C9400-SUP-1XL Cisco Catalyst 9400 Supervisor Engine Modules

Product overview

Cisco^® Catalyst^® 9400 Series switches are Cisco’s lead modular enterprise access switching platform and as part of the Catalyst 9000 family, are built to transform your network to handle a hybrid world where the workplace is anywhere, endpoints could be anything, and applications are hosted all over the place.

The Catalyst 9400 Series, including the new Catalyst 9400 SUP-2/2XL supervisor and line cards, continues to shape the future with continued innovation that helps you reimagine connections, reinforce security and redefine the experience for your hybrid workforce big and small. These switches form the foundational building blocks for Cisco SD-Access, our leading enterprise architecture. The platform provides strong investment protection, with a chassis architecture that is capable of supporting up to nine Tbps of system bandwidth and industry-leading power delivery with high-density IEEE 802.3bt PoE (60W and 90W). Redundancy is now available across the portfolio. Cisco Catalyst 9400 Series switches deliver state-of-the-art high availability with capabilities such as Nonstop Forwarding and Stateful Switchover (NSF/SSO), In-Service Software Upgrade (ISSU), uplink resiliency, and N+1/N+N redundancy for power supplies and Cisco StackWise^® Virtual (SVL) redundancy with ISSU. The platform is enterprise-optimized with an innovative, dual‑serviceable fan-tray design and side-to-side airflow and is closet-friendly with approximately 16 inches in depth. A single system can scale up to 480G per slot with SUP-2XL, 384 access ports with your choice of 10G, 5G and 2.5G mGig copper, 1G copper, Cisco UPOE^®+, Cisco UPOE and PoE+ options and up to 384 ports of 10G Fiber and 1G Fiber options. The platform also supports 100G/40G/25G/10G uplink options and advanced routing and infrastructure services, SD-Access capabilities, and network system virtualization. These features enable placement of the platform in the core and aggregation layers of small- to medium-sized campus environments.

A foundation for Software-Defined Architecture

Advanced persistent security threats, the exponential growth of the Internet of Things (IoT) devices, mobility everywhere and cloud adoption require a network fabric that integrates advanced hardware and software innovations to automate, secure, and simplify customer networks. The goal of this network fabric is to enable customer revenue growth by accelerating business service rollout.

The Cisco Networking Cloud with Software-Defined Access (SD-Access) is the most advanced network fabric to power customer business. Cisco Networking Cloud is an open and extensible, software-driven architecture that accelerates and simplifies your enterprise network operations. The programmable architecture frees your IT staff from time consuming, repetitive network configuration tasks so they can focus instead on innovation that positively transforms your business. SD-Access enables policy-based automation from edge to cloud with foundational capabilities that include:

●     Simplified device deployment

●     Unified management of wired and wireless networks

●     Network virtualization and segmentation

●     Group-based policies

●     Context-based analytics

Cisco Catalyst 9400 Series switches support enterprise fabric to provide these benefits, while extending controller-based networking with uniform enterprise-wide policy and mobility.

Software subscription

There are two choices for software subscription: Cisco DNA or Cisco Catalyst. They provide:

●     Flexible licensing models to smoothly distribute customers’ software spending over time.

●     Investment protection for software purchases through software services–enabled license portability.

●     Access to updates, upgrades, and new technology from Cisco through Cisco Software Support Services (SWSS).

●     Base product-level support for hardware, software, and Cisco IOS (Catalyst Software only).

●     ISE licenses included in the Advantage tier to facilitate zero-trust network security^* (Catalyst Software only).

●     Access to end-to-end network visibility with Cisco Spaces and service assurance through Cisco ThousandEyes Network and Application Synthetics (included with the Advantage license).

Manage your entire switching structure as a single, converged component. With one management system and one policy for wired and wireless networks, it offers an efficient way to provide more secure access.

^*ISE license quantities are outlined below. Note that ISE is not eligible for Catalyst 9200 series switches.

ISE license quantities in Cisco Catalyst software subscription for Switching.

Cisco Spaces and ThousandEyes

Cisco Catalyst 9400 Series switches support hosting Cisco Spaces natively on the CPU complex. Cisco Spaces IoT Services on Catalyst 9000 switches bridges wired smart building technology using the power of data to help speed return to a trusted workplace and the inevitable return-to-office.

