Cisco hardware doesn't stop working on its last date of support. What stops are the software fixes, the security updates and help from Cisco TAC. For a firewall at the edge of your network, that's a real risk. For an access switch in a closet, it's usually a planning question. Here's where three common platforms stand.
What "last date of support" actually means
Cisco publishes several milestones for each product. These are the ones that matter most:
- End of sale: the last day you can order the product new from Cisco.
- End of software maintenance: no more bug-fix releases.
- End of vulnerability and security support: no more security patches. For firewalls and routers facing the internet, this is the real deadline.
- Last date of support: TAC, hardware replacement and service contracts all stop. The product is officially obsolete.
Cisco ASA 5506-X, 5508-X and 5516-X: support has ended
Cisco's last date of support for the ASA 5506-X, 5508-X and 5516-X was 31 August 2026. Since then there are no new security fixes for these firewalls. If one is still guarding a branch office, it's running without a safety net. Cisco's migration path is the Firepower 1000 series. This is the one we'd put on this quarter's list.
Cisco Catalyst 2960-X: supported until 31 October 2027
The 2960-X family went end of sale some time ago, but its last date of support is 31 October 2027. Cisco's suggested replacement is the Catalyst 9200L. You have time to plan, budget and test, rather than replace in a hurry.
Cisco ISR 4321 and 4331: supported until 30 November 2028
The ISR 4300 routers stopped selling in November 2023, and their last date of support is 30 November 2028. The replacement is the Catalyst 8200 series. For most branch networks, these routers can keep running for a good while yet.
End of sale is not an emergency
End of sale and end of support are different milestones, and the gap between them is usually several years. That gap gives you a choice:
- Move to the new generation when a platform reaches end of support, or when you need features it can't offer. For anything security-facing, like a firewall, don't wait past the date.
- Keep a proven platform running with refurbished units and spares, where the risk is low and the hardware does its job. Switches and routers deep inside the network are often good candidates.
Both can be the right call. The mistake is not choosing, and finding out on the day a unit fails that no replacement is in the budget.
Running older hardware safely
If you decide to keep a platform running past its support date, a few habits keep the risk low:
- Keep it away from the internet edge. Use older switches and routers inside the network, behind a supported firewall.
- Install the last available software release before support ends, and keep a copy of the image.
- Back up the configurations, so a replacement unit can be swapped in within the hour.
- Keep at least one tested spare per platform, ideally loaded with the same software version.
A quick checklist
- List every firewall, switch and router with its model and serial number.
- Look up the last date of support for each one on Cisco's end-of-life pages.
- Replace security devices first, then plan the rest around your budget cycle.
- Keep a spare on the shelf for every platform you decide to extend.
How we can help
Networkser Group supplies both sides of that choice: the new generation, such as Cisco Firepower and Catalyst 9200L, and refurbished units and spares for Catalyst 2960 and ISR routers. Read why refurbished Cisco still makes sense, or send us your equipment list and we'll help you plan.