C1121-4PLTEP – 2x1G WAN incl. RJ45/SFP Combo – 4x1G LAN Ports – Pluggable LTE/5G Slot
Why Layer23-Switch
Stocked, Shipped and Supported by One Team
Ships in 1 Business Day
In-stock orders leave our Hong Kong or U.S. warehouse within 1 business day after payment, with tracking by email.
LSCare Warranty
3years on enterprise equipment
Free CCIE Support
Certified engineers help before and after you buy. Reply within 1 business day by email or live chat.
Verify Before You Pay
100%factory-sealed
Get label and serial photos before shipment, and check every serial number with Cisco.
C1121-4PLTEP Description
The C1121-4PLTEP is a Cisco 1000 Series Integrated Services Router for small branches that add pluggable LTE or 5G cellular to a wired WAN circuit. The router carries two Gigabit WAN ports, one an RJ-45/SFP combo, four Gigabit LAN ports, 4 GB of DRAM and up to 450 Mbps of SD-WAN IPsec at 512 bytes. The radio is an optional pluggable module rather than a built-in modem, and the LAN ports deliver no PoE until the optional 115W supply adds two PoE ports or one PoE+ port.
Quick Specs
|
Parameter |
Specification |
|---|---|
|
WAN interfaces |
2 x 1G: 1 RJ-45/SFP combo port and 1 RJ-45 port |
|
LAN switch ports |
4 x 1G RJ-45 |
|
Cellular option |
Pluggable module slot: CAT4, CAT6, CAT7 or CAT18 LTE, 5G NSA or 5G SA |
|
SD-WAN IPsec throughput (512B) |
Up to 450 Mbps |
|
IPsec throughput (512B, autonomous mode) |
Up to 500 Mbps |
|
IPv4 forwarding throughput (512B) |
Up to 1,600 Mbps |
|
SD-WAN overlay tunnels |
200 |
|
DRAM and flash |
4 GB DRAM, 4 GB flash |
|
Default technology package |
IP Base (SL-1K-4P-IPB) |
|
Default power supply |
External AC adapter, 66W maximum output, 12 VDC |
|
Default PoE budget |
None; the standard 66W adapter carries no PoE |
|
PoE with ISR-1100-POE2 |
115W power supply: 2 x 802.3af PoE or 1 x 802.3at PoE+ |
|
Minimum software release |
Cisco IOS XE 16.11.1; XE SD-WAN 17.2.1; 5G NSA 17.9.2a; 5G SA 17.12.1a |
Product Performance
Key Features
The slot accepts LTE from CAT4 through CAT18 as well as 5G NSA and 5G SA modules. Theoretical rates climb from 150 Mbps down and 50 Mbps up on CAT4 to 1200/200 Mbps on CAT18 and 4900/660 Mbps on the 5G SA module. Moving a site to 5G means replacing the module and running Cisco IOS XE 17.9.2a for NSA or 17.12.1a for SA.
Most modules hold two micro (3FF) SIM cards with Fast SIM failover; the Verizon CAT4 module has a single SIM slot. Traffic shifts between the primary and backup link without manual action. Every module except CAT18 and 5G NSA also sends a dying-gasp alert when the router loses power.
The first WAN port takes an RJ-45 cable or an SFP, including 1000BASE-SX for multimode fiber, LX/LH, EX and ZX for single-mode, and 100BASE-FX. The second WAN port is copper, which lets a site terminate two wired carriers and still keep the cellular path.
The SEC license caps IPsec at 50 Mbps. With no VPERF license for the 112x four-port models, HSEC is the only way past that cap and opens the full 500 Mbps autonomous IPsec rating at 512-byte packets.
A single Universal Cisco IOS XE image runs the router either under Catalyst SD-WAN Manager or as an autonomous router managed by CLI, WebUI or Cisco DNA Center. SD-WAN mode holds 200 overlay tunnels, and SD-WAN IPsec falls to 200 Mbps once QoS, deep packet inspection and Flexible NetFlow run on the same traffic.