Cisco Spaces is included with Cisco DNA Advantage licenses.

Access to end-to-end service assurance through Cisco ThousandEyes^* Network and Application Synthetics (included with Cisco DNA Advantage licenses).

Cisco Networking Cloud lets you manage your entire switching structure as a single, converged component. With one management system and one policy for wired and wireless networks, it offers an efficient way to provide more secure access.

^* The ThousandEyes credits included as part of Catalyst 9400 Cisco DNA Advantage subscriptions will be limited to 110,000,000 units of test capacity per customer. ThousandEyes Cloud Agent access is not included in the Cisco DNA license entitlement. Test capacity can be increased and Cloud Agents accessed with purchase of additional ThousandEyes Network and Application Synthetics.

Details

Cisco Catalyst 9400 Series switches support five supervisors optimized for various campus deployments– access and aggregation. Along with Cisco’s campus-optimized 100G and 25G optics, these modular platforms are now capable of supporting architectural transformations with industry-leading investment protection.

The Cisco Catalyst C9400X-SUP-2XL supervisor engine is designed for the core and aggregation with 100G uplinks (Figure 1).

Figure 1.

C9400X-SUP-2XL supervisor engine

The Cisco Catalyst C9400X-SUP-2XL supervisor engine is a next-generation supervisor optimized for the enterprise-class core and aggregation layers, supporting up to 480 Gbps per slot with 100G uplinks. Supervisor Engine-2XL allows for unique investment protection through a 100G uplink connectivity option, which is becoming a popular alternative to 40G in the core.

The Cisco Catalyst C9400X-SUP-2XL supervisor engine hardware is capable of supporting advanced routing and infrastructure services such as Multiprotocol Label Switching (MPLS); software-defined access control and border capabilities (such as a host-tracking database, cross-domain connectivity, and VPN Routing and Forwarding [VRF]-aware Locator/ID Separation Protocol [LISP]); and hardware capable flexible ASIC templates to create resources to optimize table sizes for different places in the network.

The Cisco Catalyst C9400X-SUP-2 supervisor engine is designed for the Access with 100G uplinks (Figure 2).

Figure 2.

C9400X-SUP-2 supervisor engine

The Cisco Catalyst C9400X-SUP-2 supervisor engine is a next-generation supervisor optimized for the enterprise-class access layers, supporting up to 240 Gbps per slot with 100G uplinks.

The Cisco Catalyst C9400-SUP-1XL-Y supervisor engine is designed for the core and aggregation with 25G uplinks (Figure 3).

Figure 3.

C9400-SUP-1XL-Y supervisor engine

The Cisco Catalyst C9400-SUP-1XL-Y supervisor engine is a next-generation supervisor optimized for the enterprise-class core and aggregation layers, supporting up to 240 Gbps per slot with 25G uplinks. Supervisor Engine-1XL-Y allows for unique investment protection through a 25G uplink connectivity option, which is becoming a popular alternative to 10G in the core. The Cisco Catalyst C9400-SUP-1XL-Y supervisor engine hardware is capable of supporting advanced routing and infrastructure services such as Multiprotocol Label Switching (MPLS); software-defined access control and border capabilities (such as a host-tracking database, cross-domain connectivity, and VPN Routing and Forwarding [VRF]-aware Locator/ID Separation Protocol [LISP]); and flexible ASIC templates to create resources to optimize table sizes for different places in the network.

The Catalyst C9400-SUP-1XL supervisor engine is designed for the core and aggregation layers (Figure 4).

Figure 4.

C9400-SUP-1XL supervisor engine

The Cisco Catalyst C9400-SUP-1XL supervisor engine is a next-generation supervisor optimized for enterprise-class the core and aggregation layers, supporting up to 240 Gbps. The C9400-SUP-1XL supervisor engine hardware is capable of supporting advanced routing and infrastructure services such as Multiprotocol Label Switching (MPLS); software-defined access control and border capabilities (such as a host tracking database, cross-domain connectivity, and VPN routing and forwarding [VRF]-aware Locator/ID Separation Protocol [LISP]); flexible ASIC templates to create resources to optimize table sizes for different places in the network; and network system virtualization with Cisco StackWise Virtual technology, which is critical for placement in the campus core.

