Skip to content

Catalyst 3560-CX Notes

Platform-specific behaviour for the Catalyst 3560-CX compact switch, where it differs from the 2960 family. Example unit: WS-C3560CX-12PC-S, IOS 15.2(4)E3, IP Base.

Port Layout

The model number tells you the downlink count, not the total. A 12-port 3560-CX has 16 interfaces:

Interfaces Role Notes
Gi0/1–Gi0/12 PoE+ downlinks 30 W per port
Gi0/13–Gi0/14 Copper uplinks No PoE
Gi0/15–Gi0/16 SFP uplinks Empty cages report Not Present

Everything is GigabitEthernet — there is no Fa-vs-Gi split to tell downlinks from uplinks as on a 2960-C, and the Type column can't help either: Gi0/13–Gi0/14 are ordinary copper, identical to the downlinks.

The reliable signal is PoE membership. show power inline lists only PoE-capable ports, which on this platform are exactly the twelve downlinks:

show power inline

Available:240.0(w)  Used:15.4(w)  Remaining:224.6(w)
Interface Admin  Oper       Power   Device              Class Max
Gi0/1     auto   off        0.0     n/a                 n/a   30.0
...
Gi0/12    auto   on         15.4    Ieee PD             4     30.0

Ports Gi0/13–Gi0/16 are simply absent from that output.

The PD variant (e.g. 3560CX-12PD) is the same 12 downlinks but with 2× 10 G SFP+ uplinks named TenGigabitEthernet0/1-2 instead of Gi0/13-16. Check the suffix: PC = 1 G uplinks, PD = 10 G.

Power Budget

240 W total, 30 W per port. Per-port capacity is not the constraint — the aggregate is:

  • 12 ports × 30 W would be 360 W, more than the budget
  • Realistically about 8 ports at true 30 W, more if devices draw less (APs usually do — see PoE)

Check headroom with the Available / Used / Remaining line above before adding devices.

No Trunk Encapsulation Command

On Layer 3 switches that support both ISL and 802.1Q (the 3560 and 3750, for instance) you must set the encapsulation before enabling a trunk:

switchport trunk encapsulation dot1q
switchport mode trunk

The 3560-CX is 802.1Q only, so it rejects that command:

switchport trunk encapsulation dot1q
                 ^
% Invalid input detected at '^' marker.

This is harmless — the trunk applies regardless — but it means scripts written for a 3560/3750 will log an error on every trunk they configure. Omit the line on the CX, or accept the noise.

Layer 3 Capability

The -S suffix is IP Base, so this switch can route: ip routing, static routes, routed ports (no switchport), and DHCP relay (ip helper-address) are all available. LAN Base switches like the 2960-C have none of these.

Whether to use it is a design decision, not a default. Enabling ip routing moves inter-VLAN traffic onto the switch, where it is forwarded locally and no longer passes through the firewall — so any rules between those VLANs stop applying. With a single-router design, leaving ip routing off and keeping router-on-a-stick on the firewall is usually the right call. See Cisco IOS Routing Fundamentals.

Commissioning Checklist

  1. Hostname, domain name, local user, enable secret — Enable SSH
  2. Management IP on an SVI plus ip default-gateway — Device Setup Fundamentals
  3. lldp run — required before any Ruckus AP will draw full PoE+; see Connecting a Ruckus AP to a Cisco Switch
  4. line con 0 / line vty 0 15 → length 0 — Terminal Pagination
  5. Uplink trunk with a blackhole native VLAN — VLANs
  6. Access ports: spanning-tree portfast edge + spanning-tree bpduguard enable
  7. errdisable recovery cause bpduguard / interval 60 so a tripped port recovers itself
  8. copy running-config startup-config