DEV Community: IT And Office

How to pick a used router for a small office or branch

IT And Office — Thu, 29 Oct 2026 17:58:40 +0000

"Just get a router" sounds simple until you're staring at a used Cisco ISR, a Juniper SRX, or a MikroTik CCR on an auction site with no idea whether it'll actually handle your WAN link, your VPN tunnels, and your VLANs at the same time. Enterprise routers are built very differently from the consumer box your ISP gave you, and buying the wrong used unit means either paying for throughput you'll never touch or bottlenecking a small office's whole internet connection. Here's how to actually evaluate one before you buy.

Step 1: Know your actual throughput requirement first

The single biggest mistake is buying based on WAN port speed instead of routing throughput with features enabled. A router's rated forwarding rate almost always assumes plain IP forwarding with no services running. Turn on a site-to-site IPsec VPN, a stateful firewall ruleset, and NAT, and real throughput on older hardware can drop by 50-80%.

Work backward from your WAN circuit:

Under 100 Mbps WAN (most small offices, many branch circuits) - almost any used enterprise router from the last 10-12 years handles this comfortably, even with VPN and firewall enabled.
100 Mbps to 1 Gbps WAN - you need to check the VPN throughput spec specifically, not just the routing throughput. This is where older ISRs (1900/2900 series without a crypto module) fall over.
Over 1 Gbps - you're now looking at hardware with dedicated crypto ASICs (ISR 4000 series, ASA 5500-X with acceleration, MikroTik CCR with multi-core ARM/Tilera) or you're routing without full encryption load.

Step 2: Match the router class to the job

Cisco ISR (Integrated Services Router) - 1900/2900/3900/4000 series
The classic small-branch choice. 1900/2900 are IOS-based, well-documented, cheap used, fine for sub-100Mbps WAN with light VPN. The 4000 series (ISR4321, ISR4331) moved to IOS-XE and handles gigabit WAN with VPN much better thanks to onboard crypto acceleration - worth the premium if your WAN circuit is fast.

Cisco ASA (5505/5506-X/5508-X)
Technically a firewall, but small offices often run it as edge router + firewall + VPN concentrator in one box. Good VPN throughput for the price on used units, but EOL dates matter here - check whether it's still getting ASA software updates or whether you're buying into a dead-end OS version.

Juniper SRX (SRX210/220/240/300 series)
Similar dual-purpose role to the ASA. JunOS is a different config paradigm from Cisco IOS (worth factoring in if your team only knows Cisco), but SRX hardware tends to be well-built and shows up used at good prices from decommissioned enterprise networks.

MikroTik (RouterBOARD/CCR series)
Not "enterprise" in the traditional vendor sense, but RouterOS is extremely capable for the price, and the CCR line's multi-core CPUs give real VPN/firewall throughput well above what similarly-priced Cisco gear from the same era can do. Steeper learning curve if you've never used RouterOS.

pfSense/OPNsense on repurposed enterprise hardware
A used enterprise 1U or small-form-factor box (some resellers sell dedicated firewall appliances like Fortinet or SonicWall units specifically for this) running open-source firewall software gives you the most flexibility and the longest software-support runway, at the cost of doing your own integration work instead of buying a turnkey appliance.

Step 3: Check what actually wears out or gets orphaned

Used networking gear fails or becomes useless in specific, predictable ways - check these before paying:

Capacitors and PSU - routers that ran 24/7 in a hot rack for 5+ years are the ones with capacitor issues. Ask for an uptime/environment history if the seller has it, or at minimum confirm it was bench-tested under load, not just powered on.
Flash/NVRAM wear - heavy syslog or config-save cycles over years can degrade flash storage on older gear. A show diag or equivalent health check before shipping is worth asking for.
License-locked features - Cisco routers in particular gate features (crypto, advanced routing protocols, security licenses) behind license tiers activated to the original owner's Smart Account. A used ISR with an expired or non-transferable Smart License can leave IPsec VPN or other features locked even though the hardware supports them. Confirm license status before buying, not after.
End-of-support date - check Cisco's/Juniper's end-of-software-maintenance date for the exact model. A router past EOL still works, but you won't get security patches, which matters more for an internet-facing router than almost any other device on your network.
Physical WAN interface type - confirm the used unit has the actual WAN interface your ISP hands off (RJ45 Ethernet vs. SFP vs. a specific WIC/HWIC module for older T1/serial circuits). This trips people up more than expected with older ISR chassis that expect a module you then have to source separately.

Step 4: Plan the redundancy question up front

Small offices often skip this and regret it. Decide before buying:

Single router, ISP-provided failover (accept some downtime risk), or
Two used routers in an HA pair (HSRP/VRRP on Cisco, VRRP on most others), which roughly doubles hardware cost but removes the single point of failure for the whole office's internet and VPN access.

If you're going the HA route, buy matched models and matched IOS/firmware versions - mismatched software versions between an HA pair is a common source of failover bugs that only show up during the actual failure you bought the redundancy to protect against.

Buying checklist

[ ] WAN throughput requirement calculated with VPN + firewall overhead, not bare routing rate
[ ] Router class matches office size (ISR 1900/2900 for small, 4000-series or MikroTik CCR for gigabit WAN)
[ ] License status confirmed transferable or already unlocked
[ ] EOL/end-of-support date checked for the specific model
[ ] Physical WAN interface confirmed to match your ISP handoff
[ ] Bench-tested/functional-tested by the seller, not just "powered on"
[ ] HA pair uses matched hardware and firmware versions, if redundancy is in scope

If you'd rather skip the auction-site gamble on unknown history and license status, resellers who function-test and reset used gear before listing - like IT and Office - will tell you upfront whether licensing is clean and what condition the unit tested at, which saves you from finding out the hard way after it's already routing your office's traffic.

What's biting people most on used router deployments these days - is it still license lockouts, or has EOL software support become the bigger blocker?

Used enterprise SSDs & SAS drives: what to check before buying

IT And Office — Fri, 23 Oct 2026 11:22:30 +0000

Enterprise storage is one of the best places to buy used. Enterprise SSDs and SAS drives are built for 24/7 duty cycles, have far higher endurance than consumer parts, and depreciate hard once a data center refreshes its fleet. But "enterprise" and "used" both cut both ways - you need to know what you're actually buying. Here's a practical checklist before you drop money on a drive from an auction site or a reseller.

Why enterprise drives are worth buying used at all

Consumer SSDs are optimized for burst performance and low cost, with endurance ratings (TBW) that assume light, bursty desktop use. Enterprise SSDs - Intel/Solidigm D3-S4x10, Samsung PM/SM series, Micron 5300/7300, HGST/Seagate SAS models - are built around sustained IOPS, power-loss protection (PLP), and endurance rated for years of constant writes. A 3-year-old enterprise SSD pulled from a decommissioned server often has more useful life left than a brand-new consumer drive under a ZFS or Ceph workload.

The catch: these drives were run hard. You're not buying "used" in the light sense of a laptop that sat in a drawer - you're buying a drive that may have logged tens of thousands of power-on hours doing exactly the workload you're about to give it. That's usually fine, but you have to verify it instead of assuming it.

SATA/NVMe vs SAS: know what you're plugging into

Before you buy, confirm your backplane and HBA actually support what you're ordering:

SAS drives need a SAS-capable HBA or backplane. A drive like a Seagate Exos or HGST Ultrastar SAS model will not run on a plain SATA port - SAS is electrically and protocol-compatible in one direction only (SAS controllers can talk to SATA drives, not the reverse).
Dual-port SAS is common on enterprise drives and is a real feature if you're doing HA storage (e.g., a dual-controller SAN or clustered ZFS) - but it's wasted on a single homelab box with one HBA.
U.2 vs M.2 vs AIC NVMe - pulled enterprise NVMe drives are frequently U.2 (2.5" SFF-8639), which needs a U.2 backplane or a PCIe adapter card, not a direct M.2 slot. Check this before buying, not after.
12Gbps vs 6Gbps SAS - mixing generations works, but you'll cap at the slower link speed. Not a dealbreaker for spinning disks, worth checking for SAS SSDs.

