C1111-4P – 2x1G WAN incl. RJ45/SFP Combo – 4x1G LAN Ports – Optional 2 PoE or 1 PoE+
Why Layer23-Switch
Stocked, Shipped and Supported by One Team
Ships in 1 Business Day
In-stock orders leave our Hong Kong or U.S. warehouse within 1 business day after payment, with tracking by email.
LSCare Warranty
3years on enterprise equipment
Free CCIE Support
Certified engineers help before and after you buy. Reply within 1 business day by email or live chat.
Verify Before You Pay
100%factory-sealed
Get label and serial photos before shipment, and check every serial number with Cisco.
C1111-4P Description
The C1111-4P is a Cisco 1000 Series Integrated Services Router for small branch offices that connect over wired WAN circuits only. The router has two Gigabit WAN ports (one RJ-45/SFP combo), four Gigabit LAN ports, up to 500 Mbps of IPsec and 1600 Mbps of IPv4 forwarding at 512 bytes, and 4 GB of DRAM, with no cellular option. Licensing sets the usable encryption rate: 50 Mbps under SEC, 150 Mbps with the VPERF license and no cap with HSEC.
Quick Specs
|
Parameter |
Specification |
|---|---|
|
WAN interfaces |
2 x 1G: 1 RJ-45/SFP combo port and 1 RJ-45 port |
|
LAN switch ports |
4 x 1G RJ-45 |
|
IPv4 forwarding throughput (512B) |
Up to 1,600 Mbps |
|
IPsec throughput (512B, autonomous mode) |
Up to 500 Mbps |
|
SD-WAN IPsec throughput (512B) |
Up to 450 Mbps |
|
DRAM and flash |
4 GB DRAM, 4 GB flash |
|
Cellular option |
None: no embedded LTE, pluggable module or LTE dongle |
|
Default technology package |
IP Base (SL-1100-4P-IPB) |
|
Default power supply |
External AC adapter, 66W maximum output, 12 VDC |
|
Default PoE budget |
None; the standard 66W adapter carries no PoE |
|
PoE with ISR-1100-POE2 |
115W power supply: 2 x 802.3af PoE or 1 x 802.3at PoE+ |
|
Minimum software release |
Cisco IOS XE 16.6.1 |
Product Performance
Key Features
The first WAN port takes either an RJ-45 cable or an SFP, and the second is copper, so a fiber circuit and an Ethernet circuit can both end on the router. Supported optics include GLC-SX-MMD for multimode fiber, GLC-LH-SMD, GLC-EX-SMD and GLC-ZX-SMD for single-mode runs, and GLC-BX-D and GLC-BX-U for single-strand links.
The SEC license adds zone-based firewall, IPsec VPN, DMVPN, FlexVPN and GETVPN to IP Base. Where import rules restrict strong payload encryption, SEC-NPE keeps the same security feature set without that encryption.
The Universal IOS XE image runs the router as an SD-WAN edge under Catalyst SD-WAN Manager or as an autonomous router managed by CLI, WebUI or Cisco DNA Center. SD-WAN mode carries 200 overlay tunnels. Its 450 Mbps IPsec rate falls to 200 Mbps once QoS, deep packet inspection and Flexible NetFlow all run on the traffic.
On the standard 66W adapter the LAN switch supplies no power. The internal ISR-1100-POE2 adapter brings a 115W supply that powers two 802.3af devices or one 802.3at PoE+ device, and it can be fitted at first order or later in the field.
In autonomous mode the 4 GB of memory holds 280K IPv4 and 260K IPv6 routes, 100K NAT sessions and 1K VRFs. Policy scales to 4K ACLs and 10K IPv4 ACEs, and up to 100 IPsec static virtual tunnel interfaces can terminate on the router.
The integrated console port accepts either a standard RJ-45 serial cable or a Micro-USB cable for local setup. A Type A USB 3.0 port next to it takes a USB drive for file storage.
Application Scenarios
A small branch that buys service from two providers lands the fiber circuit on the combo WAN port and the copper Ethernet circuit on the second port, while the four LAN ports serve its desks and printers.
