WS-C3560CX-8PC-S Replacement & Migration to Catalyst 9000

The Cisco Catalyst 3560-CX 8-port PoE compact switch (PID WS-C3560CX-8PC-S) was the go-to fanless edge switch for desks, kiosks, exam rooms, guard shacks, and any wiring-closet-less corner where a full-depth switch would not fit. That run is over. Cisco placed the 3560-CX family on its End-of-Life track (bulletin EOL15072), and this model has been End-of-Sale since April 30, 2024. If you still have these mounted under desks or behind displays, the clock is now the controlling fact in your refresh planning. This guide walks through what each milestone means, why the Catalyst 9000 Compact (C9200CX-8P-2X2G-A) is the correct successor, and how to migrate cleanly with minimal disruption to your edge.

Where the WS-C3560CX-8PC-S stands in its lifecycle

This is an IP Base, IOS-based switch with eight 10/100/1000 PoE+ downlink ports backed by a 124W PoE budget, plus a four-port uplink module (two 1G SFP and two 1G copper). It was excellent for its era: silent, shallow, and Layer 3-capable at the edge. But it runs the classic IOS image, not IOS-XE, and predates the trust and segmentation features that modern compliance frameworks now expect by default. Its position on the timeline is what matters most right now.

What each milestone date actually means

• End-of-Sale: April 30, 2024. Cisco no longer sells the WS-C3560CX-8PC-S new through normal channels. Any new units in the wild are now NOS or used inventory, and lead times only get worse from here.
• End of Software Maintenance: April 30, 2025. This date has passed. Cisco no longer ships maintenance or bug-fix software releases for this platform. Critically, this also marks the practical end of routine PSIRT security patching: new vulnerabilities found after this date are unlikely to receive fixed software builds for the 3560-CX.
• Last Day of Support (LDoS): April 30, 2029. After this date, Cisco TAC will not open cases, and there is no hardware RMA path. A dead unit becomes scrap, and an exploit becomes permanent. SmartNet on this hardware cannot be renewed past LDoS.

The recommended replacement: Catalyst 9000 Compact (C9200CX-8P-2X2G-A)

Cisco names the Catalyst 9000 Compact 8-port PoE+ model with Network Advantage (C9200CX-8P-2X2G-A) as the direct successor. It keeps the form factor that made the 3560-CX useful, fanless, shallow-depth, mountable under a desk or in a shallow enclosure, while modernizing nearly everything inside. It is supported well past the 3560-CX's LDoS, so you reset your support runway by roughly a decade.

Concretely what gets better

• PoE budget: jumps from 124W to 240W. That is the difference between powering a couple of legacy phones and running a cluster of 802.3at access points, PTZ cameras, or 60W devices at the edge without a separate injector.
• Uplinks: 10G replaces 1G. The 2X2G in the PID means two 10G SFP+ uplinks plus two 1G copper. Your edge stops being a 1G bottleneck the moment you upgrade the distribution layer or add a Wi-Fi 6/6E AP that can actually saturate a gig.
• Operating system: IOS-XE instead of classic IOS. That brings programmability (NETCONF/RESTCONF, YANG models, Python on-box), model-driven telemetry, patchable software, and a far longer security-patch tail.
• Hardware trust: the 9200CX includes Cisco Trustworthy Systems, secure boot, a Secure Unique Device Identifier (SUDI), and runtime image signing. For zero-trust postures, hardware root-of-trust is increasingly a requirement, not a nice-to-have. The 3560-CX cannot offer this.
• Segmentation: native support for policy-based segmentation (SGT/TrustSec-style microsegmentation) and modern macsec encryption at the edge.