What to actually check before buying

1. SMART data and power-on hours

Ask the seller for a smartctl -a output (SATA/SAS) or nvme smart-log (NVMe) before you buy, or request it as a condition of the listing. Key fields:

Power_On_Hours - tells you real-world age regardless of manufacture date.
Reallocated_Sector_Ct / Grown_Defect_List (SAS) - any non-zero, growing count is a red flag on spinning disks.
Percentage_Used / Media_Wearout_Indicator (SSD) - this is the one that matters most for flash. A drive at 40% used with years of TBW headroom left is a great buy; one at 90% is a paperweight regardless of price.
Uncorrectable_Error_Cnt - should be zero or explainable.

Commands to pull these values:

smartctl -a /dev/sda | grep -E "Power_On_Hours|Reallocated|Wear|Percentage_Used"

nvme smart-log /dev/nvme0 | grep -E "percentage_used|power_on_hours|media_errors"

Endurance math, not just "it still works"

A drive reporting 40% wear isn't automatically fine - check that against the drive's rated TBW/DWPD and your expected write pattern. A 1.92TB enterprise SSD rated at 1 DWPD for 5 years has roughly 3.5PB of rated writes; at 40% used you've burned through ~1.4PB, leaving a real budget to plan against - not just a vibe.

3. Firmware and reallocation behavior

Enterprise drives sometimes ship from data center pulls with vendor-locked or OEM-customized firmware (Dell, HPE, NetApp branded firmware on an otherwise-generic drive). This can affect SMART reporting accuracy, TLER/error-recovery timeouts in RAID, and sometimes compatibility with generic HBAs. If a drive shows an OEM firmware string you don't recognize, look it up before assuming it behaves like the retail part.

4. Test before you trust it with data

Before putting a used drive into production:

Run a full badblocks (destructive, read-write mode) or nvme device-self-test pass.
For SAS/SATA: smartctl -t long /dev/sdX and check the result log.
Burn in for at least 24-48 hours under load before trusting it with anything you can't afford to lose, and always run redundancy (RAID-Z2, mirrored vdevs, RAID-6) - a used drive is not a reason to skip redundancy, it's a reason to double down on it.

Buying tips

Buy from resellers who test and reset drives, not blind pallet-auction lots - a seller who can hand you a pre-sale SMART report and has erased/reset the drive is worth a small premium over the cheapest eBay listing.
Match drives in sets carefully if building a RAID/ZFS pool - mixing drives with wildly different wear levels means you'll get correlated failures right when the newest drives are still healthy.
Prefer drives with PLP (power-loss protection) for anything doing sync writes (databases, ZFS ZIL/SLOG) - this is a hardware capacitor bank, not a firmware setting, so it has to be present on the model you buy.
Don't ignore SAS on the storage side even if your compute is all NVMe - SAS enterprise drives are often the cheapest per-TB spinning storage you can buy for bulk/cold pools, and if you'd rather buy tested, pre-checked drives with SMART data provided upfront than gamble on a blind lot, resellers like IT and Office list used enterprise SSDs and SAS/SATA drives with that kind of visibility.

Your turn

What's your cutoff for wear percentage or power-on hours before you pass on a used enterprise drive - and has a "healthy-looking" SMART report ever burned you anyway?

Setting up VLANs on a used managed switch (practical guide)

IT And Office — Mon, 19 Oct 2026 14:56:15 +0000

Buying a used managed switch is the easy part. The part that actually trips people up is the first VLAN config - especially if the switch came factory-reset with zero documentation and you're reverse-engineering the CLI from forum posts. Here's a practical walkthrough that works across most enterprise-grade used gear (Cisco IOS syntax shown, with notes for HP/Aruba and Netgear where it differs meaningfully).

Why bother with VLANs at all

A flat network means your IP cameras, your NAS, your guest laptop, and your work VPN endpoint are all in the same broadcast domain and can all see each other. VLANs give you logical separation on physical switch hardware you already own - no extra cables, no extra switches. Typical home lab / small office split:

VLAN 10 - trusted (workstations, servers)
VLAN 20 - IoT / cameras / smart home
VLAN 30 - guest Wi-Fi
VLAN 99 - management (switch/AP/router admin interfaces only)

Step 1: Factory reset and get console access first

Don't trust a "reset to defaults" claim from a seller. On Cisco IOS:

erase startup-config
delete /force vlan.dat
reload

vlan.dat is the hidden file where VLAN database info lives separately from the running config - erasing startup-config alone won't touch it, and you'll inherit whatever VLANs the previous owner configured. This is the single most common gotcha with used switches: you set up VLAN 10 and 20 cleanly, then discover VLAN 50 "PrevCorp-DMZ" is still lurking in the database.

Console into it with a USB-to-RJ45 rollover cable at 9600 8N1 - don't rely on the switch already having a management IP reachable over the network, since you don't know its prior config.

Step 2: Create the VLANs

vlan 10
 name TRUSTED
vlan 20
 name IOT
vlan 30
 name GUEST
vlan 99
 name MGMT
exit

On HP/Aruba (ProCurve/Comware CLI), it's:

vlan 10
 name TRUSTED

same idea, slightly different config-mode nesting.

Step 3: Assign access ports

Ports where a single device connects (a PC, an AP's LAN uplink acting purely as an access port, a camera) get access mode - untagged, one VLAN only.

interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 20
 description "Camera - driveway"

Repeat per port. Don't skip switchport mode access - some Cisco IOS versions default to dynamic desirable trunking negotiation (DTP), which is a real security gap: an attacker (or a curious device) can sometimes negotiate a trunk and see traffic it shouldn't. Hard-set access mode explicitly on every access port.

Step 4: Set up the trunk to your router/firewall

The uplink to whatever does inter-VLAN routing (a router-on-a-stick, a firewall like a used FortiGate, or an L3 switch) needs to carry all VLANs tagged:

interface GigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 switchport trunk native vlan 99

Set the native VLAN deliberately - don't leave it at VLAN 1. Untagged traffic on a trunk lands in the native VLAN, and VLAN 1 is the default on essentially every switch out of the box, which makes it a predictable target. Match the native VLAN on both ends of the trunk, or you'll get VLAN mismatch errors (Cisco logs these loudly; other vendors sometimes fail silently).

Step 5: Inter-VLAN routing

If your switch is L2-only (like a Catalyst 2960 or most budget-tier used switches), routing happens upstream - your router or firewall does the work with subinterfaces:

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 10.10.20.1 255.255.255.0

If your switch is L3-capable (3750X, 3850, or similar), you can do it on the switch itself with SVIs:

ip routing
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
interface Vlan20
 ip address 10.10.20.1 255.255.255.0

Don't forget ip routing globally - it's off by default even on L3-licensed hardware, and it's the #1 reason "my SVIs have IPs but nothing routes" threads exist.

Step 6: Lock down the management VLAN

Put the switch's own management IP on VLAN 99, not VLAN 1 and not the same VLAN as your general workstations:

interface Vlan99
 ip address 10.10.99.2 255.255.255.0

Then restrict which VLANs can reach it - either with an ACL on the SVI or, better, only allowing management VLAN traffic through your firewall rules. A used switch with a defaulted admin/admin login sitting reachable from your IoT VLAN is a bad combination.

Common pitfalls checklist

Stale vlan.dat - always wipe it explicitly, erase startup-config isn't enough.
DTP left on - set every access port to switchport mode access explicitly, don't rely on auto-negotiation.
Native VLAN mismatch - both ends of a trunk must agree, and it shouldn't be VLAN 1.
Forgetting ip routing on an L3 switch - SVIs with IPs but no forwarding.
PVID vs tagged VLAN confusion on non-Cisco gear - on Netgear/TP-Link "smart" switches, the terminology is often "PVID" for untagged/native and a separate tagged-members table; the concepts map to Cisco's model but the UI hides it differently. Read the specific model's VLAN doc before assuming Cisco terms translate directly.
License gaps - some used L3 switches (3750X, 3850) need IP Base or IP Services licensing for full routing feature sets; verify with show license before planning your topology around a feature that isn't actually unlocked.

