Ordering guide

Cisco public

Cisco DNA Software for

SD-WAN and Routing

© 2023 Cisco and/or its affiliates. All rights reserved. Page 1 of 33

Contents
Cisco DNA Subscription for SD-WAN and Routing: PID Nomenclature 3
Step 1: Platforms 4
Step 2: Software Type 8
Step 3: Cisco DNA for SD-WAN and Routing Software Subscription 9
Step 4: Ordering Cisco Catalyst SD-WAN overlay 19
Step 5: Smart Account and Virtual Account 19
Step 6: Services 22
Appendix A: Cisco DNA for SD-WAN and Routing Subscription Opt-out 26
Appendix B: Modules Supported in SD-WAN on the 4000 Series ISRs 26
Appendix C: Ordering SD-WAN Subscriptions on ASR Aggregation Platforms 27
Appendix D: Cisco DNA Ordering and License Management on the 4000 Series ISRs 30
Appendix E: Ordering Cisco DNA for SD-WAN and Routing Subscriptions for
Cisco Industrial Routers 31

© 2023 Cisco and/or its affiliates. All rights reserved. Page 2 of 33

Cisco DNA for SD-WAN and Routing subscriptions gives the flexibility to consume the
latest technology, either in the cloud or on-premises across the entire routing stack.
Licenses are available in 3-, 5-, and 7-year term options. Cisco DNA for SD-WAN and
Routing subscription licenses include embedded SWSS support ONLY for the
subscription functionality (Cisco Catalyst SD-WAN Manager, Cisco Catalyst SD-WAN
Analytics, Cisco Catalyst SD-WAN Validator, Cisco Catalyst SD-WAN Controller, Cisco
Umbrella, Cisco SIG Essentials, etc.) enabled by the Cisco DNA Subscriptions (Cisco
DNA Essentials, Advantage, and Premier).

Cisco DNA Subscription for SD-WAN and Routing: PID Nomenclature

The Cisco DNA for SD-WAN and Routing subscription product part codes have a built-in structure that
indicates the following:

● Management options
● Tiered bandwidth entitlement
● Subscription tier
● Subscription term

Structure of Cisco DNA for SD-WAN and Routing Subscription Product ID

For industrial routers, the structure is:

Structure of Cisco DNA for SD-WAN and Routing Subscription Product ID for industrial routers

© 2023 Cisco and/or its affiliates. All rights reserved. Page 3 of 33

To begin ordering Cisco DNA for SD-WAN and Routing software subscriptions, please follow the steps below:

Step 1: Platforms

Step 2: Software Type

Step 3: Cisco DNA Software Subscription

Step 4: Ordering SD-WAN overlay

Step 5: Smart Account and Virtual Account

Step 6: Services

Note: If you are ordering the Cisco hardware along with Cisco DNA for SD-WAN and Routing software
subscriptions, follow Step 1 through Step 5. If you are ordering Cisco DNA for SD-WAN and Routing
software subscriptions for already existing hardware, start from Step 3.

Step 1: Platforms
Select the platform most appropriate for your WAN. Cisco offers a variety of hardware, virtual and cloud
options, as shown in Table 1.

Table 1. WAN Platform Summary

WAN Platform Device

Fixed Chassis Branch Routers Cisco 1000 Series Integrated Services Routers
Cisco ISR1100 and ISR1100X Series Routers

Modular Chassis Branch Routers Cisco 4000 Series Integrated Services Routers
Cisco Catalyst 8300/8200 Series Edge Platforms

Aggregation Services Routers Cisco 1000 Series Aggregation Services Routers

Cisco Catalyst 8500 Series Edge Platforms

Universal CPE Routers Cisco 5000 Series Enterprise Network Compute System
Cisco Catalyst 8200-UCPE Edge platforms

Virtualized Routers Cisco Cloud Services Router 1000v

Cisco Catalyst 8000v Edge Software Router

Cisco Teleworker/ Remote worker Routers Cisco Catalyst Wireless Gateway CG113

The platforms in Table 1 above can be ordered either for Cisco Catalyst SD-WAN deployment or for traditional
routing along with Cisco DNA for SD-WAN and Routing software subscriptions.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 4 of 33

Table 2 below shows all the Cisco DNA bundles that can be specifically ordered for Cisco Catalyst SD-WAN
deployments.

Table 2. Platform Product IDs for Cisco Catalyst SD-WAN

Product Family Product IDs Cisco DNA Subscription Part Number

Cisco ISR1000 Series C1111-8P-DNA

C1111-8PLTEEA-DNA
C1111-8PLTELA-DNA Bundled with Cisco DNA Software
C1111-4P-DNA Subscription

C1111-4PLTEEA-DNA
C1111-4PLTELA-DNA

Cisco ISR1100 Series ISR1100-4G, ISR1100X-4G Bundled with Cisco DNA Software
Subscription
ISR1100-4GLTEGB
ISR1100-4GLTENA
ISR1100-6G, ISR1100X-6G

Cisco ISR4000 Series ISR4221X-DNA Bundled with Cisco DNA Software

Subscription
ISR4321-DNA
ISR4331-DNA
ISR4351-DNA
ISR4431-DNA
ISR4451-DNA
ISR4461-DNA

Cisco ASR1000 Series ASR1001-HX-DNA Bundled with Cisco DNA Software

Subscription
ASR1002-HX-DNA
ASR1006-X-DNA1

Cisco ENCS-5000 Series NFV-BRANCH-MLB Bundled with Cisco DNA Software

Subscription

Cisco Catalyst 8000 Series Edge C8300-2N2S-4T2X Bundled with Cisco DNA Software
Platforms Subscription
C8300-2N2S-6T
C8300-1N1S-4T2X
C8300-1N1S-6T
C8200-1N-4T
C8200L-1N-4T
C8500-20X6C
C8500-12X4QC
C8500-12X
C8500L-8S4X

© 2023 Cisco and/or its affiliates. All rights reserved. Page 5 of 33

 Product Family Product IDs Cisco DNA Subscription Part Number

Cisco Catalyst Cellular Gateway CG113-4GW6A Bundled with Cisco DNA Software
Subscription
CG113-4GW6B
CG113-4GW6E
CG113-4GW6Z

1
ASR1006-X-DNA is only available from Cisco IOS-XE 17.5.1 and later releases

The platforms in Table 3 below can be ordered as a la carte, either for a Cisco Catalyst SD-WAN deployment or
for traditional routing along with Cisco DNA for SD-WAN and Routing software subscriptions through L-DNA-
TIER-ADD or L-IR-DNA-TIER-ADD (for Cisco Industrial Routers).

