Overview
This FAQ document is a resource designed to provide a high-level overview of the Cisco N9300 Series Smart Switch, covering its functions, key features, target audience, and competitive and development timelines. This document is intended to assist customers and partners in understanding the product’s core elements and how it fits into Cisco’s portfolio.
Cisco N9300 Series Smart Switches and Cisco Hypershield™ are two distinct products. The applicable Cisco Hypershield subscription must be purchased separately (when available) for Cisco N9300 Series Smart Switches. Cisco N9300 Series Smart Switches and Cisco Hypershield combined (network and security) represent both a compelling use case and value proposition, as well as a prime example of the power that is One Cisco. Security is now fused directly into the network, and customers have a seamless way to protect their infrastructure without compromising performance.
Note: Any of the products and features described in this FAQ document that are not currently available are in varying stages of development and will be offered on a when-and-if-available basis. The delivery timeline of any future products and features is subject to change at the sole discretion of Cisco, and Cisco will have no liability for delay in the delivery or failure to deliver any of the products or features set forth in this document.
Cisco N9300 Series Smart Switches
Q. What is the Cisco N9300 Series Smart Switch?
A. The Cisco N9300 Series Smart Switches are Cisco
® Silicon One
®-based data-center switches enhanced with Data Processing Units (DPUs) and designed to deliver advanced services beyond traditional networking functions. DPUs can offload complex data processing tasks, enabling high scale and performance for services such as stateful segmentation and encryption.
As networking switching hardware evolves to include DPUs, Cisco is transforming its switches into multifunctional, service-hosting devices. The Cisco N9300 Series Smart Switch is the first in Cisco's portfolio to leverage DPU-enhanced switching, serving as a network-based enforcer for Cisco Hypershield with L3/L4 stateful segmentation as the initial use case. Additional services may be delivered in the future.
Q. What is Cisco Hypershield?
A. Cisco Hypershield is a distributed security architecture that embeds security wherever it needs to be: in every software component of every application running on the network, on every server, and in public or private cloud deployments. It is a subscription-based software product that sits on top of the hardware with enforcement points that are workload- and network-based across public- or private- cloud deployments. The Cisco N9300 Series Smart Switch will be a network-based enforcer for Hypershield.
Hypershield is uniquely architected to implement an intent-based policy model that is centralized and easy to manage. No matter the form factor or location of the enforcement point, the policy being enforced is controlled by Hypershield’s on-premises controller, manageable through its on-premises UI, an API, or the cloud-based security console, Cisco Security Cloud Control (SCC).
Q. Why the Cisco N9300 Series Smart Switch?
A. The integration of Cisco’s next-generation Silicon One ASICs and AMD’s high-performance DPUs is a significant advancement for modern data centers. This combination addresses the dual demands of high network performance and comprehensive security. By embedding security enforcement directly on the switch, the need for complex routing to external devices that impose a performance tax, or the reliance on CPU-intensive agents is minimized. This approach streamlines network operations, leading to enhanced performance and reliability while also reducing overall costs. Such a solution allows data center operators to manage workloads more efficiently, ensuring that security measures do not impede network speed or functionality. This innovation is particularly beneficial as data centers continue to evolve and face increasing demands for speed, security, and cost-effectiveness.
Q. What are the first capabilities supported on a Cisco N9300 Series Smart Switch?
A. While DPUs are designed to be highly programmable and capable of supporting a wide range of services, or applications, our initial focus is on enhancing east/west segmentation capabilities. Specifically, we are integrating Cisco Hypershield with the initial Cisco N9300 Series Smart Switches to provide protections in key areas such as fabric-wide L3/L4 stateful segmentation, zone-based segmentation, Data Center Interconnect (DCI) with integrated routing, segmentation and encryption, and secure hybrid-cloud connectivity at the cloud-edge. This approach will offer a highly scalable and secure infrastructure for hybrid-cloud environments.