The Cisco Catalyst C9400-SUP-1 supervisor engine is designed for access (Figure 5).

Figure 5.

C9400-SUP-1 supervisor engine

Features

Product highlights

●     The Cisco Unified Access Data Plane (UADP) 3.0sec ASIC on C9400X-SUP-2XL, C9400X-SUP-2 and Cisco Unified Access Data Plane (UADP) 2.0 ASIC on C9400-SUP-1/1XL/1XL-Y is ready for next- generation technologies with its programmable pipeline, microengine capabilities, and template-based configurable allocation of Layer 2, Layer 3, forwarding, Access Control List (ACL), and Quality of Service (QoS) entries.

●     Intel 2.4-GHz x86 with up to 960 GB of SATA SSD local storage for container-based application hosting.

●     Up to 4 non-blocking 100/40 Gigabit Ethernet uplinks and up to 4 non-blocking 25/10 Gigabit Ethernet uplinks on C9400X-SUP-2/2XL.

●     Up to 2 non-blocking 25 Gigabit Ethernet uplinks on the C9400-SUP-1XL-Y supervisor engine.

●     Up to 2 non-blocking 40 Gigabit Ethernet uplinks (Quad Small Form-Factor Pluggable [QSFP]) and up to 8 non-blocking 10 Gigabit Ethernet uplinks (SFP+) on C9400-SUP-1/1XL/1XL-Y.

●     Up to 384 ports of non-blocking 10/100/1000 RJ-45 ports.

●     Up to 392 ports of non-blocking 1 Gigabit Ethernet Fiber (SFP) ports (C9400-SUP-1/1XL/XL-Y). Up to 384 ports of non- blocking 1Gigabit Ethernet Fiber (SFP) ports (C9400X-SUP-2/2XL).

●     Up to 392 ports of non-blocking 10 Gigabit Ethernet SFP+ ports (8 uplinks plus 384 10G line card ports) (C9400-SUP-1/1XL/XL-Y); 388 ports of non-blocking 10 Gigabit Ethernet SFP+ ports (4 uplinks plus 384 10G line cards ports) (C9400X-SUP-2/2XL).

●     Up to 168 ports of 25 Gigabit Ethernet SFP28 ports (8 uplinks plus 160 25G line cards ports) (C9400X-SUP-2/2XL).

●     Up to 36 ports of 100 Gigabit Ethernet QSFP28 ports (4 100G uplinks plus 32 100G line cards ports) (C9400X-SUP-2/2XL).

●     Up to 384 ports of non-blocking 10G/5G mGig RJ-45 ports.

●     Cisco UPOE+ (90 W), Cisco UPOE (60W), and PoE+ (30W) capabilities on 384 ports simultaneously.

●     Line rate hardware-based Flexible NetFlow (FNF) delivering flow collection up to 384,000 flows.

●     IPv6 support in hardware, providing wire rate forwarding for IPv6 networks.

●     Dual-stack support for IPv4 and IPv6 and dynamic hardware forwarding table allocations for ease of IPv4-to-IPv6 migration.

●     Support for both static and dynamic NAT and Port Address Translation (PAT).

●     Scalable routing (IPv4, IPv6, and multicast) tables and Layer 2 tables.

●     Open Cisco IOS^® XE: This modern operating system for the enterprise provides support for model-driven programmability, on-box Python scripting, streaming telemetry, container-based application hosting and patching for critical bug fixes. The OS also has built-in defenses to protect against runtime attacks.

●     Support app hosted Cisco Spaces natively on the CPU complex. Cisco Spaces IoT Services on Catalyst 9000 switches bridges wired smart building technology using the power of data to help speed return to a trusted workplace and the inevitable return-to-office.

●     End-to-end visualization of the path from campus/branch to clouds/DC with Cisco ThousandEyes Network and Application Synthetics (included with Cisco DNA Advantage licenses).

●     SD-Access: Cisco Catalyst 9400 Series Switches form the foundation building block for SD-Access – Cisco’s leading enterprise architecture, which includes:

◦    Policy-based automation from edge to cloud.

