DEV Community: IT And Office

How to size a rack PDU and UPS for your home lab

IT And Office — Mon, 05 Oct 2026 19:56:08 +0000

Most home lab builds get the compute right and the power wrong. You buy a nice used server, rack it, plug it into a random power strip, and only find out it's a problem when the breaker trips at 2am during a firmware update or your UPS dies six months in because it was never sized for the load. Sizing power correctly is boring, but it's the difference between a lab that runs for years and one that eats itself.

This post walks through how to size a rack PDU and a UPS for a realistic home lab, with the math you actually need and the mistakes that bite people.

Step 1: Know your real power draw, not the nameplate number

Every server, switch, and NAS has a nameplate rating (often on a sticker on the back) that lists the maximum draw of the power supply, not what the device actually pulls under normal load. A Dell R630 with dual 750W PSUs doesn't draw 1500W ‚Äî it might draw 120-180W idle and 250-350W under load, depending on CPUs and drive count.

To size correctly:

Use manufacturer power calculators when available. Dell, HPE, and Cisco all publish sizing tools for their gear (Dell's is particularly good and lets you configure the exact CPU/RAM/drive combo).
If you can't find a calculator, measure it. A cheap inline power meter (Kill-A-Watt or similar) on an existing device of the same family gives you real numbers fast.
When in doubt, budget for idle + 40% as a safe working estimate for a lab that isn't running sustained heavy compute.

Rough real-world numbers for common used gear, per unit, under typical lab load:

Device	Typical draw
1U server (dual CPU, few drives)	90-180W
2U server (dual CPU, 8-12 drives)	150-300W
24-48 port managed switch (non-PoE)	15-40W
24-48 port PoE+ switch (budget for PoE separately)	30-60W + PoE budget
Small NAS (4-8 bay)	40-90W
Firewall appliance (desktop form factor)	15-40W

Add these up for everything you plan to run simultaneously, not everything you own.

Step 2: Sizing the PDU

A rack PDU's job is to distribute power safely, not to protect against outages ‚Äî that's the UPS's job. Two things matter: circuit capacity and outlet count.

Circuit capacity. In North America, a standard 120V/15A circuit gives you 1800W theoretical, but you should never plan past 80% continuous load ‚Äî so 1440W usable. A 120V/20A circuit gives 2400W theoretical, ~1920W usable. In the EU/UK on 230V, a standard 13A/16A circuit gives you far more headroom (roughly 3000-3600W theoretical), which is one reason higher-density labs are easier to power outside North America.

If your total measured draw from Step 1 is getting close to 80% of your circuit's rating, stop adding gear to that circuit ‚Äî get a second circuit or a PDU that supports higher amperage, don't just add another power strip on the same wall outlet.

Outlet count and form factor. For a home lab rack, a basic 8-12 outlet vertical or horizontal PDU is usually enough. Metered PDUs (ones that show you live wattage/amperage on a small display) are worth the extra cost ‚Äî they turn "guessing" into "checking," and they'll catch a slowly creeping load before it trips a breaker. Switched/managed PDUs (remote outlet on/off) are a nice-to-have for remote power-cycling gear, but not essential for a first build.

Step 3: Sizing the UPS

This is where most people get it wrong ‚Äî either buying a UPS way too small (it dies on battery in 90 seconds under real load) or wildly oversized for the budget (paying for capacity you don't need).

The math:

Total your real wattage draw from Step 1 (all devices you want protected).
Add 20-25% headroom ‚Äî UPS efficiency drops and battery life shortens near max rated load, so running a UPS at 90%+ capacity constantly will shorten its lifespan.
Convert to VA if the UPS is rated in VA (common). Most lab-grade loads have a power factor around 0.9, so VA ‚âà Watts / 0.9.

Example: a small lab with one 2U server (250W), one switch (30W), one small NAS (60W), and a firewall (25W) totals 365W real draw. Add 25% headroom: ~456W needed. Divide by 0.9 power factor: ~507VA minimum. In practice, that means you'd want at least a 700-1000VA / 600-900W UPS to have comfortable runtime, not just "won't-immediately-shut-down" capacity.

Runtime matters more than capacity for most labs. A UPS sized to handle your load at 100% for 2 minutes is only useful if your goal is a clean shutdown ‚Äî which for a home lab is usually exactly the goal (not riding out a multi-hour outage). Check the manufacturer's runtime chart at your wattage, not the "max load" number on the box, since runtime drops fast as load approaches capacity.

Don't forget network gear on the UPS. A server that shuts down cleanly is useless if your switch and router lose power at the same time and you can't reach it remotely to diagnose. Put your core switch, router/firewall, and any out-of-band management (IPMI/iDRAC network path) on the UPS even if the bulk compute isn't.

A quick sizing checklist

[ ] Measured or calculator-based real wattage for every device, not nameplate max
[ ] Total load stays under 80% of the PDU circuit's rated capacity
[ ] UPS sized at total load + 20-25% headroom, converted to VA if needed
[ ] Runtime checked at your actual wattage, not the UPS's max-load spec
[ ] Network/management gear included on the UPS, not just compute
[ ] Automatic shutdown agent (NUT, apcupsd, or vendor tool) configured so hosts actually shut down cleanly instead of just riding the battery to zero

If you'd rather skip the spreadsheet, a PDU/UPS sizing calculator like the one IT and Office has can get you a ballpark fast ‚Äî plug in your gear list and it estimates the load for you, which is a decent sanity check even if you're buying hardware elsewhere.

