series platform uses Cisco DNA Advantage tier licenses, sized by aggregate throughput. Tier 2 (up to 2G) is for the C8500L-8S4X only; Tier 3 (up to 20G) is the maximum throughput for the 8S4X, 12X, and 12X4QC; Tier 4 (up to 50G) and Tier 5 (up to 100G) are the only tiers for the C8500-20X6C, and Tier 5 unlocks its full throughput. The tier SKU encodes the deployment type (cloud or on-premises), the bandwidth tier, the feature package, and the term — e.g. DNA-C-T4-A-3Y — and terms run 3, 5, or 7 years. Embedded support covers only the subscription-enabled functions (SD-WAN Manager, Analytics, Validator, Controller, Umbrella SIG Essentials) — the OS and network stack need the hardware support contract.

Crypto also needs attention: under U.S. export rules, full crypto functionality requires the High Security (HSEC) license — without it, a device is limited to 1000 secure tunnels and 250 Mbps of unidirectional crypto throughput. Cisco therefore includes the C8000-HSEC license by default with the hardware, tied to the chassis serial number and enforced on the device.

Optional selections — and the 20X6C special case

The optional menu covers memory, storage, rack-mount kits, optics, and air filtration. Memory offers 16 GB (default), 32 GB, or 64 GB; storage is a 480 GB M2 SATA SSD plus 8 GB USB on the 8500 models, or 16 GB M.2 USB (up to 32 GB or a 2 TB SSD) on the 8500L. Rack options are a 19-inch kit (default), 23-inch kit, or 4-post kit; a NEBS Level 3 air filter assembly is supported on the C8500-20X6C only. Optics are selected from the 1/10/40/100GE options matched to the platform (all four speeds on the 20X6C and 12X4QC; 1/10GE on the 12X and 8S4X) via the transceiver compatibility matrix.

On the 20X6C, several "options" aren't options: the 64 GB memory, 480 GB SSD, and 19-inch kit are integrated into the chassis, invisible in CCW and on the BOM, and non-upgradeable. No 23-inch kit is offered for the 20X6C (Cisco suggests a third-party adapter), and the included 19-inch kit covers 4-post installs. Default accessories (HSEC, RFID, rack kit, 16 GB memory) ship with the other models inside their platform SKUs. Cisco Success Tracks is the default and recommended support service but is not mandatory, and the hardware carries a standard 1-year return-to-factory warranty.

Worked example: a regional aggregation hub BOM

A regional hub needing twelve 10GE downlinks, dual 100GE uplinks, and Catalyst SD-WAN management is a textbook C8500-12X4QC via Option 1. The BOM: C8500-12X4QC × 1 — chassis, the two 40/100GE ports carrying the 100GE uplinks; SC8KAEPUK9-173 × 1 — unified IOS XE image; IOSXE-CTRL-MODE × 1 — controller mode (overriding the autonomous default); PWR-CH1-750WACR × 2 — redundant AC supplies with two power cables; MEM-C8500-32GB × 1 — 32 GB DRAM for higher scale (16 GB is the default); SSD-M2SATA-480G × 1 — 480 GB storage; C8500-ACCKIT-19 × 1 — 19-inch kit (fits a 4-post rack); DNA-C-T3-A-3Y × 1 — DNA Advantage Tier 3 (the 12X4QC's maximum throughput), cloud, 3-year term, in the platform SKU's Subscriptions section; optics — twelve 10GE and two 100GE modules from the compatibility matrix; C8000-HSEC — included by default with the chassis, tied to its serial number. Add a support choice (Success Tracks or partner service) — recommended but optional.

Where to source

The failure points on an 8500 order are nearly always the quiet defaults: sizing a Tier 3 DNA license for a 20X6C that requires Tier 4 or 5, forgetting controller mode when the box must join an SD-WAN fabric, or quoting the 20X6C's integrated memory and SSD as line items that will never appear on the BOM. Validate the full configuration against the official tables before it reaches CCW. Check the Cisco C8500-20X6C edge platform product page on ITMall for the flagship model — then request a quote with your model, mode, PSU, and DNA tier selections for a BOM sanity check before ordering.

Source: this guide is original material rewritten from Cisco's official Cisco Catalyst 8500 Series Edge Platforms Ordering Guide (guide-c07-744092). All models, tiers, SKUs, and ordering rules above were verified against it. Distributed by ITMall — https://www.itmall.sale/.

The virtual form factor: same software, customer-supplied compute

The guide offers physical and virtual appliances for on-premises, cloud, or hybrid environments. The physical appliance is built for enterprise-scale networks and ordered as dedicated hardware. The virtual appliance packages the same software to run where the organization already has compute, and the order consists only of the license authorizing that instance — the choice changes where the software runs and how it is purchased, not what Catalyst Center manages.

The license model: one SKU, deposited into the Smart Account

The guide defines exactly one license SKU: DN-SW-APL-LIC, "Catalyst Center Virtual Appliance." At purchase the license is deposited into the customer's Cisco Smart Account — no media ships, no license file is emailed. To consume it, the virtual appliance must be registered with the respective Smart Account or Virtual Account (see the Catalyst Center Administrator Guide). So both accounts should exist before deployment day, and DN-SW-APL-LIC authorizes the virtual appliance instance itself — per-device Essentials/Advantage/Premier licenses (guide 8) are separate. A practical detail worth keeping: the entitlement is per virtual-appliance instance. One license line covers one virtual appliance; the scale envelope, not the license quantity, is what limits how many devices that instance can manage.

Three deployment homes: AWS, ESXi, or Azure

The virtual appliance supports three deployment homes, recorded on the license order as an option: DNA-SW-AMI (Amazon Machine Image) for AWS, DNA-SW-OVA for VMware ESXi, and DNA-SW-VHD for Azure. The guide links deployment documentation per platform plus release notes; sizing and installation steps live there. Decide on infrastructure reality first — which platform the team already operates — because the order option must match where the appliance will run. Each option corresponds to a platform-specific image — AMI, OVA, or VHD — and the guide's linked platform documentation covers everything downstream: instance sizing, network prerequisites, and the deployment steps themselves.

The option SKUs are options on the DN-SW-APL-LIC order line, not separate products: search DN-SW-APL, click Edit, select DN-SW-APL-LIC, choose the platform option, checkout.

The scale envelope: one set of ceilings

The guide publishes one scale specification under the DN-SW-APL heading — check every design against it before ordering: up to 5,000 total network devices, at most 1,000 switches and routers, up to 4,000 access points, and up to 25,000 concurrent endpoints. These are simultaneous ceilings. The envelope suits mid-size enterprises consolidating an estate under one instance, and the 4,000-AP ceiling suits wireless-heavy environments like branch-dense retail or education. A useful sanity check: the ceilings are sized consistently — roughly 1,000 switches and routers fronting 4,000 access points and 25,000 endpoints is the profile of a large, wireless-dense campus. Plan to the tightest ceiling; if the switch count fits but the endpoint count does not, the endpoint count governs. Designs exceeding any ceiling — most often the switch/router count in large campuses — belong on the physical appliance path.

