Aironet 2602i (AIR-CAP2602I-A-K9) to Catalyst 9120AX Migration

If your wireless estate still has Cisco Aironet 2602i access points (PID AIR-CAP2602I-A-K9) screwed into ceilings, every Cisco lifecycle milestone that matters has already passed. The 2602i reached its Last Day of Support on December 31, 2021. From that date forward there are no software fixes, no security patches, and no TAC support or RMA hardware replacement for this model. The radios still associate clients, which is precisely why these units survive in production years past their retirement date. This guide explains what the end-of-life dates actually mean for a fleet that is still in service, why the Wi-Fi 6 Catalyst 9120AXI is a genuine upgrade rather than a like-for-like swap, and how to run a clean, low-risk refresh that holds up to a federal or healthcare audit.

What the Aironet 2602i actually was

The 2602i (AIR-CAP2602I-A-K9, the -A regulatory domain for North America) is a dual-band 802.11n (Wi-Fi 4) indoor access point with internal antennas. It runs a 3x4:3 radio design — three transmit, four receive, three spatial streams — for a peak PHY rate around 450 Mbps on 5 GHz and roughly 217 Mbps on 2.4 GHz. It was a mid-tier campus AP in its day, and Cisco differentiated it with two technologies worth naming: ClientLink 2.0 beamforming, which improved downstream reach for older and slower clients, and CleanAir spectrum intelligence, which detected non-Wi-Fi interferers like microwaves, Bluetooth, and video bridges. It has a single Gigabit Ethernet uplink, takes 802.3af or 802.3at PoE, and runs as a lightweight, controller-based AP under AireOS on a Wireless LAN Controller (a 2504, 5508/5520, 3504, or vWLC).

The architectural limitation is the era it was born in. The 2602i is single-user MIMO: no OFDMA, no MU-MIMO, no concept of subdividing a channel across many small-frame clients. For the device densities of 2013 it was a solid AP. For today's mix of laptops, phones, IoT sensors, VoIP handsets, and medical telemetry, the airtime model is the bottleneck long before raw speed is.

Why acting now matters

The danger of an end-of-life access point is not that it stops working. It is that it keeps working while the support floor quietly disappears beneath it. Three concrete exposures stack up once a device is past LDoS:

• No PSIRT security patches. When a new wireless or AireOS vulnerability is disclosed, the 2602i will never receive a fixed image — its software is frozen. Any CVE that touches that code path on this hardware is a permanent, unremediable exposure.
• No TAC or RMA. A failed unit cannot be opened as a support case or swapped under a service contract. Your only recovery is a spare you stockpiled before LDoS or a gray-market unit of the same dead-end model with no provenance.
• Audit and compliance exposure. The frameworks federal, DoD, SLED, and healthcare buyers operate under — FedRAMP, CMMC, the HIPAA Security Rule, PCI DSS, and CISA directives — assume supported, patchable infrastructure. 'The vendor no longer ships fixes for this device' is not a defensible remediation plan, and an unpatchable AP on a production VLAN is a finding waiting to be written up.

There is also a controller trap specific to this generation. The 2602i is AireOS-only. Current Catalyst 9800 controllers running IOS-XE 17.x do not support AireOS-era 2600 access points at all. So as you modernize the controller side — which you must, because AireOS WLCs are themselves winding down — the 2602i is left stranded on legacy controllers you are trying to retire. The AP and its controller age out together, which is exactly why this refresh is bigger than a one-for-one hardware swap.

What each milestone means in practice

• End of Sale (2016-12-29): the last day Cisco accepted new orders for the 2602i. Everything after this date was consuming a fixed support tail.
• Last Day of Support (2021-12-31): the hard line. After LDoS, Cisco provides no software fixes, no security patches, no TAC engagement, and no RMA. From a vendor standpoint the device no longer exists.

The recommended replacement: Catalyst 9120AXI

Cisco's migration path for the Aironet 2600 series points at the Wi-Fi 6 Catalyst 9100 family, and for an internal-antenna 2602i the natural successor is the Catalyst 9120AXI (C9120AXI-A for the US domain). It keeps the indoor, internal-antenna form factor you already have, so the physical deployment story is familiar — but everything behind the radome is a generation ahead. The jump from 802.11n to 802.11ax is substantial even when client counts look similar on paper, because the gains are in efficiency and capacity, not just peak speed.