Buying advice for VLAN-capable used gear

If you're shopping for a switch specifically to do this, confirm before buying: does it support 802.1Q tagging (basically all "managed" switches from the last 15 years do), is it L2-only or L3-capable, and does the license tier on that specific unit include what you need. Sellers who test and document configuration state before shipping - resellers like IT and Office list functional-tested, factory-reset managed switches with the model/license spelled out - save you the guesswork of finding out mid-setup that the unit you bought is LAN Lite instead of LAN Base.

What's your VLAN layout look like, and did you hit any surprises with used gear that still had a previous owner's config baked in?

Refurbished vs new enterprise hardware: a real TCO breakdown

IT And Office — Thu, 15 Oct 2026 14:44:25 +0000

Every few months the "buy refurbished or buy new" debate resurfaces on some internal Slack channel, usually right after someone gets a quote for a new rack server and nearly falls off their chair. The instinct is to treat it as a moral question - support the vendor, get the warranty, sleep easy - but it's actually a math question. Total cost of ownership (TCO) is not just the sticker price, and once you run the numbers properly, the answer is rarely as obvious as either side claims.

This isn't a "refurb is always right" post. It's a breakdown of what actually goes into the TCO calculation, so you can run it yourself against your own workload instead of trusting a vendor's slide deck or a forum thread.

What TCO actually includes

Most people stop at purchase price. A real TCO model for infrastructure hardware needs at least these line items over the expected service life:

Acquisition cost - unit price, plus any bundled warranty/support
Deployment cost - racking, cabling, imaging, integration time
Power draw - idle and load wattage x your kWh rate x hours/year
Cooling overhead - roughly proportional to power draw, often ignored entirely in home labs and SMB closets
Failure rate & downtime cost - probability of failure x cost per incident (parts, labor, lost service)
Support/maintenance contract - vendor support renewal, or your own spare-parts stock
Residual value - what you can resell the unit for at end of life
Obsolescence risk - will it still get firmware/security updates in 3 years?

Skip any of these and you're not comparing TCO, you're comparing sticker price with extra steps.

Where new hardware wins

New enterprise gear has real, non-marketing advantages that matter for specific situations:

Warranty coverage from day one. If you're deploying into a production environment with an SLA, a 3-5 year manufacturer warranty with next-business-day parts is worth real money when something dies at 2 AM.
Latest efficiency generation. A current-gen server can pull 20-40% less power per unit of compute than hardware from 3-4 generations back. If your workload is CPU-bound and power costs are high in your region, this can offset a large chunk of the price gap over 4-5 years.
Compliance requirements. Some industries (healthcare, finance, government contracts) have procurement rules that explicitly require new-from-OEM hardware with chain-of-custody documentation. Don't fight this one - check your compliance obligations before you shop on price.
Extended software support windows. Newer platforms (e.g., current-gen Dell PowerEdge, HPE ProLiant Gen11) get firmware and security patches for longer, which matters if you're planning a 6-7 year deployment.

Where used/refurbished wins

Acquisition cost is 40-70% lower for gear that's 2-4 generations old but still fully capable for most workloads - virtualization hosts, file servers, firewalls, switches, and PBXs rarely need bleeding-edge silicon.
Enterprise-grade components already screened. A tested, reset unit from a reputable reseller has already been through the "infant mortality" failure window that kills a chunk of brand-new drives and PSUs in the first 90 days.
Faster availability. No 8-12 week lead times on backordered SKUs - used enterprise inventory (think Dell R630/R640, HPE DL380 Gen9/Gen10, Cisco Catalyst 2960X/3850, FortiGate 100D/200D) tends to be in stock and shippable immediately.
Better fit for labs, DR sites, and secondary workloads. A cold-standby DR host, a homelab, or a branch-office switch rarely needs the newest silicon - it needs to be reliable and cheap enough that a failure isn't a budget event.

A rough worked example

Take a 1U virtualization host, 5-year hold:

New (current-gen, 2 CPUs, 128GB RAM): ~$6,500 acquisition + 3yr warranty included, ~450W typical draw
Used (2 generations back, same core/RAM specs, tested with 90-day-to-1-year seller warranty): ~$1,800 acquisition, ~500W typical draw

At $0.15/kWh, the ~50W delta costs you roughly $65/year in power - about $325 over 5 years. That's nowhere close to closing a $4,700 acquisition gap. The math only flips if: (a) you're buying at scale and power/cooling is genuinely constrained, (b) you need the warranty because you have no in-house hands to swap parts, or (c) compliance mandates new.

Run this same exercise for switches and firewalls and the gap is usually even more lopsided, because networking gear from 3-4 generations back is still functionally excellent - a used Catalyst 3850 or FortiGate 200D handles typical SMB/branch traffic without breaking a sweat, and the "new" alternative is mostly paying for features you won't touch.

The checklist before you decide

Calculate actual kWh cost delta for your region, not a national average.
Get a real quote for downtime cost per hour for the specific workload.
Check whether your industry has procurement rules that make this decision for you.
Ask any refurb seller for their testing/burn-in process and warranty terms in writing - a 90-day dead-on-arrival window plus paid extended coverage is table stakes for a reputable one.
Factor in end-of-life resale - used enterprise gear that's already 3 generations old will have near-zero resale value in 5 more years, while new gear might still be worth something.

If you'd rather buy tested, reset enterprise gear with a warranty than gamble on a marketplace auction with no return policy, resellers like IT and Office are worth comparing against a new quote before you commit either way.

What's your break-even point been in practice - have you run into a case where "new" actually won the TCO math for a non-compliance reason?

How to size a rack PDU and UPS for your home lab

IT And Office — Mon, 05 Oct 2026 19:56:08 +0000

Most home lab builds get the compute right and the power wrong. You buy a nice used server, rack it, plug it into a random power strip, and only find out it's a problem when the breaker trips at 2am during a firmware update or your UPS dies six months in because it was never sized for the load. Sizing power correctly is boring, but it's the difference between a lab that runs for years and one that eats itself.

This post walks through how to size a rack PDU and a UPS for a realistic home lab, with the math you actually need and the mistakes that bite people.

Step 1: Know your real power draw, not the nameplate number

Every server, switch, and NAS has a nameplate rating (often on a sticker on the back) that lists the maximum draw of the power supply, not what the device actually pulls under normal load. A Dell R630 with dual 750W PSUs doesn't draw 1500W ‚Äî it might draw 120-180W idle and 250-350W under load, depending on CPUs and drive count.

To size correctly:

Use manufacturer power calculators when available. Dell, HPE, and Cisco all publish sizing tools for their gear (Dell's is particularly good and lets you configure the exact CPU/RAM/drive combo).
If you can't find a calculator, measure it. A cheap inline power meter (Kill-A-Watt or similar) on an existing device of the same family gives you real numbers fast.
When in doubt, budget for idle + 40% as a safe working estimate for a lab that isn't running sustained heavy compute.

Rough real-world numbers for common used gear, per unit, under typical lab load:

Device	Typical draw
1U server (dual CPU, few drives)	90-180W
2U server (dual CPU, 8-12 drives)	150-300W
24-48 port managed switch (non-PoE)	15-40W
24-48 port PoE+ switch (budget for PoE separately)	30-60W + PoE budget
Small NAS (4-8 bay)	40-90W
Firewall appliance (desktop form factor)	15-40W

Add these up for everything you plan to run simultaneously, not everything you own.

Step 2: Sizing the PDU

A rack PDU's job is to distribute power safely, not to protect against outages ‚Äî that's the UPS's job. Two things matter: circuit capacity and outlet count.

Circuit capacity. In North America, a standard 120V/15A circuit gives you 1800W theoretical, but you should never plan past 80% continuous load ‚Äî so 1440W usable. A 120V/20A circuit gives 2400W theoretical, ~1920W usable. In the EU/UK on 230V, a standard 13A/16A circuit gives you far more headroom (roughly 3000-3600W theoretical), which is one reason higher-density labs are easier to power outside North America.

If your total measured draw from Step 1 is getting close to 80% of your circuit's rating, stop adding gear to that circuit ‚Äî get a second circuit or a PDU that supports higher amperage, don't just add another power strip on the same wall outlet.