Virtual vs physical: when the virtual appliance is the right order

The guide describes the physical appliance as built for enterprise-scale networks and managed on premises; the virtual appliance runs the same software on the customer's own cloud or hypervisor capacity — a purchase-path decision, not a ranking.

Placing the order in Cisco Commerce

Search DN-SW-APL, click Edit, select DN-SW-APL-LIC, choose the option matching the deployment home: option 1 DNA-SW-AMI (AWS), option 2 DNA-SW-OVA (ESXi), option 3 DNA-SW-VHD (Azure), then checkout. After purchase, the guide's deposit steps place the license in the Smart Account or Virtual Account automatically. The recurring failure mode is the wrong platform option — confirm the deployment home before checkout, not after.

Registration: connecting the appliance to the Smart Account

Go to System > Settings > Smart Account, add the Smart Account user and account name. Then System > Settings > Smart Licensing, choose the appropriate Virtual Account, click Register. Coordinate credentials and settings access before the deployment window; the guide refers to the Catalyst Center Administrator Guide beyond these steps. Only after registration does the appliance draw down the DN-SW-APL-LIC entitlement — the registration clicks are what complete the purchase.

Worked example: a mid-size enterprise on AWS

A regional enterprise consolidates management: 620 switches and routers, 1,700 access points, 11,000 concurrent endpoints; no spare rack capacity, but an existing AWS VPC. 1. Scale check: 620 < 1,000; 1,700 < 4,000; ~2,320 total devices < 5,000; 11,000 endpoints < 25,000 — fits with headroom. 2. Order: search DN-SW-APL, click Edit, select DN-SW-APL-LIC, choose option 1 (DNA-SW-AMI), checkout. 3. Confirm deposit: verify DN-SW-APL-LIC in the Smart Account's network-operations Virtual Account. 4. Deploy: launch the AMI per the AWS documentation linked in the guide. 5. Register and validate: add the Smart Account under System > Settings, register under Smart Licensing, confirm inventory stays within limits. If the estate later passes 1,000 switches or 4,000 APs, revisit the form factor against the physical ordering guide first.

Where to source

Virtual-appliance orders fail on familiar details: the wrong platform option at checkout, a Smart Account not ready at deployment time, or a device count quietly exceeding the scale envelope. Validate the BOM and account setup first. ITMall engineers review Cisco Catalyst Center licensing configurations before quoting, and you can submit your Catalyst Center BOM to ITMall for a scale and option check plus volume pricing.

Source: this is an original guide rewritten from Cisco's official Cisco Catalyst Center Virtual Appliance Ordering Guide. Sourcing: Cisco Catalyst Center licensing at ITMall.

The building blocks: what a Secure Access order contains

Every order starts with one zero-price subscription SKU, SECURE-ACCESS-SUB, which sets the term (12, 36, or 60 months) and start date. Quotes carry the subscription SKU (one line, quantity one), product SKUs (packages and quantities), and support SKUs (support level). Each end customer holds only one active subscription; a second concurrent subscription order is rejected and redirected to Change-Subscription. A subscription can cover up to three use cases — Secure Internet Access (SIA), Secure Private Access (SPA), and Secure Access – DNS Defense — or just one of them, and Secure Client is downloadable from the dashboard (a separate license applies for on-premises ASA/FTD use). The offer is on the Cisco Global Price List in all countries except China, Cuba, Iran, North Korea, Sudan, Syria, and Russia.

Essentials, Advantage, and DNS Defense: what the tiers unlock

Essentials covers the fundamentals: ZTNA and VPN-as-a-service with posture assessment; internet access via roaming security, VPN/IPsec tunnels, PAC files, and SD-WAN integration; DNS protection and cloud-delivered firewall; secure web gateway; CASB; sandbox malware analytics capped at 500 samples per day; and Experience Insights. Advantage adds unlimited sandbox samples, three full console logins, manual file submission; layer 7 application visibility; remote browser isolation for any website; multimode DLP; and intrusion prevention with traffic decryption. DNS Defense is a separate tier family with its own Essentials and Advantage levels (DNS-layer security, SaaS API DLP, cloud malware scanning).

SKU note: SA-SIA-ESS-K9 reached end-of-life on February 18, 2026; the current SIA Essentials SKU is SA-SIA-ESS, while SPA Essentials remains SA-SPA-ESS-K9.

Covered User or Covered Site: the two billing models

Most packages are licensed per covered user — every internet-connected employee, contractor, or other authorized individual — with the subscription quantity covering all of them. Cisco Commerce prices dynamically using tiered bands (1–99 up to 25,000+). The minimum is 50 users per SIA/SPA billing SKU (reduced from 100), and 1 for DNS Defense Essentials, Advantage, and EDU.

Covered Site billing is available only for SIA Essentials, priced by site bandwidth rather than user count: small sites up to 50 Mbps (SA-SIAS-S1/S2/S3-ESS), medium up to 500 Mbps (SA-SIAS-M1/M2/M3-ESS), and large up to 5 Gbps (SA-SIAS-L1/L2/L3-ESS), each with a monthly SSE data allowance (100 GB on S1 up to 50 TB on L3). It covers onsite users only — remote and roaming users still need user-based licenses — and excludes Experience Insights, the ZTA and Secure clients, RBI, Reserved IP, and Multi-Org support. SPA and DNS Defense are covered-user only.

Add-ons: DLP, Investigate, RBI, and malware analytics

Add-on quantities (except the Investigate Console add-on) must match the highest seat count of the associated option PID — the higher of the SIA and SPA counts, not their sum.

SA-INSIGHTS (Experience Insights) is auto-added at $0 to SIA and SPA orders and cannot be removed — but not to DNS Defense-only orders (with DNS + SPA it attaches on the SPA quantity only). Support is a separate pair: SVS-SECA-SUP-E (SWSS Enhanced, the default — 24×7 access, updates, onboarding assistance) and SVS-SECA-SUP-P (SWSS Premium — prioritized handling, an assigned expert; minimum $30,000 USD net annual spend; priced as a percentage of list price).

Ordering rules that reject bad configurations

Each order must be all-Essentials or all-Advantage — no mixing — except DNS Defense SKUs, which may pair with SPA at any tier combination. DNS Defense and SIA are mutually exclusive; SIA and SPA may combine only at the same tier; Cisco Commerce errors on incompatible selections.

