As enterprises continue to grow, they require high-capacity campus cores that deliver scale, resiliency, and operational clarity. Modular switching platforms are central to this architecture, providing the high port density, exceptional bandwidth, and robustness necessary for a future-proof workplace.
Cisco engaged Miercom to evaluate the Cisco C9610R Series Smart Switches – the next generation modular platform as the campus core for high-density deployments. Built upon the Cisco Silicon One architecture, the C9000 series smart switches provide a unified, programmable silicon foundation that ensures industry-leading performance, high port density, and superior energy efficiency. These switches are also engineered for AI readiness, featuring the high-speed connectivity, low latency, and intelligent observability needed to power modern AI-driven enterprise applications and workloads.
The Cisco C9000 Series Smart Switches deliver Full Stack Post-Quantum Cryptography (PQC), providing an end-to-end quantum security architecture from Secure Boot to Secure Transport. The Cisco C9000 Smart Switches feature an integrated Trust Anchor Module (TAm) within an FPGA chip, establishing a hardware-anchored chain of trust enhanced by Post-Quantum Cryptography (PQC). The TAm securely stores PQC keys, which are used to verify PQC-signed Bootloader and IOS XE images, ensuring only trusted software is loaded during bootup. Additionally, the bus interfaces between the TAm and CPU are protected with PQC to prevent confidential information from leaking. Secure Boot ensures the switch is protected from the moment it powers on. For Secure Transport, Cisco IOS XE supports PQC algorithms for protocols such as MACsec, IPsec, SSH, and TLS, ensuring protection against future quantum-enabled attacks. Full Stack PQC ensures robust, end-to-end quantum safety, making the Cisco C9000 Smart Switches uniquely prepared for the evolving cybersecurity landscape.
A standout capability of the C9000 Smart Switches is the new HCAM (Algorithmic Hash-based TCAM). By combining the strengths of TCAM and SRAM, HCAM delivers high-scale ACL and NetFlow performance. This innovative approach offers faster lookups with lower power and heat consumption compared to traditional TCAM, making it a more cost-effective solution for scaling. Beyond efficiency, HCAM serves as a critical engine for full-stack observability. It provides the granular visibility into traffic patterns and telemetry data required to optimize network health and application performance. Simultaneously, its high-scale capacity for Access Control Lists (ACLs) strengthens the overall security posture, enabling robust, hardware-accelerated policy enforcement and micro-segmentation to protect against evolving threats without sacrificing throughput.
Our test program, executed with Spirent Test Center, models real production conditions and controller workflows to validate forwarding behavior, control-plane scale, and service continuity. The scope covers Layer-2 and Layer-3 forwarding with fixed and IMIX traffic profiles; latency characterization; table scale for MAC addresses and routing entries; high-availability mechanisms (SSO, NSF) and failover continuity; QoS classification, shaping, and queue behavior under stress; and observability via telemetry and automation interfaces. The aim is to confirm architecture fit and datasheet claims for large enterprise campuses and to surface deployment guidance on slot, fabric, and uplink choices.
Key Findings
- Line-rate with no loss across all frame sizes and IMIX. Aggregate throughput remained 100% with zero frame loss from 324 to 9216 bytes; IMIX also achieved 100% with no loss.
- No small-packet cliff or jumbo penalty. The latency curve is broadly flat with a modest dip around 4096 bytes; consistency holds through jumbo frames.
- Observed FIB capacity matched or exceeded limits. 2,000,037 vs. 2,000,000 and 1,000,035 IPv6 vs. 1,000,000—confirming the switch can carry its indented dual-stack route tables without capacity risk.
- Hardware-rooted secure boot process. A Trust Anchor Module (TAM) establishes a chain of trust that validates the bootloader and IOS XE software images before execution, protecting system integrity at startup.
- Software image integrity is protected through digital signing. Signed image verification prevents unauthorized or modified software from loading on the platform and provides a foundation for future quantum-resistant signing methods.
- Post-Quantum Cryptography support is architectural and forward-looking. The platform aligns with emerging PQC standards while current implementations continue to rely on established cryptographic algorithms for secure boot and image validation.
- High Availability with Minimal Traffic Impact: SSO, NSF, and ISSU testing showed forwarding continuity during software upgrades. Traffic disruption was sub-seconds and limited to brief, expected convergence windows, with no full system reloads or manual recovery required.