Outlet count and form factor. For a home lab rack, a basic 8-12 outlet vertical or horizontal PDU is usually enough. Metered PDUs (ones that show you live wattage/amperage on a small display) are worth the extra cost ‚Äî they turn "guessing" into "checking," and they'll catch a slowly creeping load before it trips a breaker. Switched/managed PDUs (remote outlet on/off) are a nice-to-have for remote power-cycling gear, but not essential for a first build.

Step 3: Sizing the UPS

This is where most people get it wrong ‚Äî either buying a UPS way too small (it dies on battery in 90 seconds under real load) or wildly oversized for the budget (paying for capacity you don't need).

The math:

Total your real wattage draw from Step 1 (all devices you want protected).
Add 20-25% headroom ‚Äî UPS efficiency drops and battery life shortens near max rated load, so running a UPS at 90%+ capacity constantly will shorten its lifespan.
Convert to VA if the UPS is rated in VA (common). Most lab-grade loads have a power factor around 0.9, so VA ‚âà Watts / 0.9.

Example: a small lab with one 2U server (250W), one switch (30W), one small NAS (60W), and a firewall (25W) totals 365W real draw. Add 25% headroom: ~456W needed. Divide by 0.9 power factor: ~507VA minimum. In practice, that means you'd want at least a 700-1000VA / 600-900W UPS to have comfortable runtime, not just "won't-immediately-shut-down" capacity.

Runtime matters more than capacity for most labs. A UPS sized to handle your load at 100% for 2 minutes is only useful if your goal is a clean shutdown ‚Äî which for a home lab is usually exactly the goal (not riding out a multi-hour outage). Check the manufacturer's runtime chart at your wattage, not the "max load" number on the box, since runtime drops fast as load approaches capacity.

Don't forget network gear on the UPS. A server that shuts down cleanly is useless if your switch and router lose power at the same time and you can't reach it remotely to diagnose. Put your core switch, router/firewall, and any out-of-band management (IPMI/iDRAC network path) on the UPS even if the bulk compute isn't.

A quick sizing checklist

[ ] Measured or calculator-based real wattage for every device, not nameplate max
[ ] Total load stays under 80% of the PDU circuit's rated capacity
[ ] UPS sized at total load + 20-25% headroom, converted to VA if needed
[ ] Runtime checked at your actual wattage, not the UPS's max-load spec
[ ] Network/management gear included on the UPS, not just compute
[ ] Automatic shutdown agent (NUT, apcupsd, or vendor tool) configured so hosts actually shut down cleanly instead of just riding the battery to zero

If you'd rather skip the spreadsheet, a PDU/UPS sizing calculator like the one IT and Office has can get you a ballpark fast ‚Äî plug in your gear list and it estimates the load for you, which is a decent sanity check even if you're buying hardware elsewhere.

What's your lab's actual power draw, and did you get it right on the first try or learn the hard way like most of us? Curious what UPS runtime people are actually getting at real load.

PoE explained: power APs, cameras & phones from your switch

IT And Office — Sun, 27 Sep 2026 08:30:22 +0000

Power over Ethernet (PoE) lets a single Cat5e/Cat6 cable carry both data and DC power to a device — no separate power brick, no outlet needed near the ceiling where your AP or camera lives. It sounds simple until you're standing on a ladder with a PoE camera that won't boot, or you've bought a "PoE switch" that can't actually power what you plugged into it. Here's what actually matters.

The three PoE standards

There are three IEEE standards in the wild, and mixing them up is the #1 cause of "why won't this device power on" tickets:

802.3af (PoE) — up to 15.4W delivered at the switch port, ~12.95W usable at the device after cable loss. Fine for basic APs, IP phones, small cameras.
802.3at (PoE+) — up to 30W delivered, ~25.5W usable. Covers most modern Wi-Fi 6 APs, PTZ cameras, and higher-power devices.
802.3bt (PoE++ / UPOE) — split into Type 3 (up to 60W) and Type 4 (up to 100W). Needed for things like large digital signage, some AI-capable cameras, or powering thin clients over Ethernet.

A PoE+ switch will happily power an 802.3af device — the standards are backward compatible — but not the other way around. If a device negotiates PoE+ and your switch only offers PoE, it'll either refuse to power up or run in a degraded/reboot-loop state. Always check the device's power class, not just what the switch box says.

Power budget: the number that actually matters

Every PoE switch has a total PoE power budget (e.g., "370W PoE budget" on a 48-port switch), separate from the per-port maximum. This is where people get burned buying used gear:

A switch can have 48 ports each capable of 802.3at (30W), but a shared budget of only 370W. That's enough for roughly 12 ports running at full PoE+ power — not 48.
Budget is allocated dynamically on most switches (LLDP power negotiation), but some older or cheaper units allocate the maximum class per port statically, which exhausts the budget much faster with fewer devices.
Always add up your real device draw (APs are usually 9-22W depending on model/radios, PTZ cameras can hit 25-30W, basic IP phones are 3-7W) and compare against the switch's rated PoE budget, not port count.

When buying a used enterprise switch specifically for PoE, look up the exact model's PoE budget in the datasheet — sellers rarely list it, and it varies wildly even within the same product line (e.g., a Catalyst 2960X-48FPD-L has a much bigger budget than a 2960X-48LPS-L).

Injectors vs. PoE switches

If you only need to power one or two devices and your existing switch isn't PoE-capable, a PoE injector is the cheaper fix — it sits inline on the cable run and injects power without touching your existing switch. Good for a single AP or camera drop.

Once you're past 3-4 PoE devices, a proper PoE switch is worth it: centralized power budget management, port-level PoE status/power draw visibility via CLI or SNMP, and the ability to remotely power-cycle a hung device (power inline never / power inline auto on Cisco, or the equivalent toggle on the web UI) instead of walking over to unplug it.

Cable length and power loss

PoE power loss over cable is real but often overstated for home lab distances. At 100m (the Ethernet spec limit) you'll lose roughly 10-20% of injected power to resistance, more with cheap/thin-gauge cable. Practically:

Under 30m: negligible loss, don't worry about it.
Near the 100m limit with a high-power PoE+ device: budget for it, or use Cat6/Cat6a instead of Cat5e — the thicker copper loses less.
Never run PoE over damaged, kinked, or bundled-tight cable runs — the extra heat from resistive loss in a bad cable is a (minor but real) fire risk, and it's the first thing to check when a far-end device is flaky.

Common gotchas when buying used PoE gear

Passive PoE vs. standards-based PoE are not the same thing. Passive PoE (common on cheap Ubiquiti-style gear) just applies constant voltage with no negotiation — plugging a passive PoE injector into an 802.3af/at device without checking pinout and voltage compatibility can fry it. Don't mix passive PoE gear with standards-based 802.3af/at/bt equipment unless you've confirmed voltage and pinout match.
Test PoE ports before relying on them. A switch that powers up fine can still have individual ports with dead PoE controllers — this is one of the most common "half-working" faults in secondhand gear. Plug a known-good PoE device into every port you plan to use before deploying.
Check for PoE watchdog / auto-recovery features. Useful for remote APs — the switch detects a non-responsive PoE device and power-cycles the port automatically, saving you a truck roll.

If you're speccing out a PoE deployment for APs, cameras, or phones and want to buy switches with known-good, tested PoE budgets rather than gambling on untested auction listings, resellers like IT and Office list tested access points and PoE-capable networking gear with the specs already verified.

What's the largest PoE power budget you've had to plan around, and did you hit any surprises calculating it?

Build a budget Proxmox host with a used enterprise server

IT And Office — Tue, 22 Sep 2026 14:30:13 +0000

Running Proxmox VE on a $150 mini PC is fine until you actually want to do something with it — a few VMs, a couple of containers, maybe a Windows box for testing, ZFS with real redundancy. That's when a decommissioned enterprise server starts looking a lot more attractive than another NUC.

Here's how to pick one without ending up with a jet-engine paperweight.

Why an enterprise server instead of consumer hardware

Enterprise rack servers (Dell PowerEdge, HPE ProLiant, Lenovo ThinkSystem) were built for 24/7 operation, have ECC memory as standard, redundant power supplies, and — critically for a Proxmox host — proper IPMI/iDRAC/iLO out-of-band management. You can power-cycle, reinstall, and monitor the box without ever touching a keyboard connected to it.