Routing protocols, ACLs, NAT, QoS, BFD, VRF Lite and IP SLA all come with IP Base, the package every unit carries. MPLS, L2TPv3, NBAR2, AVC and PfRv3 belong to the separate APP license.
Application Scenarios
A dental practice or insurance office brings its fiber circuit into the combo WAN port, and the LTE module stays on standby until that circuit drops, keeping the front-desk PCs and phones connected.
Where no wired circuit reaches the site, such as a mall kiosk or a temporary sales office, the 5G or LTE module carries all traffic while a few terminals and a printer use the four LAN ports.
Small branches that belong to a company SD-WAN fabric are managed from Catalyst SD-WAN Manager, with the router building overlay tunnels over the wired WAN and keeping the cellular module as a backup link.
Product Comparison
|
Parameter |
C1121-4PLTEP | |||
|---|---|---|---|---|
|
WAN interfaces |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
2 x 1G: RJ-45/SFP combo + RJ-45 |
|
SD-WAN IPsec throughput (512B) |
Up to 450 Mbps |
Up to 450 Mbps |
Up to 700 Mbps |
Up to 450 Mbps |
|
IPsec throughput (512B) |
Up to 500 Mbps |
Up to 500 Mbps |
Up to 600 Mbps |
Up to 500 Mbps |
|
IPv4 forwarding throughput (512B) |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
Up to 1,600 Mbps |
|
SD-WAN overlay tunnels scale |
200 |
200 |
200 |
200 |
|
Pluggable |
Pluggable slot: CAT4, CAT6, CAT7, CAT18 LTE and 5G |
CAT4 LTE USB dongle |
Pluggable slot: CAT4, CAT6, CAT7, CAT18 LTE and 5G |
Not applicable |
|
DRAM/flash |
4 GB/4 GB |
4 GB/4 GB |
8 GB/8 GB |
4 GB/4 GB |
|
Default PoE budget |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
None; the standard 66W adapter carries no PoE |
|
PoE with optional PoE supply |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
150W supply: 4 PoE or 2 PoE+ on 8 x 1G LAN ports |
115W supply: 2 PoE or 1 PoE+ on 4 x 1G LAN ports |
The pluggable cellular slot separates C1121-4PLTEP from C1121-4P, which takes only a CAT4 LTE USB dongle at the same 450 Mbps of SD-WAN IPsec and fits sites whose wired circuits need nothing beyond CAT4 backup. More than four wired LAN devices, a second PoE+ device or SD-WAN IPsec above 450 Mbps call for C1121X-8PLTEP, which keeps the same slot and adds eight LAN ports, 700 Mbps and 8 GB of DRAM. C1111-4P matches the throughput and the 115W PoE option but has no cellular path at all, which suits wired-only sites built on the 111x range.
PoE Power Planning
|
Planning Item |
Value or Check |
|---|---|
|
Standard power adapter |
66W maximum output at 12 VDC; no PoE on any LAN port |
|
PoE option |
ISR-1100-POE2: internal PoE adapter with a 115W power supply, orderable with the router or later as a field-replaceable unit |
|
PoE ports with ISR-1100-POE2 |
2 ports at 802.3af PoE, or 1 port at 802.3at PoE+ |
|
PoE budget |
Not published in watts; the limit is expressed as port count on the 115W supply |
|
PoE output voltage |
-53.5 VDC |
|
Endpoint count |
One PoE+ access point or camera, or two 802.3af phones; the remaining LAN ports carry data only |
Ordering Checklist
- Technology license: IP Base (SL-1K-4P-IPB) is the default; add SL-1K-4P-SEC-SV for zone-based firewall and IPsec VPN, or SL-1K-4P-APP-SV for MPLS and NBAR2. SL-1100-4P licenses fit only 110x and 111x models.
