Most of a CCNA home lab runs fine on a laptop, and the part that does not is the part Cisco just added more of. The CCNA v2.0 topics that take over on February 3, 2027 ask you to diagnose copper and fiber cable faults and configure PoE edge ports for access points and IP phones. A simulator has no cable to unplug and no power budget, so a small rack of used Catalyst gear is worth buying again.
This guide covers the used Catalyst switches, ISR routers and console cables worth buying for a physical CCNA home lab, and where GNS3 already does the job. The Cisco picks are judged on datasheets, end-of-life bulletins and live Amazon listings checked in October 2026, not on our bench, and the console-cable setup was run on Ubuntu 26.04.
Pick the CCNA lab gear
For most people the answer is two switches, one router and one good cable, which comes to roughly $400 used. That is enough for trunking, spanning tree, EtherChannel, router-on-a-stick, OSPF over a routed link and NAT. We would buy these:
- Best switch pair: Catalyst 2960-X WS-C2960X-24TS-L, renewed, about $150 each
- Quiet desk switch: Catalyst 2960-CX WS-C2960CX-8TC-L, fanless, about $140
- PoE and routed access: Catalyst 3560-CX WS-C3560CX-8PC-S, 240 W PoE+, about $170 to $200
- Router: Cisco ISR 4321/K9, IOS XE, about $80
- Console cable: Cable Matters USB-C to RJ45 FTDI, about $22
Every Cisco item on that list is a renewed listing from a third-party seller, and most have between one and twenty reviews. Prices move weekly, so check the live price before you buy. The rest of this page explains why each one made the cut and what it cannot do.
Find out when GNS3 is enough
GNS3, Packet Tracer and CML cover most of the configuration work in CCNA, so start there and buy hardware only for the gaps. A virtual IOSvL2 switch handles VLANs, 802.1Q trunks, PVST spanning tree, LACP, DHCP snooping, DAI and SVIs, according to Cisco’s IOSvL2 reference page. The same page says SPAN and private VLANs are known not to work, and it puts forwarding at about 2.3 Mb/s, so you cannot test throughput on it.
Our free CCNA labs for GNS3 and Packet Tracer run every core topic without a single physical box.
Where a simulator falls short is anything that depends on copper, power or a real chassis. This is how the v2.0 topics split:
| CCNA v2.0 topic | GNS3 / CML | Physical gear |
|---|---|---|
| 1.1 Cable faults: duplex, speed, pinout, fiber | No real cable; an IOL interface stays up when its link is turned off | Needed |
| 2.1 Trunks, EtherChannel, SVIs | Works on IOSvL2 in GNS3 | Optional |
| 2.2 PoE edge ports for APs and phones | No PoE in a virtual switch | Needed (3560-CX) |
| 2.5 Rapid PVST+, PortFast, BPDU guard | Spanning tree works on IOSvL2 in GNS3 | Optional |
| 3.3 OSPFv2 and OSPFv3 | Works | Optional |
| 4.3 NAT/PAT on IOS XE routers | Works: CML-Free’s IOL is built from IOS XE | Optional (ISR 4321) |
| 4.7 DHCP snooping, DAI, port security | Works on IOSvL2 in GNS3 | Optional |
| 5.5 Ansible against devices | Works | Optional |
If you’d rather stay virtual, CML-Free is now a real option. It’s free, single-user and runs up to five nodes at once (unmanaged switches and external connectors don’t count). Its image set is IOL, IOL-L2 and ASAv rather than IOSv. Cisco’s IOL page says IOL is built from current IOS XE and passes static NAT, OSPF and HSRP tests, so the IOS XE topics are covered for free. Cisco lists 8 GB of RAM and four physical Intel cores as the minimum for any CML 2.x host.
A mini PC for GNS3 and EVE-NG covers that comfortably. If you only need the topology practice, stop here. If you want to see a link come up because you plugged in a crossover cable, keep reading.
See how we picked the hardware
Each pick had to pass three checks. The Cisco datasheet confirms the ports and features CCNA uses, the end-of-life bulletin gives a support date we can quote, and a renewed unit is buyable on Amazon at a sensible price. We ruled out anything that needs a paid licence for basic labs, anything louder than a desktop PC at idle where a quieter option exists, and anything already past its last date of support.
What we did not do is put these exact units on a bench. Noise and power figures come from Cisco’s datasheets, not from a meter. The only hands-on part is the Linux console setup further down, which was run on an Ubuntu 26.04.1 VM with picocom 3.1. The full source list for every spec sits with the draft for the reviewer.
