Most used switches, routers and firewalls still work. On most models in our catalog, the faults we could source come down to the previous owner's config, a password nobody remembers or a part that didn't make it into the box. This is the list we run through on every listing, from the first photo to the first console session.
Read the label first
The part number on the label tells you more than the title does. Cisco's guide lists the WS-C2960-24TT-L next to the 24TC-L and the 2960-Plus, and sellers mix them up. On HP the J-number matters. The HP 2530-24 is the J9782A and has no fans, while the 2530-24G (J9776A) and 2530-24-PoE+ have them.
Suffixes and generations do the same job on other brands. A UniFi US-24 with 250W or 500W after it is a PoE model, and one with a small touchscreen is the Gen2 USW-24. MikroTik sold several hEX models that look alike, so look for RB750Gr3 on the bottom sticker of a hEX. On the SRX240, the H2 has 2 GB of memory where the H has 1 GB, and show chassis routing-engine tells them apart. Revisions show up in the code too. A CCR1009 whose code starts 8G is the older revision with a switch chip.
Ask for show version and a boot photo
On a Catalyst 2960 the SYST LED should be solid green after boot, not amber. On Cisco gear, ask for show version. It names the image, so you'll see LAN Base or IP Base on a switch. On an ASA 5505 it shows the license, the user count and the serial number, and that serial should match the label.
On Juniper, ask for show version, show chassis hardware and show system license. The output of show chassis alarms and show chassis environment tells you whether the fans are happy. On MikroTik, ask for /system license print and the version shown in /system resource. For a UniFi switch, ask for a photo of it powered with cables in the ports and the link LEDs lit.
Reset and password recovery, maker by maker
Plan to wipe every device on arrival, even when the seller says they did.
Cisco
On a Catalyst 2960, holding the Mode button for about 10 seconds wipes the configuration. For a lost password on the 2960, 3560 and 3750 families, Cisco's recovery is to hold Mode while you plug in power, run flash_init and rename flash:config.text. We couldn't find Cisco's recovery steps for the ISR 2921 or the ASA 5505, so ask the seller to wipe those and plan on a console session.
Juniper
Running request system zeroize wipes the config and logs and reboots to the factory default. A lost root password doesn't need a wipe. Boot single-user from the console with boot -s, type recovery and set a new one. The EX2300 and EX3400 also have a Factory Reset/Mode button that loads the factory default after 10 seconds. SRX firewalls have a RESET CONFIG button, and holding it 15 seconds deletes every config and loads the factory one. On the SRX210 and SRX300, a brief press loads the rescue config instead. The SRX300 doesn't reboot by itself afterward, so power-cycle it.
HP and Aruba
HP's switches have Reset and Clear buttons. Holding Clear for a second deletes the console passwords. For factory defaults on a 2530, press Reset and Clear together, let go of Reset, and release Clear when the Self Test LED starts to flash. The 2920 works the same way, with its Test LED blinking after about 25 seconds. A previous owner can disable the buttons from the CLI, and then you'll need the console. We couldn't find HP's reset steps for the 2810 or the 2540, so ask the seller whether those have been reset.
Ubiquiti
Hold a UniFi switch's reset button for more than five seconds while it's powered. A UniFi switch stays tied to the controller that adopted it until it's forgotten or reset, and UniFi Network shows it as Managed by Other until then, so ask the seller to forget it in their app before shipping. On an EdgeRouter, hold reset while it's running until the port LEDs light in sequence and port 1 lights again, about 10 seconds. It comes back at 192.168.1.1 with ubnt/ubnt. The EdgeSwitch 24 Lite takes about 15 seconds, until its system LED flashes blue for two seconds.
MikroTik
Hold reset while you apply power and let go when the green LED flashes. That resets the config and the password. Keep holding until the LED goes out, about 20 seconds, and the device looks for a Netinstall server to reinstall RouterOS. Netinstall doesn't erase the license key, so a reinstalled router keeps its level. The CRS328 is a little different, with reset held during boot until the USR LED flashes.
Console cables
A console cable is the one accessory you'll use on day one. Most of this gear takes an RJ-45 rollover cable. Cisco's Catalysts run at 9600 baud. Ubiquiti's rack switches, the EdgeRouter 4 and MikroTik's RJ45 consoles run at 115200, 8N1. Juniper shipped the EX2200 with an RJ-45 cable and a DB-9 adapter, and HP put an RJ-45 to DB-9 cable in the box with the 2530 and the 2610.
Many later models add USB. Cisco lists a USB console cable for the 2960-S, the 3560-C has a mini USB port, and the EX2300, EX3400 and SRX300 have mini-USB. The SRX300's mini-USB port needs Juniper's USB driver. HP's 2530, 2920 and 2540 have micro USB, with no cable supplied. The CCR1009 is the odd one out, with an RS232 serial port that needs a null-modem cable.
Some have no console at all. The EdgeRouter X, the hEX, the hAP ac² and the UniFi US-8-60W have none, so the reset button is the way back in if you lock yourself out.
Power supplies and PoE
Look for the power supply in the photos. The ASA 5505, the SRX300, the EdgeRouter X and MikroTik's hEX, hAP ac² and RB4011 all use external adapters. Juniper's 48 V and 54 V adapters for the SRX210 can't be ordered any more, and PoE+ on it needs the 54 V one.
PoE budgets follow the supply. The 3750-X gives 435 W of PoE on the 715 W supply it ships with, and up to 1600 W with two 1100 W supplies. The Aruba 2920 needs its X332 575 W supply for PoE+. The ISR 2921 gives no PoE on its standard supply. Ask for show power inline on Cisco, show poe interface on Juniper or show power-over-ethernet on HP, and check the budget against the model page. The US-8-60W does 802.3af only, up to 15.4 W per port, whatever the 60W suggests.
Rack ears
HP shipped brackets with the 2530 and 2610, and Juniper shipped them with its EX switches, so a complete listing has them. Juniper sold the SRX210 and SRX300 rack kits separately, and the EdgeRouter 4 needs the separate ER-RMKIT. Pick a listing with the ears you need, or allow for buying them.
Optics rarely come with it
Empty SFP cages are normal. Almost every model in the catalog lists optics as not included, so look in the photos for modules and budget for your own if you need fiber or 10G. On some models the uplinks themselves are an add-on. The 3750-X gets them from a network module that isn't part of the default switch, and a bare Aruba 2920 has no 10G ports until you fit a module. The Juniper EX2300-24P stacks only over SFP+ modules, so 1G SFPs won't do for that.
Fans on arrival
Power it up the day it arrives, before you rack it, and listen. A fanned switch should settle to a steady hum with no grinding or rattling. A fanless one, like the HP 2530-24 or the ProCurve 2610-24, should make no sound at all. On Juniper's EX switches a failed fan raises a chassis alarm, so check show chassis alarms. The CRS328 has a FAN FAULT LED that should stay dark. Our guide to quiet home lab gear lists the maker noise figures, and licenses and software updates covers what show version and show license should say.