- HSEC license: Add FL-1100-4P-HSEC when tunnels must exceed the 50 Mbps SEC limit. FL-VPERF-4P-100 applies only to 110x and 111x models, so it cannot serve as an intermediate step here.
- Cellular module: The pluggable is an optional line; add the module for the carrier region, such as P-LTEA-EA for North America and Europe, P-LTEA-LA for APAC and LATAM, or P-5GS6-R16-SA for 5G SA. P-LTEA-EA and P-LTEA-LA also need a firmware selection.
- Antennas: Order the antenna that matches the module: LTE-ANTM-SMA-D for CAT4 and CAT6, LTE-ANTM2-SMA-D for CAT18, or 5G-ANTM2-SMA-D for CAT7 and 5G. Spare P-LTE-VZ, P-LTE-US and P-LTE-GB modules need the antenna selection option.
- Software type: The IOS software version and type is a required selection. A 5G NSA module needs Cisco IOS XE 17.9.2a or later, a 5G SA module 17.12.1a or later, and SD-WAN mode 17.2.1 or later.
- PoE supply: Add ISR-1100-POE2 when a LAN port must power a phone, camera or access point; it swaps the standard 66W adapter for a 115W supply. Without it every LAN port is data only.
- Rack kit and power cord: Order ACS-1100-RM2-19 for rack mounting, because ACS-1100-RM-19 fits only 111x models. The power cord is a required line on every order.
Optional Add-ons
|
Model |
Description |
|---|---|
|
P-5GS6-R16-SA= |
5G Sub-6 GHz SA pluggable module, Cisco IOS XE 17.12.1a or later |
|
P-5GS6-GL= |
5G Sub-6 GHz NSA pluggable module, Cisco IOS XE 17.9.2a or later |
|
P-LTEAP18-GL= |
CAT18 LTE Advanced Pro pluggable module |
|
P-LTEA7-NA |
CAT7 LTE pluggable module |
|
P-LTEA-EA= |
CAT6 LTE Advanced pluggable module for North America and Europe |
|
P-LTEA-LA= |
CAT6 LTE Advanced pluggable module for APAC, ANZ and LATAM |
|
P-LTE-MNA= |
CAT4 LTE pluggable module |
|
P-BLANK= |
Blank pluggable |
|
LTE-ANTM-SMA-D |
Antenna for CAT4 and CAT6 pluggable modules |
|
LTE-ANTM2-SMA-D |
Antenna for the P-LTEAP18-GL CAT18 module |
|
5G-ANTM2-SMA-D |
Antenna for CAT7 and 5G pluggable modules |
|
ISR-1100-POE2= |
Internal PoE adapter with 115W power supply for 2 PoE or 1 PoE+ LAN ports |
|
FL-1100-4P-HSEC= |
HSEC license that removes the encrypted throughput limit on ISR 1100 4P models |
|
SL-1K-4P-SEC-SV= |
Security technology license: zone-based firewall, IPsec VPN, DMVPN, FlexVPN, GETVPN |
|
SL-1K-4P-SECN-SV= |
Security license with no payload encryption |
|
SL-1K-4P-APP-SV= |
Application Experience license: MPLS, L2TPv3, NBAR2, AVC, PfRv3 |
|
ACS-1100-RM2-19= |
Rack-mount kit for 112x models |
|
CAB-CON-USBRJ45= |
Micro USB to RJ-45 console adapter |
|
1000BASE-LX/LH SFP for the combo WAN port, single-mode, DOM | |
|
1000BASE-SX SFP for the combo WAN port, multimode, DOM | |
|
1000BASE-ZX SFP for the combo WAN port, DOM |
C1121-4PLTEP Rear Panel
|
1 |
Reset button |
2 |
Power switch |
|
3 |
4-pin power connector |
4 |
Ethernet switch |
|
5 |
GE 0/0/1 |
6 |
GE WAN 0/0/0 -RJ45 |
|
7 |
GE WAN 0/0/0 -SFP |
8 |
Micro-USB console |
|
9 |
USB 3.0 |
10 |
Pluggable |
|
11 |
Kensington lock slot |
12 |
Grounding |
Specifications
| Parameter | Specification | Parameter | Specification |