Check support dates and prices
Support dates matter more than usual here. Software maintenance releases stop years before the last date of support (October 2023 for the 2960-X), security fixes stop on that date, and the renewed price already reflects both. The 2960-X goes first, in October 2027:
| Model | Role | Ports | Cooling | Last date of support | Used price |
|---|---|---|---|---|---|
| Catalyst 2960-X 24TS-L | L2 access switch | 24 GE + 4 SFP | Fan, 42 dB typical | 2027-10-31 | ~$150 |
| Catalyst 2960-CX 8TC-L | L2 desk switch | 8 GE + 2 GE + 2 SFP | Fanless | 2029-04-30 | ~$140 |
| Catalyst 3560-CX 8PC-S | PoE+, routed access | 8 GE PoE+ + 2 GE + 2 SFP | Fanless | 2029-04-30 | ~$170-200 |
| ISR 4321/K9 | IOS XE router | 2 GE (1 combo SFP) + 2 NIM | Fan, 24.2 dBA typical, 51.9 max | 2028-11-30 | ~$80 |
| Cisco 1921/K9 | IOS 15 router | 2 GE + 2 EHWIC | Fan, 33 dBA | 2023-09-30 (passed) | ~$77 |
Dates come from Cisco’s EoL notices for each family, and prices are the renewed Amazon listings in October 2026. The 1921 is in the table so you can see why it is not a pick: it costs the same as a 4321, its support ended in 2023, and it runs classic IOS rather than IOS XE.
Get two Catalyst 2960-X switches for switching labs
The 2960-X 24TS-L is the switch most CCNA material is written around, and two of them give you trunks, a spanning tree root election and a two-link EtherChannel between real ports.
Per Cisco’s 2960-X datasheet, the 24TS-L has 24 gigabit copper ports, four SFP uplinks, the LAN Base feature set with up to 1,023 active VLANs, and both an RJ-45 and a mini-USB console port. That covers everything in our guides to VLANs on a Cisco switch and LACP EtherChannel.
It idles at 28 W, so two of them cost little to leave on during a study evening.
Who it’s for: anyone who wants the switching half of CCNA on real ports and has a shelf or closet to put a 1U box on. Skip it if the lab lives on your desk. The fan runs at 42 dB typical, which you will hear in a quiet room, and support ends on October 31, 2027, earlier than anything else here. It’s about $150 renewed, so check the live price, and buy from a seller who lists the power cord.
Put a fanless Catalyst 2960-CX on your desk
The 2960-CX 8TC-L runs the same LAN Base switching as the 2960-X in a fanless compact chassis, so it can sit next to your monitor.
The CX datasheet lists eight gigabit downlinks, two copper and two SFP uplinks that also work as ordinary ports, no PoE on the 8TC, and a silent fanless design. Twelve usable ports is plenty for a trunk to a second switch, a router uplink and a few hosts. Support runs to April 30, 2029, so it outlasts the 2960-X by eighteen months.
It suits people who study in a bedroom or shared office. Skip it if you want PoE, because the 8TC has none, and the PoE sibling (2960CX-8PC-L) only budgets 124 W. It runs about $140 renewed, close to a 2960-X, so you are paying for silence rather than ports. The listing we checked had a single review, so check the live price and the seller’s return terms.
Add a Catalyst 3560-CX for PoE and routed access
The 3560-CX 8PC-S is the one box here that covers the PoE edge-port topic, and it’s still fanless.
Cisco’s datasheet gives the 8PC-S eight PoE+ ports with 240 W available, the same 2 + 2 uplinks as the 2960-CX, and the IP Base feature set. That budget runs a couple of access points and a desk phone at once, which is exactly what v2.0 topic 2.2 asks you to configure.
Watch the routing claim, though. The datasheet ties full OSPF, EIGRP and BGP to the IP Services licence and describes IP Base as “routed access”, so treat this switch as your SVI and inter-VLAN routing box and keep OSPF on the router.
Buy it if you plan to plug in a real AP or IP phone, or you want a Layer 3 switch that does not make noise. Skip it if PoE is irrelevant to you, because a 2960-CX does the switching for less. Renewed units sit around $170 to $200. We found two Amazon listings with identical titles, and the one linked here had more reviews. Check the live price either way.
Run IOS XE on an ISR 4321 router
The ISR 4321 is one of the cheapest IOS XE routers on the used market, and renewed units cost about the same as an older 1921.
From the ISR 4000 datasheet: two onboard gigabit ports (one is an RJ-45/SFP combo), two NIM slots, 4 GB of DRAM, and a USB and RJ-45 console. Default throughput is capped at 50 Mbps, or 100 Mbps with the performance licence. That does not matter for a lab, but it makes the 4321 a poor home internet router on a fast line. CML-Free’s IOL can run our NAT and PAT lab on IOS XE, so the reason to buy the 4321 is the hardware around the software: a WAN port that really drops when you pull the cable, a licence to read with show license, and ROMMON recovery on a box you can brick.
Licensing is the thing to check on a used unit. The listed PID ships with the IP Base licence, and IPsec VPN features need the security licence on top. That’s a small loss for CCNA, which only asks you to describe IPsec.
Run show license and show version as soon as it boots. It peaks at 125 W and has a fan, though Cisco rates it at 24.2 dBA typical. Skip it if you need two routers on a tight budget, because the GNS3 c7200 handles a second OSPF neighbour fine. It runs about $80 renewed; the listing had one review, so check the live price and the seller’s return policy.