What's your lab's actual power draw, and did you get it right on the first try or learn the hard way like most of us? Curious what UPS runtime people are actually getting at real load.

PoE explained: power APs, cameras & phones from your switch

IT And Office — Sun, 27 Sep 2026 08:30:22 +0000

Power over Ethernet (PoE) lets a single Cat5e/Cat6 cable carry both data and DC power to a device — no separate power brick, no outlet needed near the ceiling where your AP or camera lives. It sounds simple until you're standing on a ladder with a PoE camera that won't boot, or you've bought a "PoE switch" that can't actually power what you plugged into it. Here's what actually matters.

The three PoE standards

There are three IEEE standards in the wild, and mixing them up is the #1 cause of "why won't this device power on" tickets:

802.3af (PoE) — up to 15.4W delivered at the switch port, ~12.95W usable at the device after cable loss. Fine for basic APs, IP phones, small cameras.
802.3at (PoE+) — up to 30W delivered, ~25.5W usable. Covers most modern Wi-Fi 6 APs, PTZ cameras, and higher-power devices.
802.3bt (PoE++ / UPOE) — split into Type 3 (up to 60W) and Type 4 (up to 100W). Needed for things like large digital signage, some AI-capable cameras, or powering thin clients over Ethernet.

A PoE+ switch will happily power an 802.3af device — the standards are backward compatible — but not the other way around. If a device negotiates PoE+ and your switch only offers PoE, it'll either refuse to power up or run in a degraded/reboot-loop state. Always check the device's power class, not just what the switch box says.

Power budget: the number that actually matters

Every PoE switch has a total PoE power budget (e.g., "370W PoE budget" on a 48-port switch), separate from the per-port maximum. This is where people get burned buying used gear:

A switch can have 48 ports each capable of 802.3at (30W), but a shared budget of only 370W. That's enough for roughly 12 ports running at full PoE+ power — not 48.
Budget is allocated dynamically on most switches (LLDP power negotiation), but some older or cheaper units allocate the maximum class per port statically, which exhausts the budget much faster with fewer devices.
Always add up your real device draw (APs are usually 9-22W depending on model/radios, PTZ cameras can hit 25-30W, basic IP phones are 3-7W) and compare against the switch's rated PoE budget, not port count.

When buying a used enterprise switch specifically for PoE, look up the exact model's PoE budget in the datasheet — sellers rarely list it, and it varies wildly even within the same product line (e.g., a Catalyst 2960X-48FPD-L has a much bigger budget than a 2960X-48LPS-L).

Injectors vs. PoE switches

If you only need to power one or two devices and your existing switch isn't PoE-capable, a PoE injector is the cheaper fix — it sits inline on the cable run and injects power without touching your existing switch. Good for a single AP or camera drop.

Once you're past 3-4 PoE devices, a proper PoE switch is worth it: centralized power budget management, port-level PoE status/power draw visibility via CLI or SNMP, and the ability to remotely power-cycle a hung device (power inline never / power inline auto on Cisco, or the equivalent toggle on the web UI) instead of walking over to unplug it.

Cable length and power loss

PoE power loss over cable is real but often overstated for home lab distances. At 100m (the Ethernet spec limit) you'll lose roughly 10-20% of injected power to resistance, more with cheap/thin-gauge cable. Practically:

Under 30m: negligible loss, don't worry about it.
Near the 100m limit with a high-power PoE+ device: budget for it, or use Cat6/Cat6a instead of Cat5e — the thicker copper loses less.
Never run PoE over damaged, kinked, or bundled-tight cable runs — the extra heat from resistive loss in a bad cable is a (minor but real) fire risk, and it's the first thing to check when a far-end device is flaky.

Common gotchas when buying used PoE gear

Passive PoE vs. standards-based PoE are not the same thing. Passive PoE (common on cheap Ubiquiti-style gear) just applies constant voltage with no negotiation — plugging a passive PoE injector into an 802.3af/at device without checking pinout and voltage compatibility can fry it. Don't mix passive PoE gear with standards-based 802.3af/at/bt equipment unless you've confirmed voltage and pinout match.
Test PoE ports before relying on them. A switch that powers up fine can still have individual ports with dead PoE controllers — this is one of the most common "half-working" faults in secondhand gear. Plug a known-good PoE device into every port you plan to use before deploying.
Check for PoE watchdog / auto-recovery features. Useful for remote APs — the switch detects a non-responsive PoE device and power-cycles the port automatically, saving you a truck roll.

If you're speccing out a PoE deployment for APs, cameras, or phones and want to buy switches with known-good, tested PoE budgets rather than gambling on untested auction listings, resellers like IT and Office list tested access points and PoE-capable networking gear with the specs already verified.

What's the largest PoE power budget you've had to plan around, and did you hit any surprises calculating it?

Build a budget Proxmox host with a used enterprise server

IT And Office — Tue, 22 Sep 2026 14:30:13 +0000

Running Proxmox VE on a $150 mini PC is fine until you actually want to do something with it — a few VMs, a couple of containers, maybe a Windows box for testing, ZFS with real redundancy. That's when a decommissioned enterprise server starts looking a lot more attractive than another NUC.

Here's how to pick one without ending up with a jet-engine paperweight.

Why an enterprise server instead of consumer hardware

Enterprise rack servers (Dell PowerEdge, HPE ProLiant, Lenovo ThinkSystem) were built for 24/7 operation, have ECC memory as standard, redundant power supplies, and — critically for a Proxmox host — proper IPMI/iDRAC/iLO out-of-band management. You can power-cycle, reinstall, and monitor the box without ever touching a keyboard connected to it.