The licensing change you must plan for

This is the single biggest operational difference. The 3560-CX used a perpetual, feature-set model, you bought IP Base or IP Services and that was the end of it. The Catalyst 9000 line uses Cisco Smart Licensing with tiered subscriptions: Network Essentials or, as specified by the -A suffix here, Network Advantage. Network Advantage unlocks the full Layer 3 routing, advanced segmentation, and assurance features. These tie into Smart Licensing Using Policy (SLUP) and, optionally, Cisco DNA/Catalyst Center for fleet management. Budget for it as an ongoing subscription line item, set up your Smart Account before hardware arrives, and decide up front whether you will manage on-box or through Catalyst Center.

A practical migration plan

1. Assessment and inventory

Pull the running config and a show version from every WS-C3560CX-8PC-S. Record uplink type (SFP vs copper), the actual PoE draw per port, VLANs, ACLs, and any Layer 3 features in use. Many edge 3560-CX units run trivial configs (a few access VLANs and PoE), those are quick wins. The handful running OSPF or static routing at the edge need closer parity review. Capture serial numbers now for both warranty disposition and secure decommission tracking.

2. License and software prep

Create or confirm your Cisco Smart Account and Virtual Account, then pre-stage Network Advantage entitlements so switches register on first boot. Standardize on a target IOS-XE train and validate it in a lab before mass deployment. If you are adopting Catalyst Center, build the site hierarchy and templates first so you provision by template rather than by hand.

3. Config and feature parity

Most IOS config translates conceptually to IOS-XE, but syntax differs in places (licensing, some QoS, telemetry). Do not blind-paste old configs. Rebuild from a vetted IOS-XE template, port your VLANs/ACLs/PoE policy, and confirm each legacy feature has a 1:1 equivalent. This is also the moment to retire technical debt, collapse unused VLANs, tighten ACLs, enable 802.1X/MAB if you have been meaning to.

4. Physical: rack, power, PoE, uplinks, optics

The 9200CX is fanless and shallow like the 3560-CX, so most mounts and enclosures carry over, verify depth and the specific bracket. Watch two things: optics and power. The 3560-CX used 1G SFPs; the 9200CX 10G uplinks need SFP+ optics, so plan new transceivers and confirm the upstream switch port supports 10G. On power, the higher 240W PoE budget may mean a different power input or higher circuit draw than the 124W unit it replaces, check before energizing a full closet of them.

5. Phased cutover

These are independent edge boxes, so cut over site by site or closet by closet, not all at once. Stage the replacement, pre-load config and license, then swap during a maintenance window. Keep the old unit on a shelf, not in the trash, until the replacement has run clean for a few days. Validate PoE devices come up, VLANs pass traffic, and uplinks negotiate at 10G before you call it done.

6. Secure decommission

Do not let a configured switch leave your custody intact. Erase the startup config and any stored credentials, certificates, and SSH keys (write erase plus delete of crypto material), then log the serial against your asset register. For DoD/federal property, follow your sanitization and disposal SOP and retain the disposition record for audit.

Procurement notes for government and enterprise

• TAA compliance: the Catalyst 9000 Compact line is available through TAA-compliant supply paths required for federal and DoD purchases. Confirm country-of-origin on the specific units before you order.
• GPC / no up-front payment: uniqcli accepts the Government Purchase Card and lets you submit a cart first, we confirm stock, lead time, and final total before you pay.
• Lead times: compact PoE switches move in volume and lead times fluctuate. With the 3560-CX out of production, do not assume a same-day swap is available. Quote and reserve units early, especially for multi-site refreshes.
• Authorized partner: source from an authorized Cisco partner so warranty, Smart Licensing entitlement, and TAC eligibility attach cleanly to your Smart Account from day one, gray-market units routinely fail license registration and support validation.

See the full lifecycle dates on the WS-C3560CX-8PC-S End-of-Life page, browse the rest of your fleet on the Cisco EoL hub, or view the Catalyst 9000 Compact family in our catalog. When you are ready to scope the refresh, get a TAA-compliant, GPC-payable replacement quote and we will map your 3560-CX inventory to the right 9200CX configuration.