A simulator will teach you the commands. A real Catalyst on the desk teaches you the rest, like reading the boot messages on a console cable, recovering a forgotten password and finding out which features your image actually has. Our Cisco catalog has four Catalyst switches that suit a CCNA bench, plus the ISR 2921 router and the ASA 5505 firewall for the routing and security side. All six are past the end of Cisco's support, which matters much less on a bench than at the edge of your home network. Here's what each feature set covers, what each does for PoE and stacking, and when Cisco stopped supporting it.
Catalyst 2960-24TT-L, the plain layer 2 switch
The 2960-24TT-L is the simplest of the four. Cisco's support page dates the 2960 series to September 2005, when it was Cisco's entry-level managed access switch. It has 24 ports of 10/100, two gigabit copper uplinks and a fan, in a 1U box that Cisco rates at 30 W. The -L means LAN Base, so it's a layer 2 switch. You get VLANs, trunks and a real Cisco console, and nothing on it needs activating.
It has no PoE and no stacking, and its uplinks are copper ports with no SFP slots, so there are no optics to buy. The console is an RJ-45 port on the back, used with a rollover cable at 9600 baud. Cisco stopped selling it on October 31, 2014 and ended support on October 31, 2019. Cisco's 15.2(2)E release notes skip this original 2960, so it won't take that newer software. Read the label closely, since Cisco's guide lists it next to the 24TC-L and the 2960-Plus that replaced it.
Catalyst 2960S-48LPS-L, gigabit and PoE+
Cisco launched the 2960-S in March 2010 as the gigabit step up. The 2960S-48LPS-L has 48 gigabit PoE+ ports sharing a 370 W budget, enough for 12 ports at the full 30 W or 24 at 15.4 W, plus four 1G SFP uplinks. It's LAN Base too, a layer 2 feature set, on a universal image that holds LAN Base and LAN Lite.
Stacking on the 2960-S is FlexStack, through an optional C2960S-STACK module that runs at 20 Gbps. Check the rear slot in the photos, because a blank cover means the module isn't fitted. It still runs the 15.2(2)E software, and Cisco lists both RJ-45 and USB console cables for it. Cisco rates it at 42 dB typical and about 71 W before PoE. Sales ended on November 6, 2015 and support on November 30, 2020.
Catalyst 3560CG-8PC-S, routing on a desk
The 3560CG-8PC-S comes from Cisco's 3560-C compact line of January 2011, small enough to sit on a desk or mount under one. It has eight gigabit PoE+ ports sharing 124 W and two uplinks that each take either a copper cable or a 1G SFP. The -S means IP Base, which Cisco says adds routed access, MACsec and OSPF to the LAN Base features. That lets you practice inter-VLAN routing and OSPF on real hardware.
That's as far as it goes. Cisco's datasheet says the compact switches can't be upgraded, and the 3560-C doesn't take the IP Services image, so ignore a listing that promises it. There's no stacking. It's fanless and listed at 0 dB, so it can sit next to your keyboard. It has an RS-232 console port and a mini USB one. Sales ended on October 30, 2016 and support on October 31, 2021.
Catalyst 3750X-48P-S, stacking and room to grow
The 3750X-48P-S was Cisco's stackable layer 3 access switch when it came out in March 2010. It has 48 gigabit PoE+ ports and runs IP Base as the -S. StackWise Plus stacks up to nine switches at 64 Gbps, and StackPower shares power across up to four. Stack cables don't come with every switch, so look for them in the photos if you plan to stack.
Its uplinks come from a network module that isn't part of the default switch. The C3KX-NM-1G gives four gigabit ports, the NM-10G two 10G SFP+ ports and the NM-10GT two 10GBASE-T ports, so the module in the photos matters. PoE depends on the supply. The 715 W unit it ships with gives 435 W, a single 1100 W gives 800 W, and two 1100 W supplies reach 1600 W. IP Services was a separate permanent license, and under Cisco's transfer policy you should count on what's installed. Cisco rates it at 43 dB typical, and it draws about 134 W before PoE, so it suits a garage more than a desk. Sales ended on October 30, 2016 and support on October 31, 2021.
Picking between them
For VLANs, trunks and console practice, the 2960-24TT-L covers it with nothing to activate. If you also want to power access points or phones, the 2960-S adds PoE+ and gigabit on every port. For routing on a switch, the 3560CG-8PC-S is the quiet one, and its IP Base covers OSPF. The 3750-X is the one for stacking, and its module slot leaves room for 10G, if you can live with the noise. Two switches on the bench let you run trunks between them, so a 2960 and a 3560-C make a sensible pair.
The routing side, ISR 2921
The ISR 2921 sat in the middle of Cisco's second-generation Integrated Services Routers, and Cisco dates the 2900 series to October 2009. It's a 2U router with three gigabit ports, one of which takes an SFP. It also has four EHWIC slots for serial, switch or WAN cards, a service-module slot and three PVDM slots for voice. Home-labbers use the EHWIC slots for serial links and the onboard crypto for IPsec labs.
Every unit runs one universal IOS image, and licenses turn on the IP Base, Data, Unified Communications and Security packages, tied to the router's product ID and serial number. Ask for show license and a list of the EHWIC cards fitted, since listings often show cards in one photo and ship without them. PoE needs the optional PoE supply, which gives up to 280 W. It's loud for a home, at 54.4 dBA typical. Sales ended on December 9, 2017 and support on December 31, 2022.
The firewall side, ASA 5505
Cisco launched the ASA 5500 family in May 2005 to succeed its PIX firewalls, and the ASA 5505 was the small desktop member. It has an eight-port 10/100 switch built in, with PoE on two of those ports, and a stateful firewall rated up to 150 Mbps with IPsec VPN. It's a cheap way to practice the classic ASA command line, and Cisco's ASA 9.2 configuration guide still covers it.
The license matters more than the hardware. Base stops at three VLANs in routed mode with no trunks or failover, while Security Plus raises that to 20 VLANs and eight trunks and adds active/standby failover. The user count of 10, 50 or unlimited is a separate license on either. Cisco stopped selling it on August 25, 2017 and ended support on August 31, 2022, and Wikipedia says its final software came out in 2014.
Before you buy one
Read the part number on the label and ask for show version on any of them. Our guide to checking used network gear covers the Mode button recovery and console cables, and licenses on used network gear goes deeper on Cisco's feature sets and transfer policy. If you'd like a second switch from another maker for CLI practice, the EdgeSwitch 24 Lite has an industry-standard CLI over its RJ45 console, though it only does static routing. The rest of the switch catalog is a click away.