Clinics and pharmacies that belong to a larger healthcare group join the corporate SD-WAN fabric through the router, which builds encrypted overlay tunnels to the data center and cloud applications under Catalyst SD-WAN Manager.
An accounting or engineering office outside the SD-WAN fabric runs the router in autonomous mode, reaching headquarters over DMVPN or FlexVPN tunnels while the zone-based firewall screens its internet traffic.
Product Comparison
|
Parameter |
C1111-4P | |||
|---|---|---|---|---|
|
WAN interfaces |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
|
IPsec throughput (512B) |
Up to 500 Mbps |
Up to 500 Mbps |
Up to 500 Mbps |
Up to 600 Mbps |
|
SD-WAN IPsec throughput (512B) |
Up to 450 Mbps |
Up to 450 Mbps |
Up to 450 Mbps |
Up to 650 Mbps |
|
IPv4 forwarding throughput (512B) |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
Up to 1,800 Mbps |
|
SD-WAN overlay tunnels scale |
200 |
200 |
200 |
200 |
|
Pluggable |
Not applicable |
CAT4 LTE USB dongle |
Pluggable slot: CAT4, CAT6, CAT7, CAT18 LTE and 5G |
Not applicable |
|
DRAM/flash |
4 GB/4 GB |
4 GB/4 GB |
4 GB/4 GB |
4 GB/4 GB |
|
Default PoE budget |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
|
PoE with optional PoE supply |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
150W supply: 4 PoE or 2 PoE+ on 8 x 1G LAN ports |
C1111-4P has no cellular option, while C1121-4P takes a CAT4 LTE USB dongle for backup; their WAN ports, 500 Mbps IPsec rating, 1600 Mbps forwarding rate and 4 GB of DRAM are the same. A site that plans CAT6 to CAT18 LTE or 5G as its primary or backup link needs C1121-4PLTEP, whose pluggable slot takes those modules. More than four wired LAN devices, more than two PoE devices or SD-WAN IPsec above 450 Mbps point to C1111-8P. That model has eight LAN ports, 650 Mbps of SD-WAN IPsec and four PoE or two PoE+ ports on a 150W supply.
PoE Power Planning
|
Planning Item |
Value or Check |
|---|---|
|
Standard power adapter |
External, 66W maximum output at 12 VDC; supplies no PoE |
|
PoE option |
ISR-1100-POE2: internal PoE adapter with a 115W power supply, fitted at first order or later as a field-replaceable unit |
|
PoE ports with ISR-1100-POE2 |
2 ports at 802.3af PoE, or 1 port at 802.3at PoE+ |
|
PoE budget |
Defined by powered port count; no wattage budget is published beyond the 115W supply rating |
|
PoE output voltage |
-53.5 VDC |
|
Endpoint check |
Two 802.3af phones or cameras, or one 802.3at access point; a third powered device needs its own power source |
Ordering Checklist
- Technology license: IP Base (SL-1100-4P-IPB) is the default; add SL-1100-4P-SEC for firewall and VPN, SL-1100-4P-SECNPE where payload encryption is restricted, or SL-1100-4P-APP for MPLS and NBAR2. SL-1K-4P licenses fit C112x, C1131 and C1161 models, not this router.
- IPsec performance license: With SEC alone tunnels stop at 50 Mbps; FL-VPERF-4P-100 raises the ceiling to 150 Mbps, and FL-1100-4P-HSEC removes it. Without HSEC the 500 Mbps IPsec rating is out of reach.
- Software type: The IOS software version and type is a required selection; the router needs Cisco IOS XE 16.6.1 or later, and 16.8.1 or later once the HSEC license is on the order.
- PoE supply: Add ISR-1100-POE2 when a LAN port must power a phone or access point; it replaces the standard 66W adapter with a 115W supply. Without it no LAN port supplies power.
- Rack kit and power cord: Order ACS-1100-RM-19 for rack mounting, because ACS-1100-RM2-19 fits 112x, 1131 and 1161 models. The power cord is a required line on every order.
