WS-C3650-48PD-S End of Life: Migrate to Catalyst 9300L

If you still have Catalyst 3650 48-port PoE switches in your access layer, the clock is now measured in months, not years. The WS-C3650-48PD-S — the IP Base, 2x10G fixed-uplink member of the 3650 family — reaches its Last Day of Support (LDoS) on October 31, 2026. After that date there are no more software fixes, no TAC cases, and no hardware RMAs. This guide walks through what each milestone actually means, why the Catalyst 9300L (C9300L-48P-4X-A) is the right landing spot, and how to run a clean, low-risk migration for federal, healthcare, and enterprise environments.

Where the WS-C3650-48PD-S sits in its lifecycle

The 3650 was the fixed-uplink sibling of the modular 3850 — a workhorse 48-port PoE+ access switch built on Cisco's first-generation UADP ASIC and running IOS XE. The 48PD-S variant ships with 48 10/100/1000 PoE+ ports, a 2x10G SFP+ uplink module, a 640W PoE power budget, and the IP Base feature set (full Layer 3 routing requires the IP Services upgrade). Three dates define its decline:

• End of Sale: October 31, 2021 — Cisco stopped selling the SKU. Any unit bought after this date came from channel inventory or the secondary market.
• End of Software Maintenance: October 31, 2022 — the last date Cisco released maintenance and bug-fix IOS XE releases. Since then only critical security fixes trickled out, and even those now stop at LDoS.
• Last Day of Support (LDoS): October 31, 2026 — the hard cutoff. No PSIRT patches, no TAC, no RMA, no contract renewals. The hardware still forwards packets, but it is unsupported in every sense that matters to an auditor.

The recommended replacement: Catalyst 9300L (C9300L-48P-4X-A)

Cisco's migration path is the Catalyst 9300L, and the C9300L-48P-4X-A is the direct one-for-one for the 48PD-S: 48 ports of PoE+, but with four 10G SFP+ fixed uplinks instead of two, and a Network Advantage license. The 9300L is the fixed-config, value-tier line within the 9300 family — purpose-built as the affordable refresh target for 3650/3850 access switches while staying on the same Catalyst 9000 software train.

What you actually gain

• Uplink capacity doubles: 4x10G SFP+ (40G of fabric uplink) versus the 3650's 2x10G — meaningful headroom for high-density Wi-Fi 6/6E APs and IP camera fleets aggregating back to distribution.
• Modern silicon: the 9300L runs Cisco's UADP 2.0-class ASIC and an x86 control-plane CPU, replacing the 3650's first-gen UADP. This unlocks line-rate Encrypted Traffic Analytics (ETA), flexible NetFlow, and on-box application hosting (containers) that the 3650 cannot do.
• StackWise-320 stacking — the 9300L stacks at 320 Gbps versus StackWise-160 on the 3650, with the same one-cable data-stack model. Note: 9300L cannot stack with legacy 3650/3850 units, so stacks are migrated as whole groups.
• Programmability and assurance: model-driven telemetry, NETCONF/YANG, and native onboarding into Cisco Catalyst Center (formerly DNA Center) for automated provisioning, SD-Access fabric, and AI-driven assurance — none of which the 3650 supports natively.
• Security baseline: secure boot, runtime defense, and a Trust Anchor module providing hardware-anchored integrity that the 3650 generation lacks.

The licensing change you must plan for

This is the single biggest operational difference. The 3650 used perpetual right-to-use feature sets (IP Base / IP Services) baked into the image. The 9300L moves to Cisco Smart Licensing with subscription DNA tiers. The '-A' in C9300L-48P-4X-A denotes Network Advantage, the higher of the two tiers (Network Essentials is the entry tier). Each switch carries a perpetual Network-tier base license plus a term-based Cisco DNA subscription (typically 3, 5, or 7 years) that funds Catalyst Center features and embedded software support. Budget for the subscription renewal up front, register devices to a Smart Account, and decide between a connected Smart Software Manager (CSSM) model or an on-prem Smart Software Manager for air-gapped or classified networks.

A practical migration plan

1. Assess and inventory

Pull a current inventory: serial numbers, IOS XE versions, stack memberships, uplink optics, and per-switch PoE load. Capture running-configs from every 3650. Map which closets host stacks versus standalone units, and confirm SmartNet/contract status — many 3650s are already off-contract, which is itself the trigger to move. Cross-check each unit against its EoL record on the WS-C3650-48PD-S end-of-life page and the broader Cisco EoL hub so the dates land in your risk register.

2. License transition

Create or confirm a Cisco Smart Account and Virtual Account, decide on Network Advantage versus Essentials per closet, and size DNA subscription terms to your refresh cycle. For disconnected enclaves, stand up an on-prem Smart Software Manager before the switches arrive so devices can register without internet egress.

3. Config and feature parity

Most 3650 access configs port cleanly to 9300L IOS XE, but audit for parity: VLANs, voice VLAN, 802.1X/MAB and dot1x, QoS policy maps, ACLs, and STP roles. The 9300L is Layer 3-capable in both license tiers, so IP Base-only 3650s gain routing headroom. Convert any deprecated CLI, and stage the target config in a lab or on one pilot switch before broad rollout.

4. Physical: rack, power, uplinks, optics, stacking

• Both are 1RU — rack footprint is unchanged.
• Reuse 10G SFP+ optics where compatible, but validate against the 9300L optics matrix; the extra two uplinks may need additional transceivers and fiber.
• Stack cables differ between generations — order 9300-series StackWise cables; do not expect 3650 stack cables to carry over.
• Verify power: dual power supplies for closet-critical stacks, and confirm PoE budget against measured load (see callout above).

5. Phased cutover

Migrate one closet or stack at a time during a maintenance window. Pre-stage the 9300L with the validated config and license, label uplinks, then move uplinks and access patches in a controlled swing. Keep the old 3650 racked and powered-off but reversible for the first 24–48 hours as a rollback. Validate PoE, 802.1X auth, voice, and uplink reachability before declaring the closet done.

6. Secure decommission

For government and regulated environments, wipe configs (including the certificate/Trust store and any saved credentials), zeroize, and follow your media-sanitization policy before the 3650s leave the building. Document chain of custody for asset disposal; do not resell PoE switches that held production VLAN and auth configuration without a verified wipe.

Procurement notes for government and enterprise buyers

• TAA compliance: confirm country of origin on every unit and optic for federal/DoD orders — request TAA documentation with the quote.
• Lead times: Catalyst 9300L demand spikes ahead of LDoS deadlines. Order early; DNA subscription provisioning and Smart Account setup add time even when hardware is in stock.
• GPC and purchasing paths: Government Purchase Card (GPC), Simplified Acquisition, and FAR-based purchase orders are supported directly; if your office buys through a GWAC/IDIQ vehicle, we prepare the BOM and compliance packet your holder quotes from.
• Source from an authorized Cisco partner so units arrive with valid warranty, registerable licenses, and clean serial-number provenance — gray-market 9300L gear frequently cannot register Smart Licenses.

Ready to scope the swap? Browse the Catalyst 9300L and access-switch lineup or get a refresh quote with TAA documentation, license sizing, and lead-time confirmation built in — so your 3650s are retired well before the October 2026 support cliff.