◦    Segmentation and micro-segmentation made easy, with having predictable performance and scalability.

◦    Automation through Cisco Catalyst Center.

◦    Policy through the Cisco Identity Services Engine (ISE).

◦    Network assurance through Network Data Platform.

◦    The ability to launch new business services faster and improve issue resolution time significantly.

●     Plug and Play (PnP) enabled: A simple, secure, unified, and integrated offering eases new branch or campus device rollouts and can also be used for providing updates to an existing network.

Advanced security

●     Cisco Encrypted Traffic Analytics (ETA)¹: You benefit from the power of machine learning to identify and take actions toward threats or anomalies in your network, including malware detection in encrypted traffic (without decryption) and distributed anomaly detection.

●     AES-256² support with the powerful MACsec-256 encryption algorithm is available in hardware.

●     100G IPsec in hardware: With the new 3.0sec UADP ASIC, the Catalyst 9400X comes with 100G line rate IPsec to provide secure transport over Layer 3 networks.

●     Secure Tunnel connectivity: With the new IPsec capability, C9400X enables secure connections to any remote location which is IKEv2 standards using IPsec tunnel with AES-256 Encryption and speeds up to 100G.

●     Trustworthy systems: Secure Unique Device Identification (SUDI) support for PnP tamper-proof device identity capability secures zero-touch provisioning by allowing your device to show a certificate to the server to be able to get onto your network.

¹ ETA is currently not supported in C9400X-SUP-2/2XL.² MACsec is currently not supported in hardware in the C9400-SUP-1XL-Y supervisor engine.

Supervisor Engine Chassis and Line Card Support

Table 1 shows the supervisor engine and line card slot assignment options in the Cisco Catalyst 9400 Series chassis.

Table 1.           Cisco Catalyst 9400 Chassis Slot: Assignment Options

Table 2.           Cisco Catalyst 9400 Chassis Minimum Software Support

Table 3 summarizes the performance capacities of the Supervisor Engine on a per-chassis basis.

Table 3.           Cisco Catalyst 9400 Supervisor Engine Bandwidth per Slot for Different Chassis

Table 4 summarizes the line card modules supported on Supervisor Engine.

Table 4.           Cisco Catalyst 9400 Supervisor Engine Line Card and Module Support

Performance and scalability

Table 5 highlights the performance and scalability enhancements of the Cisco Catalyst 9400 Supervisor Engine.

Table 5.           Cisco Catalyst 9400 Supervisor Engine Performance and Scalability Features

¹ Depends on SDM templates² C9400X-SUP-2/2XL with Custom SDM template³ host route (/32) + LPM (Longest Prefix Match) route⁴ 300 with IOS XE 17.1.1 or later. 256 with IOS XE 16.12 or earlier

Host routes refer to any /32 routes, including those that are learned indirectly (for instance, learned over Open Shortest Path First [OSPF] or other routing protocols). It does not mean the supervisor module can install 80,000 directly connected clients (/32) for attached VLANs or SVIs. In other words, directly connected routes in engineering terms refers to any /32 prefix. This includes clients attached to switch's own VLAN/SVI and those /32 prefixes learned over any routing protocols as well. An indirectly connected route is a route with a prefix other than /32.

Flexible ASIC templates

Flexible ASIC templates¹ enable universal deployments by leveraging the Unified Access Data Plane’s (UADP) ability to create resources to optimize table sizes for different places in the network. Based on how the switch is used in the network, an appropriate flexible ASIC template may be selected to configure the switch for specific features.

The following flexible ASIC templates are supported on Cisco Catalyst 9400 Series switches:

●     Access: Maximizes system resources for MAC addressing and security.

●     Core: Maximizes system resources for unicast and multicast routing.

●     Software-Defined access (SD-Access): Maximizes system resources to support fabric deployment.

●     Network Address Translation (NAT): Maximizes system resources for Layer 3 and NAT to support collapsed core WAN deployments.

¹ Currently not supported on C9400X-SUP-2/2XL in software.

Table 6.           Cisco Catalyst 9400 Series switches and flexible ASIC templates