Q. What are the key products in the family of Cisco N9300 Series Smart Switches?
A. Currently, the two (2) products in the Cisco N9300 Series Smart Switches family are described in Table 1:
Table 1. Cisco N9300 Series Smart Switches
| Model |
Cisco N9324C-SE1U |
N9348Y2C6D-SE1U |
| Key specs |
● 24x100G ports
● 800G services throughput
|
● 48x25G ports, 6x400G ports, 2x100G ports
● 800G services throughput
|
| Switch details |
● 4xAMD Elba DPU
● 4.8T Cisco Silicon One ASIC (E100)
|
● 2xAMD Giglio DPU
● 4.8T Silicon One ASIC (E100)
|
| Use cases |
● Zone-based segmentation
● Data center interconnect
● Top of Rack (ToR)
|
● Top of rack (ToR)
|
| Management (network) |
● Cisco NX-OS, Nexus
® Dashboard, NX-API
|
● Cisco NX-OS, Nexus Dashboard, NX-API
|
| Management (security) |
● Cisco Hypershield (on-premises)
● Cisco Security Cloud Control (SCC)
|
● Cisco Hypershield (on-premises)
● Cisco Security Cloud Control (SCC)
|
Q. What constitutes a Cisco N9300 Series Smart Switch?
A. Cisco N9300 Series Smart Switches are the latest-generation of Nexus switches combining a Cisco Silicon One ASIC (NPU) with Data Processing Units (DPUs) in a single platform. Each component serves a distinct function:
Network (NPU):
● Provides routing, switching, and VXLAN fabric capabilities powered by Cisco Silicon One
● Managed by NetOps through Cisco NX-OS CLI, Nexus Dashboard, and NX-OS Open APIs
● Requires Cisco Data Center Networking (DCN) licenses
Note: A DCN Premier license is required to utilize the DPU function.
Security (DPU):
● Provides advanced security services such as L4 stateful segmentation
● Managed by SecOps through the Hypershield on-premises controller, its UI, API, or Cisco Security Cloud Control
● Requires 12 Cisco Cloud Protection Suite (CPS) units per switch
Note: By default, the DPU is powered down until Hypershield services are enabled.
Network operations and security operations are separated, with each management solution designed for the needs and focus of its respective persona (NetOps vs. NetSecOps). Whereas management consoles are independent, integration and context sharing between Nexus Dashboard and Hypershield exist for consistent operations and faster troubleshooting, with Data Processing Units (DPUs) added to provide additional network services.
Note: Each Cisco N9300 Series Smart Switch supports the same automation and management capabilities as the current Cisco Nexus 9000 Series Switches, enabling seamless integration with existing network architectures.
Q. What Operating System (OS) does the Cisco N9300 Series Smart Switch run on?
A. The Cisco N9300 Series Smart Switch runs on the Cisco NX-OS 10.6.x software train. The NX-OS image includes the software for switch operations as well as the components to activate, manage, and monitor the DPUs.
The DPU runs its own firmware, which includes the Hypershield agent responsible for receiving security policies from the Hypershield on-premises controller and programming them into the DPU. During initial deployment, the NX-OS image bundles both the switch software and the DPU firmware. After initial deployment, the Hypershield agent and DPU firmware can be upgraded independently from Hypershield, without requiring a full switch software upgrade.
Q. How does Cisco Hypershield work with the Cisco N9300 Series Smart Switch solution?
A. The Cisco N9300 Series Smart Switch delivers on the Cisco Hypershield vision of embedding security capabilities into the networking infrastructure, simplifying operations, security, and network topologies.
The N9300 Series smart switch serves as a hardware enforcement point for Hypershield, leveraging the DPU to enforce L3/L4 stateful segmentation policies at line rate within the network fabric. Security policies are defined and managed centrally through the Hypershield on-premises controller and enforced locally on the DPU.
Q. What are the benefits of using Cisco N9300 Series Smart Switch with Cisco Hypershield?
A. There are several benefits provided by our Cisco N9300 Series Smart Switch with Cisco Hypershield that give customers a win-win solution.
● Architecture simplification: streamlines network and security architecture, reducing complexity and making it easier to manage and maintain
● Significant TCO savings: reduces Total Cost of Ownership (TCO) for customers by minimizing the need for multiple, disparate security solutions and leveraging a unified platform. Additionally, consolidating functions into fewer devices reduces power consumption, cooling, and rack space, further contributing to lower operational costs.
● Consistent security policies: ensures uniform security policy deployment across the entire infrastructure, including network and workloads, reducing the risk of misconfigurations and enhancing overall security posture
● High throughput and scale: compute intensive services are offloaded to the high-performance DPU, achieving reduced latency (compared to solutions relying on CPU) and higher scale for security enforcement
● Persona-driven operational models: network operations and security operations are separated, with management solutions designed for the needs and focus of different personas (NetOps vs. NetSecOps). Although management consoles are independent, integration and context sharing exist for consistent operations and faster troubleshooting.