• Wi-Fi 6 (802.11ax) vs. Wi-Fi 4 (802.11n): OFDMA subdivides each channel into resource units so the 9120AXI serves many small-frame clients — handhelds, sensors, VoIP, telemetry — far more efficiently than the 2602i's OFDM-only PHY, which forced one client per transmission opportunity.
• 4x4:4 spatial streams plus uplink and downlink MU-MIMO, versus the 2602i's 3x4:3 single-user design, with up to ~5.38 Gbps aggregate (up to 4.8 Gbps on 5 GHz, 574 Mbps on 2.4 GHz) against the 2602i's ~450 Mbps ceiling — roughly a 10x capacity jump in dense space.
• A dedicated RF ASIC radio for full-time spectrum analysis and CleanAir-class interference detection without stealing airtime from the serving radios — a meaningful improvement over the 2602i's CleanAir, which shared radio resources.
• A multigigabit (mGig) uplink at up to 2.5 Gbps over your existing Cat5e/Cat6 cabling, replacing the 2602i's 1 GbE port so a single AP can actually exceed a gigabit without a forklift on the wired side.
• Integrated BLE/IoT radio for location and IoT use cases the 2602i could not address at all.

Power and cabling are friendly. The 9120AXI runs at full capability on standard 802.3at PoE+ — UPOE is not required — which is the same power class most 2602i sites already provision, so existing switch PoE budgets and Cat-class cabling typically carry over. The cost and complexity live on the controller and licensing side, not the wire.

A practical migration plan

1. Assessment and inventory

Pull an accurate count of live 2602i units by site, floor, and controller. Capture the AireOS controller model and code train hosting them, the switchports and PoE budget feeding them, and the current RF design. Wi-Fi 6 cell sizing differs from Wi-Fi 4, so plan a fresh RF survey for high-density and RF-hostile areas — operating rooms, labs, shielded spaces, warehouse racking — rather than assuming a 1:1 location map. In most open-office ceilings a same-location swap is realistic; in dense or shielded zones it is not safe to assume.

2. Controller and license transition

This is the step that surprises teams. The 9120AXI cannot join your AireOS WLC, so the refresh requires standing up a Catalyst 9800 controller — physical (9800-40/9800-L), virtual (9800-CL), or embedded (9800-EWC running on the APs themselves for smaller sites). Set up or confirm your Cisco Smart Account, choose DNA/Catalyst Essentials vs. Advantage, and pick a term (3, 5, or 7 year). Order licensing alongside the hardware so the APs activate fully on day one — license lead time, not hardware, is the most common source of refresh delay.

3. Config and feature parity

On the Catalyst 9800, rebuild WLANs, RF profiles, AP join profiles, FlexConnect groups, and security policy. Most 2602i features map to richer 9120AXI equivalents — CleanAir, band select, and ClientLink-style beamforming all have modern counterparts, and Flexible Radio Assignment is new capability you did not have before. Validate 802.1X/RADIUS, captive portal, mDNS/Bonjour, and any segmentation policy on a pilot SSID before touching production. Do not hand-translate AireOS configs line by line; rebuild against current IOS-XE best practice.

4. Physical, power, and uplinks

Confirm each switch's PoE budget covers the new APs at peak draw on 802.3at. Where you want the 9120AXI to exceed a gigabit, move those drops to mGig (2.5/5G) switchports; standard 1 GbE ports still work but cap the uplink. Reuse existing Cat5e/Cat6 — mGig negotiates over both — and reuse mounting hardware and ceiling locations wherever the new RF survey supports it. No optics change is needed for standard copper PoE drops.

5. Phased cutover and secure decommission

Because the two AP generations live on separate controllers, run a coexistence migration: stand up the Catalyst 9800 next to the legacy AireOS WLC, pilot one floor or wing on the 9120AXI, validate roaming and client experience, then swap area by area — leaving 2602i units live in unconverted zones until each new zone is confirmed. This keeps users on Wi-Fi throughout and gives you a clean per-zone rollback. As each 2602i comes down, wipe its configuration, record the serial against your asset retirement log, and dispose of or recycle it through a documented, audit-friendly chain of custody — federal and healthcare environments will want that paper trail.

Procurement notes for regulated buyers

• TAA compliance: because the 2602i is years past End of Sale, any 'new' 2602i is suspect inventory. New Catalyst 9120AXI units sourced through an authorized partner carry verifiable TAA country-of-origin documentation required for federal contracts.
• GPC and purchase paths: hardware plus DNA term subscriptions can be structured for GPC-payable and contract-vehicle purchasing through an authorized partner.
• Lead times: plan for both hardware and Smart Licensing provisioning. Order licenses with the APs so units activate immediately on join.

You can review the full milestone record on the EoL detail page for AIR-CAP2602I-A-K9, see the broader Cisco wind-down on the Cisco EoL hub, and browse the replacement on our catalog. When you are ready to scope the refresh, get a quote for Catalyst 9120AXI hardware, a Catalyst 9800 controller, and DNA licensing matched to your 2602i footprint. The 2602i has been unsupported since the end of 2021 — every additional quarter it stays in the ceiling is an unpatched, unauditable risk, so treat this as the overdue project it is, not a someday upgrade.