Optional Add-ons
|
Model |
Description |
|---|---|
|
ISR-1100-POE2= |
Internal PoE adapter with 115W power supply for 2 PoE or 1 PoE+ LAN ports |
|
FL-1100-4P-HSEC= |
HSEC license that removes the encrypted throughput limit on ISR 1100 4P models |
|
FL-VPERF-4P-100= |
IPsec performance license adding 100 Mbps on ISR 1100 4P models, for a 150 Mbps ceiling |
|
SL-1100-4P-SEC= |
Security technology license: zone-based firewall, IPsec VPN, DMVPN, FlexVPN, GETVPN |
|
SL-1100-4P-SECNPE= |
Security license without strong payload encryption |
|
SL-1100-4P-APP= |
Application Experience license: MPLS, L2TPv3, VPLS, NBAR2, AVC, PfRv3 |
|
ACS-1100-RM-19= |
Rack-mount kit for 111x models |
|
1000BASE-LX/LH SFP for the combo WAN port, single-mode, DOM | |
|
1000BASE-SX SFP for the combo WAN port, multimode, DOM | |
|
1000BASE-EX SFP for the combo WAN port, single-mode, DOM | |
|
1000BASE-ZX SFP for the combo WAN port, DOM | |
|
GLC-BX-D |
1000BASE-BX SFP, 1490 nm, single-strand |
|
GLC-BX-U |
1000BASE-BX SFP, 1310 nm, single-strand |
|
10/100/1000BASE-T copper SFP |
C1111-4P Rear Panel
|
① |
LAN |
⑦ |
GE 0/0/0 – SFP |
|
② |
CLEI Label |
⑧ |
GE 0/0/0 – RJ45 |
|
③ |
Serial Number |
⑨ |
GE 0/0/1 |
|
④ |
Kensington Lock Slot |
⑩ |
4-pin Power Connector |
|
⑤ |
RJ45 / Micro USB Console |
⑪ |
Power Switch |
|
⑥ |
USB3.0 |
⑫ |
Reset Button |
Specifications
| Parameter | Specification | Parameter | Specification |
|---|---|---|---|
| Product ID | C1111-4P | WAN interfaces | 2 x Gigabit Ethernet: 1 copper/SFP combo port and 1 copper port |
| LAN switch ports | 4 x Gigabit Ethernet (copper) | Console port | 1 x integrated Micro-USB/RJ-45 |
| USB port | 1 x Type A USB 3.0 | LTE | Not supported |
| DSL interface | Not supported | Embedded access point | Not supported |
| DRAM | 4 GB | Flash | 4 GB |
| IPv4 forwarding throughput (512B) | Up to 1,600 Mbps | IPsec throughput (512B) | Up to 500 Mbps |
| SD-WAN IPsec throughput (512B) | Up to 450 Mbps | SD-WAN Profile: IPsec + QoS + deep packet inspection + Flexible NetFlow (512B) | Up to 200 Mbps |
| SD-WAN overlay tunnels scale | 200 | Number of IPsec SVTI tunnels | 100 |
| Number of ACLs per system | 4K | Number of IPv4 ACEs per system | 10K |
| Number of IPv4 routes | 280K | Number of IPv6 routes | 260K |
| Number of NAT sessions | 100K | Number of VRFs | 1K |
| Default technology package | IP Base (SL-1100-4P-IPB): routing protocols, ACL, NAT, QoS, BFD, VRF Lite, IPSLA responder and initiator | Optional technology licenses | APP (SL-1100-4P-APP), SEC (SL-1100-4P-SEC), SEC-NPE (SL-1100-4P-SECNPE) |
| SEC license IPsec performance | Up to 50 Mbps | VPERF license | FL-VPERF-4P-100; IPsec performance limited to 150 Mbps |
| HSEC license | FL-1100-4P-HSEC; removes the encrypted performance limit; Cisco IOS XE 16.8.1 or later | Software image | Single Universal Cisco IOS XE image; features enabled by right-to-use licenses |
| Management | WebUI without a license; Catalyst SD-WAN Manager (controller mode) or Cisco DNA Center (autonomous mode) | Minimum software release | Cisco IOS XE 16.6.1 |
| Default power supply | External AC adapter, 66W maximum output | AC input voltage | Universal 100 to 240 VAC, 50 to 60 Hz |
| Output voltage | 12 VDC | Default PoE budget | None; the standard 66W adapter carries no PoE |