|---|---|---|---|
| Product ID | C1121-4PLTEP | WAN interfaces | 2 x Gigabit Ethernet: 1 copper/SFP combo port and 1 copper port |
| LAN switch ports | 4 x Gigabit Ethernet (copper) | Console port | 1 x Micro-USB |
| USB port | 1 x Type A USB 3.0 | Cellular option | Pluggable module slot: CAT4, CAT6, CAT7, CAT18 LTE; 5G NSA; 5G SA |
| Cellular theoretical DL/UL speeds | CAT4 150/50 Mbps; CAT6 300/50 Mbps; CAT7 300/150 Mbps; CAT18 1200/200 Mbps; 5G NSA 3300/400 Mbps; 5G SA 4900/660 Mbps | Cellular module features | Dual micro (3FF) SIM sockets with Fast SIM failover (P-LTE-VZ single SIM); automatic primary/backup failover; remote firmware upgrade; SIM lock; dying gasp except CAT18 and 5G NSA modules |
| Antennas | LTE-ANTM-SMA-D (CAT4, CAT6); LTE-ANTM2-SMA-D (CAT18); 5G-ANTM2-SMA-D (CAT7, 5G) | DSL interface | Not supported |
| Embedded access point | Not supported | DRAM | 4 GB |
| Flash | 4 GB | SD-WAN IPsec throughput (512B) | Up to 450 Mbps |
| SD-WAN Profile: IPsec + QoS + deep packet inspection + Flexible NetFlow (512B) | Up to 200 Mbps | SD-WAN overlay tunnels scale | 200 |
| IPv4 forwarding throughput (512B) | Up to 1,600 Mbps | IPsec throughput (512B) | Up to 500 Mbps |
| Number of IPsec SVTI tunnels | 100 | Number of ACLs per system | 4K |
| Number of IPv4 ACEs per system | 10K | Number of IPv4 routes | 280K |
| Number of IPv6 routes | 260K | Number of NAT sessions | 100K |
| Number of VRFs | 1K | Default technology package | IP Base (SL-1K-4P-IPB): routing protocols, ACL, NAT, QoS, BFD, VRF Lite, IPSLA responder and initiator |
| Optional technology licenses | APP (SL-1K-4P-APP-SV), SEC (SL-1K-4P-SEC-SV), SEC-NPE (SL-1K-4P-SECN-SV) | SEC license IPsec performance | Up to 50 Mbps |
| VPERF license | No 112x 4P VPERF license; FL-VPERF-4P-100 applies to C110x and C111x models | HSEC license | FL-1100-4P-HSEC; removes the encrypted performance limit; Cisco IOS XE 16.8.1 or later |
| Software image | Single Universal Cisco IOS XE image; features enabled by right-to-use licenses | Management | WebUI without a license; Catalyst SD-WAN Manager (controller mode) or Cisco DNA Center (autonomous mode) |
| Minimum software release | Cisco IOS XE 16.11.1; 5G NSA module 17.9.2a; 5G SA module 17.12.1a | Minimum supported version (XE SD-WAN) | 17.2.1 |
| Default power supply | External AC adapter, 66W maximum output | AC input voltage | Universal 100 to 240 VAC, 50 to 60 Hz |
| Output voltage | 12 VDC | Default PoE budget | None; the standard 66W adapter carries no PoE |
| PoE with ISR-1100-POE2 | 115W power supply: 2 PoE ports or 1 PoE+ port | Inline PoE | 802.3af-compliant PoE, 802.3at-compliant PoE+ |
| PoE output voltage | -53.5 VDC | Maximum power consumption (excluding external PS loss) | 23.5W |
| Operating temperature | 0 to 40°C at sea level; 1°C per 1000 ft derating from 40°C | Operating altitude | 0 to 10,000 ft (0 to 3048 m) |
| Operating humidity | 10% to 85% relative humidity, noncondensing | Storage temperature | -40°C to +70°C (-40°F to +158°F) |
