Cisco CBS350-8FP-E-2G

Cisco · managed switch, 10 ports, 8 with PoE · Cisco CBS350-8FP-E-2G

what it is

A managed switch from the Cisco Business 350 family — the successor to the Small Business 300 series. The login prompt looks the same as on the SG300, but the web interface, command line and factory accounts are different; settings from an SG300 cannot be carried over directly.

According to the datasheet: eight 10/100/1000 ports with PoE+ sharing a 120 W budget and two combo ports at 1 Gb/s — copper or an SFP transceiver, one or the other, not both at once. The enclosure is 268 mm wide, 185 mm deep and 44 mm high, i.e. narrower than a nineteen-inch rack; rack and wall mounting brackets are included. The power supply is external (the "-E" in the name), passive cooling, no fan. Power draw according to the datasheet: approx. 17 W with no PoE loads, approx. 147 W at full PoE load.

On the front: Reset button, System LED, mini-USB and RJ-45 console, a USB-A port (configuration files, firmware images, log). The command line itself reports the port types: show interfaces status shows gi1–gi8 as 1G-Copper, and gi9–gi10 as 1G-Combo-C. PoE budget in show power inline: 120 W.

Unit tested: 800 MHz CPU, 512 MB RAM, 256 MB flash memory (boot output), operating temperature 43–46°C (show system, show power inline).

firmware: two images

The switch keeps two firmware images — active and backup. show version shows both with version and date; on the unit tested the active one was version 3.2.1.1 from February 2023, and the backup version 3.1.1.7 from August 2021. Switching between images is also possible from the boot menu (the "Image menu" item). Newer releases than the one active on the tested unit exist for this family.

console

Mini-USB console: the computer sees a serial port, 115 200 b/s, 8N1, with speed autodetection — the switch asks you to press Enter twice. The RJ-45 console also runs at 115 200 b/s, not 9600 like the SG300: at 9600 you get occasional garbage and the port looks broken. When both cables are plugged in, mini-USB takes precedence.

password recovery without losing the configuration

With an unknown password you do not have to erase the configuration. It requires the console and a power cycle:

• After the Loading active image messages and the image checksum verification, you get Autoboot in 2 seconds - press RETURN or Esc. to abort and enter prom.
• A single Esc at that moment opens the Startup Menu: [1] Image menu, [2] Restore Factory Defaults, [3] Password Recovery Procedure, [4] Back. Esc sent in bursts throughout boot did not open the menu — the same key exits it once inside.
• Item [3] responds "Current password will be ignored!". Then Enter (back to the menu) and Esc — the switch boots without asking for a password, with the configuration preserved, and after enable immediately gives the # prompt.

Item [2] restores factory defaults and erases the configuration irreversibly. From the command line the same is done by delete startup-config and reload — reload asks two questions (unsaved changes, restart of the whole system). A factory boot takes approx. 2 minutes, because the switch generates SSH keys (RSA, DSA) and a 2048-bit certificate.

first login

The factory account cisco with password cisco works only once: the switch forces a change of username and password. Password rules, as listed by the device itself:

• at least 8 characters, from 3 of 4 classes (lowercase, uppercase, digits, special characters);
• the same character at most 3 times in a row;
• at most 2 consecutive sequence characters ("abc", "123" and reversed) — a randomly generated password can fail this condition, so it is worth checking before sending;
• no username, manufacturer or product name, including spelled backwards;
• not on the list of leaked passwords.

After the change the cisco account disappears. The new account has privilege 15 — straight to #, without a separate enable.

factory defaults worth disabling

Right after a reset the switch:

• connects to Cisco: a few seconds after obtaining an address the PnP agent contacts devicehelper.cisco.com (%PNPAGENT-I-PNPSRVRDETECT, retry every 24 hours) and replaces the CA certificate bundle. It is disabled with no pnp enable;
• takes time from five servers on the internet: pool.ntp.org, time-pnp.cisco.com and three timefreq.bldrdoc.gov servers. On a network without internet access they must be removed and your own server specified (sntp unicast client enable, sntp server … poll, clock source sntp);
• has Bonjour enabled (no bonjour enable) and the web panel over HTTP and HTTPS (no ip http server, no ip http secure-server);
• has SSH disabled.

Changes are saved with copy running-config startup-config.

SSH

ip ssh server alone is not enough. Without ip ssh password-auth the client logs in with the "none" method, and the switch asks for the password only inside the open channel — like the SG300. With this command normal password login works. The server identifies itself as OpenSSH_7.3p1.RL and — unlike the SG300 — accepts a modern client without enabling legacy algorithms.

SNMPv3: the engineID pitfall

snmp-server user goes through without an error, but the user is not created until the switch has a local engineID. From the factory it has none ("Local SNMP engineID is not configured"). Only a repeated attempt says it plainly: "Non default local engine id value is required before configuring the user table". The order that works:

• snmp-server engineID local default — two questions; the second warns that the SNMPv3 database will be erased;
• snmp-server view WIDOK iso included;
• snmp-server group GRUPA v3 priv read WIDOK;
• snmp-server user UŻYTKOWNIK GRUPA v3 auth sha HASŁO priv HASŁO.

The encryption algorithm cannot be selected — the command accepts only the password. show snmp users shows SHA1 and AES-128; a query with DES ends in a timeout. Passwords in show snmp users are displayed in encrypted form.

what we read from it

Over SNMPv3 (authPriv, SHA and AES) the standard branches respond:

• state of each port, speed, traffic on 64-bit counters and error counters (IF-MIB, EtherLike-MIB);
• component inventory (ENTITY-MIB) with model, serial number and firmware version;
• PoE: state, powered device detection, class and priority of each port, plus overload and short-circuit counters; for the whole switch the available power, current consumption and alarm threshold;
• LLDP and CDP neighbors;
• bridge and VLANs — the BRIDGE-MIB table and static VLANs with port membership (Q-BRIDGE);
• interface IP addresses (IP-MIB).

The firmware version is not in sysDescr, which says only "CBS350-8FP-E-2G 8-Port Gigabit PoE Managed Switch". The version is given by entPhysicalSoftwareRev from ENTITY-MIB.

what to watch out for

• The console does not lock out login attempts. After a wrong password it replies authentication failed and waits for Enter — no delay and no lockout. Physical access to the console means an unlimited number of attempts, so the console needs physical protection.
• The interface table contains a pseudo-interface with index 20000 without traffic counters. A monitoring template that assumes counters on every interface gets unsupported items on it.

what we cannot read

The SNMP branches we checked do not contain:

• temperature — the switch reports it on the command line (show system), but the sensor branches (ENTITY-SENSOR-MIB and the Cisco IOS sensor branch) are empty;
• CPU and memory load (HOST-RESOURCES-MIB and the Cisco IOS branches are empty);
• power draw on an individual port — the standard PoE branch gives it only for the whole switch.

The Cisco branches known from Catalyst (environment, CPU, flash, image, configuration, VTP, stack) are not exposed by this model. The Small Business family's own branch (9.6.1) is not covered by the inventory — temperature, CPU and per-port power draw may be there; this is unconfirmed.

The back of the enclosure is not drawn — the manufacturer does not show it straight on. From the datasheet we know only that it has the external power supply jack.

full list of parameters read via SNMP

The list shows WHAT the device exposes — including parameters we do not use ourselves. There are no values here at all: it is a catalog of capabilities, not a reading from anyone's network. It is not a closed list either — explanation below the table.

148 parameters

List source: reading of 1 working unit (as of 2026-10-18). The list is the sum of what we observed — more units reveal more parameters, so numbers for different models are not directly comparable.