Managed vs Unmanaged Switches: Why Boxes That Look Alike Aren't

Put two 24-port switches side by side. Same colour, same LEDs, same number of ports. One costs three times as much as the other. The whole difference is inside: can you tell it what to do, and can it tell you what's going on?

On a network with three PCs, that difference doesn't matter. In an office with 30 cameras, guest Wi-Fi and an accounting system, it matters a great deal.

Three tiers

Four problems unmanaged switches cause in organizations

No VLANs. Cameras, guests and staff all share one network. A camera with old firmware becomes a way into the accounting PCs.

Loops. The cleaner sees a loose cable and plugs it back into a free port on the same switch. Within seconds there's a broadcast storm and the whole floor is down. We get this call more often than you'd think.

No visibility. When the network is slow, there's no way to see which port is busy or throwing errors. The technician has to unplug cables one by one to find it.

Rogue DHCP. Someone brings in a home router to "add Wi-Fi", it starts handing out its own addresses, and half the office loses internet.

Unmanaged still has its place

Adding ports at a single desk within one VLAN, such as a PC and a printer. A lab. A temporary setup. Even then, choose one with loop detection and keep it at the very edge of the network, never in the path between two VLAN-aware switches.

Layer 2 or Layer 3?

Layer 2 managed for access switches on each floor, taking the desk cables and sending traffic up to the core.

Layer 3 for core switches that route between VLANs in hardware at full port speed. They suit organizations with many VLANs and heavy internal traffic, such as staff working off a NAS all day. Most offices under 50 people can let the firewall route instead and don't need Layer 3.

Cloud-managed is another option. Many brands manage switches in the same dashboard as their APs and firewalls, which suits organizations with provincial branches and a small IT team. Budget for the annual licences, and ask what happens if one lapses.

Port speed and PoE in 2026

Two things changed what an access switch needs to do: faster Wi-Fi and hungrier PoE devices.

Multigigabit ports. A Wi-Fi 6E or Wi-Fi 7 access point can push more than 1 Gbps on a busy floor. Switches with 2.5G or 5G ports (802.3bz) carry that over the Cat6 already in the walls, up to 100 m. You don't need them on every port; desks are fine at 1G. Put multigigabit ports where the APs connect.

PoE classes. Know which standard each device needs:

High-end Wi-Fi 7 access points can require 802.3bt for full operation. On PoE+ they may boot with radios or ports disabled. Read the AP datasheet before you pick the switch.

Uplinks. An access switch with 48 users and several Wi-Fi 7 APs needs 10G uplinks, ideally two bundled with LACP to the core. Use fibre or DAC cables for 10G inside the rack, and Cat6A if 10G copper has to run across a building.

Worked example: one floor of a 120-person office

Each of three floors gets one 48-port access switch. Per floor:

• 8 Wi-Fi 7 APs, budgeted at 30 W each: 240 W
• 6 IP phones at about 6 W: 36 W
• 10 cameras at about 7 W: 70 W
• Total 346 W, plus 20% headroom: about 415 W of PoE budget

So the switch needs a PoE budget above 415 W, which on many 48-port models means the larger power supply option. Eight ports should be 2.5G for the APs. Two 10G uplinks per floor go to a pair of Layer 3 core switches, so a single core switch or fibre can fail without taking the floor down. With 48 x 1G plus APs feeding 20G of uplink, oversubscription is about 2.5 to 1, which is comfortable for office traffic.

Answer these before you buy

• Port count plus 20–30% spare
• PoE needed? Total PoE budget? (Check with our PoE budget calculator)
• Enough uplink capacity (1G, 10G SFP+)?
• VLAN, QoS, STP, LACP, SNMP support
• Warranty and firmware update policy
• Stacking needed?

Eight settings we apply to every managed switch

The most common mistake isn't buying unmanaged switches. It's buying expensive managed ones and never configuring them: default passwords still in place, the management interface reachable from every VLAN, and the switch behaving exactly like an unmanaged one that cost more.

1. Change default passwords and create individual admin accounts
2. Move the management IP into the management VLAN; disable Telnet/HTTP in favour of SSH/HTTPS
3. Enable RSTP, with BPDU guard on user-facing ports
4. Enable DHCP snooping to block rogue DHCP servers
5. Configure NTP for accurate time and send logs to syslog
6. Enable SNMPv3 for monitoring
7. Shut unused ports and add descriptions to every uplink
8. Back up the configuration after every change

It takes under an hour per switch, and it's what makes the extra money for a managed switch worthwhile.

One more thing to check: a switch carrying many 4K cameras on a 1 Gbps uplink. Each 4K camera uses roughly 8–16 Mbps, but add playback from the NVR and other traffic, and a 1 Gbps uplink fills up sooner than you'd expect.

What's different in Laos

• Heat in cabinets. Office switches are usually rated to about 40–45 °C ambient. A closed wall cabinet in a room without air conditioning passes that by early afternoon in the hot season, and fans and power supplies fail first. Ventilate the cabinet or move it, and prefer fanless models for small closets.
• Dust. On mine and factory sites, switch fans pull in dust that clogs heatsinks within months. Use sealed industrial switches, typically rated around -40 to 75 °C, or clean on a schedule.
• Power. A PoE switch powers the cameras, phones and APs. If it isn't on a UPS, a two-second flicker reboots all of them. Size the UPS for the PoE load, not just the switch.
• Long outdoor runs. Copper running to a gate camera or another building brings lightning surges straight into the switch port. Fit surge protectors or use fibre.
• Firmware and end-of-life lists. Check the vendor's end-of-sale and end-of-support dates before buying. A cheap switch that stops getting security fixes next year isn't cheap.

Our view

Twenty or more users, or even a single CCTV camera: managed or smart switches everywhere. Core for mid-size organizations and up: Layer 3 with 10G uplinks. Provincial branches: cloud-managed. Factories and mines: industrial managed switches on DIN rail with a wide temperature rating, because an office switch in a steel box in the sun doesn't last.

Choose brands with spare parts and warranty support through Thai distributors. A failed core switch with a three-week wait is three weeks everyone remembers.

Already have switches?

Photograph the model label (underneath or on the back) of every switch you have and send the photos to us. We'll tell you which are managed switches that were never configured, which should be replaced and which are fine to keep.