C1121-4P – 2x1G WAN incl. RJ45/SFP Combo – 4x1G LAN Ports – ISR 1000 Branch Router
Shop Expert-Recommended Accessories for the C1121-4P
Explore optics, stacking accessories, modules, and power supplies—all verified by our engineers for use with this model.-
GLC-LH-SMD
1000BASE-LX/LH SFP - 10km SMF / 550m MMF - DOMOriginal price was: $1,260.58.$95.80Current price is: $95.80. -
GLC-SX-MMD
1000BASE-SX SFP - MMF 850nm - DOMOriginal price was: $633.46.$59.00Current price is: $59.00.
Why Layer23-Switch
Stocked, Shipped and Supported by One Team
Ships in 1 Business Day
In-stock orders leave our Hong Kong or U.S. warehouse within 1 business day after payment, with tracking by email.
LSCare Warranty
3years on enterprise equipment
Free CCIE Support
Certified engineers help before and after you buy. Reply within 1 business day by email or live chat.
Verify Before You Pay
100%factory-sealed
Get label and serial photos before shipment, and check every serial number with Cisco.
C1121-4P Description
The C1121-4P is a Cisco 1000 Series Integrated Services Router for small branch offices with up to four wired LAN devices and one or two WAN circuits. The router has two Gigabit WAN ports (one RJ-45/SFP combo), up to 450 Mbps of SD-WAN IPsec at 512 bytes, 200 overlay tunnels and 4 GB of DRAM, with cellular limited to a CAT4 LTE USB dongle. The four LAN ports carry no PoE on the standard 66W adapter, and two PoE ports or one PoE+ port need the optional 115W supply.
Quick Specs
|
Parameter |
Specification |
|---|---|
|
WAN interfaces |
2 x 1G: 1 RJ-45/SFP combo port and 1 RJ-45 port |
|
LAN switch ports |
4 x 1G RJ-45 |
|
SD-WAN IPsec throughput (512B) |
Up to 450 Mbps |
|
IPsec throughput (512B, autonomous mode) |
Up to 500 Mbps |
|
IPv4 forwarding throughput (512B) |
Up to 1,600 Mbps |
|
SD-WAN overlay tunnels |
200 |
|
DRAM and flash |
4 GB DRAM, 4 GB flash |
|
Cellular option |
CAT4 LTE USB dongle; no pluggable module slot |
|
Default technology package |
IP Base (SL-1K-4P-IPB) |
|
Default power supply |
External AC adapter, 66W maximum output, 12 VDC |
|
Default PoE budget |
None; the standard 66W adapter carries no PoE |
|
PoE with ISR-1100-POE2 |
115W power supply: 2 x 802.3af PoE or 1 x 802.3at PoE+ |
|
Minimum software release |
Cisco IOS XE 16.11.1; XE SD-WAN 17.2.1 |
Product Performance
Key Features
The first WAN port takes either an RJ-45 cable or an SFP, which lets one router handle a copper handoff or a fiber circuit. Supported optics run from 1000BASE-SX on multimode fiber to 1000BASE-LX/LH, EX and ZX on single-mode, and the second WAN port stays copper for another carrier.
IPsec reaches up to 500 Mbps with 512-byte packets in autonomous mode, yet the SEC license on its own caps encrypted traffic at 50 Mbps. The HSEC license removes that cap. SEC-NPE is the variant for countries that restrict strong payload encryption.
The same Universal IOS XE image runs as an SD-WAN edge under Catalyst SD-WAN Manager from release 17.2.1, or as a traditional router managed by CLI, WebUI or Cisco DNA Center. In SD-WAN mode the router holds 200 overlay tunnels, and IPsec drops from 450 Mbps to 200 Mbps once QoS, deep packet inspection and Flexible NetFlow are applied.
Cellular comes from a CAT4 LTE USB dongle rated at 75 Mbps down and 50 Mbps up in theory. The router fails over to the LTE link when the primary WAN drops and moves back when it returns. SD-WAN mode supports the dongle from IOS XE 17.10.
The 4 GB of DRAM holds 280K IPv4 and 260K IPv6 routes, 100K NAT sessions and 1K VRFs, and autonomous mode supports up to 100 IPsec static virtual tunnel interfaces.