Table 3. Cisco WAN Platform Product IDs Supported with Cisco DNA for SD-WAN and Routing Software Subscriptions

Product Family Product IDs Cisco DNA Subscription Part Number

Cisco ISR1000 Series ● C1101-4P, C1101-4PLTEP, C1101-4PLTEPW* Order Cisco DNA Software
● C1109-4PLTE2P, C1109-4PLTE2PW* Subscription through
● C1109-2PLTEGB, C1109-2PLTEUS, C1109-2PLTEVZ L-DNA-TIER-ADD
● C1111-4P, C1111-4PLTEEA, C1111-4PLTELA

● C1116-4P, C1116-4PLTEEA, C1116-4PLTEW*

● C1117-4P, C1117-4PM, C1117-4PLTEEA, C1117-
4PLTELA, C1117-4PMLTEEA
● C1121-4P, C1121-4PLTEP, C1121-8P, C1121X-8P,
C1121-8PLTEP, C1121X-8PLTEP, C1121X-
8PLTEPW*, C1121-8PLTEPW*
● C1111-8P, C1111X-8P, C1111-8PLTEEA, C1111-
8PLTELA, C1111-8PW*, C1111-8PLTEEAW*, C1111-
8PLTELAW*
● C1113-8PLTEEA, C1113-8PMLTEEA

● C1131-8PLTEPWA, C1131-8PLTEPWB, C1131-

8PLTEPWE, C1131-8PLTEPWQ, C1131-8PLTEPWZ,
C1131-8PWA, C1131-8PWB, C1131-8PWE, C1131-
8PWQ, C1131-8PWZ
● C1131X-8PLTEPWA, C1131X-8PLTEPWB, C1131X-
8PLTEPWE, C1131X-8PLTEPWQ, C1131X-
8PLTEPWZ, C1131X-8PWA, C1131X-8PWB,
C1131X-8PWE, C1131X-8PWQ, C1131X-8PWZ
● C1161X-8P, C1161X-8PLTEP, C1161-8P

● C1127-8PLTEP, C1127-8PMLTEP, C1127X-8PLTEP,

C1127X-8PMLTEP

Cisco ISR4000 Series ● ISR4221/K9, ISR4221X/K9 L-DNA-TIER-ADD

● ISR4321/K9, ISR4331/K9, ISR4351/K9

● ISR4431/K9, ISR4451-X/K9, ISR4461/K9

Cisco ENCS-5000 Series ● ENCS5406/K9, ENCS5408/K9, ENCS5412/K9 L-DNA-TIER-ADD

Cisco ASR1000 Series ● ASR1002-X, ASR1002-HX L-DNA-TIER-ADD

● ASR1001-X, ASR1001-HX
● ASR1006-X2

© 2023 Cisco and/or its affiliates. All rights reserved. Page 6 of 33

 Product Family Product IDs Cisco DNA Subscription Part Number

Cisco Catalyst 8500 Series ● C8500-12X4QC L-DNA-C8500

Edge Platforms ● C8500-12X

● C8500L-8S4X

● C8500-20X6C

Cisco Catalyst 8300 Series ● C8300-2N2S-4T2X L-DNA-C8300

Edge Platforms ● C8300-1N1S-4T2X

● C8300-2N2S-6T

● C8300-1N1S-6T

Cisco Catalyst 8200 Series ● C8200-1N-4T L-DNA-C8200

Edge Platforms ● C8200L-1N-4T

Cisco Universal CPE and ● C8200-UCPE-1N8 L-DNA-C8000v

Cisco Catalyst 8000 Series ● C8000V
Virtualized Platforms

Cisco Catalyst Cellular ● CG113-4GW6A L-DNA-TIER-ADD

Gateway ● CG113-4GW6B

● CG113-4GW6E

● CG113-4GW6Z

Cisco Industrial Routers ● IR1101-K9, IR1101-A-K9 L-IR-DNA-TIER-ADD

● IR1821-K9, IR1831-K9, IR1833-K9, IR1835-K9

● IR8140H-K9, IR8140H-P-K9

● ESR-6300-NCP-K9, ESR6-6300-CON-K9

W* - Refer to the ISR1000 ordering guide for more information on various Wireless-domain SKU’s:
https://www.cisco.com/c/en/us/products/collateral/routers/1000-series-integrated-services-routers-isr/guide-c07-740009.html.

2
Please refer to Appendix D for the supported modules on ASR1006-X.

Table 4 below lists the Software WAN platforms that can be deployed on Private or Public cloud and can be
ordered only using L-DNA-TIER-ADD.

Table 4. Software WAN Platform Product IDs for New Deployments

Product Family Cisco DNA Subscription Product IDs Platform Selection

Cisco CSR 1000V L-DNA-TIER-ADD Choose CSR1KV-DNA-PF

Cisco Catalyst 8000 Series Edge platforms must be ordered with a mandatory Cisco DNA for SD-WAN and
Routing subscription for both Cisco Catalyst SD-WAN or for traditional routing deployments. Cisco has
developed specific Ordering Guides for this platform. For more details on how to order the Cisco Catalyst 8000
Series Edge platform and the applicable Cisco DNA for SD-WAN and Routing subscriptions, please refer to the
links below:

1) Ordering Cisco Catalyst 8300/8200 series Edge platforms

2) Ordering Cisco Catalyst 8500 series Edge platforms

3) Ordering Cisco Catalyst 8000 series UCPE and C8000v Virtualized platforms

© 2023 Cisco and/or its affiliates. All rights reserved. Page 7 of 33

Step 2: Software Type
Cisco delivers consistent and rich routing and security features across multiple operating systems that run on all
the platforms mentioned in Step 1. Below are three types of Cisco operating systems to choose from:

● Cisco IOS XE for traditional routing deployments managed through Cisco Catalyst Center console.
● Cisco IOS XE SD-WAN for SD-WAN deployments managed through Cisco Catalyst SD-WAN Manager
console.
● Viptela OS for SD-WAN deployments managed through Cisco Catalyst SD-WAN Manager console.
Understanding the Cisco DNA for SD-WAN and Routing and Cisco IOS Product Part Codes

The Cisco IOS and subscription product part codes have a built-in structure as described below.

Structure of Cisco Unified Image Nomenclature

Structure of Cisco IOS XE-SDWAN Image Nomenclature

Selecting a Cisco IOS Type for the SD-WAN Bundles (Cisco IOS XE-SDWAN)

For any router with a Cisco DNA bundle (for example, ISR4331-DNA or ASR1001-HX-DNA), the choice of
Cisco IOS type is limited only to Cisco IOS XE-SDWAN (which will be pre-installed at factory) and is chosen as
follows:

● Choose the desired Cisco DNA bundle and select Cisco IOS type under the Option class “IOS Software
and Version Type”
● Choose from available IOS XE SD-WAN image versions under the Option subclass “SD-WAN Image with
Payload Encryption”

© 2023 Cisco and/or its affiliates. All rights reserved. Page 8 of 33

Choose the Software Image and Type

Selecting a Cisco IOS Type for the Router (Cisco IOS XE-SDWAN)

For any ISR/ASR series router (for example, ISR4331/K9 or ASR1001-X), the Cisco IOS type is chosen as
below:

● The customer selects the Cisco IOS type under the Option class “IOS Software and Version Type”
● If the customer prefers the IOS XE SD-WAN image, they will choose from the available versions under
the Option subclass “SDWAN Image with Payload Encryption.”
● If the customer prefers the Cisco IOS XE image, they will choose from the available versions under the
Option subclass “Image with Payload Encryption” or “Image with No Payload Encryption”

Choose the Software Image and Type

Step 3: Cisco DNA for SD-WAN and Routing Software Subscription

Cisco DNA for SD-WAN and Routing software subscription offer is constructed with four important elements:

A. Management Option

B. Tiered Bandwidth Entitlement

C. Subscription Tier

D. Subscription Term

© 2023 Cisco and/or its affiliates. All rights reserved. Page 9 of 33

Management Option:

Cisco DNA for SD-WAN and Routing subscriptions offer maximum flexibility through cloud or on-premises
management options. Cloud management through the Cisco Catalyst SD-WAN Manager console is the
recommended option for customers wishing to simplify WAN deployments, accelerate digital transformation,
and move toward intent-based networking.

Table 5. Management Options

Management Option Description

Cloud management Provides simplicity of management with Cisco Catalyst SD-WAN Manager cloud
management software part numbers follow the Cisco DNA-C-<>-<>-<> construct
(For example: DNA-C-T1-E-3Y)

On-premises management Manages WAN using Cisco Catalyst Center or Cisco Catalyst SD-WAN Manager on-
premises. On-premises management software part numbers follow the Cisco
DNA-P-<>-<>-<> construct (For example: DNA-P-T1-E-3Y). Note: Cisco Catalyst
Center requires the purchase of an additional appliance.