● Increased visibility: the integration between Hypershield and Nexus Dashboard yields improved end-to-end visibility across networking and security domains, enabling better monitoring, threat detection, and response capabilities
Q. What use cases does the Cisco N9300 Series Smart Switch address?
A. There are three (3) initial use cases for Cisco N9300 Series Smart Switches together with Cisco Hypershield:
Top-of-rack segmentation and enforcement:
The Cisco N9300 Series Smart Switches can be deployed as a top-of-rack leaf, bringing the enforcement point closer to the workloads and distributing segmentation across the fabric.
Every port on the N9300 Series smart switch becomes an enforcement point, enabling L3/L4 stateful segmentation for all connected workloads regardless of type (VMs, bare-metal, or containers). Policies are managed centrally through the Hypershield on-premises controller (or through Cisco Security Cloud Control) and enforced locally on the DPU, eliminating the need for external firewalls or host-based agents. This results in fewer devices to manage, reduced complexity, and consistent security enforcement at the access layer.
Zone-based segmentation:
Traditionally, security appliances such as Next-Generation Firewalls (NGFWs) are used to provide L3/L4 segmentation between data-center zones (based on subnets, VLANs, bridge domains, tenants, or VRFs). For use cases where L4 stateful segmentation is sufficient, using an NGFW introduces unnecessary latency, cost, and scale limitations.
This use case is designed for Cisco ACI
® fabric environments.
The Cisco N9300 Series Smart Switch can replace external firewalls in these scenarios, delivering L3/L4 stateful segmentation with higher throughput, lower latency, improved scale, and reduced TCO. Additionally, the integration between Nexus Dashboard and Hypershield provides enhanced end-to-end visibility across network and security domains.
Data Center Interconnect (DCI):
Communication between data centers (whether routed, through DWDM, dark fiber, etc.) needs to be fast and secure. Customers often deploy multiple routers and security devices to ensure protection and redundancy, adding cost and complexity.
The Cisco N9300 Series Smart Switch can be deployed as an IP border gateway or VXLAN border gateway, combining routing, L3/L4 stateful segmentation, and MACsec encryption in a single device to secure Data Center Interconnects. This reduces TCO by consolidating multiple functions, simplifies the architecture by eliminating complex routing to external firewalls, and improves digital resiliency.
Q. How will customers troubleshoot workflows between the NPU and DPU?
A. Cisco Nexus Dashboard includes a feature called connectivity analysis, which provides end-to-end path visibility and traffic assurance. This feature has been extended to leverage packet tracer, a tool available on the Silicon One NPU, to provide visibility into traffic forwarding between the NPU and the DPU within the N9300 Series smart switch. This enables visual troubleshooting across both networking and security domains, and can be launched from Nexus Dashboard or NX-API.
Q. Will the Cisco N9300 Series Smart Switch be VRF-aware, VLAN-aware, or support contexts/instances?
A. Yes. Through Nexus Dashboard, administrators can select which VRFs or VLANs are redirected to the DPU for security policy enforcement. Security policies can be defined on a per-VRF or per-VLAN basis, and Hypershield will deploy the corresponding rules to the N9300 Series smart switches where that VRF or VLAN is redirected. Inter-VRF DPU filtering is also supported as a foundational use case.
Q. Can customers purchase the Cisco N9300 Series Smart Switch without Hypershield?
A. Yes, the Cisco N9300 Series Smart Switch can be deployed in network mode with DPUs powered down, operating as a regular Cisco Nexus switch. The DPUs are powered down by default. Customers can enable DPU security services at a later point by acquiring the Cisco Cloud Protection Suite (CPS) licenses. This provides flexibility and makes the customer’s network future-ready.
Q. How does the Cisco N9300 Series Smart Switch support sustainability initiatives?
A. By consolidating switching and security functions into a single device, the Cisco N9300 Series Smart Switch reduces the number of devices required in the data center, resulting in lower power consumption, reduced cooling requirements, and less rack space.
Customers can save up to 77 percent in power consumption and 89 percent in rack space due to the reduction of required infrastructure. This consolidation directly contributes to a more sustainable data center footprint.
Additional resources
Cisco N9300 Series Smart Switch Data Sheet
Cisco N9300 Series Smart Switch At-a-Glance
Cisco N9300 Series Smart Switch
Cisco Hypershield