Terms default to 12-month prepaid, with optional annual billing — but annual billing only works on terms that are multiples of 12 months. The PO must cover the full term amount, billed annually at each service-year start, and the subscription cannot be cancelled mid-term. On expiry it automatically renews for 12 months unless auto-renewal was deselected at the initial order; renewal notices go out about 120 days before term end, and a renewal may be cancelled up to 60 days before the new term starts — mid-term cancellations for credit are not allowed. Manual renewals (12, 36, or 60 months) and mid-term changes both use the Change-Subscription process; Umbrella or Secure Connect migrations are manual. Provisioning requires the end-customer administrator's name and email at order entry — missing details delay activation, which can take up to 72 hours — followed by a claim code and a welcome email. Multi-Org ships with no extra PID (contact Cisco TAC to activate); Reserved IP requires a preapproval form and four to six weeks to provision.

Worked example: a subscription BOM for a mid-size company

A 780-person organization wants internet and private application access at the Advantage tier on a 36-month term, with DLP and extra Investigate console users. The BOM: SECURE-ACCESS-SUB × 1 (subscription anchor, 36-month term, start date set); SA-SIA-ADV-K9 × 780 — SIA Advantage covered users (500–999 band); SA-SPA-ADV-K9 × 780 — SPA Advantage (same tier as SIA); SA-INSIGHTS × 780 — auto-added $0 Experience Insights; SA-DLP × 780 — DLP add-on, matching the highest seat count (780, not 780 + 780); SA-INVC-USR × 3 — three extra Investigate Console users; SVS-SECA-SUP-E — SWSS Enhanced support. Later headcount increases use Change-Subscription, co-terminating with the original 36 months — never a second subscription.

Where to source

Subscription quotes fail most often on the quiet rules — the one-subscription-per-customer limit, no tier mixing outside DNS-plus-SPA, the 50-user minimums, and add-on quantities matching the highest seat count. Validate the BOM against the official ordering tables before it reaches Cisco Commerce. ITMall engineers review Cisco Secure Access subscription configurations before quoting — submit your Secure Access BOM to ITMall for a packaging check and subscription pricing.

Source: this is an original guide rewritten from Cisco's official Cisco Secure Access Subscription Ordering Guide (©2026, June 2026 edition, C07-3781109-08). Sourcing: Cisco Secure Access subscriptions at ITMall.

Three models, one core-and-aggregation family

The series is a family of fixed-form-factor switches built for core and aggregation roles, and the ordering decision starts with three models. The guide lists them with their port configurations and the power supply that ships by default. The two smaller models share the same uplink block, differing in downlink density; the 96-port model is the largest and, per the guide, a 2RU chassis with 400G uplinks throughout.

Each model is ordered under one unified SKU, regardless of region or management preference — there are no regional variants to track.

What's in the box, and what to add

By default, a C9550 ships with four things: the switch unit itself, the default power supply for the model selected, an RFID module for asset tracking, and default 19-inch mounting brackets. Note the RFID behavior: it is included automatically, and customers must explicitly opt out during the ordering process if they do not want it — so decide before order day whether asset tracking is part of the deployment plan.

Everything else is optional and must be explicitly selected. A secondary power supply can be added for redundancy. Power cables follow a strict rule: one cable must be selected for each power supply, default and redundant alike, with the specific cable type chosen for the region or operational requirements — it is easy to forget the cable for the redundant PSU, so count cables as 2x whenever redundancy is ordered. An SSD module can be added for enhanced application hosting or storage, and it must be selected during the ordering process rather than assumed. Specialized bracket kits for non-19-inch racks are not included and are ordered separately.

The power supply PIDs, exactly as listed: C9K-PWR-750WAC — 750W AC supply, the default for the 24- and 48-port models. C9K-PWR-750WAC/2 — the same supply in redundant form (this is what to order for the secondary PSU). C9K-PWR-750WAC= — the spare form for the shelf. Likewise C9K-PWR-1100WAC, C9K-PWR-1100WAC/2, and C9K-PWR-1100WAC= for the 96-port model. The "/2" suffix denotes the redundant add-on unit; the "=" suffix is the conventional spare.

One tier, three sizes: the Advantage-only license model

Licensing is where the C9550 breaks most sharply from older Catalyst generations. The guide introduces a unified licensing structure through the Cisco Networking Subscription, which consolidates the management of software, hardware, services, and platforms and protects the investment over time. A single, per-device license unlocks the platform's flexible management options — Catalyst Center and the Cisco Meraki dashboard — and customers can mix and match how and where they manage each device. The licenses can be purchased either in a Cisco Networking Subscription or in an Enterprise Agreement.

There is only one tier: Advantage is the only tier available on the C9550 Series. There is no Essentials or Premier choice to make. The decision is purely one of size — Medium, Large, or XL — with one SKU per size:

Two facts deserve emphasis. First, the guide's only stated term constraint is that new subscriptions require a term of at least 36 months — plan renewals and budgets on a three-year minimum horizon. Second, the guide does not publish an explicit mapping between license size and switch model: nothing in the document states that a particular model takes the M, L, or XL SKU. There is, however, a grounded working correspondence: the parallel Cisco Cisco Networking Subscription for Cisco C9000 Series Smart Switches document (revised July 2026) confirms the three C9550 tiers as Medium (LIC-CS-CO-M-A), Large (LIC-CS-CO-L-A), and XL (LIC-CS-CO-XL-A), and the sibling C9350 ordering guide explicitly maps tier size to port count — Medium for up to 24 ports, Large for 48 ports. With three C9550 models (24, 48, and 96 downlink ports) and three tiers, the natural reading is M → C9550-24L4CD, L → C9550-48L4CD, XL → C9550-96L4D. That correspondence is a reasoned inference from the documented C9350 precedent, not a stated C9550 fact — confirm the size in the CCW guided flow or with the Cisco account team before finalizing.

The new ordering model: unified everything

The guide frames the C9550 release as three deliberate departures from the traditional ordering process: unified licensing (one common license with flexible management), unified support (product support for software and hardware included in the license), and unified hardware (a single SKU for each model, regardless of region or management preference). The practical effect is a shorter decision list — model, accessories, license size, support level, subscription terms — with far less SKU wrangling than the old approach.

The unified model simplifies, but it also removes choices that used to exist — there is no lower software tier to fall back on for cost reasons, and the 36-month minimum term makes short-term or pilot licensing impossible under a new subscription. Budget accordingly.