Cisco DNA for SD-WAN and Routing licenses provide you the flexibility to move from on-premises to cloud
management, and across hardware and software platforms. There is no charge for porting licenses within the
same bandwidth tier. Device family classifications for Cisco ONE Software are available in the Cisco ONE
Software Device Tiering Guide.
Bandwidth Entitlement (Entitled Throughput when Selecting Bandwidth)

Cisco offers a multitude of bandwidth options so that you can purchase what’s best for your business and
networking needs. The key takeaway from Figure 6 below is that Cisco uses two bandwidth nomenclatures.
Nominal and Aggregate. Nominal bandwidth is what the Product ID is based on. Aggregate bandwidth is double
the nominal bandwidth. This is aligned with how service providers sell WAN bandwidth.

So let’s work through the example in the figure below. Aggregate all of your bandwidth together. Upstream.
Downstream. Across all circuits. That’s your Aggregate bandwidth. In this example it’s 335 Mbps. Now divide
that by two to get to a Nominal bandwidth to determine which PID is needed. In this case, you need a PID that
can handle greater than 167.5 Mbps. That’s the Tier 1 bandwidth PID.

Bandwidth Level Selection Process

© 2023 Cisco and/or its affiliates. All rights reserved. Page 10 of 33

Note: For encrypted throughput above 250Mbps an HSEC license is required. Although Tier 1 bandwidth
license provides entitlement for 400Mbps aggregate crypto throughput with HSEC, one-way encrypted
traffic must be less than 250Mbps. For instance, 250Mbps download and 150Mbps upload would work but
300Mbps download and 100Mbps upload would be throttled down to 250Mbps and 100Mbps.

Table 6 below gives the range of bandwidth entitlement and subscription term options available with Cisco DNA
Software for SD-WAN and Routing subscriptions.

Table 6. Cisco DNA Cloud (C) and On-Premises (P) Software Subscription Product IDs

Product IDs Bandwidth Options Term Options Example PID

DNA-C-<BW-tier>-E-<Term> BW = Term = DNA-C-T0-E-3Y

DNA-P-<BW-tier>-E-<Term> ● T0 = Up to 25Mbps ● 3Y DNA-C-T0-E-5Y
(Agg. 50Mbps)
● 5Y
● T1 = Up to 200Mbps
DNA-P-T1-E-3Y
● 7Y
(Agg. 400Mbps) DNA-P-T1-E-5Y
● T2 = Up to 1Gbps (Agg. 2Gbps)

DNA-C-<BW-tier>-A-<Term> BW = Term = DNA-C-T1-A-3Y

● T0 = Up to 25Mbps (Agg.
DNA-P-<BW-tier>-A-<Term> ● 3Y DNA-C-T1-A-5Y
50Mbps)
● 5Y
● T1 = Up to 200Mbps (Agg. DNA-P-T2-A-3Y
400Mbps) ● 7Y
DNA-P-T2-A-5Y
● T2 = Up to 1Gbps (Agg. 2Gbps)

● T3 = Up to 10Gbps (Agg. 20Gbps)

DNA-C-<BW-tier>-P-<Term> BW = Term = DNA-C-T2-P-3Y

DNA-P-<BW-tier>-P-<Term> ● T0 = Up to 25Mbps (Agg. ● 3Y DNA-C-T2-P-5Y
50Mbps)
● 5Y
● T1 = Up to 200Mbps (Agg.
DNA-P-T3-P-3Y
400Mbps) DNA-P-T3-P-5Y
● T2 = Up to 1Gbps (Agg. 2Gbps)

● T3 = Up to 10Gbps (Agg. 20Gbps)

Subscription Tiers:

Three software subscription tiers offer feature combinations tailored to your needs. Depending on the platform
and deployment needs, the following subscription tiers can be chosen across all the platforms mentioned in
Step 1:

● Cisco DNA Premier: Product ID format is DNA-<>-<>-P-<> (e.g.: DNA-C-T1-P-3Y).

● Cisco DNA Advantage: Product ID format is DNA-<>-<>-A-<> (e.g.: DNA-C-T1-A-3Y).
● Cisco DNA Essentials: Product ID format is DNA-<>-<>-E-<> (e.g.: DNA-C-T1-E-3Y).
Note: The Cisco 1000 and 4000 Series ISRs include Network Essentials or Network Advantage stack,
depending on the tier purchased. ASR 1000 Series include Network Advantage only. Cisco DNA Essentials
includes Network Essentials as the perpetual element. Cisco DNA Premier and Cisco DNA Advantage
include Network Advantage as the perpetual element. The perpetual element is subscription neutral,
meaning that it will continue to work regardless of the subscription term.

For Cisco Industrial Routers, Network Essentials/Advantage licenses (perpetual elements) are mandatory and
configured as part of the hardware ordering and are not included as part of Cisco DNA subscription.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 11 of 33

Subscription Term:

With any of the Cisco software subscription tiers, there is a choice of subscription terms

● 3-Year, 5-Year and 7-Year Cisco DNA Essentials: Product ID format is DNA-<>-<>-E-3Y/5Y/7Y*
● 3-Year, 5-Year and 7-Year Cisco DNA Advantage: Product ID format is DNA-<>-<>-A-3Y/5Y/7Y*
● 3-Year, 5-Year Cisco DNA Premier: Product ID format is DNA-<>-<>-P-3Y/5Y.
*
7Y term option is only available for Cisco DNA Essentials and Advantage subscriptions, and is not available in Enterprise Agreements (EA)

Ordering Cisco Software Subscription:

Step 1: Select the Cisco Router of your Choice:

A. If you are choosing a Cisco DNA Bundle (For example: ISR4331-DNA OR any platform from Table 2 in
Step 1: Platforms Section), you can complete the ordering process along with built-in Cisco DNA
subscription SKUs. You can skip Step 2.

B. If you are choosing an a la carte router hardware platform (For example: ISR4221/K9 or ASR1002-X),
complete the a la carte ordering process by selecting the suitable Cisco IOS type, Network Modules and
add L-DNA-TIER-ADD SKU or L-IR-DNA-TIER-ADD at the end.

When purchasing a new router, if the intended use is to deploy the subscription through Cisco Catalyst
Center, no additional Technology Package license needs to be purchased (exception: ASR 1000
platforms require selection of IP Base, which acts as the OS). All necessary feature licenses required for
a subscription are included when Cisco DNA Essentials or Cisco DNA Advantage licenses are procured
(through Step 2).

Similarly, for all applicable platforms at the applicable bandwidth tiers, the required
Performance/Boost/HSEC licenses are automatically included when Cisco DNA licenses are procured
(through Step 2).

Note: For Cisco Industrial Routers, Network Essentials/Advantage licenses (perpetual elements) are
mandatory and configured as part of the hardware ordering and are not included as part of Cisco DNA
subscription.

Refer to “Working with L-DNA-TIER-ADD” section in Step 2 below to complete the Cisco DNA Software
subscriptions ordering process.

Step 2: Select the L-DNA-TIER-ADD or L-IR-DNA-TIER-ADD SKU:

Working with L-DNA-TIER-ADD or L-IR-DNA-TIER-ADD

Customers may seek to add a Cisco DNA for SD-WAN and Routing subscription license to

● A router that has already been deployed in the field.

● A router that the customer intends to purchase that does not have a Cisco DNA bundle associated with it
(for example, ISR4221/K9, ISR4461/K9 or ASR1001-X, but NOT platform bundles such as ISR4321-
SEC/K9, ISR4351-AX/ K9 etc).
● A software WAN router that is intended to be deployed on either Private or Public Cloud.

