Every Cisco platform dies twice. First at end-of-sale, when you can no longer buy it new, and then at the Last Date of Support (LDoS), when TAC stops answering, software fixes stop shipping, and your support contract quietly becomes a piece of paper. The gap between the two is where planning happens. Here's the LDoS calendar that matters for the installed base we see most, verified against Cisco's published end-of-life notices.
Already past: unsupported today
- Catalyst 3850 (copper/UPOE models): end-of-sale October 30, 2020; LDoS October 31, 2025. If they're still in your racks, they've been unsupported for nine months. (The fiber 3850 SKUs, 12XS/24XS/48XS and friends, run on a later clock, to April 30, 2027.)
- ASA 5525-X / 5545-X / 5555-X firewalls: LDoS September 30, 2025. After 2025's actively exploited ASA vulnerabilities, both CISA and the UK's NCSC publicly urged replacing end-of-support ASA appliances, an unusual step worth taking seriously.
- Nexus 5500/5600, Nexus 6000, first-gen Nexus 9300: LDoS dates passed between 2020 and 2024.
Unsupported doesn't mean broken: these platforms keep forwarding packets for years. It means you're self-insuring, and the sane way to self-insure is cheap tested spares (more below).
What LDoS actually changes
It's worth being precise about what stops at the last date of support, because it's more than a phone number: no more TAC cases, no more software maintenance or security fixes, no more RMA under an OEM contract, and no new support contracts, ever. For infrastructure that only switches packets, that's a manageable, insurable risk. For anything security-facing or compliance-scoped it's a different conversation: auditors and cyber-insurance questionnaires increasingly ask directly whether production systems run vendor-supported software, and "no" is an answer with a premium attached.
Imminent: the 2026 deadlines
- ASA 5506-X / 5508-X / 5516-X firewalls: end-of-sale August 2021; LDoS August 31, 2026. That is weeks away. Cisco's migration path is the Secure Firewall 1200/3100 series.
- Catalyst 3650: end-of-sale October 31, 2021; LDoS October 31, 2026. The 3850's little brother gets three extra months of runway, then joins it.
The 2027 wave
- Catalyst 2960-X / 2960-XR: end-of-sale October 31, 2022; LDoS October 31, 2027. This is the big one: the 2960-X family is one of the most widely deployed access switches ever shipped. Whole campuses run on it.
- Catalyst 6807-XL: end-of-sale April 30, 2022; LDoS April 30, 2027. The last of the Catalyst 6K era, and its final contract-renewal cutoff is July 29, 2026, weeks away.
- Nexus 7000 chassis: end-of-sale February 28, 2022; LDoS February 28, 2027.
- Aironet 2800/3800 access points: end-of-sale October 31, 2022; LDoS October 31, 2027. Wave 2 Wi-Fi 5 estates age out alongside the switches that power them.
On the horizon: 2028
- ISR 4200/4300 and select 4400 routers: end-of-sale November 7, 2023; software maintenance already ended August 31, 2025; LDoS November 30, 2028. Migration target: Catalyst 8200/8300 Edge. (The ISR 4461 runs on its own clock: LDoS January 31, 2030.)
- Nexus 7700: end-of-sale October 12, 2023; LDoS October 31, 2028. Line-card dates vary, so check your exact modules against Cisco's EOL portal.
For clarity: Catalyst 9200 and 9300 are not end-of-life: they're the current campus platforms and the standard migration target, with no EOL notices as of mid-2026. That matters for planning: a migration onto 9300-class hardware, new or refurbished, buys you a platform with years of supported runway rather than a hop onto the next expiring generation.
Migrate, sustain, or sell: the honest decision tree
Migrate when the platform carries something that matters: your internet edge, your core, anything security-facing. Firewalls past LDoS stop receiving the fixes that make them firewalls. The ASA deadline is not one to run through. Typical mappings: 2960-X → Catalyst 9200L/9300-L; 3650/3850 → Catalyst 9300; ASA 5500-X → Secure Firewall 1200/3100; ISR 4300 → Catalyst 8300; Nexus 7700 → Nexus 9300/9500. Refurbished current-generation gear covers most of these moves at a fraction of list. A tested 9300 does everything the datasheet says regardless of who bought it first.
Sustain when the gear is deep in the access layer, stable, and replacement disruption outweighs risk. The playbook: buy shelf spares while the secondary market still has deep stock, standardize on a final known-good software release, and document the self-support decision. A spare 2960-X-48 costs little today; the risk isn't the switch dying, it's the switch dying in 2029 when spares are scarce.
Sell when you're consolidating or migrating anyway. Timing matters more than sellers expect: resale value drops at end-of-sale (when refresh waves flood the market with supply) and again at LDoS (when support-dependent buyers exit). 2960-X series pulled today, ahead of the October 2027 deadline, is worth meaningfully more than the same switch in 2028. We buy decommissioned gear: pickup arranged, processed within 48 hours.
The 90-day version
Audit serial numbers against Cisco's EOL notices this quarter, before the August ASA date, not after. Sort every hit into migrate, sustain, or sell. Then act while both sides of the market are still liquid.
Planning a migration or holding gear on this list? Browse tested Catalyst and Nexus inventory, firewalls, or get a quote, including trade-in credit for what comes out of the racks.
Sources
- Cisco End-of-Sale and End-of-Life products portal: the platform-specific notices for Catalyst 3850, 3650, 2960-X, 6807-XL, ASA 5500-X, ISR 4000, Nexus 7700, and Aironet 2800/3800 (retrieved July 2026)
- CISA Emergency Directive ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices
