Cisco 3504 WLC to Catalyst 9800-L Migration Guide

The Cisco 3504 Wireless Controller (AIR-CT3504-K9) was the right answer for a lot of small and midsize sites: a compact 1RU AireOS controller that managed up to 150 access points and 3,000 clients without the cost or footprint of a 5520. If you still have one anchoring a branch, a clinic, a school building, or a remote DoD site, the clock on it is now the thing to plan around. Cisco stopped selling the 3504 on January 31, 2021, ended software maintenance on January 31, 2023, and the platform reaches its Last Day of Support (LDoS) on January 31, 2027. This guide explains exactly what those milestones mean for an AireOS controller specifically, why the Catalyst 9800-L is the modern replacement Cisco points to, and how to run the migration without breaking your wireless.

Where the 3504 stands today, and why the clock matters

End-of-life is not a single event. It is a sequence of milestones, and for the 3504 most of them are already behind us. The one that should drive your budget is the last one.

What each milestone date means

• End of Sale (Jan 31, 2021): Cisco stopped taking new orders for the AIR-CT3504-K9. Any unit added to your estate since then is secondary-market or was already on a shelf. This date is past.
• End of Software Maintenance (Jan 31, 2023): the last date Cisco delivered maintenance AireOS releases and bug fixes for the platform. After this point you stopped getting routine code, which matters because AireOS 8.10 is the terminal train for the 3504 and it does not learn new tricks.
• Last Day of Support / LDoS (Jan 31, 2027): the hard wall. After this date Cisco provides no PSIRT security fixes, no TAC engineering support, and no hardware RMA. A failed controller is simply a dead controller, and a new CVE against AireOS is one you live with.

There is a second, quieter reason to act before the 2027 wall rather than at it: the 3504 controls your APs. When the controller is unsupported, every Wave 1 and Wave 2 802.11ac access point joined to it is effectively frozen alongside it. You can confirm your exact platform dates and affected serials on the 3504 end-of-life detail page, and see the broader retirement schedule across the Cisco EoL hub.

The recommended replacement: Catalyst 9800-L

Cisco's migration path off the 3504 is the Catalyst 9800 family running IOS XE — specifically the Catalyst 9800-L (C9800-L-F-K9) as the like-for-like fit for the small-to-midsize footprint the 3504 served. For very small or distributed sites there is also the Embedded Wireless Controller (EWC) option that runs the 9800 control plane directly on a Catalyst 9100-series access point, eliminating the dedicated appliance entirely. For most former 3504 sites that want a real appliance with headroom, the 9800-L is the answer.

What you actually gain

• Capacity headroom: the 9800-L scales to roughly 250 access points and 5,000 clients, versus 150 APs and 3,000 clients on the 3504 — meaningful room to grow without a forklift.
• Wi-Fi 6/6E and 7 readiness: the 3504 was built for 802.11ac (Wave 1/Wave 2). The 9800-L drives Catalyst 9100 and CW91xx access points, unlocking 802.11ax OFDMA, BSS coloring, target wake time, and 6 GHz spectrum that AireOS simply cannot manage.
• mGig and fiber uplinks: the C9800-L-F-K9 is the fiber variant with SFP/SFP+ network ports plus multigigabit (up to 2.5/5 Gbps) copper data ports — a real upgrade over the 3504's four 1G/multi-rate copper and SFP ports, and necessary to backhaul Wi-Fi 6E/7 APs.
• IOS XE instead of AireOS: a modern, programmable OS with model-driven telemetry, NETCONF/YANG, RESTCONF, and Cisco's Software Maintenance Updates (SMUs) that allow targeted hot patching of security fixes without a full image swap and reboot.
• High Availability SSO: stateful switchover with sub-second client failover, plus N+1 redundancy options, so a controller fault no longer drops the whole site.
• Native Catalyst Center and DNA integration: the 9800-L is a first-class citizen in Catalyst Center for assurance, AI/ML RF analytics, and policy — capabilities that never existed on the 3504.

Licensing: the model is different, plan for it

This is the single biggest conceptual shift, and the place migrations go over budget. The 3504 used perpetual AP-count licenses tied to the controller. The 9800-L uses Cisco Smart Licensing Using Policy (SLUP) with term-based DNA/Network subscriptions — Catalyst Center Network Essentials or Advantage per access point, managed through your Smart Account in Cisco Smart Software Manager. Your old AireOS right-to-use AP licenses do not carry over as subscriptions. Budget for the access-point subscription tier and term up front, size the tier to the features you actually need (Advantage unlocks assurance and SDA; Essentials is base connectivity), and stand up the Smart Account before the controller arrives so day-one activation is not a procurement scramble.

A practical migration plan

1. Assess and inventory

Pull show sysinfo and show ap summary on the 3504 to capture exact AireOS version, AP count, model mix, and client load. Document WLANs, AP groups, RF profiles, FlexConnect groups, mobility peers, AAA/RADIUS servers, and any web-auth or guest anchor configuration. This inventory is your feature-parity checklist and the basis for right-sizing the 9800-L subscription. Note which APs are 802.11ac (Wave 1 APs like 1700/2700/3700 are themselves EoL and should be retired, not just re-homed; Wave 2 11ac APs can join the 9800 but won't deliver Wi-Fi 6).

2. Config and feature parity

AireOS and IOS XE are different operating systems — this is a translation, not a copy/paste. Cisco's Wireless Config Analyzer Engine (WCAE) and the AireOS-to-IOS XE config conversion tooling give you a head start, but treat the output as a draft. Re-validate WLAN-to-policy-profile mappings, FlexConnect (now Flex profiles), RF profiles, and AAA. The IOS XE model separates WLAN profiles, policy profiles, and policy tags — a cleaner architecture, but one you should rebuild deliberately rather than machine-translate blindly.

3. Physical: rack, power, uplinks, optics

The 9800-L is a compact 1RU appliance like the 3504, so rack space is rarely the constraint. The real planning items are the uplinks and optics: the C9800-L-F-K9 expects SFP/SFP+ transceivers on its fiber ports, so confirm you have matching 1G/10G optics and fiber to your distribution switch. If you also plan to lean on the multigigabit copper data ports, make sure the upstream switch ports are mGig-capable. Power is single 12V DC/AC with optional redundant supply — spec the redundant PSU for any site that cannot tolerate a controller outage.

4. Phased cutover

Do not flash-cut a production wireless estate. Stand the 9800-L up in parallel, join a small pilot group of APs (a single closet or floor), validate authentication, roaming, QoS, and guest access against the old behavior, then migrate AP groups in waves during maintenance windows. APs running CAPWAP can be re-pointed at the new controller via DHCP option 43 or DNS, so the move is largely a controlled re-home rather than a re-cable. Keep the 3504 online and reachable as a rollback target until the last wave is verified.

5. Secure decommission

Once the 9800-L owns all APs, wipe the 3504 before it leaves the rack. Erase the configuration and any stored RADIUS secrets and certificates. For federal and DoD environments, follow NIST SP 800-88 media sanitization and capture a certificate of data destruction for the audit trail. Retain the chassis serials in your asset records so the retired unit is provably out of the supported-fleet count.

Procurement notes for regulated buyers

Because the 3504 is past End of Sale, you cannot buy a new one through authorized channels, and gray-market controllers carry no warranty and no support path — a non-starter for any compliance-driven buyer. Source the Catalyst 9800-L through an authorized partner so the unit is TAA-compliant where required, eligible for federal procurement vehicles and GPC purchases, and covered by a genuine Smart Account and SmartNet/Solution Support contract. Lead times on controllers and matching optics move with demand, so place orders ahead of your cutover window rather than against the LDoS date. You can browse current controller and access-point options in our catalog, and when you are ready to size the platform, subscription tier, and optics together, get a quote and our team will scope the full 3504-to-9800 refresh — hardware, licensing, and migration services — as one defensible bill of materials.