In these scenarios, the customer will configure the router and the subscription independently. The customer
configures the router (for example, the ISR4321/K9, ISR4351/K9, or ASR1002-X) and selects the relevant Cisco

© 2023 Cisco and/or its affiliates. All rights reserved. Page 12 of 33

IOS type as described in the section “Step 2: Software”. Finally, the customer chooses L-DNA-TIER-ADD or L-
IR-DNA-TIER-ADD, which provides various subscription options for each platform family as described below.

If the choice is a cloud platform or a subscription on existing hardware, the Product ID shown in Table 7 is
applicable.

Table 7. WAN Platform Product ID for Cloud or Existing Deployments

Product ID Description

L-DNA-TIER-ADD Cisco DNA Subscription License for SD-WAN and Routing

L-IR-DNA-TIER-ADD Cisco DNA Subscription License for IoT

Once you have selected the above Product ID, select the platform for which you need to order the Cisco DNA
for SD-WAN and Routing subscription license (See Table 8 below).

Table 8. Platform Licenses for L-DNA-TIER-ADD (previously L-LIC-DNA-ADD) and L-IR-DNA-TIER-ADD for Cloud or
Existing Deployments

Platform License Part Number Description

ENCS 5000 ENCS5400-DNA-PF Cisco DNA Subscriptions for the 5400 ENCS platform

ISR 1000 C1100-8P-DNA-PF Cisco DNA Subscriptions for the 1100 ISR 8-port platform

C1100-4P-DNA-PF Cisco DNA Subscriptions for the ISR1100 4-Port platform

C1100SV-8P-DNA-PF Cisco DNA Subscriptions for the ISR1100 SV 8 Port platforms

C1100SV-4P-DNA-PF Cisco DNA Subscriptions for the ISR1100SV 4-Port platform

ISR 1100 ISR1100-4G-DNA-PF Cisco DNA Subscriptions for the ISR1100-4G

ISR1100-6G-DNA-PF Cisco DNA Subscriptions for the ISR1100-6G

ISR1100-4GLTE-PF Cisco DNA Subscriptions for the ISR1100 4GLTE Platform

ISR 4220 ISR4220-DNA-PF Cisco DNA Subscriptions for the 4200 ISR platform

ISR 4300 ISR4320-DNA-PF Cisco DNA Subscriptions for the 4300 ISR platform
ISR4330-DNA-PF
ISR4350-DNA-PF

ISR 4400 ISR4430-DNA-PF Cisco DNA Subscriptions for the 4400 ISR platform
ISR4450-DNA-PF
ISR4460-DNA-PF

ASR 1001X ASR1001X-DNA-PF Cisco DNA Subscriptions for the ASR 1001-X platform

ASR 1001HX ASR1001HX-DNA-PF Cisco DNA Subscriptions for the ASR 1001-HX platform

ASR 1002X ASR1002X-DNA-PF Cisco DNA Subscriptions for the ASR 1002-X platform

© 2023 Cisco and/or its affiliates. All rights reserved. Page 13 of 33

 Platform License Part Number Description

ASR 1002HX ASR1002HX-DNA-PF Cisco DNA Subscriptions for the ASR 1002-HX platform

ASR 1006X ASR1006X-DNA-PF Cisco DNA Subscriptions for the ASR 1006X

ASR 1009X ASR1009X-AUTO-PF Cisco DNA Subscriptions for the ASR 1009X platform (no SD-WAN
support)

CSR 1000V CSR1KV-DNA-PF Cisco DNA Subscriptions for the CSR 1000V

CG113 CG113-DNA-PF Cisco DNA Subscriptions for the CG113 Series platform

IR1101 IR1101-PF Cisco DNA Subscriptions for the IR1101 platform

IR1800 IR1800-PF Cisco DNA Subscriptions for the IR1800 platform

IR8100 IR8100-PF Cisco DNA Subscriptions for the IR8100 platform

ESR6300 ESR6300-PF Cisco DNA Subscriptions for the ESR6300 platform

Select the SKU for the subscription L-DNA-TIER-ADD or L-IR-DNA-TIER-ADD.

Select the platform family against which the subscription is expected to be purchased from one of the platform
selection categories, as shown below:

Choose the Platform

Select the intended deployment use case from the category “Software Mode”, using one of the options from
below:

● IOSXE-CTRL-MODE-PF: Choose this if your deployment use case is SD-WAN (irrespective of on-prem
or cloud) and the management is through Cisco Catalyst SD-WAN Manager.
● IOSXE-AUTO-MODE-PF: Choose this if your deployment use case is traditional routing (management is
through Cisco Catalyst Center).

© 2023 Cisco and/or its affiliates. All rights reserved. Page 14 of 33

Choose the Deployment Mode

Select the appropriate tiered bandwidth for the product family chosen. Refer to Table 9 for the appropriate
bandwidth selections.

Table 9. Cisco DNA for SD-WAN and Routing Subscription Bandwidth Tiers by Platform

ENT Routing Platforms SD-WAN Traditional T0 T1 T2 T3

Routing
up to 50 up to 400# up to 2 up to 20 Gbps
Mbps agg. Mbps agg. Gbps agg. agg.

ISR1K C1100-4P & Y Y ✓✓✓ ✓✓✓

C1100SV-4P

C1100-8P & Y Y ✓✓✓ ✓✓✓

C1100SV-8P

ISR1100-4G Y N ✓✓✓ ✓✓✓

ISR1100-6G Y N ✓✓✓ ✓✓✓ ✓✓✓

ISR4K ISR4220 Y Y ✓✓✓ ✓✓✓

ISR4320 Y Y ✓✓✓ ✓✓✓

ISR4330 Y Y ✓✓✓ ✓✓✓ ✓✓✓

ISR4350 Y Y ✓✓✓ ✓✓✓ ✓✓✓

ISR4430 Y Y ✓✓✓ ✓✓✓ ✓✓✓

ISR4450 Y Y ✓✓✓ ✓✓✓ ✓✓✓

ISR4460 Y Y ✓✓✓ ✓✓✓ ✓✓✓

© 2023 Cisco and/or its affiliates. All rights reserved. Page 15 of 33

 ENT Routing Platforms SD-WAN Traditional T0 T1 T2 T3
Routing
up to 50 up to 400# up to 2 up to 20 Gbps
Mbps agg. Mbps agg. Gbps agg. agg.

ASR1K ASR1001-X Y Y ✓✓ ✓✓

ASR1002-X Y Y ✓✓ ✓✓

ASR1001-HX Y Y ✓✓

ASR1002-HX Y Y ✓✓

ASR1006-X Y Y ✓✓

ASR1009-X N Y ✓✓

VNF CSR1KV Y Y ✓✓✓ ✓✓✓ ✓✓✓ ✓✓

ENCS5400 Y Y ✓✓✓ ✓✓✓ ✓✓✓

IR1101 IR1101-K9 Y Y ✓✓ ✓✓ ✓✓

IR1101-A-K9 Y Y ✓✓ ✓✓ ✓✓

IR1800 IR1821-K9 Y Y ✓✓ ✓✓ ✓✓

IR1831-K9 Y Y ✓✓ ✓✓ ✓✓

IR1833-K9 Y Y ✓✓ ✓✓ ✓✓

IR1835-K9 Y Y ✓✓ ✓✓ ✓✓

IR8100 IR8140H-K9 Y Y ✓✓ ✓✓ ✓✓

IR8140H-P- Y Y ✓✓ ✓✓ ✓✓
K9

ESR6300 ESR-6300- Y Y ✓✓ ✓✓ ✓✓
NCP-K9

ESR-6300- Y Y ✓✓ ✓✓ ✓✓
CON-K9

✓ =Essentials ✓ =Advantage ✓ =Premier

*
Only fixed chassis of ASR1000 family supports Cisco SD-WAN Cisco DNA subscriptions.
#
One-way encrypted traffic must be less than 250Mbps for a T1 bandwidth license.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 16 of 33

Ordering Enforced Encryption (HSEC) License

Federal regulations mandate that all encrypted traffic greater than 250Mbps be provisioned through a separate
license – the HSEC License. The HSEC License is required purely for increasing the crypto throughput and
tunnel scale, irrespective of Cisco SD-WAN or traditional routing deployments. The following examples
demonstrate how the HSEC licenses may be provisioned for different scenarios.

