A network switch connects the devices in a building, such as computers, phones, access points and cameras, and passes traffic between them. Switches sit in telecom rooms at the end of the structured cabling. For any business network, choose managed switches with enough ports, enough PoE power and fast enough uplinks, with a little headroom for growth.
What a switch does
Each device plugs into a switch port, usually through a patch panel. The switch learns which device is on which port and sends traffic only where it needs to go. Switches in each telecom room connect back to a core or distribution switch in the main equipment room, which connects to the router or firewall and the internet.
A typical building network has three layers, though small sites often combine them:
- Access switches in each IDF, connecting end devices
- Distribution or aggregation, connecting access switches together
- Core, the high-speed centre of the network, usually in the MDF or data centre
The links between layers, called uplinks, are usually fibre or high-speed copper. Because every device on an access switch shares its uplinks, an undersized uplink becomes a bottleneck as soon as many users are busy at once.
Managed vs unmanaged
An unmanaged switch works out of the box with no configuration. It is fine at home or for a few devices on a desk. A managed switch can be configured and monitored, which a business network needs for:
- VLANs, which separate staff, guest, voice, security and building systems traffic on the same physical network
- Quality of service, which prioritizes voice and video; see QoS for voice and video
- Security features such as port authentication, which ties into 802.1X
- Monitoring, so you can see errors, port use and PoE draw
- PoE control, including priorities and scheduled power
Managed switches are configured through a web page, command line or a cloud management platform. Cloud-managed switches are popular with organizations that have many small sites, because one dashboard covers them all.
Layer 2 and Layer 3
A Layer 2 switch forwards traffic within a network segment (VLAN). Traffic between VLANs has to go through a router or firewall. A Layer 3 switch can also route between VLANs itself, at high speed. Core and distribution switches are usually Layer 3. Access switches are often Layer 2, with routing handled further up. Whether inter-VLAN traffic should go through the firewall or be routed at the core is a security design decision, not just a performance one.
What to check when choosing switches
| Item | Why it matters |
|---|---|
| Port count | Enough for every patched outlet, plus spares |
| Port speed | Gigabit for most devices; multi-gigabit (2.5, 5 or 10 Gb) ports for current WiFi access points |
| PoE budget | Total power for all PoE devices, not just per-port capability |
| Uplinks | Fast enough to carry the combined traffic back to the core, usually over fibre |
| Stacking | Lets several switches be managed as one and share uplinks |
| Redundant power | Keeps critical switches running if a power supply fails |
| Support and updates | Firmware updates and replacement parts over the expected life |
PoE budgeting is covered in more detail in Power over Ethernet (PoE).
Watch for small switches under desks. Unmanaged switches added by users to get more ports can create loops that take down a network segment, and they hide devices from monitoring. Fix the cause by providing enough outlets, and enable loop protection on managed switches.
A typical case: sizing switches for one floor
Suppose an IDF serves a floor with desk outlets, ceiling access points, a few cameras and some meeting room equipment. Working out the switches looks like this:
- Count the active ports. From the cabling drawings, list the outlets that will actually be patched on day one: desk phones and docks, access points, cameras, printers and room systems. Unpatched outlets do not need switch ports yet.
- Group by need. Access points need multi-gigabit ports and higher PoE. Phones and cameras need PoE but modest speed. Docks and printers may need no PoE at all. This decides which switch models are needed, and in what mix.
- Add the PoE total. Add up the maximum draw of every powered device and compare it with each switch's budget, as described in the PoE guide.
- Size the uplinks. Consider what all the devices on the stack might send at a busy time, and make sure the uplinks to the core can carry it. Two uplinks to different core or distribution switches also give a backup path.
- Add headroom. Leave spare ports for growth and for moving the ports of a failed switch to working ones in an emergency.
- Size the UPS and cooling. The switches and their PoE load set the electrical and heat load for the room.
Using switch data to troubleshoot
Managed switches report a lot of information that points straight at the cause of common problems:
| What the switch shows | What it often means |
|---|---|
| Rising error counts on one port | A damaged patch cord, bad termination or faulty cable |
| A port linking at a lower speed than expected | A cable fault on one pair, a lower-category component in the link, or a device setting |
| A port flapping up and down | A loose connector, a failing device, or a device rebooting because of insufficient PoE |
| Uplink running near full most of the day | An undersized uplink, or one device sending far more traffic than expected |
| Loop protection shutting a port | A small switch or cable added by a user that creates a loop |
Most of these are found quickly when the port map is up to date; see cable labelling and documentation.
Keeping the network healthy
- Document the configuration and keep backups of every switch
- Apply firmware updates on a planned schedule
- Use strong, unique administrative credentials and restrict management access
- Disable or assign unused ports to an isolated VLAN
- Monitor port errors, which often point to cabling faults
- Put switches on UPS, sized for the PoE load as well as the switch
- Keep telecom rooms cool, clean and locked
Switches only perform as well as the cabling behind them. See cable testing and certification.
How ehZee can help
Switching is planned alongside cabling and wireless in our designs, because port counts, PoE and uplink speeds all depend on what the cabling and access points need. Our structured cabling design and build service covers the infrastructure, rooms and equipment, verified at handover.
Common questions
How many spare ports should we plan for?
Enough to cover expected growth and replacement of a failed switch's ports. Many designers patch only active outlets and keep spare capacity in the switch stack rather than patching every outlet.
Do we need a separate switch for security cameras?
Not necessarily. A VLAN on shared switches separates the traffic logically. Some organizations prefer physically separate switches for security systems; it is a policy choice.
How long do switches last?
Switches often run for many years, but their useful life is usually set by vendor support and firmware updates rather than hardware failure. Check the end-of-support dates for your models and plan replacements before security updates stop, ideally alongside WiFi or PoE upgrades.