| Nonoperating altitude | 0 to 15,000 ft (0 to 4572 m) | Nonoperating humidity | 5% to 95% relative humidity, noncondensing |
| Dimensions (H x W x D) | 1.65 x 10.80 x 7.85 in. | Weight | 1.68 kg (3.70 lb) |
| Rack-mount kit | ACS-1100-RM2-19 | Console adapter | CAB-CON-USBRJ45, Micro USB to RJ-45 |
| Compatible SFPs | GLC-EX-SMD, GLC-LH-SM, GLC-LH-SMD, GLC-SX-MM, GLC-SX-MMD, GLC-ZX-SM, GLC-ZX-SMD, GLC-FE-100FX, GLC-FE-100LX, GLC-GE-100FX, GLC-TE, SFP-GE-S, SFP-GE-T | Standard safety certifications | UL 60950-1, CSA 60950-1, EN 60950-1, IEC 60950-1, UL 62368-1, CSA 62368-1, EN 62368-1, IEC 62368-1 |
| EMC emissions | EN55022/CISPR22, CFR 47 Part 15, ICES003, VCCI-V-3, AS/NZS CISPR22, CNS13438, EN300-386, EN61000-3-2, EN61000-3-3, EN61000-6-1 | EMC immunity | EN55024/CISPR24, EN61000-4-2, EN61000-4-3, EN61000-4-4, EN61000-4-5, EN61000-4-6, EN61000-4-11, EN300-386 |
| Radio immunity | EN 301 489-1, EN 301 489-7, EN 301 489-24 | Cellular radio | EN 301 908-1, EN 301 908-2, EN 301 511, 47 CFR Part 22, 47 CFR Part 24, EN 301 908-13 |
Quality Certifications
Customer Reviews
Questions & Answers
-
What IPsec throughput is C1121-4PLTEP rated for?
-
Which technology license package is the default on C1121-4PLTEP?
-
Is FL-VPERF-4P-100 a valid performance license for C1121-4PLTEP?
-
What is the maximum power consumption of C1121-4PLTEP, excluding external power supply loss?
-
Which EMC emission and immunity standards is C1121-4PLTEP listed against?
-
What operating temperature range applies to C1121-4PLTEP at sea level?
Warranty
Layer23-Switch.com offers genuine, high-quality ICT products at competitive wholesale prices—ensuring exceptional value without compromising quality.
All items are brand new, original, and factory-sealed.
Upon request, each unit can be fully tested and verified by a Cisco CCIE-certified engineer to ensure perfect working condition before shipment.
Our Cisco CCIE-certified experts provide free professional support via phone, email, online chat, or remote login—helping you deploy and troubleshoot with confidence.
If you are not satisfied with your purchase, you may request an exchange or full refund. Our customer service team will guide you through the return process quickly and smoothly. Visit Return Policy page for more information.
We support multiple secure payment and logistics options, backed by industry-leading verification:
Visit How to Pay page for more information
Extended, Worry-Free Warranty Coverage Factory New Sealed Enterprise Hardware:
· 3 Years Factory New Sealed
Visit Warranty Policy page for more information
Verify, plan, and comparewith confidence
Use practical tools to check device details, review lifecyclemilestones, and compare hardware before you buy.
Order placed, order delivered, product works. Job done.
Product was packed securely enough to survive rough handling.
Our branch managers across multiple locations all order from Layer23 now.
Great signal reception. Genuine Cisco hardware. Arrived safely.
Comms are critical. This unit delivers. Vendor is reliable.