IP Base, the default package, already runs routing protocols, NAT, QoS, BFD, VRF Lite and IP SLA. The APP license adds MPLS, L2TPv3, VPLS and Ethernet over MPLS, plus NBAR2, AVC and PfRv3 for application-aware path selection.
Application Scenarios
A retail store or clinic joins the company SD-WAN fabric through the router, which builds tunnels to the data center and cloud over its wired WAN ports and serves the few local devices on its LAN switch ports.
Where the carrier delivers Gigabit service on fiber, the optic goes straight into the combo WAN port, and the small office routes, NATs and filters its traffic without a separate media converter.
A remote kiosk or field office that has only one wired circuit keeps a USB LTE dongle attached, and the router shifts traffic to the cellular link when the wired WAN fails.
Product Comparison
|
Parameter |
C1121-4P | |||
|---|---|---|---|---|
|
WAN interfaces |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
|
SD-WAN IPsec throughput (512B) |
Up to 450 Mbps |
Up to 450 Mbps |
Up to 700 Mbps |
Up to 450 Mbps |
|
IPsec throughput (512B) |
Up to 500 Mbps |
Up to 500 Mbps |
Up to 600 Mbps |
Up to 500 Mbps |
|
IPv4 forwarding throughput (512B) |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
|
SD-WAN overlay tunnels scale |
200 |
200 |
200 |
200 |
|
Pluggable |
CAT4 LTE USB dongle |
Pluggable slot: CAT4, CAT6, CAT7, CAT18 LTE and 5G |
CAT4 LTE USB dongle |
Not applicable |
|
DRAM/flash |
4 GB/4 GB |
4 GB/4 GB |
8 GB/8 GB |
4 GB/4 GB |
|
Default PoE budget |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
|
PoE with optional PoE supply |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
150W supply: 4 PoE or 2 PoE+ on 8 x 1G LAN ports |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
C1121-4P and C1121-4PLTEP share two 1G WAN ports, 450 Mbps of SD-WAN IPsec and 4 GB of DRAM, and they differ in cellular: C1121-4P takes only a CAT4 LTE USB dongle. Branches that run CAT6 to CAT18 LTE or 5G as their primary or backup WAN need C1121-4PLTEP, the model with a pluggable cellular slot. More than four wired LAN devices, more than two PoE devices or SD-WAN IPsec above 450 Mbps point to C1121X-8P, with eight LAN ports, 700 Mbps and 8 GB of DRAM. C1111-4P matches C1121-4P on throughput, tunnels and PoE but has no cellular option, and fits wired-only sites already standardized on the 111x range.
PoE Power Planning
|
Planning Item |
Value or Check |
|---|---|
|
Standard power adapter |
66W maximum output at 12 VDC; supplies no PoE |
|
PoE option |
ISR-1100-POE2: internal PoE adapter with a 115W power supply, orderable with the router or later as a field-replaceable unit |
|
PoE ports with ISR-1100-POE2 |
2 ports at 802.3af PoE, or 1 port at 802.3at PoE+ |
|
PoE budget |
Set by port count; no wattage budget is published beyond the 115W supply rating |
|
PoE output voltage |
-53.5 VDC |
|
Endpoint count |
Two 802.3af phones or cameras, or one 802.3at PoE+ access point; any further powered device needs power from another source |
Ordering Checklist
- Technology license: IP Base (SL-1K-4P-IPB) is the default; add SL-1K-4P-SEC-SV for zone-based firewall, IPsec VPN and DMVPN, or SL-1K-4P-APP-SV for MPLS and NBAR2. SL-1100-4P licenses are for 110x and 111x models only.
- HSEC license: Add FL-1100-4P-HSEC when tunnels must run above the 50 Mbps that the SEC license allows. Without it the router cannot reach its 500 Mbps IPsec rating.
- Software type: The IOS software version and type is a required selection; XE SD-WAN needs release 17.2.1 or later, and autonomous Cisco IOS XE needs 16.11.1 or later.
- PoE supply: Add ISR-1100-POE2 when a LAN port must power a phone or access point; it replaces the standard 66W adapter with a 115W supply. Without it no LAN port supplies power.
- LTE dongle: For cellular backup add D-LTE-NA for North America, D-LTE-GB for EMEAR or D-LTE-AS for India, China and other listed markets, plus D-MHLD as the magnetic holder. SD-WAN mode needs IOS XE 17.10 or later.