| PoE with ISR-1100-POE2 | 115W power supply: 2 PoE ports or 1 PoE+ port | Inline PoE | 802.3af-compliant PoE, 802.3at-compliant PoE+ |
| PoE output voltage | -53.5 VDC | Maximum power consumption (excluding external PS loss) | 18W |
| Operating temperature | 0 to 40°C at sea level; 1°C per 1000 ft derating from 40°C | Operating altitude | 0 to 10,000 ft (0 to 3048 m) |
| Operating humidity | 10% to 85% relative humidity, noncondensing | Storage temperature | -40°C to +70°C (-40°F to +158°F) |
| Nonoperating altitude | 0 to 15,000 ft (0 to 4572 m) | Nonoperating humidity | 5% to 95% relative humidity, noncondensing |
| Dimensions (H x W x D) | 1.75 x 12.70 x 9.03 in. (4.45 x 32.26 x 22.94 cm) | Weight | 1.98 kg (4.37 lb) |
| Rack-mount kit | ACS-1100-RM-19 | Compatible SFPs | GLC-EX-SMD, GLC-LH-SM, GLC-LH-SMD, GLC-SX-MM, GLC-SX-MMD, GLC-ZX-SM, GLC-ZX-SMD, GLC-BX-D, GLC-BX-U, GLC-BX40-D-I, GLC-BX40-U-I, GLC-GE-100FX, GLC-T, GLC-TE, SFP-GE-S, SFP-GE-T |
| Standard safety certifications | UL 60950-1, CSA 60950-1, EN 60950-1, IEC 60950-1, UL 62368-1, CSA 62368-1, EN 62368-1, IEC 62368-1 | EMC emissions | EN55022/CISPR22, CFR 47 Part 15, ICES003, VCCI-V-3, AS/NZS CISPR22, CNS13438, EN300-386, EN61000-3-2, EN61000-3-3, EN61000-6-1 |
| EMC immunity | EN55024/CISPR24, EN61000-4-2, EN61000-4-3, EN61000-4-4, EN61000-4-5, EN61000-4-6, EN61000-4-11, EN300-386 |
Quality Certifications
Customer Reviews
Questions & Answers
-
What throughput does C1111-4P with 512-byte packets?
-
Which license does C1111-4P need for firewall and VPN?
-
Can SL-1K-4P-SEC-SV be installed on C1111-4P?
-
What is the maximum power consumption of C1111-4P, excluding external power supply loss?
-
Which EMC emission and immunity standards is C1111-4P listed against?
-
What operating temperature range applies to C1111-4P at sea level?
Warranty
Layer23-Switch.com offers genuine, high-quality ICT products at competitive wholesale prices—ensuring exceptional value without compromising quality.
All items are brand new, original, and factory-sealed.
Upon request, each unit can be fully tested and verified by a Cisco CCIE-certified engineer to ensure perfect working condition before shipment.
Our Cisco CCIE-certified experts provide free professional support via phone, email, online chat, or remote login—helping you deploy and troubleshoot with confidence.
If you are not satisfied with your purchase, you may request an exchange or full refund. Our customer service team will guide you through the return process quickly and smoothly. Visit Return Policy page for more information.
We support multiple secure payment and logistics options, backed by industry-leading verification:
Visit How to Pay page for more information
Extended, Worry-Free Warranty Coverage Factory New Sealed Enterprise Hardware:
· 3 Years Factory New Sealed
Visit Warranty Policy page for more information
Verify, plan, and comparewith confidence
Use practical tools to check device details, review lifecyclemilestones, and compare hardware before you buy.
Everything you’d hope for in a vendor experience.
QA approved the product on the first review.
Our procurement has been simplified since we standardized on Layer23.
Reliable hardware. Layer23 handled the shipping documents perfectly.
Built like a tank. Setup was easy. Shipping was solid.