Walking through CCW: the seven steps

The guide lays out the order as a seven-step flow in Cisco Commerce. Step 1: search for the device series C9550-SWITCH in CCW, which enters the guided buying experience. Step 2: choose the specific device SKU and the quantity to purchase — this is where the model decision from the first table lands. Step 3: add the accessories: additional power supplies, power cables, the SSD module, and bracket kits. Step 4: select the licensing option for the devices. Step 5: confirm the tier — the guide notes explicitly that only the Advantage tier is available on the C9550 Series, so this step is a size choice (M, L, or XL) rather than a tier choice. Step 6: choose the level of support desired for the devices. Step 7: choose subscription details such as renewal and billing frequency, review the order details, and submit.

Support deserves its own look. The Cisco Networking Subscription level includes consistent, reliable unified product support covering both software and hardware: access to Cisco Communities, 24x7 TAC support, major software updates, maintenance, minor software releases, digital insights, and e-learning. If stronger hardware replacement is needed, the RMA Upgrade service can be added at the device level. Because support rides with the license, aligning the subscription term with the support horizon happens naturally — one fewer contract to reconcile.

Warranty: the Limited Lifetime Warranty terms

The guide closes the commercial picture with the Limited Lifetime Warranty (LLW). It applies to the Cisco C9550 Series Smart Switches and lasts as long as the original customer owns the product. The end-of-life policy is specific: if Cisco discontinues manufacture, warranty support is limited to 5 years from the announcement of discontinuance. Hardware replacement ships on the next business day after a valid RMA request is issued — actual ship times vary by customer location, and taxes and duties fall on the recipient of the replacement part. The warranty commences from the date of shipment to the customer (and, for reseller sales, not more than 90 days after original shipment by Cisco). One access caveat: the warranty allows guest access only to Cisco.com.

Worked example: a collapsed-core pair

Scenario: an enterprise is refreshing its campus aggregation layer with a redundant collapsed-core pair — 48 downlink ports per switch, full power redundancy. The BOM, built strictly from the guide's tables: hardware: 2x C9550-48L4CD (each ships with a C9K-PWR-750WAC default supply and 19-inch brackets). Redundancy: 2x C9K-PWR-750WAC/2 — one secondary supply per switch — plus 4 power cables (one per PSU, default and redundant, cable type chosen for the region). Licensing: 2x LIC-CS-CO-L-A as an illustrative size selection — the guide does not publish which size pairs with which model, so confirm the size in the CCW guided flow before finalizing. Term: a new subscription of at least 36 months, Advantage tier only.

Options to decide up front: add an SSD module per switch if application hosting is in scope, opt out of the RFID module explicitly if asset tracking is not wanted, and add device-level RMA Upgrade if stronger hardware replacement is required. The order itself runs the seven CCW steps — search C9550-SWITCH, set the quantity, add accessories, select the Advantage license size, choose the support level, set renewal and billing frequency, and review. Cisco Capital financing is also noted as an option for spreading the cost over time.

Where to source

C9550 orders are simpler than traditional Catalyst orders, but they still fail on small details — a missing power cable for the redundant PSU, an unconfirmed license size, or a term that doesn't meet the 36-month minimum. Validate the full BOM before it reaches Cisco Commerce. ITMall engineers review Cisco C9550 switch configurations before quoting, and you can submit your C9550 BOM to ITMall for a configuration check and volume pricing.

Source: this is an original guide rewritten from Cisco's official Cisco C9550 Series Smart Switches Ordering Guide (©2026). Sourcing: Cisco C9550 switches at ITMall.

The building blocks: what an ACI order contains

Three components are mandatory. The Application Policy Infrastructure Controller (APIC) cluster holds the policy model, distributes it to the fabric, and monitors fabric health. Production clusters are ordered as three appliances — APIC-CLUSTER-M4 for up to 1200 edge ports, APIC-CLUSTER-L4 above that; single appliances (APIC-M4/APIC-L4) and spares (APIC-M4=/APIC-L4=) cover lab and proof-of-concept use. Plan production as a three-node cluster from day one.

The fabric is a full mesh of Nexus 9000 switches — Nexus 9300 as leaf or spine, Nexus 9500 as spine — and the ordering question is license classes: GF (1G fixed), XF (10/25/40/100G fixed), XF2 (400G-class fixed like the Nexus 9364C and 9300-GX), and modular classes (9500M4, 9500M816, 9400CM8, 9800M8). Map every switch to its class before licensing — the PIDs are organized around these classes. Optional: Nexus Dashboard Orchestrator for multi-fabric policy, ACI Remote Leaf for remote sites.

Essentials, Advantage, Premier: what the tiers unlock

ACI licenses are per-device, and the tiers are cumulative — Premier includes Advantage, which includes Essentials. Essentials covers the fundamentals: policy-driven fabric management and automation, zero-touch provisioning, zero-trust security with RBAC and microsegmentation, ACI Multi-Pod, VMM integration (VMware, Kubernetes, OpenShift, KVM, Nutanix), streaming telemetry, open APIs and L4–7 service integration. Advantage adds the two features that most often trigger a mid-project tier change: ACI Multi-Site (policies stretched across fabrics via Nexus Dashboard) and Physical Remote Leaf. Premier adds Nexus Insights-class day-2 operations: anomaly signatures, pre-change analysis, flow telemetry, assurance verification, ELAM-based analysis. Rule of thumb: Essentials for single-site automation, Advantage for multi-site or remote-leaf, Premier for analytics-grade assurance.

Nexus Dashboard Orchestrator requires Advantage or Premier on every device in every connected fabric — one Essentials device breaks the model.

Subscription or perpetual: how the PIDs are structured

The two models use different PID families. Subscription licenses run 3, 5 or 7 years in the C1E1TN/C1A1TN/C1P1TN pattern (Essentials/Advantage/Premier) with license class and term appended — C1A1TN9300XF-5Y is a five-year Advantage subscription for a 10/25/40/100G fixed switch. Perpetual licenses are nontransferable Advantage-tier entitlements: ACI-AD-GF/XF/XF2 fixed, plus ACI-AD-M4/M8-16/CM8/DM4/DM8 for modular platforms. No perpetual Premier; Premier is subscription-only.

Licenses order with new hardware (options on the switch PID) or standalone: license-only subscriptions under top-level PID C1-N9K-ADD-T, perpetual ones as "=" spares (ACI-AD-XF=). The per-device rule is unforgiving: licenses are required for both leaf and spine switches. Smart Licensing pools entitlements but requires a Smart Account before order day; above $100K net contract value, Cisco recommends Enterprise Agreement enrollment. Also: N9K-EX-24P-UPG=/N9K-FX-24P-UPG= unlock the second 24 ports on 24-port EX/FX platforms.

GF, XF, XF2 and modular PIDs are not interchangeable, and the subscription term should match the hardware support contract term so neither lapses first.