Scenario 1 – Purchasing subscription in conjunction with the platform using the Cisco DNA bundles
(e.g: ISR4331-DNA, C1111-8P-DNA).

● In this scenario, a platform specific HSEC license is automatically included at $0 with each Cisco DNA for
SD-WAN and Routing subscription that is equal to or exceeds a Tier 1 bandwidth entitlement.
● For a Cisco DNA for SD-WAN and Routing subscription license with a Tier 0 bandwidth entitlement, if
you wish to procure HSEC license to increase the tunnel scale, it can be done so by selecting the HSEC
license under the bundle as an add-on paid item.

Scenario 2 – Purchasing subscription for an existing router using the L-DNA-TIER-ADD top level SKU
(e.g: ISR4221/K9, C1117-4P and a subscription using L-DNA-TIER-ADD).

● In this scenario, a platform specific HSEC license is auto-included at $0 with each Cisco DNA for SD-
WAN and Routing subscription that is equal to or exceeds a Tier 1 bandwidth entitlement.
● For a Cisco DNA for SD-WAN and Routing subscription license with a Tier 0 bandwidth entitlement, if
you wish to procure HSEC license to increase the tunnel scale, it can be done so by buying the platform
specific SPARE HSEC license as a paid item.

For Cisco Industrial Routers, where applicable, HSEC licenses are ordered in conjunction with ordering the
hardware.

Important Note: Starting with Cisco IOS XE Bengaluru 17.6.1a, instead of tagging HSECK9 licenses according
to router model (for example, ISR_4331_Hsec), HSECK9 licenses are tagged as Router US Export Lic for DNA
(DNA_HSEC). If you want to purchase new HSECK9 licenses for Cisco 1000 Series ISRs and Cisco 4000 Series
ISRs, you should buy DNA_HSEC. Read more here.
Cisco Catalyst SD-WAN Security Applicability Matrix

The core security features—Enterprise Firewall with Application Awareness and DNS Security Monitoring—are
supported in all platforms listed in the Cisco Catalyst SD-WAN applicability matrix. (Note that vEdge routers
support only zone-based firewall).

The following advanced security features require a minimum of 8 GB memory and 8 GB boot flash on all
platforms:

● Intrusion prevention system.

● URL filtering.
● Cisco Secure Endpoint and Cisco Secure Malware Analytics.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 17 of 33

Table 10. Cisco SD-WAN Security Features Applicability Matrix

Platforms/Features Enterprise Enterprise IPS URL Cisco Secure DNS/Weblayer

Firewall Firewall Filtering Endpoint // Cisco security
Application Secure Malware
Awareness Analytics

ISRv (ENCS) Y Y Y Y Y Y

ISR 4000 (4461, 4451, 4431, Y Y Y Y Y Y

4351, 4331, 4321, 4221x)

ISR 1100 (ISR1100-4G, Y N/A N/A N/A N/A Y

ISR1100-6G)

ISR1100X (ISR1100X-4G, Y Y Y Y Y Y
ISR1100X-6G)

ISR 1000X (1111X, 1121X, Y Y Y Y Y Y

1126X,1127X,1161X)

ASR1K (1001-HX, 1002-HX, Y Y N/A N/A N/A Y

1001-X, 1002-X, 1006-X)

C8300 and C8200 platforms Y Y Y Y Y Y

C8500 platforms Y Y N/A N/A N/A Y

C8000v Y Y Y Y Y Y

Industrial Routers (4GB Y Y N/A N/A N/A Y

RAM)
● IR1101-K9
● IR1101-A-K9

● ESR-6300-NCP-K9

● ESR-6300-CON-K9
● IR1821-K9

● IR1831-K9

● IR1833-K9

Industrial Routers Y Y Y Y Y Y
(8 GB RAM) (Roadmap) (Roadmap) (Roadmap)
● IR1835-K9

● IR8140H-K9

● IR8140-P-K9

Notes:

● CSR 1000V supports URL Filtering, Cisco Secure Endpoint and DNS Security only in on-premises
deployment. The Cisco ISRv and Cisco CSR 1000V need four vCPU and a minimum of 8GB RAM and
8GB boot flash.
● URL filtering is supported with cloud lookup only with 8GB. 16GB is required for on-box URL database
download and lookup.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 18 of 33

Step 4: Ordering Cisco Catalyst SD-WAN overlay
It is mandatory to order Cisco Catalyst SD-WAN Overlay (Controller subscriptions) through the top-level ATO
"L-CONTROLLER-ADD" for all Cisco Catalyst SD-WAN deployments. This is required even for a complimentary
overlay that is entitled for Cisco Catalyst SD-WAN customers irrespective of Cloud or On-prem.

Please refer to the following ordering guide for more details on how to order the Cisco Catalyst SD-WAN
Controller subscriptions: Cisco Catalyst SD-WAN controller ordering guide.

Step 5: Smart Account and Virtual Account

Cisco Smart Licensing is a flexible licensing model that provides you with an easier, faster, and more consistent
way to purchase and manage software across the Cisco portfolio and across your organization. And it’s secure
– you control what users can access. With Smart Licensing you get:

● Easy Activation: Smart Licensing establishes a pool of software licenses that can be used across the
entire organization—no more PAKs (Product Activation Keys).
● Unified Management: My Cisco Entitlements (MCE) provides a complete view into all of your Cisco
products and services in an easy-to-use portal, so you always know what you have and what you are
using.
● License Flexibility: Your software is not node-locked to your hardware, so you can easily use and
transfer licenses as needed.

To use Smart Licensing, you must first set up a Smart Account on Cisco Software Central (software.cisco.com).

For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide.

An end-user smart account and virtual account are mandatory for the Cisco Catalyst SD-WAN ordering
process. Cisco Catalyst SD-WAN requires a unique identifier to auto-provision hardware devices for end
customers. Since Smart Accounts and Virtual Accounts are both unique and partner-enabled, they provide a
convenient mechanism for provisioning the Cisco Catalyst SD-WAN solution. (Note: Cisco Catalyst SD-WAN
will be provisioned on Cisco routers using Smart Accounts).

For the Cisco Catalyst SD-WAN solution, Virtual Accounts are aligned to a customer overlay and the devices
that should be associated with the overlay. Failure to provide a Virtual Account during ordering will result in a
delay in device provisioning.

Each Smart Account can have multiple Virtual Accounts. If the customer has two customer overlays, they would
have two different Virtual Accounts. Managed Services Providers (MSPs) will create a Smart Account and be
the Smart Account owner. The MSP would then need to create a Virtual Account for every end customer (or
tenant), assuming that each end customer has a specific overlay.

● Step 1: Create a Smart Account (one-time operation)

Go to https://software.cisco.com/software/company/smartaccounts/home#accountcreation-account.