The tradeoffs: noise, power draw, and rack space. If you're putting this in a bedroom, plan for that upfront (more on cooling below).

What to actually look for

CPU generation. Don't go below a 2nd-gen Xeon Scalable (Cascade Lake, e.g. Xeon Silver 4210) or, for the older PowerEdge 13G line, Broadwell-era E5-2600 v4. Older Haswell/Ivy Bridge (E5-2600 v3 and earlier) parts are cheap but burn far more watts per core than what you'd get today — bad if you're paying residential electricity rates 24/7.

RAM. Buy DDR4 ECC RDIMM, and buy more than you think you need — RAM is the first thing Proxmox exhausts once you start running more than 3-4 VMs plus ZFS ARC. 128GB is a comfortable homelab target and is usually affordable on the used market for these platforms.

Drive bays and controller. Check whether the server ships with a RAID controller (PERC H730/H330 on Dell, Smart Array P440ar on HPE) or a plain HBA. For Proxmox + ZFS, you want an HBA in IT mode, not a hardware RAID controller — if the listing only mentions a PERC/Smart Array, budget for crossflashing it or swapping it for an HBA330/H330 in IT mode.

Network. Onboard 4x1GbE is standard and fine to start. If you plan to do SR-IOV passthrough or fast storage replication between nodes, check whether the server has a free PCIe slot for a 10GbE card later.

iDRAC/iLO license level. Basic remote management is free; virtual media (mounting an ISO remotely to install Proxmox without a USB stick) usually requires the Enterprise/Advanced license. Confirm it's included, since a bare "Basic" license makes the first install noticeably more annoying.

Models that show up often on the used market

Dell PowerEdge R630 (1U) — dual E5-2600 v3/v4, up to 24 DIMM slots, compact. Good if rack space is tight. Fewer 3.5" bay options.
Dell PowerEdge R730 / R730xd (2U) — same CPU generation as the R630 but with far more drive bays (up to 16x 2.5" or 12x 3.5" on the xd), making it the better pick if you want a real ZFS pool with several drives.
HPE ProLiant DL360 Gen9 / Gen10 — similar profile to the R630/R730 line, iLO instead of iDRAC. Gen10 supports Scalable Xeons.
Lenovo ThinkSystem SR630 — less common used but shows up, similar generation.

For a first Proxmox node, an R730xd with dual Xeon Silver/Gold, 128GB RAM, and an HBA330 in IT mode is a very common and well-documented sweet spot.

Power and noise — the part people underestimate

A 2U dual-CPU server idles significantly higher than a desktop — expect 120-180W at idle depending on drive count and CPU TDP, more under load. That's a real line item if it runs 24/7. Rack fans on 1U chassis in particular are loud at boot and under load; a 2U chassis is noticeably quieter. If it's going in a closet or garage, that's usually fine. If it's next to your desk, budget for either a 2U unit or planning fan curve/BIOS tweaks (which vary a lot by vendor and aren't always accessible without the enterprise license tier).

Proxmox-specific setup notes

Update the BMC firmware (iDRAC/iLO) and the BIOS/system firmware before installing Proxmox — old firmware is a common source of weird PCIe passthrough and NIC issues.
Enable IOMMU in BIOS if you want to pass through a GPU or HBA to a VM.
If you crossflash a PERC to IT mode, do it before installing Proxmox on top of it — reflashing after the pool is created will make ZFS see a different controller and can complicate imports.
Set up email or Discord/webhook alerts in Proxmox for drive and node health early. Used drives are used drives.

Buying tips

Sellers will usually list CPU model, RAM amount, and drive bay count, but often skip whether it includes rail kits, the RAID controller model, or the iDRAC/iLO license tier — ask before buying if it's not in the listing, since those three things are exactly what determine whether the box is ready to rack-and-go or needs extra parts. Tested/burned-in units cost a bit more than pure auction pulls but save you the risk of a DOA PSU or a server that throws memory errors the first week — for something running unattended, that premium is usually worth it. If you'd rather skip auction-sourced gear entirely and buy something already tested and reset, resellers like IT and Office list refurbished rack servers with the specs already listed per unit.

What's everyone else running as their main Proxmox node — still on Broadwell/v4 Xeons, or have you moved to Scalable/Epyc used gear yet?

How to choose a used FortiGate firewall (without getting burned)

IT And Office — Mon, 21 Sep 2026 00:18:31 +0000

Used enterprise firewalls are one of the best deals in homelab and small-office hardware. A FortiGate 100F that retailed for €4,000 can be had for €400–600 on the secondary market. But unlike a used switch or server, a firewall has pitfalls specific to the platform that can turn a bargain into a headache. This guide focuses on FortiGate because Fortinet dominates the SMB/branch market — which means the widest used supply — but most principles transfer to other NGFW vendors.

Why FortiGate specifically

FortiGate runs FortiOS, a mature, well-documented OS with a strong CLI, solid VPN (IPsec + SSL), IPS, web filtering, SD-WAN, and ZTNA features. Even old models (6.0-era hardware) run a recent enough FortiOS to be genuinely useful. The management UI is clean, the CLI is learnable, and there's a large community behind it.

The catch: Fortinet's subscription model means some features (IPS signatures, web filter categories, AV databases) are tied to a license. Hardware without an active license still works great as a stateful firewall and VPN concentrator — the signatures just stop updating. For homelab and many SMB use cases, that's acceptable.