The tradeoffs: noise, power draw, and rack space. If you're putting this in a bedroom, plan for that upfront (more on cooling below).

What to actually look for

CPU generation. Don't go below a 2nd-gen Xeon Scalable (Cascade Lake, e.g. Xeon Silver 4210) or, for the older PowerEdge 13G line, Broadwell-era E5-2600 v4. Older Haswell/Ivy Bridge (E5-2600 v3 and earlier) parts are cheap but burn far more watts per core than what you'd get today — bad if you're paying residential electricity rates 24/7.

RAM. Buy DDR4 ECC RDIMM, and buy more than you think you need — RAM is the first thing Proxmox exhausts once you start running more than 3-4 VMs plus ZFS ARC. 128GB is a comfortable homelab target and is usually affordable on the used market for these platforms.

Drive bays and controller. Check whether the server ships with a RAID controller (PERC H730/H330 on Dell, Smart Array P440ar on HPE) or a plain HBA. For Proxmox + ZFS, you want an HBA in IT mode, not a hardware RAID controller — if the listing only mentions a PERC/Smart Array, budget for crossflashing it or swapping it for an HBA330/H330 in IT mode.

Network. Onboard 4x1GbE is standard and fine to start. If you plan to do SR-IOV passthrough or fast storage replication between nodes, check whether the server has a free PCIe slot for a 10GbE card later.

iDRAC/iLO license level. Basic remote management is free; virtual media (mounting an ISO remotely to install Proxmox without a USB stick) usually requires the Enterprise/Advanced license. Confirm it's included, since a bare "Basic" license makes the first install noticeably more annoying.

Models that show up often on the used market

Dell PowerEdge R630 (1U) — dual E5-2600 v3/v4, up to 24 DIMM slots, compact. Good if rack space is tight. Fewer 3.5" bay options.
Dell PowerEdge R730 / R730xd (2U) — same CPU generation as the R630 but with far more drive bays (up to 16x 2.5" or 12x 3.5" on the xd), making it the better pick if you want a real ZFS pool with several drives.
HPE ProLiant DL360 Gen9 / Gen10 — similar profile to the R630/R730 line, iLO instead of iDRAC. Gen10 supports Scalable Xeons.
Lenovo ThinkSystem SR630 — less common used but shows up, similar generation.

For a first Proxmox node, an R730xd with dual Xeon Silver/Gold, 128GB RAM, and an HBA330 in IT mode is a very common and well-documented sweet spot.

Power and noise — the part people underestimate

A 2U dual-CPU server idles significantly higher than a desktop — expect 120-180W at idle depending on drive count and CPU TDP, more under load. That's a real line item if it runs 24/7. Rack fans on 1U chassis in particular are loud at boot and under load; a 2U chassis is noticeably quieter. If it's going in a closet or garage, that's usually fine. If it's next to your desk, budget for either a 2U unit or planning fan curve/BIOS tweaks (which vary a lot by vendor and aren't always accessible without the enterprise license tier).

Proxmox-specific setup notes

Update the BMC firmware (iDRAC/iLO) and the BIOS/system firmware before installing Proxmox — old firmware is a common source of weird PCIe passthrough and NIC issues.
Enable IOMMU in BIOS if you want to pass through a GPU or HBA to a VM.
If you crossflash a PERC to IT mode, do it before installing Proxmox on top of it — reflashing after the pool is created will make ZFS see a different controller and can complicate imports.
Set up email or Discord/webhook alerts in Proxmox for drive and node health early. Used drives are used drives.

Buying tips

Sellers will usually list CPU model, RAM amount, and drive bay count, but often skip whether it includes rail kits, the RAID controller model, or the iDRAC/iLO license tier — ask before buying if it's not in the listing, since those three things are exactly what determine whether the box is ready to rack-and-go or needs extra parts. Tested/burned-in units cost a bit more than pure auction pulls but save you the risk of a DOA PSU or a server that throws memory errors the first week — for something running unattended, that premium is usually worth it. If you'd rather skip auction-sourced gear entirely and buy something already tested and reset, resellers like IT and Office list refurbished rack servers with the specs already listed per unit.

What's everyone else running as their main Proxmox node — still on Broadwell/v4 Xeons, or have you moved to Scalable/Epyc used gear yet?

How to choose a used FortiGate firewall (without getting burned)

IT And Office — Mon, 21 Sep 2026 00:18:31 +0000

Used enterprise firewalls are one of the best deals in homelab and small-office hardware. A FortiGate 100F that retailed for €4,000 can be had for €400–600 on the secondary market. But unlike a used switch or server, a firewall has pitfalls specific to the platform that can turn a bargain into a headache. This guide focuses on FortiGate because Fortinet dominates the SMB/branch market — which means the widest used supply — but most principles transfer to other NGFW vendors.

Why FortiGate specifically

FortiGate runs FortiOS, a mature, well-documented OS with a strong CLI, solid VPN (IPsec + SSL), IPS, web filtering, SD-WAN, and ZTNA features. Even old models (6.0-era hardware) run a recent enough FortiOS to be genuinely useful. The management UI is clean, the CLI is learnable, and there's a large community behind it.

The catch: Fortinet's subscription model means some features (IPS signatures, web filter categories, AV databases) are tied to a license. Hardware without an active license still works great as a stateful firewall and VPN concentrator — the signatures just stop updating. For homelab and many SMB use cases, that's acceptable.

What to check before buying

1. Hardware generation and throughput

FortiGate model numbers encode rough throughput:

FortiGate 40F / 60F: ~1 Gbps firewall throughput — fine for fiber ≤1 Gbps and a small team
FortiGate 80E / 100E / 100F: 2–10 Gbps — suitable for mid-size offices, remote-access VPN hubs, or a demanding homelab VLAN setup
FortiGate 200E / 300E / 400F: 20–40 Gbps — branch aggregation or small datacenter edge

The "E" suffix = 6.x-era hardware (NP6/SP3 ASICs). The "F" suffix = 7.x-era (NP7/SOC4). Both are fully supported as of FortiOS 7.4.

Also check the number of physical interfaces. Some models have SFP+ ports that are useful for direct fiber uplinks or inter-zone 10G links; verify they match your cabling.

2. License status

Run or ask the seller to run:

get system status

Look for License Status: Valid or Expired. An expired license means:

Stateful firewall ✅
IPsec/SSL VPN ✅
VLAN, routing, NAT ✅
IPS signatures ❌ (frozen at expiry date)
Web filter categories ❌
FortiGuard DNS filtering ❌

For a homelab or budget office, unlicensed is often fine. For a production environment that needs up-to-date threat intelligence, budget for a license renewal or buy a unit that still has active FortiCare.

3. FortiOS version and upgrade path

Fortinet's firmware lifecycle is strict:

Check Fortinet's product lifecycle page for EoS dates
FortiGate 80E and older are approaching or past EoS — fine for air-gapped or homelab, a risk for internet-facing production
From the CLI: get system status shows the current version

The good news: FortiOS upgrades between major versions (e.g. 6.4 → 7.0 → 7.2) are straightforward via the GUI, and Fortinet publishes upgrade path tools to avoid skipping versions.

4. Factory reset status

Always ask: "Has this been factory-reset?" A unit that still has a previous org's config is usable but requires extra care:

Previous VPN credentials could be cached
Custom certificates may still be present
If you get a unit without the admin password, you CAN reset it via the console port and a BIOS interrupt — but you need a RJ45-to-DB9 console cable or a USB console adapter

The console reset procedure is documented in Fortinet's knowledge base and takes about 5 minutes. It's not a dealbreaker, but confirm before buying whether the seller has done it.

5. PSU and accessories

Mid-range FortiGates (200E+) use redundant PSUs in some configurations. Check:

Is both/the PSU included?
Any rack ears?
Console cable? (3rd-party USB console cables work fine — CP210x chip)

Which model for which use case?