Don’t use email addresses in the Smart Account name. A Smart Account name can have A-Z, a-z, 0-9,
and _

Example Smart Account format: <MSP>_SD-WAN or <Customer-Name>_SD-WAN

● Step 2: Create Virtual Accounts (one is needed for every tenant)

Go to Manage Smart Accounts at https://software.cisco.com/#module/accountdetails.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 19 of 33

 Click “New Virtual Account”
Don’t use email addresses in the Virtual Account name. A Virtual Account name can have A-Z, a-z, 0-9,
and _. Virtual Account names can be a maximum of 32 characters

The Virtual Account name is the Org ID. The Org ID is used in the certificate Org Name
Example Virtual Account format: For an MSP tenant, <END-CUSTOMER>_PROD
● Step 3: Go to CCW and start ordering

https://apps.cisco.com/ccw/cpc/estimate/create

Ensure that the Smart Account and Virtual Account details are populated via “Assign Smart Account”

When ordering in Cisco Commerce Workspace (CCW), the end customer’s Smart Account and Virtual Account
can be added at the line level or at the header level and applied to all applicable Smart items on the order.

Furnishing SA/VA Details

Partners who have placed the order using a holding account can add the end customer’s Smart Account and
Virtual Account details after order submission. Please click here for a training video on reassigning an order
from a partner holding account to the end customer’s smart account.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 20 of 33

Furnishing SA/VA details

The end customer’s email address is essential for Cisco Catalyst SD-WAN orders. In the case of cloud
deployments, details on Cisco Catalyst SD-WAN Manager will be sent to this email address.

Furnishing contact information for SA/VA

© 2023 Cisco and/or its affiliates. All rights reserved. Page 21 of 33

Step 6: Services
Cisco DNA for SD-WAN and Routing Subscription Embedded Support

Cisco DNA for SD-WAN and Routing subscription licenses include embedded SWSS support ONLY for the
subscription functionality (Cisco Catalyst SD-WAN Manager, Cisco Catalyst SD-WAN Analytics, Cisco Catalyst
SD-WAN Validator, Cisco Catalyst SD-WAN Controller, Cisco Umbrella, Cisco SIG Essentials, etc.) enabled by
the tier purchased (Cisco DNA Essentials, Advantage, and Premier). Cisco DNA SWSS support includes
24x7x365 Cisco Technical Assistance Center (TAC) and Cisco DNA subscription software release updates.

Cisco Embedded Support includes:

● Access to support and troubleshooting via online tools and web case submission. Case severity or
escalation guidelines are not applicable.
● Cisco Technical Assistance Center (TAC) access 24 hours per day, 7 days per week to assist by
telephone, or web case submission and online tools with application software use and troubleshooting
issues.
● Entitlement to maintenance releases and software updates for SD-WAN software only. The Support for
the hardware platform OS, along with OS updates, is covered by the support contract on the hardware.
● Access to www.cisco.com This system provides the customer with helpful technical and general
information on Cisco products, as well as access to Cisco’s online Software Center library.

No additional products or fees are required to receive these services with a software subscription.

No support is included for the underlying hardware, nor are support, upgrades or updates included for the IOS-
XE related perpetual network stack (Network Essentials/Advantage). Any support services for the hardware and
for the IOS-XE perpetual network stack will require a separate router hardware support contract: Smart Net
Total Care, or Solution Support for your multivendor Cisco solution environment.
Recommended: Cisco Solution Support with Smart Net Total Care

Cisco Solution Support is an essential element of Cisco DNA for SD-WAN and Routing as it helps customers
maintain its performance, reliability, and return on investment.

Solution Support provides:

● Centralized support from a primary point of contact.

● Priority access and response from a solution expert.
● Addresses Cisco and Solution Support Partner products.
● Coordination between Cisco and Solution Support Partner product support teams.
● Accountability for issue management and resolution.

When purchased on the hardware, it also covers any issues encountered with the Cisco Catalyst SD-WAN
software hosted on that hardware platform. Refer to the service description for more detailed information
regarding Cisco Solution Support.

● Cisco Solution Support with Cisco Smart Net Total Care ® Service.

You can learn more about Cisco Solution Support at www.cisco.com/go/solutionsupport.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 22 of 33

Steps for Ordering Cisco DNA for SD-WAN and Routing Subscriptions on the Cisco Enterprise Network
Compute System (ENCS).

In this section we will go over the subscription ordering process for the ENCS. The Enterprise NFV solution is
ordered through term-based subscription licenses that may be purchased with a 3- or 5-year duration. At the
time of ordering, you may choose a Cisco DNA for SD-WAN and Routing licensing start date that is
independent of the hardware ship date.

The ordering process for Cisco DNA for SD-WAN and Routing subscriptions on the ENCS hardware is
structured using a multiline bundle. This bundle provides the flexibility to choose the appropriate software stack
and the corresponding hardware stack to run it on.

To order the SD-Branch solution, use the NFV-BRANCH-MLB top-level part number, as shown in Table 11.

Table 11. Enterprise NFV Solution Top-level Product ID

Product ID Description

NFV-BRANCH-MLB NFV multiline bundle for software and hardware options

NFV-BRANCH-MLB is the top-level multiline part number and can be used as the starting point for both the
software subscription licenses and the Cisco ENCS hardware options. Table 12 covers the sub options under
NFV-BRANCH-MLB.

Table 12. Sub Options under NFV-BRANCH-MLB

Product IDs Description

Software licenses

L-DNA-TIER-ADD Software subscription licenses

Hardware

ENCS5412/K9 5412 Enterprise Network Compute System (12-core, 1.5 GHz Intel® CPU, 16 GB DRAM)

ENCS5408/K9 5408 Enterprise Network Compute System (8-core, 2.0 GHz Intel CPU, 16 GB DRAM)

ENCS5406/K9 5406 Enterprise Network Compute System (6-core, 1.9 GHz Intel CPU, 16 GB DRAM)

Ordering Cisco DNA for SD-WAN and Routing Subscription Licenses for the Cisco 5000 Series ENCS

L-DNA-TIER-ADD is a container for all of the Cisco DNA for SD-WAN and Routing subscription licenses for the
5000 Series ENCS solution. These software licenses are common to all ENCS platforms. The ENCS platforms
have been grouped together under the Hardware category.

The Cisco DNA for SD-WAN and Routing subscription licenses include choices along four main dimensions:
preferred choice of management, bandwidth tiers, term, and feature packages.

For ENCS deployments, choosing on-premises or cloud SKUs will entitle the end user to Cisco Catalyst Center
licenses, as the instantiation of virtual network functions on the ENCS is orchestrated via Cisco Catalyst Center.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 23 of 33

Performance options on the ENCS range from 400 Mbps (T1) to 2 Gbps (T2). This selection maps to the Cisco
Integrated Services Virtual Router (ISRv) and IOS XE SD-WAN throughput licenses. When using L-DNA-TIER-
ADD, you must choose the platform license. The platform license determines the throughputs supported on the
underlying hardware. Table 13 lists the throughput licenses supported on the ENCS platforms.

Table 13. Throughputs Supported on the ENCS Platforms

Platform Throughputs supported

5400ENCS T1 up 400# Mbps agg.

T2 up 2 Gbps agg.

#
One-way encrypted traffic must be less than 250Mbps for a T1 bandwidth license.

Ordering ENCS Hardware Options

Table 14 lists the various hardware options available for the Enterprise NFV solution for deployment at the
branches or remote sites. The hardware platform requirements must be derived from the software components
that it hosts. Its resources must not only exceed the sum of the individual VNF requirements, but also leave
room for future growth. While each hardware platform is unique in its own way, each has three basic common
resources – CPU cores, memory, and disk capacity – that must be considered individually.