Add-ons: security, storage and visibility

Beyond the base tier, per-device add-ons apply. MACsec: any tier plus ACI-SEC-XF/GF per leaf, ACI-SEC-XF per fixed spine, ACI-SEC-XM per modular spine; CloudSec inter-site encryption instead needs Advantage or Premier per device plus the same spine add-ons. The security add-on is mandatory on the N9K-C9348D-GX2A (MACsec on all ports). Storage attachment (FCoE/FC NPV/SAN switching) needs ACI-STRG per device (subscription form C1-N9K-STRG-XF). Nexus Data Broker visibility uses C1-N9K-NDB (not on 9300-GX); Synchronous Ethernet uses C1-N9K-SYNCE-XF / DCN-SYNCE-XF.

For smaller designs, Virtual APIC (vAPIC) runs the controller as a virtual appliance: ACI-C9332-VAPIC-B1 (one) with at least two ACI-supported leafs and per-device licenses, or DCN-VAPIC (three) with two fixed spines and two leafs. vAPIC suits small or distributed fabrics; production scale wants the physical three-node cluster.

Brownfield: tier upgrades and NX-OS-to-ACI migration

Moving a fabric to a higher tier depends on the model: subscription-to-subscription is done by modifying the subscription (a contract action, no upgrade SKU); perpetual-to-perpetual uses explicit PIDs — ACI-UPG-B-AD-GF=/XF= (base-to-Advantage), ACI-UPG-ES-AD-GF=/XF=/XF2= (Essentials-to-Advantage). No perpetual path to Premier; that move needs a subscription. And there is no upgrade SKU from perpetual to subscription — order new subscriptions under C1-N9K-ADD-T (possible Enterprise Agreement credit).

Perpetual NX-OS holders moving switches to ACI mode use NXOS-ACI-UP-AD-GF=/XF=. Lower tiers need two steps: first raise the NX-OS tier (NXOS-UPG-L-AD-GF=/XF= from LAN, NXOS-UPG-ES-AD-GF=/XF= from Essentials), then apply the NX-OS-to-ACI PID. Current DCN subscription SKUs already include both ACI and NX-OS features, so subscription holders skip license migration — just reload the ACI image.

Worked example: a greenfield medium fabric

A new single-site fabric: ~800 edge ports, multi-pod on the roadmap, FCoE-attached storage. The BOM: one APIC-CLUSTER-M4, 4 leafs N9K-C93180YC-FX3, 2 spines N9K-C9332C, C1A1TN9300XF-5Y × 6 — Advantage per device, leaf and spine, for the multi-site and analytics roadmap. Add C1-N9K-STRG-XF-5Y on the two leafs running FCoE NPV toward the SAN. Confirm the Smart Account before order day; align the term with the hardware support contract. Brownfield variant: if those six switches already ran NX-OS Advantage perpetual, the only license lines are 6× NXOS-ACI-UP-AD-XF= plus the APIC cluster.

Where to source

ACI orders fail most often on licensing fine print — tier mismatches, missing spine licenses, the wrong license class. Work from the official ordering tables and validate the BOM before it reaches Cisco Commerce. ITMall engineers review Cisco ACI licensing configurations before quoting, and you can submit your ACI fabric BOM to ITMall for a license-path check and volume pricing.

Source: this is an original guide rewritten from Cisco's official Cisco Application Centric Infrastructure (ACI) Ordering Guide (©2026). Sourcing: Cisco Nexus 9000 switches at ITMall.

Choosing the series: five rungs of the ladder

The appliance families form a performance ladder, each with its own ordering chapter — and one rule covers them all: use the bundle part number unless you have an explicit reason not to. The Firepower 1000 series is the branch tier (master bundles FPR1010-BUN through FPR1150-BUN): the desktop FPR1010 with PoE (plus the no-PoE 1010E), the 1RU 1120/1140 with 8×1G plus 4×1G SFP, and the 1150 adding 2×10G SFP+. The Firepower 2100 series used to sit above it, but it no longer appears in the current guide — buyers looking at 2100s are dealing with legacy stock, and the Secure Firewall 3100 series is the current midmarket tier.

The 3100 series (3105–3140) covers hybrid midmarket to data center at 10–45 Gbps NGFW, with 8×1G copper plus 8×10G SFP+ (8×25G SFP28 on the 3130/3140) and a NetMod bay. The Firepower 4100 series (4112/4115/4125/4145) is the data-center tier at 19/33/45/53 Gbps with 8×SFP+ and two network-module bays. The Firepower 9300 is the modular carrier-grade top: up to three security modules (SM-40/48/56), a 960-Gbps fabric, up to 190 Gbps NGFW per chassis (0.87 Tbps across 16 clustered modules), sub-5-microsecond latency. Bare chassis SKUs (FPR1140-NGFW-K9, FPR1140-ASA-K9) exist as building blocks; the bundle PID is the recommended starting point. On the 9300 a minimum of one security module must be ordered, with the supervisor's eight 10-Gbps ports bundled by default; on 4K/9K bundles a Talos Incident Response retainer (CTIR-NGFW-S=) is auto-attached but removable.

A practical rule: size by the throughput class with the threat services switched on, not the raw stateful-inspection number — the NGFW figure is what the firewall will actually deliver in production.

The first fork: FTD or ASA software image

Most families can run either Firewall Threat Defense (FTD) or ASA software (on the 9300, both on separate security modules in one chassis), and this choice decides the license SKUs: threat defense subscriptions can only be added to a chassis running FTD software. ASA deployments take the ASA Standard license plus paid security-context licenses for multitenancy, and an optional carrier license for Diameter/GTP/SCTP inspection on the larger chassis. Both include a local on-device manager — Firewall Device Manager (FDM) for FTD, ASDM for ASA; FTD can be centrally managed by the on-premises, virtual or cloud-delivered Secure Firewall Management Center, ASA by Cisco Security Manager or Cisco Security Cloud Control (which also handles FTD). One prerequisite is non-negotiable: a Smart Account must exist before ordering FTD software — licenses land in the Smart Licensing account at order time. FTD ships with the option to activate a 3-month trial license without a Smart License account.

The subscription scheme: T, M, C and the TMC bundle

FTD subscriptions are not sold in tiered plans on appliances. They are a-la-carte letter services in 1, 3 and 5-year terms, with discounts on multiyear terms. T (Threat) covers Security Intelligence and IPS; M (Malware, also written AMP) covers malware defense with sandboxing; C (URL) covers URL filtering. The combination SKUs are what most orders use: TMC (Threat, Malware and URL) is the full package, with TM and TC as partial combinations. One dependency governs the scheme: the Threat/IPS (T) license is a prerequisite for Malware (M) or URL (C) — neither can be ordered on its own.