What to check before buying

1. Hardware generation and throughput

FortiGate model numbers encode rough throughput:

FortiGate 40F / 60F: ~1 Gbps firewall throughput — fine for fiber ≤1 Gbps and a small team
FortiGate 80E / 100E / 100F: 2–10 Gbps — suitable for mid-size offices, remote-access VPN hubs, or a demanding homelab VLAN setup
FortiGate 200E / 300E / 400F: 20–40 Gbps — branch aggregation or small datacenter edge

The "E" suffix = 6.x-era hardware (NP6/SP3 ASICs). The "F" suffix = 7.x-era (NP7/SOC4). Both are fully supported as of FortiOS 7.4.

Also check the number of physical interfaces. Some models have SFP+ ports that are useful for direct fiber uplinks or inter-zone 10G links; verify they match your cabling.

2. License status

Run or ask the seller to run:

get system status

Look for License Status: Valid or Expired. An expired license means:

Stateful firewall ✅
IPsec/SSL VPN ✅
VLAN, routing, NAT ✅
IPS signatures ❌ (frozen at expiry date)
Web filter categories ❌
FortiGuard DNS filtering ❌

For a homelab or budget office, unlicensed is often fine. For a production environment that needs up-to-date threat intelligence, budget for a license renewal or buy a unit that still has active FortiCare.

3. FortiOS version and upgrade path

Fortinet's firmware lifecycle is strict:

Check Fortinet's product lifecycle page for EoS dates
FortiGate 80E and older are approaching or past EoS — fine for air-gapped or homelab, a risk for internet-facing production
From the CLI: get system status shows the current version

The good news: FortiOS upgrades between major versions (e.g. 6.4 → 7.0 → 7.2) are straightforward via the GUI, and Fortinet publishes upgrade path tools to avoid skipping versions.

4. Factory reset status

Always ask: "Has this been factory-reset?" A unit that still has a previous org's config is usable but requires extra care:

Previous VPN credentials could be cached
Custom certificates may still be present
If you get a unit without the admin password, you CAN reset it via the console port and a BIOS interrupt — but you need a RJ45-to-DB9 console cable or a USB console adapter

The console reset procedure is documented in Fortinet's knowledge base and takes about 5 minutes. It's not a dealbreaker, but confirm before buying whether the seller has done it.

5. PSU and accessories

Mid-range FortiGates (200E+) use redundant PSUs in some configurations. Check:

Is both/the PSU included?
Any rack ears?
Console cable? (3rd-party USB console cables work fine — CP210x chip)

Which model for which use case?

Use case	Recommended models
Home fiber ≤1 Gbps + VPN	FortiGate 40F, 60F, 60E
Small office (≤50 users)	FortiGate 80E, 100E, 100F
VPN concentrator (branch hub)	FortiGate 100F, 200E
Lab firewall / VLAN isolation	Any 60E/80E — cheap, plenty of ports
Multi-tenant / advanced routing	FortiGate 300E, 400F

For pure homelab VLAN segmentation without active IPS, a FortiGate 60E running FortiOS 7.2 is the sweet spot: cheap, well-documented, 5 physical interfaces, capable CLI.

Configuration tips after buying

Factory reset first: execute factoryreset in the CLI, even if the seller says it's clean.
Update firmware before touching production traffic. Download directly from support.fortinet.com (free, needs a (free) account).
Disable FortiGuard reachability checks if you're running unlicensed — the unit will log repeated license check failures otherwise. Under System > FortiGuard, disable services you're not using.
Use policy-based NAT + security zones from day one — trying to retrofit zones later is painful.
Enable logging to memory or a syslog server (e.g. Graylog, Loki). Local disk logging on small FortiGates is limited and fills fast.

Where to find tested units

Auctions (eBay, Marktplaats) are hit-or-miss: units sometimes arrive still linked to a previous MSP's FortiManager, or with burned PSUs. Specialist resellers that test, reset, and warrant used enterprise gear are worth the small price premium — if you're in Europe and want reset, tested FortiGates with a warranty, IT and Office maintains a rotating stock of used firewalls from major brands.

What's your homelab firewall setup?

Running FortiGate, pfSense, OPNsense, or something else? Any surprising finds from the used market — good or bad? Drop a comment below.

What is an HSM — and why a used one is a smart buy

IT And Office — Fri, 11 Sep 2026 19:28:03 +0000

Hardware Security Modules sit at the very bottom of your key management stack — and yet most developers encounter them only when something has already gone wrong. This post explains what an HSM actually does, how to reason about buying a used one, and what to check before you power it up.

What an HSM actually does

An HSM is a tamper-resistant piece of hardware whose sole job is to generate, store, and use cryptographic keys without ever exposing those keys to the host system. Operations (sign, decrypt, derive) happen inside the module; the key material never crosses the PCIe or network boundary in plaintext.

Concrete use cases:

PKI roots and intermediate CAs — your CA private key lives in the HSM; even if the server is compromised, the key cannot be extracted.
Code signing — sign binaries or firmware in CI without writing the key to disk.
TLS offload — some HSMs act as a cryptographic accelerator; the private key for your cert stays inside.
Database encryption key wrapping — the HSM holds the Key Encryption Key (KEK); column-level encryption keys are wrapped by it.
FIDO2 / PKCS#11 back-end — enterprise identity systems (ADCS, Vault, EJBCA) can use an HSM as their PKCS#11 provider.