The ordering tool does not verify the VNF requirements at this time. For the purposes of sizing in this document,
the terms “core,” “vCPU,” and “physical CPU core” are considered equivalent.
Software Selection Choices on the ENCS

Software subscription licenses are ordered via L-DNA-TIER-ADD, as described in the previous section. On the
ENCS hardware you will have to select either the ISRv (non-SD-WAN) or ISRv XE SD-WAN image binary and
version.

Notes:

● Selecting this instance does not license the VNF. This ensures only that the right code is loaded onto the
hardware.
● ISRv XE SD-WAN is supported on all 5400 ENCS platforms.

Table 14 lists the supported ENCS platforms.

Table 14. Hardware Platforms Supported on the ISRv 16.9 – SD-WAN XE

Model Description

ENCS 5412/K9 5412 Enterprise Network Compute System (12-core, 1.5 GHz Intel CPU, 16 GB DRAM)

ENCS 5408/K9 5408 Enterprise Network Compute System (8-core, 2.0 GHz Intel CPU, 16 GB DRAM)

ENCS5406/K9 5406 Enterprise Network Compute System (6-core, 1.9 GHz Intel CPU, 16 GB DRAM)

© 2023 Cisco and/or its affiliates. All rights reserved. Page 24 of 33

NIMs on the ENCS with ISRv 16.9.1 XE SD-WAN

A limited number of Network Interface Modules (NIMs) are supported on the ENCS when using ISRv XE SD-
WAN 16.9 on the ENCS. Table 15 lists the modules supported on the 5400 ENCS.

Table 15. NIMs Supported with ISRv XE SD-WAN 16.9 on the 5400 ENCS

Type of Interface NIMs

4G-LTE NIM-LTEA-EA
NIM-LTEA-LA

T1/E1 NIM-1MFT-T1/E1
NIM-2MFT-T1/E1
NIM-4MFT-T1/E1
NIM-8MFT-T1/E1

ISRv 16.9.1 (non-SD-WAN) is supported on all ENCS platforms. Table 16 lists the supported ENCS platforms.

Table 16. Hardware Platforms Supported on the ISRv 16.9.1

Model Description

ENCS 5412/K9 5412 Enterprise Network Compute System (12-core, 1.5 GHz Intel CPU, 16 GB DRAM)

ENCS 5408/K9 5408 Enterprise Network Compute System (8-core, 2.0 GHz Intel CPU, 16 GB DRAM)

ENCS 5406/K9 5406 Enterprise Network Compute System (6-core, 1.9 GHz Intel CPU, 16 GB DRAM)

Further, additional NIMs are supported with ISRv 16.9 (non-SD-WAN), as shown in Table 17.

Table 17. NIMs Supported with ISRv 16.9 on the 5400 ENCS

Type of Interface NIMs NIM-4G-

4G-LTE LTE-NA NIM-4G-

LTE-VZ NIM-4G-
LTE-GA NIM-
4G-LTE-ST
NIM-4G-LTE-LA
NIM-LTEA-EA
NIM-LTEA-LA

© 2023 Cisco and/or its affiliates. All rights reserved. Page 25 of 33

 Type of Interface NIMs NIM-4G-

T1/E1 NIM-1MFT-T1/E1
NIM-2MFT-T1/E1
NIM-4MFT-T1/E1
NIM-8MFT-T1/E1
NIM-1CE1T1-PRI
NIM-2CE1T1-PRI
NIM-8CE1T1-PRI

Appendix A: Cisco DNA for SD-WAN and Routing Subscription Opt-out

All Cisco DNA bundled routers have to be ordered with a mandatory subscription attach. However, there can be
exceptions as mentioned below:

● Customer has a valid Enterprise License Agreement (EA).

● Managed Service Providers (MSPs) who would opt for MSLA construct.

To accommodate these exceptions, there is an option to “Opt out of Cisco DNA Subscriptions” by selecting the
appropriate DNA-OPTOUT SKU under all the Cisco DNA bundled routers as shown below:

● Under the Cisco DNA hardware bundle, select the Option class “DNA OPT OUT” and select one of the
below appropriate opt-out SKU’s.

Table 18. Cisco DNA for SD-WAN and Routing Subscription Opt Out Options

PID Description

DNA-SDWAN-EA Subscription: Enterprise Agreement Use Only

DNA-SDWAN-MSLA Subscription: MSLA Use Only

Appendix B: Modules Supported in SD-WAN on the 4000 Series ISRs

The following modules are supported for the 4000 Series ISRs:

Table 19. Cisco SD-WAN Module Compatibility Matrix for Cisco ISR4000 Series

NIM-1GE-CU-SFP NIM-1MFT-T1/E1 NIM-LTEA-EA UCS-EN120S-M2/K9

NIM-2GE-CU-SFP NIM-2MFT-T1/E1 NIM-LTEA-LA UCS-EN140N-M2/K9
SM-X-6X1G NIM-4MFT-T1/E1 NIM-1T UCSE-140S-M2/K9
SM-X-4X1G-1X10G NIM-8MFT-T1/E1 NIM-2T UCSE-160D-M2/K9
NIM-4T UCSE-180D-M2/K9

© 2023 Cisco and/or its affiliates. All rights reserved. Page 26 of 33

 NIM-1CE1T1-PRI NIM-ES2-4 NIM-VAB-A UCSE-160S-M3/K9
NIM-2CE1T1-PRI NIM-ES2-8 NIM-VAB-M UCSE-180D-M3/K9
NIM-8CE1T1-PRI NIM-ES2-8-P NIM-VA-B UCSE-1120D-M3/K9
SM-X-NIM-ADPTR NIM-4SHDSL-EA

NIM-2FXO SM-X-24FXS/4FXO NIM-PVDM-32 SM-X-PVDM-500

NIM-4FXO SM-X-16FXS/2FXO NIM-PVDM-64 SM-X-PVDM-1000
NIM-2FXSP SM-X-8FXS/12FXO NIM-PVDM-128 SM-X-PVDM-2000
NIM-4FXSP SM-X-72FXS NIM-PVDM-256 SM-X-PVDM-3000
NIM-2FXS/4FXOP

The following crypto modules are required for the ASR 1000 Series routers:

● ASR1001HX-IPSECHW, for the ASR 1001-HX

● ASR1002HX-IPSECHW, for the ASR 1002-HX

Appendix C: Ordering SD-WAN Subscriptions on ASR Aggregation Platforms

Starting with Cisco IOS-XE 17.5.1, the ASR1006-X platform can also be ordered with a Cisco DNA for SD-
WAN and Routing subscription. The Cisco DNA for SD-WAN and Routing subscriptions applicable to this
platform can be found in Table 20 below.

Table 20. Cisco DNA Subscription Applicability Matrix for Aggregation Platforms

Aggregation Platforms T2 T3
up to 2 Gbps agg. up to 20 Gbps agg.

ASR1001-X ✓✓ ✓✓
ASR1002-X

ASR1001-HX ✓✓
ASR1002-HX
ASR1006-X

✓ =Essentials ✓ =Advantage ✓ =Premier

Note: The T3 subscription license on ASR1006-X entitles the customer to the maximum platform
throughput for SD-WAN.

There are broadly two ways to order this platform as outlined below.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 27 of 33

Option 1: Ordering ASR1006-X-DNA as a Greenfield SD-WAN Router

ASR1006-X can be ordered as an “SD-WAN only” device bundled with Cisco DNA for SD-WAN and Routing
subscription through a top-level SKU “ASR1006-X-DNA”. In this bundle, the ASR1006-X chassis comes with
the following default hardware configuration:

● One Cisco ASR Route Processor 3 (RP3).