Get a USB-C FTDI console cable
Every box above boots to a console port before it ever has an IP address, so the console cable is the one purchase you cannot skip, even with an all-virtual lab at home and a rack at work.
Cable Matters lists this as a 6 ft rollover cable with an integrated FTDI chipset and an RS-232 level shifter, with drivers built into Windows 10 and macOS. FTDI matters because Linux has had a mainline driver for it for years. On our Ubuntu 26.04 VM, ftdi_sio was already in the stock 7.0 kernel, next to pl2303, cp210x and ch341. Cables with an unnamed chip and no driver page are a gamble, because you find out which chip you got only after you plug it in.
It is about $22, or $17.49 for the USB-A version if your laptop still has those ports. Skip it if your gear all has the mini-USB console port the 2960-X, ISR 4321 and 1921 carry, since a plain USB-A to mini-B cable works there. The RJ-45 cable still wins because it fits every Cisco box with an RJ-45 console port, including older ones with no USB console. Check the live price before ordering.
Connect the console cable on Linux
On Linux, nothing needs installing except a terminal program, but your user has to be allowed to open the serial device. Install picocom (minicom, screen and tio work too; we installed all four):
sudo apt install -y picocomThen open the port at Cisco’s default 9600 baud, 8 data bits, no parity and 1 stop bit. A USB cable shows up as /dev/ttyUSB0. Our test VM had no USB passthrough, so the capture below uses its built-in /dev/ttyS0, which Ubuntu gives the same root:dialout ownership:
picocom -b 9600 /dev/ttyUSB0The first try fails for almost everyone, and the fix is group membership rather than a driver:
Read the capture top to bottom: the first picocom call dies on Permission denied, ls -l shows why, and the same command works once the new login carries the dialout group.
Fix “FATAL: cannot open /dev/ttyUSB0: Permission denied”
The message is identical for /dev/ttyS0 in our capture. The device is mode crw-rw---- and owned by group dialout, so a normal user cannot open it. Add yourself to the group, then log out and back in, because a running shell keeps its old group list:
sudo usermod -aG dialout $USERAfter the new login, id -nG lists dialout and picocom prints its port settings, ending in Terminal ready. Press Enter to get the switch prompt, and Ctrl-a then Ctrl-x to exit.
Give the cable a stable device name
With two cables plugged in, ttyUSB0 and ttyUSB1 swap places after a replug. A udev rule keyed on the USB ID fixes that. Run lsusb first and use the vendor and product IDs it prints for your cable. FTDI’s FT232R reports 0403:6001, which is the value in our rule:
sudo vim /etc/udev/rules.d/99-cisco-console.rulesAdd one line:
SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", SYMLINK+="cisco-console", MODE="0660", GROUP="dialout"systemd 259 on Ubuntu 26.04 can lint the file before you reload it, which catches a mistyped key before you start replugging cables:
sudo udevadm verify /etc/udev/rules.d/99-cisco-console.rules
sudo udevadm control --reloadA clean rule reports one success and no failures:
1 udev rules files have been checked.
Success: 1
Fail: 0From the next plug-in on, picocom -b 9600 /dev/cisco-console always reaches the same cable. Once you’re at the prompt, the CCNA command cheat sheet has the IOS commands for the first session.
Check a used Cisco switch before you trust it
Renewed Cisco gear on Amazon comes from refurbishers, not from Cisco, and the listings carry very few reviews. Most problems show up in the first ten minutes on the console, so do these checks inside the return window:
- Model and serial in
show versionmatch the listing - Licence level in
show license(LAN Base, IP Base, security) - Fan and temperature status in
show environment all - Every port links at 1000/full with a known-good cable
- No startup config left over from the previous owner
A leftover config with an unknown enable password is common and fixable. Catalyst switches recover by holding the MODE button at power-on to reach the boot loader, and ISR routers recover from ROMMON. Both happen over the console, so make sure the cable has arrived before you start. Budget for SFP modules separately if you want fiber links, because renewed switches rarely ship with them, and fiber is one of the cable types topic 1.1 names.
Start free, then buy in this order
Start free and add hardware only when a topic needs it:
- Packet Tracer and GNS3 on the computer you own
- An FTDI console cable, about $22
- One ISR 4321 for real WAN links on IOS XE, about $80
- Two 2960-X or 2960-CX switches for trunking and STP, about $280 to $300
- A 3560-CX when you have an AP or phone to power
That order matches how the money gets used. The cable is used daily, the router is the cheapest way to fault a real cable and watch a link go down, and the switches pay off once you start breaking spanning tree on purpose. While the gear is in the post, run the free CCNA practice questions and the CCNA exam topics breakdown. Cisco’s own exam topics page confirms v1.1 runs until February 2, 2027, so anyone testing on or before that date can leave the PoE switch off the list.