On the 1000 series the pattern is visible in the part numbers: base license L-FPR1140T-TMC with term subscriptions L-FPR1140T-TMC-1Y/3Y/5Y, alongside the single-service variants per model; the 9300 licenses per security module (for example L-FPR9K-40T-TMC-3Y for an SM-40), and the 3100/4100 use their own prefixes. Everything is Smart Licensed, and subscriptions include software-application support (SASU) for the full term. For high availability: an HA pair of FTD appliances requires two subscriptions, one per box — which the HA bundles below solve.

Bundles, HA pairs and the special editions

Beyond the master bundles, the guide defines three purpose-built families. The FTD HA bundles exist because of the two-subscription rule: two identically configured chassis plus two identical subscriptions, with a 50% discount automatically applied to the second subscription — including at renewal. Examples: FPR1140-FTD-HA-BUN, FPR3100-FTD-HA-BUN, FPR4115-FTD-HA-BUN, FPR9K-SM48-FTD-BUN.

The Small Business Edition is a simplified pack for the FPR1010 only, 3-year term, orderable with hardware or standalone: SBE Lite (FPR1010T-SBE-L-3Y) and SBE Standard (FPR1010T-SBE-3Y). Both include threat, malware and URL filtering, a Security Cloud Control license and 50 Secure Client seats; Standard adds Security Analytics and Logging. Commerce: on the FPR1010 SKU choose "Edit Options", select the SBE subscription and set the country — distributors use FPR-SEC-TERM. The Connect and Protect bundles (FPR-SECURE-CAMPUS, FPR-SECURE-BRANCH, FPR-SECURE-DC) package Cisco's portfolio for three use cases with matching subscription SKUs (FPR-CAMPUS-SUB, FPR-BRANCH-SUB, FPR-DC-SUB).

Worked example: a branch office HA pair

Take a typical requirement: a branch office with roughly 150 users, dual firewalls in active/standby, full threat services for 3 years, managed from the cloud. The build: FPR1140-FTD-HA-BUN — two identically configured FPR1140 chassis and two identical subscriptions, 50% off the second. Add the FTD image, the TMC subscription at 3 years (L-FPR1140T-TMC-3Y), rack-mount hardware and region-correct power, registered against the customer's Smart Account, and manage from Cisco Security Cloud Control. Nothing is a bare chassis, nothing is missing its subscription, and the two subscriptions satisfy the HA rule from day one.

The ordering sequence

The order flow in five steps: (1) pick the series and model by throughput class, starting from the master bundle PID; (2) declare the image — FTD for threat subscriptions, ASA for ASA licensing; (3) attach the subscription letters, defaulting to the TMC bundle (two for an HA pair); (4) choose the bundle form — master, HA, Small Business Edition or Connect and Protect; (5) confirm the Smart Account, select the management platform, and order — licenses land in the Smart account automatically.

Where to source

Firewall builds are order-sensitive — image, subscription and bundle SKUs must agree — so quote from a validated configuration. Cisco Secure Firewall appliances at ITMall are listed with specifications and ordering configurations, including HA builds like the Cisco FPR4115-FTD-HA-BUN two-unit bundle; ITMall engineers can validate the subscription services on your Cisco Secure Firewall 3100 series BOM before you order.

Source: an original guide rewritten from Cisco's official Cisco Network Security Ordering Guide (April 2026, © 2026 Cisco and/or its affiliates). Sourcing: Cisco Secure Firewall appliances at ITMall.

The three DNA tiers — and what the hardware suffix really means

For Catalyst switching and wireless, Cisco DNA subscriptions come in three tiers, and the tier is not just a support label — it determines which features the hardware is entitled to run. DNA Essentials covers base automation, monitoring and assurance: the fundamentals for operating the network. DNA Advantage adds the advanced tier — policy-based automation, AI-driven analytics such as AI Endpoint Analytics, Encrypted Traffic Analytics for threat detection in encrypted flows, and ThousandEyes network and application synthetics. DNA Premier, available on select platforms such as the Catalyst 8300, adds the full advanced stack for the most demanding environments.

Here's the part buyers must internalize: on switches, the tier is encoded in the hardware part number itself. A -E suffix means Network Essentials with DNA Essentials; -A means Network Advantage with DNA Advantage. The subscription you order must match that suffix — an -A subscription against -E hardware (or vice versa) is a mismatch the ordering system will not bless. Choose the tier by the features you will actually operate over the hardware's life: SD-Access, full routing policy and the advanced analytics all require Advantage. Upgrading later is a separate post-purchase transaction, never an order-time checkbox, so the tier decision belongs in the architecture discussion, not the procurement rush.

Terms, defaults, and the start-date trap

DNA subscriptions are sold in 3-, 5- and 7-year terms, and two Cisco Commerce behaviors routinely cost buyers money. First, the defaults: wireless quotes preselect DNA Advantage 5-year, and similar defaults appear across the portfolio. A default is not a recommendation — set the term deliberately against the hardware refresh cycle and the support contract term. A 7-year subscription on 5-year refresh hardware wastes two years; a 3-year subscription on 7-year hardware guarantees a renewal event mid-life.

Second, the start-date trap: always order the subscription with the hardware. Co-ordered subscriptions sync their start date with the hardware ship date (edge platforms even allow up to a 90-day offset selection). A separately ordered subscription starts its paid term on its own clock — order the license a month before the hardware ships and you've donated a month of paid term to Cisco. The standalone parent SKUs (AIR-DNA for wireless, L-DNA-C8300 / L-DNA-C8200 for edge) exist for adds, moves and renewals. Using them for first orders is how the trap springs.

The license families buyers confuse

Cisco's licensing has three distinct families and they are not interchangeable — ordering from the wrong family is a paperwork error that blocks onboarding until unwound. DNA/AIR-DNA serves Catalyst switching and Wi-Fi 6/6E (AIR-DNA-E/A in 3/5/7Y terms). LIC-CW-E / LIC-CW-A — the unified Cisco Networking Subscription's Wireless Essentials and Wireless Advantage — serves Wi-Fi 7 (CW917x) exclusively. Meraki licenses (LIC-MX/MS/MR families, 1/3/5/7Y, co-terminated) serve Meraki hardware exclusively, at a strict 1:1 device-to-license ratio. The confusion pattern is predictable: buyers apply DNA SKUs to Wi-Fi 7 APs, or assume one "Cisco license" covers a mixed estate. It doesn't. Match the license family to the hardware generation on every line of the BOM, and have someone who knows the difference review the quote.

DNA vs. Catalyst subscription: the support fork

Within the DNA world there's a second decision buyers often sleepwalk through: DNA subscription vs. Cisco Catalyst (DNX) subscription. These are genuinely different support products. The DNA subscription is software-only support with faster 1-hour TAC response for severity 1/2 — but no ISE endpoint sessions, and hardware RMAs route through the Catalyst warranty program rather than the subscription. The Catalyst subscription bundles hardware and software support: 4-hour TAC response for Sev 1/2, Catalyst Center management entitlement, and — on Advantage — ISE endpoint sessions per license (10 on most platforms, 40 on the 9600) for identity-based policy. Cisco Commerce preselects DNA; switching to the Catalyst subscription requires the "Clear Section" action. Neither is universally better — the right choice follows the support model: if hardware replacement SLAs matter to the business, the Catalyst subscription's bundled hardware support is doing real work; if the estate is software-operated with warranty handling hardware, DNA's faster software TAC response may fit better.

Cisco Commerce preselects DNA — use "Clear Section" to switch to the Catalyst subscription when bundled hardware support is wanted.

Smart Accounts, renewals, and the calendar

Every one of these licenses is claimed in the customer's Cisco Smart Account — confirm it exists with the right access before deployment, not during. Then put every expiration on one calendar with real margin: a lapsed DNA subscription degrades the management and assurance plane it was bought to run, and a lapsed Meraki license disables devices outright. Set 90-day renewal warnings, assign an owner, and treat the renewal like the infrastructure event it is. The cheapest license problem is the one solved by a calendar reminder; the most expensive is the one discovered during an outage.

The pre-order licensing checklist

Before any Cisco purchase order goes out: (1) confirm the DNA tier encoded in every hardware PID (-E vs -A) and that the subscription tier matches; (2) set the term deliberately — 3, 5 or 7 years against the refresh cycle, never the Commerce default by inertia; (3) co-order licenses with hardware so start dates sync with ship dates; (4) verify the license family per line — AIR-DNA for Wi-Fi 6/6E, LIC-CW for Wi-Fi 7, Meraki licenses for Meraki, never mixed; (5) choose DNA vs. Catalyst subscription by the support model the business needs; and (6) confirm Smart Account readiness and calendar every expiration.

Where to source

Licensing errors are cheaper to prevent than to fix. ITMall's pre-sales team validates Cisco DNA licensing tier, term and PID combinations against your BOM, and you can contact ITMall for a licensing review before placing the order.

Source: this is an original guide consolidating the licensing models from Cisco's official Wireless, Catalyst 8300/8200 Edge, and Meraki ordering documentation. Sourcing: ITMall.

The deployment-model decision comes first

Before any SKU is selected, settle the architectural question: traditional routing or SD-WAN? The platforms run a unified IOS XE image containing two software modes in a single binary — IOSXE-AUTO-MODE for autonomous/traditional routing (managed by CLI or DNA Center) and IOSXE-CTRL-MODE for Catalyst SD-WAN (controller-managed). This isn't a setting you flip casually later; it determines the software mode, the management plane, the licensing path and ultimately the operational model of every site. A brownfield migration (traditional now, SD-WAN later) is a legitimate plan, but it should be an explicit plan with the mode transitions mapped — not something discovered during deployment. Get this decision in writing from the architecture owner before the BOM exists.

Decoding the chassis: N, S, T, X

Catalyst 8300/8200 part numbers encode the platform's expansion capacity directly: N = NIM (network interface module) slots, S = SM (service module) slots, T = 1G WAN ports, X = 10G ports. The lineup: C8300-2N2S-6T and C8300-2N2S-4T2X (two NIM plus two SM slots — the flexible branch workhorses), C8300-1N1S-6T and C8300-1N1S-4T2X (one NIM plus one SM slot for lighter sites), and the compact C8200-1N-4T / C8200L-1N-4T. The selection logic follows the modules, not the ports: choose 2N2S variants when the branch needs LTE/cellular modules, service modules or future expansion headroom; the 1N1S variants suit sites whose module needs are known and fixed. The classic ordering error is buying the 1N1S chassis to save money, then discovering the LTE backup module needs a slot that doesn't exist — a mistake that costs a chassis swap, not a module. For higher-throughput edge and colocation roles, the 8500 series (C8500-20X6C, C8500-12X4QC, C8500-12X, C8500L-8S4X with L-DNA-C8500 licensing) follows the same ordering logic at bigger scale.

The subscription: two methods, one right answer for first orders

The official guide defines two ways to buy the mandatory DNA subscription, and the distinction matters for your budget. Option 1 (recommended): order the subscription with the hardware through the top-level platform SKU. The subscription start date syncs with the hardware ship date (with up to a 90-day offset selectable), so you're not paying for license time while the chassis sits in a warehouse. Option 2: order the subscription separately via L-DNA-C8300 / L-DNA-C8200 (L-DNA-C8500 for the 8500s) — useful for adds and renewals, but separately-ordered subscriptions allow at most a 90-day start-date delay, and any misalignment between the license clock and the hardware arrival is paid term burned idle.

For first orders, Option 1 is the right answer in nearly every case: it keeps the commercial and deployment timelines aligned by construction. Reserve Option 2 for what it's designed for — adding licenses to an existing deployment or renewing. Tiers and terms: DNA Essentials (8200: 3Y/5Y), DNA Advantage (3Y/5Y/7Y), DNA Premier (8300: 3Y/5Y). On support: Cisco Embedded Support is included with the subscription, while Cisco Solution Support is the recommended pairing when you want combined hardware-plus-license coverage with a single support experience.

Module compatibility: verify before the PO, not on site

NIMs and service modules are where edge BOMs most often go wrong, because compatibility is a three-way match between the module, the chassis slot count and the chassis power budget. Verify every NIM/SM against the chosen chassis before ordering — slot counts differ across the 2N2S/1N1S/C8200 variants, and power envelopes differ too. A module that is electrically compatible but power-hungry can force a PSU rethink; a module that needs two slots on a 1N1S chassis forces a chassis rethink. The official guide's ordering flow treats module verification as a gate, not a suggestion: chassis first, then modules against the chassis, then power against the modules. Build the BOM in that order and the surprises disappear.

The Smart Account: a deployment prerequisite

All DNA licenses are claimed and assigned in the customer's Cisco Smart Account — which makes Smart Account readiness a deployment prerequisite, not an administrative afterthought. Confirm the account exists, the right people have access, and the virtual account structure matches how you want licenses organized, before deployment day. The number of edge rollouts delayed by "we can't claim the licenses" is a quiet embarrassment the industry could avoid entirely with a two-week heads-up.

Worked example: a 50-site SD-WAN rollout

Fifty branches, SD-WAN managed, each needing LTE backup and 1G WAN. The per-site build: C8300-1N1S-4T2X (one NIM slot for the LTE module, 10G-ready uplinks for growth), the LTE NIM verified against the 1N1S slot and power budget, DNA Advantage 3-year ordered with the hardware (Option 1) so all fifty subscriptions start with their ship dates, region power cables, and rack mounting. Smart Accounts provisioned two weeks before the first shipment. One chassis SKU, one module SKU, one subscription SKU — repeated fifty times with zero per-site exceptions. That's what a clean edge BOM looks like.