◦ Comes with a default 8GB DRAM (upgradeable up to 64GB).

◦ Comes with a default 100GB SSD (upgradeable up to 400GB).

● One Cisco ASR1000 Embedded Services Processor X, 200G (ESP200-X).
● Optionally one/two ASR1000 100G Modular Interface Processor.

◦ Each MIP slot can be optionally configured with up to two EPA’s.

● Cisco DNA for SD-WAN and Routing subscription options.

◦ A Tier 3 Cisco DNA Advantage Cloud/On-Prem license (3Y/5Y/7Y).

◦ A Tier 3 Cisco DNA Premier Cloud/On-Prem license (3Y/5Y).

Below are the some of the ordering screenshots of ASR1006-X-DNA.
Step 1. Select the Universal IOS-XE Image, Required DRAM, HDD and Power Supply Options.

Ordering Selections for ASR10006-X-DNA

© 2023 Cisco and/or its affiliates. All rights reserved. Page 28 of 33

Step 2. (Optional) Select the MIP100 and EPA’s.

Optional Selections for ASR1006-X-DNA

Step 3. Choose the Cisco DNA for SD-WAN and Routing Subscription License.

Ordering Cisco DNA for SD-WAN and Routing Subscriptions with ASR1006-X-DNA

Option 2: Ordering Brownfield SD-WAN Subscriptions for ASR1006-X using L-DNA-TIER-ADD

This option is applicable only if the ASR1006-X hardware is already purchased. You can buy the Cisco DNA for
SD-WAN and Routing subscription license using the top-level SKU “L-DNA-TIER-ADD”. For more information
on supported hardware, please refer to the Option 1 section above.
Step 1. Under L-DNA-TIER-ADD, Make the Platform Selection of ASR1006-X-DNA-PF and the Software
Mode as IOSXE-CTRL-MODE-PF

© 2023 Cisco and/or its affiliates. All rights reserved. Page 29 of 33

Ordering Cisco DNA for SD-WAN and Routing Subscriptions for ASR1006-X

Step 2. Choose the Cisco DNA for SD-WAN and Routing Subscription License.

Ordering Cisco DNA for SD-WAN and Routing Subscriptions for ASR1006-X

Appendix D: Cisco DNA Ordering and License Management on the 4000

Series ISRs
When the customer wishes to buy a Cisco DNA for SD-WAN and Routing license for either SD-WAN or
traditional routing and orders:

● Cisco DNA Essentials, Advantage, or Premier with a bandwidth entitlement less than or equal to the
factory default of the platform, no Performance or Booster license will be fulfilled. Customer is expected
to run the platform at the purchased bandwidth entitlement.
● Cisco DNA Essentials, Advantage, or Premier with bandwidth entitlement greater than the factory default
but less than the bandwidth provided by the High-Performance license (Booster license) of the platform,
a performance license is automatically included at the time of order and the customer does not need to
order it. Additionally, if the bandwidth (post-encryption) is greater than 250Mbps, a platform specific
HSEC license for the relevant platform is automatically included.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 30 of 33

 ● Cisco DNA Essentials, Advantage, or Premier with bandwidth entitlement greater than the High-
Performance license of the platform, but less than or equal to the maximum subscription bandwidth
permitted for the platform, a Boost license is automatically added to the order and the customer does
not need to order it. Additionally, if the bandwidth (post-encryption) is greater than 250Mbps, a platform
specific HSEC license for the relevant platform is automatically included.
● Cisco DNA Essentials, Advantage, or Premier - no additional Technology Packages need to be ordered.
Every Cisco DNA license comes with a term-based Cisco DNA stack entitlement (for SD-WAN) and a
perpetual network stack entitlement (for traditional routing). The perpetual network stack included with
Essentials/Advantage/Premier will have the right technology package feature sets packaged with it (for
example: SECK9, UCK9, APPX).
● If the Cisco DNA for SD-WAN and Routing license is consumed in a traditional routing deployment, only
the network stack is consumed and is available in perpetuity to the customer.
● If the Cisco DNA for SD-WAN and Routing license is consumed in an SD-WAN deployment, only the
Cisco DNA stack is consumed and is only available to the customer for the duration of the subscription
term selected. In other words, the customer must maintain an active Cisco DNA subscription to utilize
SD-WAN functionality and benefit from the continuous innovation enabled by the subscription.
● If the platform is deployed in SD-WAN mode, Performance and Boost licenses have no relevance. In SD-
WAN mode, customer is only entitled to the Cisco DNA bandwidth tier purchased, irrespective of the
underlying platform supporting higher throughput.
● Unified Communications is now also supported on SD-WAN fabric and is packaged into Cisco DNA
Essentials and Cisco DNA Advantage. Cisco DNA Essentials only supports basic CUBE (without DSP
services) whereas Rich voice services and integration with SRST/FXO/FXS/DSP modules are the prime
focus of the Cisco DNA Advantage tier. In SD-WAN mode, the signaling protocol is limited to SIP only,
however traditional routing mode supports all call-control signaling protocols that are currently
supported.

Appendix E: Ordering Cisco DNA for SD-WAN and Routing Subscriptions for
Cisco Industrial Routers
Cisco DNA for SD-WAN and Routing subscriptions for Cisco Industrial Routers can be ordered through L-IR-
DNA-TIER-ADD. The ordering process is similar to the ordering process used with the L-DNA-TIER-ADD SKU.

Step 1: Select the Cisco Industrial Router of your Choice

Complete the a la carte hardware ordering process (e.g.: IR1101-K9 or IR1821-K9) by selecting the suitable
Cisco IOS type, Software Mode (Autonomous or SD-WAN boot up mode), Network Essentials/Advantage
perpetual licenses, Network Modules and accessories.

© 2023 Cisco and/or its affiliates. All rights reserved. Page 31 of 33

Step-2: Add L-IR-DNA-TIER-ADD SKU:

L-IR-DNA-TIER-ADD provides various subscription options for each platform.

● After adding L-IR-DNA-TIER-ADD SKU, select the platform family against which the subscription is
expected to be purchased from one of the platform selection categories, as shown below:

Ordering Cisco DNA for SD-WAN and Routing Subscriptions for IoT Platforms

● Select the intended deployment use case from the category “Software Mode”, using one of the options
from below:

IOSXE-CTRL-MODE-PF: Choose this if your deployment use case is SD-WAN (irrespective of On-prem
or Cloud) and the management is through Cisco Catalyst SD-WAN Manager.

IOSXE-AUTO-MODE-PF: Choose this if your deployment use-case is traditional routing (management is

through Cisco Catalyst Center).

© 2023 Cisco and/or its affiliates. All rights reserved. Page 32 of 33

Deployment Mode Options

Select the appropriate tiered bandwidth for the product family chosen. Refer to Table 9 for the appropriate
bandwidth selections on IoT Platforms.

Note: For Cisco Industrial Routers, Network Essentials/Advantage (perpetual elements) are mandatory
and configured as part of the hardware ordering.

It is recommended that the Cisco DNA for SD-WAN and Routing subscription tier selected aligns with the
closest perpetual license bandwidth ordered with the hardware:

● Perpetual DEF license with Cisco DNA for SD-WAN and Routing Tier 0 subscription.
● Perpetual PERF license with Cisco DNA for SD-WAN and Routing T1 subscription.
● Perpetual Boost license with Cisco DNA for SD-WAN and Routing Tier 2 subscription.

When ordering in CCW, alerts will show which matching Network Essentials/Advantage license matches the
selected product and bandwidth tier.

Printed in USA C07-740642-16 10/23

© 2023 Cisco and/or its affiliates. All rights reserved. Page 33 of 33