Use case	Recommended models
Home fiber ≤1 Gbps + VPN	FortiGate 40F, 60F, 60E
Small office (≤50 users)	FortiGate 80E, 100E, 100F
VPN concentrator (branch hub)	FortiGate 100F, 200E
Lab firewall / VLAN isolation	Any 60E/80E — cheap, plenty of ports
Multi-tenant / advanced routing	FortiGate 300E, 400F

For pure homelab VLAN segmentation without active IPS, a FortiGate 60E running FortiOS 7.2 is the sweet spot: cheap, well-documented, 5 physical interfaces, capable CLI.

Configuration tips after buying

Factory reset first: execute factoryreset in the CLI, even if the seller says it's clean.
Update firmware before touching production traffic. Download directly from support.fortinet.com (free, needs a (free) account).
Disable FortiGuard reachability checks if you're running unlicensed — the unit will log repeated license check failures otherwise. Under System > FortiGuard, disable services you're not using.
Use policy-based NAT + security zones from day one — trying to retrofit zones later is painful.
Enable logging to memory or a syslog server (e.g. Graylog, Loki). Local disk logging on small FortiGates is limited and fills fast.

Where to find tested units

Auctions (eBay, Marktplaats) are hit-or-miss: units sometimes arrive still linked to a previous MSP's FortiManager, or with burned PSUs. Specialist resellers that test, reset, and warrant used enterprise gear are worth the small price premium — if you're in Europe and want reset, tested FortiGates with a warranty, IT and Office maintains a rotating stock of used firewalls from major brands.

What's your homelab firewall setup?

Running FortiGate, pfSense, OPNsense, or something else? Any surprising finds from the used market — good or bad? Drop a comment below.

What is an HSM — and why a used one is a smart buy

IT And Office — Fri, 11 Sep 2026 19:28:03 +0000

Hardware Security Modules sit at the very bottom of your key management stack — and yet most developers encounter them only when something has already gone wrong. This post explains what an HSM actually does, how to reason about buying a used one, and what to check before you power it up.

What an HSM actually does

An HSM is a tamper-resistant piece of hardware whose sole job is to generate, store, and use cryptographic keys without ever exposing those keys to the host system. Operations (sign, decrypt, derive) happen inside the module; the key material never crosses the PCIe or network boundary in plaintext.

Concrete use cases:

PKI roots and intermediate CAs — your CA private key lives in the HSM; even if the server is compromised, the key cannot be extracted.
Code signing — sign binaries or firmware in CI without writing the key to disk.
TLS offload — some HSMs act as a cryptographic accelerator; the private key for your cert stays inside.
Database encryption key wrapping — the HSM holds the Key Encryption Key (KEK); column-level encryption keys are wrapped by it.
FIDO2 / PKCS#11 back-end — enterprise identity systems (ADCS, Vault, EJBCA) can use an HSM as their PKCS#11 provider.

Network HSM vs PCIe HSM vs USB token

Form factor	Typical use	Example models
Network (appliance)	Shared across multiple hosts, DC rack	Thales Luna Network, Bull Atos Trustway Proteccio
PCIe card	Single server, low-latency	Thales Luna PCIe, Utimaco Se-Series
USB token	Developer workstation, small-scale signing	Yubico YubiHSM 2, Nitrokey HSM

For homelab and small-business PKI, a network appliance is the most flexible: any host with network access can reach it, and you can cluster two units for HA without extra licensing drama.

Why used HSMs make sense

New network HSMs from Thales or Atos cost €15 000–€50 000+. That pricing reflects enterprise support contracts and FIPS 140-2 Level 3 (or 4) certification, not necessarily the hardware cost.

A used unit from a decommissioned bank or telco:

Same tamper-resistance — the physical security of the module doesn't degrade with age.
Same FIPS certification — the certification is tied to the hardware model and firmware version, not the ownership chain.
Factory-resettable — a proper zeroization wipes all key material and returns the unit to factory state. You can verify this yourself.
Firmware upgradeable — most units support firmware updates; check the vendor's support matrix.

The main risk is buying a unit that has not been properly zeroized or one where the tamper-evident seals have been broken. More on that below.

What to check before buying a used HSM

1. Confirm the model and firmware support matrix

Get the exact model string (e.g., Bull Atos Trustway Proteccio PCA4H) and cross-reference with the vendor's firmware support page. You want to know:

Which firmware versions are still supported.
Whether the unit is still eligible for security patches.
Whether FIPS re-validation is required after a firmware update (usually no for minor updates).

2. Request proof of zeroization

A properly decommissioned HSM should come with a zeroization certificate or at minimum a factory-reset confirmation from the previous owner's security team. If the seller can't provide this, budget for doing it yourself — most units have a documented factory-reset procedure that requires physical access to the unit (a deliberate tamper-detection feature).

After reset, you should see the unit boot into an uninitialized state: no partitions, no policies, no keys. The admin console will ask you to go through the initial setup wizard.

3. Inspect the tamper-evident seals

Network HSMs ship with tamper-evident labels on screws and chassis seams. Broken or missing seals don't necessarily mean the unit is compromised (they degrade with age and heat), but they're a red flag worth discussing with the seller. Some enterprise buyers document seal status at decommission — ask for photos.

4. Check the battery

HSMs use a battery to power the SRAM that holds key material even when the unit is unplugged. A dead battery on an active unit triggers tamper response and wipes keys — which is the correct behavior. On a factory-reset unit it's less critical, but you'll want to replace it before production use. Battery replacement ## Integration patterns worth knowing

HashiCorp Vault + PKCS#11 seal: Vault can use an HSM to auto-unseal and wrap its master key — a significant security upgrade over Shamir's secret sharing for production.
EJBCA + PKCS#11: open-source PKI that works natively with most network HSMs.
OpenSSL engine: many HSMs ship an OpenSSL engine so existing TLS stacks can offload private-key operations without code changes.
AWS CloudHSM / Azure Dedicated HSM: if you want cloud-native, these are FIPS 140-2 Level 3 options — but at roughly $1.50–$2/hour, a physical used unit pays itself off in under a year for sustained workloads.

Where to source used HSMs

Enterprise liquidators, secondary-market IT brokers, and specialist refurbishers are your best options. Avoid random eBay listings where provenance is unclear. If you want a unit that's been tested, reset, and verified operational before shipping — rather than gambling on an untested lot — European IT hardware resellers like IT and Office stock specific models (e.g., the Bull Atos Trustway Proteccio PCA4H) with documented testing.

Quick checklist before you power up a used HSM

[ ] Model confirmed, firmware support checked
[ ] Zeroization certificate obtained or factory reset verified
[ ] Tamper-evident seals inspected and photographed
[ ] Battery status checked, replacement scheduled if needed
[ ] Admin credentials / SO cards situation clarified
[ ] PKCS#11 client library version matches HSM firmware
[ ] Network access tested (appliance responds on management port)

Have you deployed a used HSM in production or homelab? What was the trickiest part of the initial setup — zeroization, PKCS#11 integration, or something else entirely? procedures are documented in most service manuals; factor in the cost.

5. Verify the authentication scheme

Modern network HSMs use either:

Smart cards + PINs (n-of-m quorum): you need the correct number of SO (Security Officer) cards to administer the unit. If the previous owner didn't hand over the cards, you'll need to factory-reset.
Password-based auth: simpler, common on older firmware.

Make sure you know which scheme is active and that you'll have everything needed to initialize the unit under your own credentials.

6. Test PKCS#11 connectivity

Before going further, validate the PKCS#11 interface:


bash
# Example with the vendor's client library installed
pkcs11-tool --module /usr/lib/libCryptoki2_64.so --list-slots

Used Cisco Catalyst switches: 2960X vs 3750X vs 3850

IT And Office — Fri, 03 Jul 2026 14:23:36 +0000

If you're building a lab or scaling a small office network, Cisco Catalyst switches dominate the second-hand enterprise market. They're robust, well-documented, and cheap compared to their original price — but the three most common series you'll encounter (2960X, 3750X, 3850) are very different beasts. Picking the wrong one wastes money; picking the right one can anchor your network for a decade.

Here's a practical breakdown.

