Buy used network gear and you get whatever software rights came with it. Cisco ties ASA and ISR licenses to the serial number, Juniper binds them to the chassis serial, MikroTik binds them to the device's storage, and Ubiquiti doesn't sell them at all. So what matters is what's on the box right now, and show version, show license or the maker's equivalent tells you.
Cisco Catalyst feature sets
On Cisco's Catalyst switches the last letter of the part number names the feature set. An -L is LAN Base. Cisco's guide says the 2960-24TT-L runs LAN Base software, and there's nothing on it to activate or upgrade. The 2960S-48LPS-L runs a universal image that holds LAN Base and LAN Lite, and the part number sets which one runs.
An -S is IP Base. On the 3560CG-8PC-S, Cisco says IP Base adds routed access, MACsec and OSPF to the LAN Base features. Cisco's datasheet says the compact switches can't be upgraded, and its release notes say the 3560-C doesn't support the IP Services image. A listing that promises IP Services on one is wrong.
The 3750X-48P-S is where an upgrade did exist. Cisco offered LAN Base, IP Base and IP Services on the 3750-X, and moving from IP Base to IP Services took a permanent license through Cisco IOS Software Activation, part L-C3750X-48-S-E. The -L and -E part numbers are the LAN Base and IP Services versions of the same switch.
Cisco's transfer policy
Cisco's Software Transfer and Re-Licensing Policy lets license rights move to a new owner in only a few cases. The law has to require it, or one of Cisco's permitted transfer scenarios has to apply, such as a merger or acquisition. Otherwise Cisco has to consent, and the new owner pays a transfer license fee equal to a new license at list. For a home lab, count on the software that's installed and don't plan on moving or adding licenses later.
ASA 5505 Base, Security Plus and user counts
On the ASA 5505, the license matters more than the hardware. The Base license allows three VLANs in routed mode, one of them a restricted DMZ, with no trunks, no failover and 10 IPsec VPN peers. Security Plus raises that to 20 VLANs, eight trunks and 25 IPsec peers, and adds active/standby failover. The user count is a separate license on both, at 10, 50 or unlimited inside hosts.
The bundle part numbers give you a first clue. ASA5505-BUN-K9 is the 10-user Base bundle, -50-BUN-K9 the 50-user one, -UL-BUN-K9 the unlimited-user one and -SEC-BUN-K9 the unlimited-user Security Plus bundle. Cisco ties the activation key to the serial number, and its feature licenses can't move between devices. Match the serial in show version to the label in the photos.
ISR technology packages
Every ISR 2921 runs one universal IOS image, universalk9. Licenses turn on the packages inside it, which are IP Base, Data (SL-29-DATA-K9), Unified Communications (SL-29-UC-K9) and Security (SL-29-SEC-K9). Cisco binds them to the router's UDI, its product ID plus serial number. Cisco's activation guide for these routers also describes 60-day evaluation licenses, so ask for show license and look for Data and Security listed as permanent if the listing claims them.
Juniper EFL, AFL and Flex
Juniper's EX switches do layer 2 with no license, and routing is where licenses come in. On the EX2200-24T-4G, the enhanced feature license (EFL), part EX-24-EFL, adds OSPFv1/v2 limited to four active interfaces, plus VRRP, PIM, IGMP, BFD, Q-in-Q and virtual routers. BGP isn't on the EX2200's list at all. On the EX2300, the EFL covers OSPF, VRRP, IGMP and PIM, and IS-IS and MPLS aren't supported. The EX3400 keeps OSPF, VRRP and virtual routers on the EFL, puts IS-IS behind an advanced feature license (AFL) and sells MACsec as its own license.
Juniper now also sells Flex licenses in Standard, Advanced and Premium tiers. OSPF, RIP and VRRP come with Advanced, and BGP, IS-IS and EVPN are Premium. Juniper notes that a feature in a tier isn't always supported on every model, so check the model's own list. License keys are made from the authorization code and the serial number, so a key belongs to the switch it was made for. Ask for show system license before you count on any routing.
SRX tiers and old subscriptions
The SRX300's Standard tier comes with the hardware and covers routing, firewall, switching, NAT, VPN and MPLS. Advanced 1 adds SecIntel, IDP and application security, and Juniper also offers Advanced 2 and Premium 1 on the SRX300. On the older SRX210 and SRX240, antivirus, antispam and web filtering ran as subscriptions, and Juniper's dates page shows those reaching end of support by November 30, 2024. All of them are bound to the chassis serial number, so plan on the Standard features and don't pay extra for a listing that mentions UTM licenses.
HP and Aruba
We couldn't find HP's feature lists for any of the HP and Aruba switches we cover, so we don't promise routing on them. The 2530s run ArubaOS-Switch, covered by HPE's 16.05 guide from April 2018. The ProCurve 2610-24 runs R.11 software, and the 2810-24G runs N.10 to N.11. HPE's parts site says support ended on September 30, 2020 for the 2610-24 and on December 31, 2023 for the 2920-24G-PoE+. Ask for show version and plan on the features of the release it runs.
Ubiquiti
Ubiquiti doesn't license features. UniFi switches are set up from the UniFi Network app, which Ubiquiti gives away with no licensing or support fee. The one thing to clear is the old owner's adoption, so ask the seller to forget it in their app. EdgeOS ships with its full feature set on the EdgeRouter X and EdgeRouter 4, and EdgeSwitch firmware has every feature out of the box. Ubiquiti released EdgeOS 3.0.0 in July 2025, EdgeSwitch 1.12.2 in June 2026 and UniFi switch firmware 7.5.15 in September 2026.
MikroTik
Every MikroTik device ships with a RouterOS license, and the level comes with the box. Level 4 allows 200 PPPoE, PPTP or L2TP tunnels and 200 hotspot users, and it's what the hEX and hAP ac² carry. Level 5 raises both to 500, on the RB4011, CRS326 and CRS328. The CCR1009 has Level 6, with no limit. MikroTik binds the license to the device's storage and it can't move to another device, so it stays with the hardware when it's sold, and Netinstall doesn't erase it. Updates are free for the life of the product or at least five years from purchase, and MikroTik still builds current v7 releases for the MMIPS, ARM and Tile chips in these models.
End of sale and end of support
Cisco's end-of-life bulletins carry several dates. On the 2960-24TT-L, end of sale was October 31, 2014, the last software maintenance release date was October 31, 2015, security fixes ended on October 30, 2017, and support ended on October 31, 2019. End of sale is the day the maker stopped selling it new. The dates after it matter more to you, because they're when bug fixes and then security fixes stopped. The EX2300 took its last orders on September 30, 2026, and Juniper names Junos 25.4 as its last release, with support until September 30, 2031. The EX2200 lost support on June 30, 2024, and Junos 12.3X48 support for the SRX100 and SRX200 lines ended on November 30, 2024. As of October 2026, Juniper hasn't announced end of life for the EX3400 or SRX300 hardware.
What no more updates means at home
On a lab bench, an unsupported box gives up very little. A 2960 still does VLANs and trunks exactly as it did in 2019. On a bench network that doesn't face the internet, the missing security fixes matter much less.
The edge of your home network is different, because that box faces the internet every day. Use something there that still gets security fixes, like the SRX300, an EdgeRouter on EdgeOS 3.0 or a MikroTik on current v7. MikroTik's own history shows why. Unpatched MikroTik routers were hit by VPNFilter in 2018 and by the Meris botnet from June 2021, so update any used one before it goes on the edge. Our first router guide compares them, and the checking guide covers resets.