Network HSM vs PCIe HSM vs USB token

Form factor	Typical use	Example models
Network (appliance)	Shared across multiple hosts, DC rack	Thales Luna Network, Bull Atos Trustway Proteccio
PCIe card	Single server, low-latency	Thales Luna PCIe, Utimaco Se-Series
USB token	Developer workstation, small-scale signing	Yubico YubiHSM 2, Nitrokey HSM

For homelab and small-business PKI, a network appliance is the most flexible: any host with network access can reach it, and you can cluster two units for HA without extra licensing drama.

Why used HSMs make sense

New network HSMs from Thales or Atos cost €15 000–€50 000+. That pricing reflects enterprise support contracts and FIPS 140-2 Level 3 (or 4) certification, not necessarily the hardware cost.

A used unit from a decommissioned bank or telco:

Same tamper-resistance — the physical security of the module doesn't degrade with age.
Same FIPS certification — the certification is tied to the hardware model and firmware version, not the ownership chain.
Factory-resettable — a proper zeroization wipes all key material and returns the unit to factory state. You can verify this yourself.
Firmware upgradeable — most units support firmware updates; check the vendor's support matrix.

The main risk is buying a unit that has not been properly zeroized or one where the tamper-evident seals have been broken. More on that below.

What to check before buying a used HSM

1. Confirm the model and firmware support matrix

Get the exact model string (e.g., Bull Atos Trustway Proteccio PCA4H) and cross-reference with the vendor's firmware support page. You want to know:

Which firmware versions are still supported.
Whether the unit is still eligible for security patches.
Whether FIPS re-validation is required after a firmware update (usually no for minor updates).

2. Request proof of zeroization

A properly decommissioned HSM should come with a zeroization certificate or at minimum a factory-reset confirmation from the previous owner's security team. If the seller can't provide this, budget for doing it yourself — most units have a documented factory-reset procedure that requires physical access to the unit (a deliberate tamper-detection feature).

After reset, you should see the unit boot into an uninitialized state: no partitions, no policies, no keys. The admin console will ask you to go through the initial setup wizard.

3. Inspect the tamper-evident seals

Network HSMs ship with tamper-evident labels on screws and chassis seams. Broken or missing seals don't necessarily mean the unit is compromised (they degrade with age and heat), but they're a red flag worth discussing with the seller. Some enterprise buyers document seal status at decommission — ask for photos.

4. Check the battery

HSMs use a battery to power the SRAM that holds key material even when the unit is unplugged. A dead battery on an active unit triggers tamper response and wipes keys — which is the correct behavior. On a factory-reset unit it's less critical, but you'll want to replace it before production use. Battery replacement ## Integration patterns worth knowing

HashiCorp Vault + PKCS#11 seal: Vault can use an HSM to auto-unseal and wrap its master key — a significant security upgrade over Shamir's secret sharing for production.
EJBCA + PKCS#11: open-source PKI that works natively with most network HSMs.
OpenSSL engine: many HSMs ship an OpenSSL engine so existing TLS stacks can offload private-key operations without code changes.
AWS CloudHSM / Azure Dedicated HSM: if you want cloud-native, these are FIPS 140-2 Level 3 options — but at roughly $1.50–$2/hour, a physical used unit pays itself off in under a year for sustained workloads.

Where to source used HSMs

Enterprise liquidators, secondary-market IT brokers, and specialist refurbishers are your best options. Avoid random eBay listings where provenance is unclear. If you want a unit that's been tested, reset, and verified operational before shipping — rather than gambling on an untested lot — European IT hardware resellers like IT and Office stock specific models (e.g., the Bull Atos Trustway Proteccio PCA4H) with documented testing.

Quick checklist before you power up a used HSM

[ ] Model confirmed, firmware support checked
[ ] Zeroization certificate obtained or factory reset verified
[ ] Tamper-evident seals inspected and photographed
[ ] Battery status checked, replacement scheduled if needed
[ ] Admin credentials / SO cards situation clarified
[ ] PKCS#11 client library version matches HSM firmware
[ ] Network access tested (appliance responds on management port)

Have you deployed a used HSM in production or homelab? What was the trickiest part of the initial setup — zeroization, PKCS#11 integration, or something else entirely? procedures are documented in most service manuals; factor in the cost.

5. Verify the authentication scheme

Modern network HSMs use either:

Smart cards + PINs (n-of-m quorum): you need the correct number of SO (Security Officer) cards to administer the unit. If the previous owner didn't hand over the cards, you'll need to factory-reset.
Password-based auth: simpler, common on older firmware.

Make sure you know which scheme is active and that you'll have everything needed to initialize the unit under your own credentials.

6. Test PKCS#11 connectivity

Before going further, validate the PKCS#11 interface:


bash
# Example with the vendor's client library installed
pkcs11-tool --module /usr/lib/libCryptoki2_64.so --list-slots

Used Cisco Catalyst switches: 2960X vs 3750X vs 3850

IT And Office — Fri, 03 Jul 2026 14:23:36 +0000

If you're building a lab or scaling a small office network, Cisco Catalyst switches dominate the second-hand enterprise market. They're robust, well-documented, and cheap compared to their original price — but the three most common series you'll encounter (2960X, 3750X, 3850) are very different beasts. Picking the wrong one wastes money; picking the right one can anchor your network for a decade.

Here's a practical breakdown.