The quick answer

Feature	2960X	3750X	3850
Layer	L2 (limited L3)	Full L3	Full L3
Stacking	FlexStack	StackWise-480	StackWise-480
PoE	Yes (PoE+ models)	Yes (PoE+ models)	Yes (PoE+ models)
Uplink	SFP / SFP+	SFP+	SFP+
IOS-XE	No	No	Yes
End of SW maintenance	2025	2023	2028

Cisco Catalyst 2960X — the access-layer workhorse

The WS-C2960X-48FPS-L (48 PoE+ ports, 740 W) and WS-C2960X-24PS-L are the most common units you'll find on the market for €100–250. These are pure access-layer switches: great for connecting workstations, APs, and IP cameras to an uplink.

What you get

Solid Layer 2 feature set: VLANs, STP, LACP, IGMP snooping, 802.1X
LAN Base or LAN Lite IOS (LAN Base is what you want — it supports more ACLs and SPAN)
FlexStack for up to 8-unit stacking via a dedicated cable (costs extra, check if included)
No full routing — the 2960X does static routes in hardware but no dynamic routing protocols (OSPF, EIGRP, BGP) without an IP Services license upgrade, which is expensive used

When to choose it

Pure access layer (users, APs, cameras connect here, routing handled upstream)
Budget is tight
You don't need inter-VLAN routing on the switch itself

What to check before buying

IOS version — verify the image: show version. LAN Base vs LAN Lite is burned into the license, not the hardware. Ask the seller for a screenshot or check the PID (product ID sticker on the back; LPS = LAN Lite, L = LAN Base).
Fan noise — 2960X fans can be loud under load. Check the fan model; some community-sourced Noctua swaps exist for lab use.
FlexStack modules — if you want to stack, the C2960X-STACK module must be present (one per switch). Often missing from pulled units.
PoE budget — the -FPS suffix means 740 W PoE budget; -PS is 370 W. Calculate your AP + camera load first.

Cisco Catalyst 3750X — the full L3 workhorse (aging but solid)

The WS-C3750X-48P-S or WS-C3750X-24P-S run €150–350 used. End of Software Maintenance was 2023, meaning no new IOS releases — but existing IOS 15.2(4) images are stable and widely deployed.

What you get

Full Layer 3: OSPF, EIGRP, BGP, PBR, MPLS (with IP Base or IP Services license)
StackWise-480: up to 9 units with 480 Gbps stacking bandwidth, shared control plane
Modular uplink: the rear slot accepts C3KX-NM-1G (4× SFP) or C3KX-NM-10G (2× SFP+) modules — check whether the module is included, it's often missing and costs €30–80 extra
Hardware-assisted ACLs, QoS, and NetFlow

When to choose it

You need routing at the distribution/core layer
You want to stack switches with a true backplane (not cascaded uplinks)
Budget allows a bit more than a 2960X

What to check before buying

Network module — the rear uplink slot is empty by default. Decide early: C3KX-NM-10G for 10G uplinks (most labs want this), C3KX-NM-1G for 1G SFP.
License tier — show license in IOS. IP Base supports EIGRP/OSPF. IP Services adds BGP, MPLS, advanced QoS. Licenses are node-locked (tied to the unit's serial), so verify the license matches the advertised feature set.
Software support — no new IOS since 2023. For a lab or stable office this is fine; for a PCI or HIPAA environment, check with your auditor.
Power supply — the 3750X has a removable PSU at the back. 1100WAC or 715WAC. Confirm it's present; some stripped units are sold PSU-less.

Cisco Catalyst 3850 — the modern distribution switch

The WS-C3850-48P-S or WS-C3850-24P-S are the premium used option at €300–600. They run IOS-XE (not classic IOS), software maintenance extends to 2028, and they support full Wireless LAN Controller functionality natively — meaning you can terminate Cisco CAPWAP APs directly on the switch without a separate WLC.

What you get

Full L3 on IOS-XE: cleaner CLI, modular architecture, more consistent with modern Catalyst 9K behavior
StackWise-480 (same as 3750X, up to 9 units)
Integrated Wireless LAN Controller (with IP Services license): manage Cisco APs without a dedicated WLC — huge for SMBs
40 Gbps uplink module slot (QSFP+ with the right module)
Software support through 2028 (unlike the 3750X)

When to choose it

You need wireless controller functionality baked in
You want IOS-XE experience (closer to current Catalyst 9K)
Longer software support matters (audit requirements, regulated environments)
You run a mixed-mode network with Cisco APs already on-site

What to check before buying

IOS-XE version — target 16.x. Versions before 16.3 have known memory leak bugs in stacking. show version output should confirm.
License — IP Base vs IP Services (same logic as 3750X). WLC functionality requires IP Services. Check via show license right-to-use.
Network module — same situation as 3750X: the rear uplink slot may be empty. C3850-NM-2-10G gives 2× SFP+, C3850-NM-4-1G gives 4× GE SFP.
USB Bluetooth module — some units have a USB Bluetooth dongle for Mobility Services. If you're not using Cisco CMX, remove it to reduce attack surface.

Feature comparison in plain terms

For pure access layer + tight budget → 2960X-48FPS-L.
For routing + stacking + a few hundred euros more → 3750X-48P-S with a 10G module.
For IOS-XE, wireless controller, and longer support runway → 3850-48P-S.

All three support VLANs, 802.1X, PoE+, LACP, and SPAN — the feature you're giving up as you go down the stack is full Layer 3 routing and software longevity.

Where to find tested units

Auction sites (eBay, LeBonCoin) carry these in volume, but you're often buying blind: no IOS verification, PSU missing, or fans at end-of-life. For a production or semi-production setup, tested and reset units from a specialist reseller reduce the risk considerably. If you prefer not to gamble on auction lots, specialty resellers like IT and Office typically provide functional testing, reset to factory defaults, and accurate model/license information before shipping.

Common mistakes to avoid

Buying a 2960S instead of a 2960X — the older S series has only 10/100/1000 SFP uplinks and slower ASICs. The X is the right generation.
Ignoring the license — LAN Lite on a 2960X, or IP Base when you need IP Services on a 3750X/3850, will wall you off from features you assumed were included.
Missing the stack cable — StackWise uses a proprietary ring cable (STACK-T1-50CM or STACK-T1-1M). Not cheap, not universal, often absent from pulled units.
Underestimating PoE load — a 48-port switch powering 30 APs at 15 W each = 450 W. The -PS (370 W) won't cover it; you need -FPS (740 W).

What's your current stack? Running any of these three in a home lab or office? I'm curious whether anyone has found good sources for the NM-10G modules specifically — they seem harder to find than the switches themselves.

SAN vs NAS for your home lab: which used storage to buy

IT And Office — Fri, 19 Jun 2026 19:28:03 +0000

If you're building out a home lab and need shared storage, you'll eventually hit the SAN vs NAS question. Both solve "storage that multiple machines can reach," but they do it differently — and the wrong choice will haunt your weekend troubleshooting sessions for years.

This guide focuses on used/refurbished enterprise gear, which is where the real value is. New prosumer NAS appliances are fine, but for $300–600 you can run production-grade hardware that Fortune 500 companies retired last year.

The core difference (no hand-waving)

NAS (Network Attached Storage) presents storage as a file system over the network. Your clients talk SMB (Windows), NFS (Linux/VMware), or AFP (old Macs). The NAS owns the filesystem; clients just see folders. Think of it as a file server with a good OS baked in.

SAN (Storage Area Network) presents raw block devices over the network (Fibre Channel, iSCSI, or NVMe-oF). Clients see a disk — or something that looks exactly like one — and they manage their own filesystem on top of it. The SAN has no idea what's inside the blocks.

This distinction drives almost every practical difference between them.

When NAS makes sense for a home lab

Use NAS when your primary use case is file sharing or backup targets:

Media server (Plex, Jellyfin) pulling files from a central library
Time Machine / rsync backup destination
Docker volumes that are mostly config + small data
Shared project folders across dev machines

Used NAS hardware worth looking at

Synology DS1821+ — if you want appliance simplicity, the DS1821+ is the gold standard. But it's not cheap even used. An alternative is to build a DIY NAS on a used Dell PowerEdge R230 or similar — TrueNAS Scale runs great on it, you get ECC RAM, and the IPMI is a life-saver for remote management.

QNAP TS-h886 — uses ZFS natively, 10GbE ports included, can handle iSCSI if you later need it. Used units show up regularly.