- Rack kit and power cord: Order ACS-1100-RM2-19 for rack mounting, because ACS-1100-RM-19 fits only 111x models. The power cord is a required line on every order.
Optional Add-ons
|
Model |
Description |
|---|---|
|
ISR-1100-POE2= |
Internal PoE adapter with 115W power supply for 2 PoE or 1 PoE+ LAN ports |
|
FL-1100-4P-HSEC= |
HSEC license that removes the encrypted throughput limit on ISR 1100 4P models |
|
SL-1K-4P-SEC-SV= |
Security technology license: zone-based firewall, IPsec VPN, DMVPN, FlexVPN, GETVPN |
|
SL-1K-4P-SECN-SV= |
Security license with no payload encryption |
|
SL-1K-4P-APP-SV= |
Application Experience license: MPLS, L2TPv3, NBAR2, AVC, PfRv3 |
|
D-LTE-NA= |
CAT4 LTE USB dongle for North America |
|
D-LTE-GB= |
CAT4 LTE USB dongle for EMEAR |
|
D-LTE-AS= |
CAT4 LTE USB dongle for India, China, Hong Kong, Indonesia, Malaysia, the Philippines and South Africa |
|
D-MHLD= |
Magnetic holder for the USB LTE dongle |
|
ACS-1100-RM2-19= |
Rack-mount kit for 112x models |
|
CAB-CON-USBRJ45= |
Micro USB to RJ-45 console adapter |
|
1000BASE-LX/LH SFP for the combo WAN port, single-mode, DOM | |
|
1000BASE-SX SFP for the combo WAN port, multimode, DOM | |
|
1000BASE-EX SFP for the combo WAN port, single-mode, DOM | |
|
GLC-ZX-SM |
1000BASE-ZX SFP for the combo WAN port |
C1121-4P Rear Panel
|
1 |
Reset button |
2 |
Power switch |
|
3 |
4-pin power connector |
4 |
Ethernet switch |
|
5 |
RJ-45 stacked connector |
6 |
GE WAN 0/0/0 -RJ45 |
|
7 |
GE WAN 0/0/0 -SFP |
8 |
Micro-USB console |
|
9 |
USB 3.0 |
10 |
Kensington lock slot |
|
11 |
Grounding |
Specifications
| Parameter | Specification | Parameter | Specification |
|---|---|---|---|
| Product ID | C1121-4P | WAN interfaces | 2 x Gigabit Ethernet: 1 copper/SFP combo port and 1 copper port |
| LAN switch ports | 4 x Gigabit Ethernet (copper) | Console port | 1 x Micro-USB |
| USB port | 1 x Type A USB 3.0 | Cellular option | CAT4 LTE USB dongle (D-LTE-NA, D-LTE-GB, D-LTE-AS); no pluggable module slot |
| DSL interface | Not supported | Embedded access point | Not supported |
| DRAM | 4 GB | Flash | 4 GB |
| SD-WAN IPsec throughput (512B) | Up to 450 Mbps | SD-WAN Profile: IPsec + QoS + deep packet inspection + Flexible NetFlow (512B) | Up to 200 Mbps |
| SD-WAN overlay tunnels scale | 200 | IPv4 forwarding throughput (512B) | Up to 1,600 Mbps |
| IPsec throughput (512B) | Up to 500 Mbps | Number of IPsec SVTI tunnels | 100 |
| Number of ACLs per system | 4K | Number of IPv4 ACEs per system | 10K |
| Number of IPv4 routes | 280K | Number of IPv6 routes | 260K |
| Number of NAT sessions | 100K | Number of VRFs | 1K |
| Default technology package | IP Base (SL-1K-4P-IPB): routing protocols, ACL, NAT, QoS, BFD, VRF Lite, IPSLA responder and initiator | Optional technology licenses | APP (SL-1K-4P-APP-SV), SEC (SL-1K-4P-SEC-SV), SEC-NPE (SL-1K-4P-SECN-SV) |
| SEC license IPsec performance | Up to 50 Mbps | HSEC license | FL-1100-4P-HSEC; removes the encrypted performance limit; Cisco IOS XE 16.8.1 or later |
| Software image | Single Universal Cisco IOS XE image; features enabled by right-to-use licenses | Management | WebUI without a license; Catalyst SD-WAN Manager (controller mode) or Cisco DNA Center (autonomous mode) |
| Minimum software release | Cisco IOS XE 16.11.1 | Minimum supported version (XE SD-WAN) | 17.2.1 |
| Default power supply | External AC adapter, 66W maximum output | AC input voltage | Universal 100 to 240 VAC, 50 to 60 Hz |
