Unmanaged, smart and managed
| Type | What you get | Best for |
|---|---|---|
| Unmanaged | Plug and play; no configuration, no visibility | Tiny, simple networks; a few devices on a desk |
| Smart / web-managed | Basic VLANs, QoS, port settings via a web page | Small offices, budget-conscious sites |
| Fully managed | VLANs, RSTP, link aggregation, port security, SNMP, CLI, logging | Business networks, anything with CCTV, VoIP or Wi-Fi |
Layer 2 and Layer 3
A Layer 2 switch forwards frames within a network. A Layer 3 switch can also route between VLANs at wire speed. Small sites can let the firewall route between VLANs; larger sites with heavy inter-VLAN traffic benefit from Layer 3 switching at the core.
PoE: standards and power budgets
| Standard | Name | Max power at switch port | Power available to device |
|---|---|---|---|
| IEEE 802.3af | PoE (Type 1) | 15.4 W | 12.95 W |
| IEEE 802.3at | PoE+ (Type 2) | 30 W | 25.5 W |
| IEEE 802.3bt | PoE++ (Type 3) | 60 W | 51 W |
| IEEE 802.3bt | PoE++ (Type 4) | 90 W | 71.3 W |
A switch's total PoE budget is usually lower than ports multiplied by per-port power. A 24-port PoE+ switch might offer 370 W in total, not 720 W. Add up real device draw, plus 20% headroom.
| Device | Typical draw |
|---|---|
| Fixed IP camera | 4–12 W |
| PTZ camera with heater or IR | 20–30 W or more |
| Wi-Fi 5 / Wi-Fi 6 access point | 10–25 W |
| Wi-Fi 6E / Wi-Fi 7 access point | Often 25–40 W; may require PoE+ or bt |
| IP phone | 3–7 W |
| Door controller / small reader | 5–15 W |
Always read the exact device datasheet. Our free PoE budget calculator on the Tools page does the sum for you.
VLANs and segmentation
- Separate staff, servers, guest Wi-Fi, CCTV/IoT, printers and management into VLANs
- Trunk VLANs only where needed; prune the rest
- Route and filter between VLANs on the firewall or an L3 switch, with default deny
- Keep a VLAN and subnet plan on paper before configuring anything
Uplinks, redundancy and loops
- Design uplink speed for the busiest segment: 1 Gbps edges often need 10 Gbps SFP+ uplinks
- Use RSTP to prevent loops; enable loop protection and storm control on edge ports
- Link aggregation (LACP) for extra bandwidth and resilience
- Stacking or redundant cores where downtime is costly
- A single unmanaged switch plugged into itself can take down a whole floor
Planning ports
- Count users, desks and devices per floor or room
- Add printers, APs, cameras, phones, door controllers and future growth
- Add 25–30% spare ports
- Total the PoE draw and check the budget
- Plan uplinks, rack space, patch panel ports and UPS load
- Label every port and cable, and record it in the port map
Security and operations
- Change default credentials; use named admin accounts; disable unused services (Telnet, HTTP)
- Disable unused ports or place them in a dead VLAN
- Port security, DHCP snooping and dynamic ARP inspection where supported
- Syslog and SNMP to a monitoring system; back up configurations
- Keep firmware current and track warranty end dates in your asset register
- Document the network diagram and VLAN plan
Key takeaways
- Use managed switches wherever CCTV, VoIP or Wi-Fi are present
- Check PoE budget in watts, not just port count
- Plan for 25–30% spare ports and a tidy, labelled rack
- Enable loop protection and keep a VLAN plan
An illustrative PoE budget example. A site added six Wi-Fi 6 access points (about 20 W each) to a 24-port switch that already powered 14 cameras at about 8 W each. Totals: 6 × 20 + 14 × 8 = 232 W. The switch's PoE budget was 190 W, so under load it dropped ports and cameras rebooted. Moving to a 370 W model, or splitting the load across two switches, fixed it. (Illustrative example, not a client case study.)
References and further reading
General information for orientation; it is not legal or professional advice. Specifications, products and regulations change, so verify current details before acting. Product names belong to their owners and are mentioned only as examples.