A network switch connects the devices in a building, such as computers, phones, access points and cameras, and passes traffic between them. Switches sit in telecom rooms at the end of the structured cabling. For any business network, choose managed switches with enough ports, enough PoE power and fast enough uplinks, with a little headroom for growth.
What a switch does
Each device plugs into a switch port, usually through a patch panel. The switch learns which device is on which port and sends traffic only where it needs to go. Switches in each telecom room connect back to a core or distribution switch in the main equipment room, which connects to the router or firewall and the internet.
A typical building network has three layers, though small sites often combine them:
- Access switches in each IDF, connecting end devices
- Distribution or aggregation, connecting access switches together
- Core, the high-speed centre of the network, usually in the MDF or data centre
The links between layers, called uplinks, are usually fibre or high-speed copper. Because every device on an access switch shares its uplinks, an undersized uplink becomes a bottleneck as soon as many users are busy at once.
Managed vs unmanaged
An unmanaged switch works out of the box with no configuration. It is fine at home or for a few devices on a desk. A managed switch can be configured and monitored, which a business network needs for:
- VLANs, which separate staff, guest, voice, security and building systems traffic on the same physical network
- Quality of service, which prioritizes voice and video; see QoS for voice and video
- Security features such as port authentication, which ties into 802.1X
- Monitoring, so you can see errors, port use and PoE draw
- PoE control, including priorities and scheduled power
Managed switches are configured through a web page, command line or a cloud management platform. Cloud-managed switches are popular with organizations that have many small sites, because one dashboard covers them all.
Layer 2 and Layer 3
A Layer 2 switch forwards traffic within a network segment (VLAN). Traffic between VLANs has to go through a router or firewall. A Layer 3 switch can also route between VLANs itself, at high speed. Core and distribution switches are usually Layer 3. Access switches are often Layer 2, with routing handled further up. Whether inter-VLAN traffic should go through the firewall or be routed at the core is a security design decision, not just a performance one.
What to check when choosing switches
| Item | Why it matters |
|---|---|
| Port count | Enough for every patched outlet, plus spares |
| Port speed | Gigabit for most devices; multi-gigabit (2.5, 5 or 10 Gb) ports for current WiFi access points |
| PoE budget | Total power for all PoE devices, not just per-port capability |
| Uplinks | Fast enough to carry the combined traffic back to the core, usually over fibre |
| Stacking | Lets several switches be managed as one and share uplinks |
| Redundant power | Keeps critical switches running if a power supply fails |
| Support and updates | Firmware updates and replacement parts over the expected life |
PoE budgeting is covered in more detail in Power over Ethernet (PoE).
Watch for small switches under desks. Unmanaged switches added by users to get more ports can create loops that take down a network segment, and they hide devices from monitoring. Fix the cause by providing enough outlets, and enable loop protection on managed switches.
Keeping the network healthy
- Document the configuration and keep backups of every switch
- Apply firmware updates on a planned schedule
- Use strong, unique administrative credentials and restrict management access
- Disable or assign unused ports to an isolated VLAN
- Monitor port errors, which often point to cabling faults
- Put switches on UPS, sized for the PoE load as well as the switch
- Keep telecom rooms cool, clean and locked
Switches only perform as well as the cabling behind them. See cable testing and certification.
How ehZee can help
Switching is planned alongside cabling and wireless in our designs, because port counts, PoE and uplink speeds all depend on what the cabling and access points need. Our structured cabling design and build service covers the infrastructure, rooms and equipment, verified at handover.
Common questions
How many spare ports should we plan for?
Enough to cover expected growth and replacement of a failed switch's ports. Many designers patch only active outlets and keep spare capacity in the switch stack rather than patching every outlet.
Do we need a separate switch for security cameras?
Not necessarily. A VLAN on shared switches separates the traffic logically. Some organizations prefer physically separate switches for security systems; it is a policy choice.