Cisco Embedded Support is included with the subscription; Cisco Solution Support is recommended for combined hardware-plus-license coverage.

The ordering sequence

Distilled from the official guide: (1) fix the deployment model — autonomous vs. SD-WAN — as an architectural decision; (2) select the chassis by NIM/SM slot and port needs, sizing for the modules you'll ever install; (3) order the DNA subscription with the hardware at the right tier and term; (4) verify and add NIMs, service modules, power and cabling in chassis→module→power order; and (5) confirm Smart Account access before anything ships.

Where to source

Edge BOMs combine chassis, modules and subscriptions, so a pre-sales compatibility check pays off. ITMall's engineers validate Cisco Catalyst 8300/8200 edge platforms configurations — chassis, NIM/SM fit and DNA subscription tier — and you can submit your Catalyst 8300 BOM to ITMall for quoting and lead-time confirmation.

Source: this is an original guide rewritten from Cisco's official Catalyst 8300/8200 Series Edge Platforms Ordering Guide (and the 8500 companion guide). Sourcing: Cisco Catalyst edge platforms at ITMall.

The hardware-plus-license pairing rule

Internalize this first: a Meraki order is always a pair. An MX64-HW security appliance is only half an order until LIC-MX64-SEC-3YR (or its tier/term siblings) sits next to it; an MS220-24P-HW switch needs its matching MS license the same way. The license is not an accessory or a support contract in the traditional sense — it is the device's permission to function, and it simultaneously unlocks the Meraki dashboard, cloud management, firmware updates and support. Budgeting "hardware now, licenses later" is not a phased plan; it's an outage scheduled for the day the grace period ends. Quote and purchase the pairs together, always.

Choosing the license tier per product line

Tiers are defined per product line, and the right tier follows the site's security and feature requirements — not the price list order. MX security appliances offer Enterprise, Advanced Security and Secure SD-WAN Plus (LIC-MX<model>-ENT/SEC/SDW-<term>). The tier decision here is a security architecture decision: any site handling payment data, health records or other regulated traffic should be on Advanced Security for IDS/IPS, malware defense and content filtering — Enterprise alone lacks the UTM feature set, and discovering that during a compliance audit is the expensive way to learn it. MR access points offer Enterprise or MR Advanced, with the convenient property that MR licenses are model-agnostic (LIC-ENT-xYR, LIC-MR-ADV-xYR) — AP upgrades don't force license repurchases. MS switches offer Enterprise and Advanced tiers, with Essential/Advantage options under the subscription-licensing model on newer hardware. Map each site's requirements to tiers before pricing, because the tier decision gets revisited far less often than buyers expect.

Terms, co-termination, and the single-date discipline

Licenses are sold in 1-, 3-, 5- or 7-year terms. Under the classic co-term model, every license in an organization converges on one expiration date — and a co-term organization cannot mix license tiers. Outgrow Enterprise at one site and the whole organization converts; there is no per-device tier salad. This has two practical consequences. First, plan renewals around that single date with real margin — a lapsed license doesn't degrade gracefully, it disables the devices. Second, think in organization lifecycles rather than device lifecycles: adding a device mid-term means a pro-rated license to the co-term date, which keeps the single-date discipline intact. Put the renewal date on a calendar with a 90-day warning, not a 7-day one.

Sizing the switch hardware: PoE budgets are where money hides

The MS portfolio is tiered by role: the MS220 family is Layer 2 for branch access, while MS320/MS350 add Layer 3 routing for larger sites. The PoE suffix sets the power budget — P for PoE+, LP for lower-power PoE, FP for full PoE/UPoE — and this is where careful buyers save real money or avoid real outages. The method: list every powered endpoint (APs, cameras, phones, with their actual draw — not the port maximum), sum it, add headroom, and compare against the switch's budget (124W/370W/740W class). The FP/UPoE models exist precisely for power-hungry endpoints — a MS350-48FP or MS350-24X with its 740W budget is the answer when the camera count says so; a P model is the answer when it doesn't. Overbuying PoE budget "just in case" across fifty branches is a six-figure mistake in the other direction.

Two more hardware notes from the official documentation: the MS350 stacks up to 8 units / 160 Gbps using MA-CBL-40G-1M/3M QSFP stacking cables (one 0.5 m cable ships with each switch — order the rest), and optics use MA-SFP-* modules with the buyer-friendly policy that Meraki does not lock out third-party optics. That last point is a genuine cost lever on large rollouts: validate compatibility once, then price accordingly.

MS350 stacks up to 8 units / 160 Gbps via MA-CBL-40G-1M/3M (one 0.5 m cable included per switch). Meraki does not lock out third-party optics.

The warranty economics most TCO comparisons miss

Every Meraki device includes a lifetime hardware warranty with next-day advanced replacement at no extra cost. When the finance team compares Meraki against Catalyst on total cost of ownership, this line item belongs in the model explicitly: Catalyst hardware support is a separate purchase (Smart Net and its successors), while Meraki bakes advance replacement into the license you were already buying. It doesn't make Meraki cheaper in every scenario — the license itself is the recurring cost — but it makes the comparison honest.

Worked example: a 30-person branch

A branch needs internet security, 24 switched ports (8 PoE+ for APs and phones), and Wi-Fi — all cloud-managed. The build: one MX-series appliance sized for the WAN throughput, paired with LIC-MX<model>-SEC-3YR (Advanced Security — the branch processes card payments); one MS220-24P-HW (Layer 2 is sufficient; P tier covers the PoE+ load with the budget math done), paired with its 3-year MS license; two MR APs with model-agnostic LIC-ENT-3YR licenses. All licenses share one 3-year co-term date. One site, one expiry, one renewal conversation in three years.

The ordering sequence

Distilled from the official documentation: (1) select hardware by site role — MX for security/SD-WAN, MS for switching, MR for wireless; (2) choose the license tier per product line against security and feature requirements; (3) set a uniform term and protect the co-termination date; (4) size PoE budgets with real endpoint math and plan stacking; (5) add mounting, power, cabling and optics; and (6) calendar the single renewal date with margin.

Where to source

Because the license pairing is mandatory, buy hardware and licenses together from one source to keep co-termination clean. You can order Cisco Meraki MS, MR and MX with licenses at ITMall, where engineers validate the hardware-to-license pairing and tier consistency on the ITMall before fulfillment.

Source: this is an original guide rewritten from Cisco's official Meraki MX data sheet Ordering Guide section and Meraki licensing documentation. Sourcing: ITMall.