The quick answer

Feature	2960X	3750X	3850
Layer	L2 (limited L3)	Full L3	Full L3
Stacking	FlexStack	StackWise-480	StackWise-480
PoE	Yes (PoE+ models)	Yes (PoE+ models)	Yes (PoE+ models)
Uplink	SFP / SFP+	SFP+	SFP+
IOS-XE	No	No	Yes
End of SW maintenance	2025	2023	2028

Cisco Catalyst 2960X — the access-layer workhorse

The WS-C2960X-48FPS-L (48 PoE+ ports, 740 W) and WS-C2960X-24PS-L are the most common units you'll find on the market for €100–250. These are pure access-layer switches: great for connecting workstations, APs, and IP cameras to an uplink.

What you get

Solid Layer 2 feature set: VLANs, STP, LACP, IGMP snooping, 802.1X
LAN Base or LAN Lite IOS (LAN Base is what you want — it supports more ACLs and SPAN)
FlexStack for up to 8-unit stacking via a dedicated cable (costs extra, check if included)
No full routing — the 2960X does static routes in hardware but no dynamic routing protocols (OSPF, EIGRP, BGP) without an IP Services license upgrade, which is expensive used

When to choose it

Pure access layer (users, APs, cameras connect here, routing handled upstream)
Budget is tight
You don't need inter-VLAN routing on the switch itself

What to check before buying

IOS version — verify the image: show version. LAN Base vs LAN Lite is burned into the license, not the hardware. Ask the seller for a screenshot or check the PID (product ID sticker on the back; LPS = LAN Lite, L = LAN Base).
Fan noise — 2960X fans can be loud under load. Check the fan model; some community-sourced Noctua swaps exist for lab use.
FlexStack modules — if you want to stack, the C2960X-STACK module must be present (one per switch). Often missing from pulled units.
PoE budget — the -FPS suffix means 740 W PoE budget; -PS is 370 W. Calculate your AP + camera load first.

Cisco Catalyst 3750X — the full L3 workhorse (aging but solid)

The WS-C3750X-48P-S or WS-C3750X-24P-S run €150–350 used. End of Software Maintenance was 2023, meaning no new IOS releases — but existing IOS 15.2(4) images are stable and widely deployed.

What you get

Full Layer 3: OSPF, EIGRP, BGP, PBR, MPLS (with IP Base or IP Services license)
StackWise-480: up to 9 units with 480 Gbps stacking bandwidth, shared control plane
Modular uplink: the rear slot accepts C3KX-NM-1G (4× SFP) or C3KX-NM-10G (2× SFP+) modules — check whether the module is included, it's often missing and costs €30–80 extra
Hardware-assisted ACLs, QoS, and NetFlow

When to choose it

You need routing at the distribution/core layer
You want to stack switches with a true backplane (not cascaded uplinks)
Budget allows a bit more than a 2960X

What to check before buying

Network module — the rear uplink slot is empty by default. Decide early: C3KX-NM-10G for 10G uplinks (most labs want this), C3KX-NM-1G for 1G SFP.
License tier — show license in IOS. IP Base supports EIGRP/OSPF. IP Services adds BGP, MPLS, advanced QoS. Licenses are node-locked (tied to the unit's serial), so verify the license matches the advertised feature set.
Software support — no new IOS since 2023. For a lab or stable office this is fine; for a PCI or HIPAA environment, check with your auditor.
Power supply — the 3750X has a removable PSU at the back. 1100WAC or 715WAC. Confirm it's present; some stripped units are sold PSU-less.

Cisco Catalyst 3850 — the modern distribution switch

The WS-C3850-48P-S or WS-C3850-24P-S are the premium used option at €300–600. They run IOS-XE (not classic IOS), software maintenance extends to 2028, and they support full Wireless LAN Controller functionality natively — meaning you can terminate Cisco CAPWAP APs directly on the switch without a separate WLC.

What you get

Full L3 on IOS-XE: cleaner CLI, modular architecture, more consistent with modern Catalyst 9K behavior
StackWise-480 (same as 3750X, up to 9 units)
Integrated Wireless LAN Controller (with IP Services license): manage Cisco APs without a dedicated WLC — huge for SMBs
40 Gbps uplink module slot (QSFP+ with the right module)
Software support through 2028 (unlike the 3750X)

When to choose it

You need wireless controller functionality baked in
You want IOS-XE experience (closer to current Catalyst 9K)
Longer software support matters (audit requirements, regulated environments)
You run a mixed-mode network with Cisco APs already on-site

What to check before buying

IOS-XE version — target 16.x. Versions before 16.3 have known memory leak bugs in stacking. show version output should confirm.
License — IP Base vs IP Services (same logic as 3750X). WLC functionality requires IP Services. Check via show license right-to-use.
Network module — same situation as 3750X: the rear uplink slot may be empty. C3850-NM-2-10G gives 2× SFP+, C3850-NM-4-1G gives 4× GE SFP.
USB Bluetooth module — some units have a USB Bluetooth dongle for Mobility Services. If you're not using Cisco CMX, remove it to reduce attack surface.

Feature comparison in plain terms

For pure access layer + tight budget → 2960X-48FPS-L.
For routing + stacking + a few hundred euros more → 3750X-48P-S with a 10G module.
For IOS-XE, wireless controller, and longer support runway → 3850-48P-S.

All three support VLANs, 802.1X, PoE+, LACP, and SPAN — the feature you're giving up as you go down the stack is full Layer 3 routing and software longevity.

Where to find tested units

Auction sites (eBay, LeBonCoin) carry these in volume, but you're often buying blind: no IOS verification, PSU missing, or fans at end-of-life. For a production or semi-production setup, tested and reset units from a specialist reseller reduce the risk considerably. If you prefer not to gamble on auction lots, specialty resellers like IT and Office typically provide functional testing, reset to factory defaults, and accurate model/license information before shipping.

