Cisco recommends the Catalyst 9300 series, though refurbished hardware or TPM may be more cost-effective depending on your environment.