| Output voltage | 12 VDC | Default PoE budget | None; the standard 66W adapter carries no PoE |
| PoE with ISR-1100-POE2 | 115W power supply: 2 PoE ports or 1 PoE+ port | Inline PoE | 802.3af-compliant PoE, 802.3at-compliant PoE+ |
| PoE output voltage | -53.5 VDC | Maximum power consumption (excluding external PS loss) | 18.8W |
| Operating temperature | 0 to 40°C at sea level; 1°C per 1000 ft derating from 40°C | Operating altitude | 0 to 10,000 ft (0 to 3048 m) |
| Operating humidity | 10% to 85% relative humidity, noncondensing | Storage temperature | -40°C to +70°C (-40°F to +158°F) |
| Nonoperating altitude | 0 to 15,000 ft (0 to 4572 m) | Nonoperating humidity | 5% to 95% relative humidity, noncondensing |
| Dimensions (H x W x D) | 1.65 x 10.80 x 7.85 in. | Weight | 1.55 kg (3.43 lb) |
| Rack-mount kit | ACS-1100-RM2-19 | Console adapter | CAB-CON-USBRJ45, Micro USB to RJ-45 |
| Compatible SFPs | GLC-EX-SMD, GLC-LH-SM, GLC-LH-SMD, GLC-SX-MM, GLC-SX-MMD, GLC-ZX-SM | Standard safety certifications | UL 60950-1, CSA 60950-1, EN 60950-1, IEC 60950-1, UL 62368-1, CSA 62368-1, EN 62368-1, IEC 62368-1 |
| EMC emissions | EN55022/CISPR22, CFR 47 Part 15, ICES003, VCCI-V-3, AS/NZS CISPR22, CNS13438, EN300-386, EN61000-3-2, EN61000-3-3, EN61000-6-1 | EMC immunity | EN55024/CISPR24, EN61000-4-2, EN61000-4-3, EN61000-4-4, EN61000-4-5, EN61000-4-6, EN61000-4-11, EN300-386 |
Quality Certifications
Customer Reviews
Questions & Answers
-
What IPsec throughput is C1121-4P rated for?
-
Which technology license package is the default on C1121-4P?
-
Is FL-VPERF-4P-100 a valid performance license for C1121-4P?
-
What is the maximum power consumption of C1121-4P, excluding external power supply loss?
-
Which EMC emission and immunity standards is C1121-4P listed against?
-
What operating temperature range applies to C1121-4P at sea level?
Warranty
Layer23-Switch.com offers genuine, high-quality ICT products at competitive wholesale prices—ensuring exceptional value without compromising quality.
All items are brand new, original, and factory-sealed.
Upon request, each unit can be fully tested and verified by a Cisco CCIE-certified engineer to ensure perfect working condition before shipment.
Our Cisco CCIE-certified experts provide free professional support via phone, email, online chat, or remote login—helping you deploy and troubleshoot with confidence.
If you are not satisfied with your purchase, you may request an exchange or full refund. Our customer service team will guide you through the return process quickly and smoothly. Visit Return Policy page for more information.
We support multiple secure payment and logistics options, backed by industry-leading verification:
Visit How to Pay page for more information
Extended, Worry-Free Warranty Coverage Factory New Sealed Enterprise Hardware:
· 3 Years Factory New Sealed
Visit Warranty Policy page for more information
Verify, plan, and comparewith confidence
Use practical tools to check device details, review lifecyclemilestones, and compare hardware before you buy.
Started with one unit, now we’ve outfitted three offices through Layer23.
Production deployment was textbook. Exactly the outcome we wanted.
If you’ve found Layer23, you’ve found a vendor worth ordering from.
Solid router. Drops into the rack and just works. Delivery was on point.
Consistent packaging and documentation. Makes rollout easy.