Common mistakes to avoid

Buying a 2960S instead of a 2960X — the older S series has only 10/100/1000 SFP uplinks and slower ASICs. The X is the right generation.
Ignoring the license — LAN Lite on a 2960X, or IP Base when you need IP Services on a 3750X/3850, will wall you off from features you assumed were included.
Missing the stack cable — StackWise uses a proprietary ring cable (STACK-T1-50CM or STACK-T1-1M). Not cheap, not universal, often absent from pulled units.
Underestimating PoE load — a 48-port switch powering 30 APs at 15 W each = 450 W. The -PS (370 W) won't cover it; you need -FPS (740 W).

What's your current stack? Running any of these three in a home lab or office? I'm curious whether anyone has found good sources for the NM-10G modules specifically — they seem harder to find than the switches themselves.

SAN vs NAS for your home lab: which used storage to buy

IT And Office — Fri, 19 Jun 2026 19:28:03 +0000

If you're building out a home lab and need shared storage, you'll eventually hit the SAN vs NAS question. Both solve "storage that multiple machines can reach," but they do it differently — and the wrong choice will haunt your weekend troubleshooting sessions for years.

This guide focuses on used/refurbished enterprise gear, which is where the real value is. New prosumer NAS appliances are fine, but for $300–600 you can run production-grade hardware that Fortune 500 companies retired last year.

The core difference (no hand-waving)

NAS (Network Attached Storage) presents storage as a file system over the network. Your clients talk SMB (Windows), NFS (Linux/VMware), or AFP (old Macs). The NAS owns the filesystem; clients just see folders. Think of it as a file server with a good OS baked in.

SAN (Storage Area Network) presents raw block devices over the network (Fibre Channel, iSCSI, or NVMe-oF). Clients see a disk — or something that looks exactly like one — and they manage their own filesystem on top of it. The SAN has no idea what's inside the blocks.

This distinction drives almost every practical difference between them.

When NAS makes sense for a home lab

Use NAS when your primary use case is file sharing or backup targets:

Media server (Plex, Jellyfin) pulling files from a central library
Time Machine / rsync backup destination
Docker volumes that are mostly config + small data
Shared project folders across dev machines

Used NAS hardware worth looking at

Synology DS1821+ — if you want appliance simplicity, the DS1821+ is the gold standard. But it's not cheap even used. An alternative is to build a DIY NAS on a used Dell PowerEdge R230 or similar — TrueNAS Scale runs great on it, you get ECC RAM, and the IPMI is a life-saver for remote management.

QNAP TS-h886 — uses ZFS natively, 10GbE ports included, can handle iSCSI if you later need it. Used units show up regularly.

For NFS performance in a VMware or Proxmox environment, you want at minimum 1GbE between NAS and hypervisor. 10GbE is worth it if you plan to store VM disks there — you'll feel the difference during live migrations.

What to check before buying a used NAS

Drive bays count and whether it supports the form factor you need (3.5" vs 2.5" vs M.2)
RAM expandability — ZFS loves RAM; some units are soldered
NIC speed — many budget NAS boxes ship 1GbE only, 10GbE adapters for them are sometimes proprietary
Firmware support — Synology especially locks down OS versions by model
Fan noise — some units designed for quiet office use are genuinely acceptable; rackmount NAS gear is loud

When SAN makes sense for a home lab

Use SAN when your use cases involve:

Hypervisor shared storage for live VM migration (vMotion, Proxmox live migration)
High IOPS workloads — databases, write-intensive apps
Multi-host clustering — shared disk presented to a cluster for failover

iSCSI SAN is the practical choice for home labs because it runs on standard Ethernet and you don't need a dedicated FC switch. FC is worth learning if you can acquire the gear cheaply, but the SFP+ fiber infrastructure adds complexity and cost.

Used SAN hardware worth looking at

Dell EMC PowerVault MD3420 / MD3820f — direct-attach SAS storage, can be repurposed with a used RAID controller. Not technically a SAN but bridges the gap.

HP MSA 2040 / 2050 — dual-controller iSCSI/FC SAN. These show up at good prices once hardware refresh cycles hit. They support 10GbE iSCSI natively with the right SFPs.

NetApp FAS2554 / FAS2650 — ONTAP is a serious enterprise OS; the learning curve pays off if you ever touch NetApp at work. These units can do both NFS and iSCSI simultaneously, which gives you flexibility.

IBM DS3500 / DS4700 — solid workhorse for iSCSI. Less common now, but spares are still around.

What to check before buying used SAN gear

Controller firmware version — on dual-controller units, both controllers must be on the same firmware version or you'll get mysterious I/O errors
Cache battery / supercapacitor status — write-back cache is disabled if the backup power unit is dead; performance tanks
Port type — 8Gb FC vs 16Gb FC vs 10GbE iSCSI matters. Make sure your HBAs or NICs match
Expansion shelf compatibility — if you buy a head unit expecting to add shelves, verify the shelf-to-controller compatibility matrix before buying
Noise and power draw — dual-controller SANs are datacenter hardware. Budget 200–400W idle and significant fan noise

The hybrid option: software-defined storage

Before spending money on dedicated hardware, consider running TrueNAS Scale or Ceph on existing servers. TrueNAS Scale can serve NFS, SMB, and iSCSI from the same pool. Ceph is complex but extremely powerful for multi-node setups.

