Cisco 881 (C881-K9) to ISR 1100 C1111-4P Migration Guide

The Cisco 881 Integrated Services Router (PID C881-K9) has been the workhorse of small branch offices, retail closets, and teleworker desks for well over a decade. It is a compact, fanless, fixed-configuration secure access router: a single 10/100 FastEthernet WAN port, a 4-port 10/100 managed switch on the LAN side, and an IOS feature set that handles VPN, zone-based firewall, and basic QoS. That longevity is exactly the problem. The platform hit End of Sale on October 29, 2020, and its Last Day of Support (LDoS) passed on October 31, 2025. As of that date the C881-K9 is fully retired by Cisco, and every unit still racked in your environment is now running unsupported.

Why the C881-K9 retirement demands action now

After LDoS, three things stop simultaneously, and each one carries real operational and compliance risk. First, Cisco PSIRT no longer publishes fixes for the 881. IOS 15.x on this platform will not receive patches for new CVEs, so any future vulnerability in IKE, SSH, the web UI, or the IP stack is permanent on these boxes. Second, TAC will not open cases and Cisco will not honor RMA hardware replacement, even if you carried SmartNet up to the deadline. A dead 881 at a remote site is now a truck roll with no spare path. Third, and most consequential for our federal, DoD, and healthcare customers, an unsupported router is an audit finding waiting to happen.

What each milestone date actually means

• End of Sale (Oct 29, 2020): Cisco stopped selling the C881-K9 through normal channels. Anything sold after this is refurbished or gray-market. This is the clock-start, not the danger date.
• End of Software Maintenance: Cisco's official bulletin milestone for the 881 could not be independently confirmed from a current Cisco source for this guide. Treat software as frozen and assume no further maintenance releases are coming.
• Last Day of Support / LDoS (Oct 31, 2025): The hard stop. No TAC, no RMA, no PSIRT fixes, no guaranteed software downloads. This is the date that matters for your audit posture, and it has already passed.

You can read the full milestone breakdown and bulletin references on our C881-K9 end-of-life detail page, and see the broader retirement schedule across the ISR 800 family on the Cisco EoL hub.

The recommended replacement: ISR 1100 (C1111-4P)

Cisco's supported migration path for the fixed-config 881 is the ISR 1100 series, specifically the C1111-4P. This is not a like-for-like swap; it is a generational leap, and the gap is wide because the 881 was designed in the FastEthernet era.

Throughput and interfaces

The 881 tops out at 10/100 Mbps on every port, which caps real-world VPN-enabled throughput in the low tens of Mbps. The C1111-4P delivers dual Gigabit Ethernet WAN ports (one RJ-45 plus an SFP-capable combo port) and a managed 4-port Gigabit Ethernet LAN switch. Aggregate forwarding moves from roughly 100 Mbps on the 881 to system throughput in the hundreds of Mbps up to about 1 Gbps on the 1100, depending on services enabled. For any site that has upgraded to fiber or business cable since the 881 was installed, the old router is now the bottleneck, not the circuit.

From IOS 15 to IOS-XE and SD-WAN

This is the most important change. The 881 runs classic monolithic IOS 15.x. The C1111-4P runs IOS-XE, a 64-bit Linux-based, modular operating system with a true control-plane/data-plane split, programmability (NETCONF/YANG, RESTCONF), and native support for Cisco SD-WAN (Catalyst SD-WAN, formerly Viptela). The same C1111-4P hardware can run an autonomous IOS-XE image today and be converted to an SD-WAN-managed edge later with a software/license change, no hardware swap. That future-proofing simply does not exist on the 881.

Licensing: from feature licenses to Smart Licensing

The 881 used the old universal-image plus right-to-use/PAK feature-license model (securityk9, datak9). The C1111-4P uses Smart Licensing with the IOS-XE tiered model: a perpetual Network Essentials or Network Advantage base, optionally paired with DNA Essentials/Advantage (now the Cisco Networking subscription) term licenses for SD-WAN, advanced security, and Catalyst Center/vManage management. Plan the license SKU at purchase time, because the tier governs whether you can run SD-WAN, application visibility, and advanced routing. For most teleworker and small-branch refreshes, Network Advantage plus a DNA Advantage term is the practical landing spot.

A practical migration plan

1. Assessment and inventory

Pull a show running-config, show version, and show license (or equivalent) from every 881 in scope. Document the WAN type (PPPoE, DHCP, static, ADSL), the IKE/IPsec parameters for any site-to-site or EasyVPN tunnels, ACLs, NAT rules, DHCP scopes, and zone-based firewall policies. Capture which sites are bandwidth-constrained by the old 10/100 ports versus genuinely low-traffic.

2. License transition

Stand up a Cisco Smart Account and Virtual Account before hardware lands. Map each old feature-license entitlement to the new tier. Decide autonomous IOS-XE versus SD-WAN-managed per site; this drives the DNA/subscription SKU and onboarding (PnP / Plug and Play for zero-touch).

3. Config and feature parity

Do not blindly paste 881 config into IOS-XE. The CLI is largely familiar but interface naming, the security license model, crypto defaults, and zone-based firewall syntax have moved. Rebuild IPsec/IKEv2 tunnels with modern, FIPS-validated transforms (the 881 era often left weak DH groups and SHA-1 in place; the refresh is your chance to enforce AES-256/GCM, DH 19/20, IKEv2). Recreate NAT, DHCP, and ACLs, then diff behavior against the old box in a lab before cutover.

4. Physical: power, uplinks, optics

The C1111-4P swaps cleanly into the 881's footprint. Confirm the WAN handoff: if the circuit is now fiber, use the SFP combo port and order the correct Cisco-coded optic. Re-terminate the LAN to the GigabitEthernet switch ports. Verify the power outlet and any UPS still fit the new external PSU.

5. Phased cutover

Pilot one or two representative sites first, ideally one VPN-tunnel site and one simple DHCP/NAT site. Pre-stage configs via PnP so a non-technical person at the remote location can power on and ship the old unit back. Keep the 881 on-site but powered down for a short rollback window, then proceed in waves grouped by region or circuit type.

6. Secure decommission

Do not let retired 881s walk out the door with config intact. Run write erase plus a reload, and for federal/DoD assets follow your media-sanitization standard (NIST 800-88) for the device's flash. Record serial numbers and disposition for the asset register so the audit trail shows the unsupported gear was removed, not just unplugged.

Procurement notes for government and enterprise

For TAA-sensitive buyers, source the C1111-4P through an authorized Cisco partner who can attest to country-of-origin and provide a clean chain of custody; post-EoS 881 replacements bought on the secondary market are not a substitute and will not be supportable. Government Purchase Card (GPC) orders, contract-vehicle pricing, and SmartNet/Solution Support attach can all be handled at quote time. Lead times on the 1100 series are generally healthy but can swing with optic and license bundling, so order early and confirm the exact SKU stack (chassis + Network tier + DNA term + optics) up front.

You can browse the C1111-4P and related ISR 1100 SKUs in our catalog, or have us scope the full fleet refresh. When you are ready, get a refresh quote and we will turn your 881 inventory into a per-site bill of materials with the right license tiers, optics, and TAA documentation attached.