For NFS performance in a VMware or Proxmox environment, you want at minimum 1GbE between NAS and hypervisor. 10GbE is worth it if you plan to store VM disks there — you'll feel the difference during live migrations.

What to check before buying a used NAS

Drive bays count and whether it supports the form factor you need (3.5" vs 2.5" vs M.2)
RAM expandability — ZFS loves RAM; some units are soldered
NIC speed — many budget NAS boxes ship 1GbE only, 10GbE adapters for them are sometimes proprietary
Firmware support — Synology especially locks down OS versions by model
Fan noise — some units designed for quiet office use are genuinely acceptable; rackmount NAS gear is loud

When SAN makes sense for a home lab

Use SAN when your use cases involve:

Hypervisor shared storage for live VM migration (vMotion, Proxmox live migration)
High IOPS workloads — databases, write-intensive apps
Multi-host clustering — shared disk presented to a cluster for failover

iSCSI SAN is the practical choice for home labs because it runs on standard Ethernet and you don't need a dedicated FC switch. FC is worth learning if you can acquire the gear cheaply, but the SFP+ fiber infrastructure adds complexity and cost.

Used SAN hardware worth looking at

Dell EMC PowerVault MD3420 / MD3820f — direct-attach SAS storage, can be repurposed with a used RAID controller. Not technically a SAN but bridges the gap.

HP MSA 2040 / 2050 — dual-controller iSCSI/FC SAN. These show up at good prices once hardware refresh cycles hit. They support 10GbE iSCSI natively with the right SFPs.

NetApp FAS2554 / FAS2650 — ONTAP is a serious enterprise OS; the learning curve pays off if you ever touch NetApp at work. These units can do both NFS and iSCSI simultaneously, which gives you flexibility.

IBM DS3500 / DS4700 — solid workhorse for iSCSI. Less common now, but spares are still around.

What to check before buying used SAN gear

Controller firmware version — on dual-controller units, both controllers must be on the same firmware version or you'll get mysterious I/O errors
Cache battery / supercapacitor status — write-back cache is disabled if the backup power unit is dead; performance tanks
Port type — 8Gb FC vs 16Gb FC vs 10GbE iSCSI matters. Make sure your HBAs or NICs match
Expansion shelf compatibility — if you buy a head unit expecting to add shelves, verify the shelf-to-controller compatibility matrix before buying
Noise and power draw — dual-controller SANs are datacenter hardware. Budget 200–400W idle and significant fan noise

The hybrid option: software-defined storage

Before spending money on dedicated hardware, consider running TrueNAS Scale or Ceph on existing servers. TrueNAS Scale can serve NFS, SMB, and iSCSI from the same pool. Ceph is complex but extremely powerful for multi-node setups.

A used Dell R720 or HP DL380 Gen9 with a bunch of drives inside, running TrueNAS, covers 80% of home lab storage needs without a dedicated storage appliance.

The trade-off is management overhead and the fact that your storage host is also burning CPU.

Speed expectations on real gear

Setup	Realistic throughput
1GbE NFS/SMB	110–115 MB/s sequential
10GbE NFS	800–950 MB/s sequential (SSD backend)
iSCSI on 10GbE	700–900 MB/s, lower latency than NFS for IOPS
FC 8Gb	~800 MB/s, very low latency
FC 16Gb	~1.5 GB/s

iSCSI latency is typically 200–500 µs over 10GbE on decent hardware. NFS adds overhead from the protocol stack. Neither approaches local NVMe, but for home lab workloads both are more than adequate.

My recommendation

Start with NAS (TrueNAS on an old server, or a used Synology/QNAP) unless you specifically need live VM migration or block storage clustering.
Add iSCSI SAN when you run Proxmox or ESXi clusters and need shared block storage.
Don't buy FC infrastructure unless you're using it to learn for a job that requires it — the additional cost and complexity of HBAs and fiber switches is hard to justify.

If you want tested and reset gear without the lottery of eBay auctions, resellers like IT and Office stock used enterprise NAS and storage hardware with basic checks done — worth browsing before you commit to a blind buy from a surplus pallet.

What's your current storage setup? Are you running a software-defined solution like TrueNAS or Ceph, or did you go the dedicated appliance route? Curious what workloads pushed you toward SAN vs NAS in the end.

How to Build a Pro-Grade Home Lab on a Budget with Refurbished Enterprise Gear

IT And Office — Tue, 16 Jun 2026 21:26:47 +0000

Enterprise hardware depreciates faster than almost anything in tech. A switch or firewall that cost €2,000 new is often €150 three years later — not because it stopped working, but because the company that bought it moved to a support contract on a newer model. For a home lab, that depreciation curve is a cheat code: you get real production-grade features for a fraction of the price.

Here's a practical guide to building a serious home lab with used enterprise gear — what to buy, what each piece gives you, and the traps to avoid.

Why refurbished enterprise gear beats consumer kit

Consumer "prosumer" gear fakes the features you actually want to learn. Real enterprise hardware gives you:

Managed switching — VLANs, 802.1Q trunking, LACP, STP, QoS, SNMP. The exact CLI you'll use at work.
Out-of-band management — iDRAC (Dell) / iLO (HPE) let you power-cycle and install an OS over the network, headless.
ECC RAM and redundant PSUs — stability for 24/7 virtualization.
PoE — power your APs, IP cameras and phones over the same cable.

You learn on the same equipment that runs datacenters, and you can break things safely.

The shopping list

1. A managed switch (the backbone)

Start here. A used Cisco Catalyst 2960X (Layer 2) or 3750X / 3850 (Layer 3) gives you VLANs, inter-VLAN routing and PoE for very little.

Check before buying: the PoE budget (e.g. 370W vs 740W), the IOS feature set (IP Base vs IP Services for L3), and fan noise — some 1U switches are loud for a bedroom.

2. A firewall / router

A used Fortinet FortiGate (or similar) lets you segment your network, run VPNs and inspect traffic — invaluable for learning real security.

The catch: without an active subscription you lose live threat feeds and some auto-updates. For a lab that's fine; just buy on hardware merit and know the model isn't end-of-support. Generate fresh config on a factory-reset unit.

3. A server (the workhorse)

A Dell PowerEdge (R620/R630/R720) or HPE ProLiant (DL360/DL380) Gen8–Gen10 runs Proxmox, ESXi or a Kubernetes cluster comfortably.

Check: RAM type/amount (ECC RDIMM), the RAID controller (PERC / Smart Array) mode, the iDRAC/iLO license level, and — again — noise and power draw. A 2U server idles around 80–120W.

4. Storage

SAS/SSD disks pulled from servers are cheap and fast. A small NAS (or a server with a RAID controller) gives you shared storage for VM images and backups. For SAS drives, check the SMART health and remaining life.

5. Don't forget power

Rack gear needs clean, sufficient power. A rack PDU distributes it; a UPS rides out brownouts and lets VMs shut down gracefully. Size the PDU to your total load with ~20% headroom — a 16A PDU gives ~3.7 kVA, a 32A ~7.4 kVA.

The five traps when buying used

Firmware / license locks — some vendors disable features without an active contract. Verify what works without a subscription.
End-of-support models — fine for a lab, risky if you need security patches. Check the EoL date.
Missing components — caddies, rails, PSUs, SFP modules and licenses are often not included. Confirm what's in the box.
Noise and heat — 1U gear screams. If it lives where you sleep, prefer 2U or tower form factors.
No reset / dirty config — insist the unit is factory-reset (zeroized) so you start clean and inherit no one else's keys or rules.

Buy tested, not blind

Auctions are a gamble — untested units, missing parts, dead PSUs. If you'd rather skip the lottery, specialist refurbishers test and reset gear before shipping. I've sourced switches, firewalls and PDUs from IT and Office, which sells tested, reset enterprise hardware (Cisco, Fortinet, Dell, HPE and more) with EU shipping — handy when you want kit that boots and works on day one.

Wrap-up

A capable home lab — managed switch, firewall, a virtualization host, shared storage and proper power — can be built for the price of a single new mid-range switch if you buy used. You'll learn the real tools, break things without fear, and run services that would cost a fortune to host elsewhere.

What's in your rack? Drop your build in the comments — always curious what people are running. 👇`