A used Dell R720 or HP DL380 Gen9 with a bunch of drives inside, running TrueNAS, covers 80% of home lab storage needs without a dedicated storage appliance.

The trade-off is management overhead and the fact that your storage host is also burning CPU.

Speed expectations on real gear

Setup	Realistic throughput
1GbE NFS/SMB	110–115 MB/s sequential
10GbE NFS	800–950 MB/s sequential (SSD backend)
iSCSI on 10GbE	700–900 MB/s, lower latency than NFS for IOPS
FC 8Gb	~800 MB/s, very low latency
FC 16Gb	~1.5 GB/s

iSCSI latency is typically 200–500 µs over 10GbE on decent hardware. NFS adds overhead from the protocol stack. Neither approaches local NVMe, but for home lab workloads both are more than adequate.

My recommendation

Start with NAS (TrueNAS on an old server, or a used Synology/QNAP) unless you specifically need live VM migration or block storage clustering.
Add iSCSI SAN when you run Proxmox or ESXi clusters and need shared block storage.
Don't buy FC infrastructure unless you're using it to learn for a job that requires it — the additional cost and complexity of HBAs and fiber switches is hard to justify.

If you want tested and reset gear without the lottery of eBay auctions, resellers like IT and Office stock used enterprise NAS and storage hardware with basic checks done — worth browsing before you commit to a blind buy from a surplus pallet.

What's your current storage setup? Are you running a software-defined solution like TrueNAS or Ceph, or did you go the dedicated appliance route? Curious what workloads pushed you toward SAN vs NAS in the end.

How to Build a Pro-Grade Home Lab on a Budget with Refurbished Enterprise Gear

IT And Office — Tue, 16 Jun 2026 21:26:47 +0000

Enterprise hardware depreciates faster than almost anything in tech. A switch or firewall that cost €2,000 new is often €150 three years later — not because it stopped working, but because the company that bought it moved to a support contract on a newer model. For a home lab, that depreciation curve is a cheat code: you get real production-grade features for a fraction of the price.

Here's a practical guide to building a serious home lab with used enterprise gear — what to buy, what each piece gives you, and the traps to avoid.

Why refurbished enterprise gear beats consumer kit

Consumer "prosumer" gear fakes the features you actually want to learn. Real enterprise hardware gives you:

Managed switching — VLANs, 802.1Q trunking, LACP, STP, QoS, SNMP. The exact CLI you'll use at work.
Out-of-band management — iDRAC (Dell) / iLO (HPE) let you power-cycle and install an OS over the network, headless.
ECC RAM and redundant PSUs — stability for 24/7 virtualization.
PoE — power your APs, IP cameras and phones over the same cable.

You learn on the same equipment that runs datacenters, and you can break things safely.

The shopping list

1. A managed switch (the backbone)

Start here. A used Cisco Catalyst 2960X (Layer 2) or 3750X / 3850 (Layer 3) gives you VLANs, inter-VLAN routing and PoE for very little.

Check before buying: the PoE budget (e.g. 370W vs 740W), the IOS feature set (IP Base vs IP Services for L3), and fan noise — some 1U switches are loud for a bedroom.

2. A firewall / router

A used Fortinet FortiGate (or similar) lets you segment your network, run VPNs and inspect traffic — invaluable for learning real security.

The catch: without an active subscription you lose live threat feeds and some auto-updates. For a lab that's fine; just buy on hardware merit and know the model isn't end-of-support. Generate fresh config on a factory-reset unit.

3. A server (the workhorse)

A Dell PowerEdge (R620/R630/R720) or HPE ProLiant (DL360/DL380) Gen8–Gen10 runs Proxmox, ESXi or a Kubernetes cluster comfortably.

Check: RAM type/amount (ECC RDIMM), the RAID controller (PERC / Smart Array) mode, the iDRAC/iLO license level, and — again — noise and power draw. A 2U server idles around 80–120W.

4. Storage

SAS/SSD disks pulled from servers are cheap and fast. A small NAS (or a server with a RAID controller) gives you shared storage for VM images and backups. For SAS drives, check the SMART health and remaining life.

5. Don't forget power

Rack gear needs clean, sufficient power. A rack PDU distributes it; a UPS rides out brownouts and lets VMs shut down gracefully. Size the PDU to your total load with ~20% headroom — a 16A PDU gives ~3.7 kVA, a 32A ~7.4 kVA.

The five traps when buying used

Firmware / license locks — some vendors disable features without an active contract. Verify what works without a subscription.
End-of-support models — fine for a lab, risky if you need security patches. Check the EoL date.
Missing components — caddies, rails, PSUs, SFP modules and licenses are often not included. Confirm what's in the box.
Noise and heat — 1U gear screams. If it lives where you sleep, prefer 2U or tower form factors.
No reset / dirty config — insist the unit is factory-reset (zeroized) so you start clean and inherit no one else's keys or rules.

Buy tested, not blind

Auctions are a gamble — untested units, missing parts, dead PSUs. If you'd rather skip the lottery, specialist refurbishers test and reset gear before shipping. I've sourced switches, firewalls and PDUs from IT and Office, which sells tested, reset enterprise hardware (Cisco, Fortinet, Dell, HPE and more) with EU shipping — handy when you want kit that boots and works on day one.

Wrap-up

A capable home lab — managed switch, firewall, a virtualization host, shared storage and proper power — can be built for the price of a single new mid-range switch if you buy used. You'll learn the real tools, break things without fear, and run services that would cost a fortune to host elsewhere.

What's in your rack? Drop your build in the comments — always curious what people are running. 👇`