What is a managed switch?
A managed switch is a network switch that, in addition to forwarding Ethernet frames, offers configurable management, diagnostic and security functions such as VLANs, QoS, redundancy protocols, port security and monitoring via SNMP and Syslog. An unmanaged switch is plug and play and does nothing but forward frames; a managed switch can be configured, interrogated and locked down. In OT networks, that is the difference between a network that “just works” and a network you can segment, watch and recover when something goes wrong.
In OT networks, managed switches are indispensable for reliable, secure and structured communication between PLCs, HMIs, SCADA and field devices.
🧠 What can a managed switch do that an unmanaged switch cannot?
The difference is not in speed or port count but in software. A managed switch runs its own operating system with a configuration you can change, save and restore. The key functions:
| Function | Standard or mechanism | Value in OT |
|---|---|---|
| VLANs | IEEE 802.1Q, 12-bit VLAN ID (4,094 usable VLANs) | Separating control, engineering, cameras and management on one physical network |
| QoS | 802.1Q priority (PCP, 3 bits, 8 classes) and DSCP | Priority for PROFINET (priority 6) and IP over backup or video traffic |
| Redundancy | RSTP, MRP, DLR, PRP, HSR | Communication continues after a cable break or a failed switch |
| Multicast control | IGMP snooping | Stops multicast traffic, for example from EtherNet/IP, from flooding every port |
| Topology information | LLDP (IEEE 802.1AB) | Neighbours and port connections mapped automatically; required for PROFINET topology diagnostics |
| Port mirroring | SPAN | Copying traffic to an IDS, an analyser or Wireshark |
| Diagnostics | SNMP, Syslog, port statistics | Reading error counters, link status and alarms centrally |
| Port security | Port Security, MAC Binding, 802.1X | Only known or authenticated devices on a port |
| Time synchronisation | PTP (IEEE 1588), NTP/SNTP | Switch as transparent or boundary clock; its own clock for correct log timestamps |
These functions turn the switch into an active part of network segmentation, redundancy and network monitoring rather than an invisible pass-through.
🔄 What types of managed switch are there?
“Managed” is a spectrum. Vendors use names such as smart, web-managed or lite managed for switches with a limited feature set.
| Type | Management | Typical functions | Suitable for |
|---|---|---|---|
| Unmanaged | None | Forwarding only | Inside a single isolated machine |
| Smart / lite managed | Web interface | VLANs, port priority, sometimes PROFINET diagnostics | Small machine networks |
| Fully managed (layer 2) | Web, CLI, SNMP | All layer 2 functions, redundancy, 802.1X, mirroring | Cell and zone networks, rings |
| Layer 3 managed | Web, CLI, SNMP | Routing between VLANs, IP-level ACLs | Backbones and distribution layer |
For control cabinets, each variant also exists as an industrial switch with DIN rail mounting, 24 V DC supply and a wide temperature range. “Managed” describes the software, “industrial” the hardware; in OT you usually need both.
🔧 How do you manage a managed switch?
A managed switch has its own IP address in a management VLAN and can be reached through several interfaces:
- CLI - over the serial console or SSH; suited to scripts and quick diagnosis.
- Web interface - over HTTPS; accessible for technicians and maintenance staff.
- SNMP - reading port statistics (UDP 161) and receiving traps (UDP 162). Use SNMPv3 with authentication and encryption; v1 and v2c send the community string in clear text.
- NETCONF/YANG - model-driven configuration from management tools, mainly in larger IT-oriented networks.
- Engineering tools - many industrial switches can also be configured from PLC software, such as TIA Portal for Siemens switches, or show up through PROFINET diagnostics in the control system.
The configuration usually consists of a running config (active) and a startup config (saved). A change that has not been saved disappears after a restart, a classic cause of “mysterious” faults after a power cut. Many industrial switches can also keep the configuration on a removable memory module, so a replacement switch starts with the same settings straight away after a failure. Keep configurations under configuration management, with version control and a backup after every change.
For PROFINET a managed switch is often a practical requirement: conformance class B adds network diagnostics via SNMP and topology information via LLDP, with MRP as an optional feature.
🏭 Where do you use managed switches in an OT network?
| Application | Function of the managed switch |
|---|---|
| Network segregation | VLANs for SCADA, cameras, remote access and engineering |
| Protection of PLCs | Allowing only known MAC addresses via MAC Binding |
| Improving availability | Ring redundancy using MRP or DLR |
| Diagnosing communication issues | Mirror port for packet capture with Wireshark |
| Detecting anomalies | SPAN port or separate TAP feeding anomaly detection and an IDS |
| Asset overview | MAC tables, LLDP and SNMP feed the asset inventory |
| Data to higher levels | Reliable transport of process data to the historian |
In the Purdue Model, managed switches form the backbone within each level. They carry segmentation inside a zone through VLANs, but the transition between zones, the conduit in the zones and conduits model, belongs to an industrial firewall. A layer 3 switch with ACLs can restrict traffic between VLANs, but it does not inspect industrial protocols.
🔐 How do you secure a managed switch?
Precisely because a managed switch is configurable, it is also a target: whoever controls the switch can change VLANs, eavesdrop through a mirror port or bring down the ring. Security therefore has two parts: protecting the network with the switch, and protecting the switch itself.
| Security feature | Application in OT |
|---|---|
| Port Security | Limit the maximum number of MAC addresses per port |
| MAC Binding | Allow only specific devices per port |
| 802.1X | Authentication against a RADIUS server before network access |
| DHCP Snooping | Prevents rogue DHCP servers |
| Dynamic ARP Inspection | Blocks spoofed ARP replies |
| IP Source Guard | Verifies IP traffic against established bindings |
| ACLs | Filter traffic by port, IP address or protocol |
For the switch itself, hardening applies: replace default passwords, disable Telnet, HTTP and SNMPv1/v2c, shut down unused ports or place them in an empty VLAN, allow management only from the management VLAN, and keep firmware current through patch management. Send logs to a SIEM for security monitoring so you see configuration changes and new devices immediately.
For components, IEC 62443-4-2 sets out the technical requirements per security level; several vendors have their industrial managed switches certified against it. In the EU, switches are listed in Annex III of the Cyber Resilience Act as important products of class I: manufacturers must report actively exploited vulnerabilities from 11 September 2026 and meet all requirements from 11 December 2027. Organisations in scope of NIS2, which the Netherlands implemented through the Cyberbeveiligingswet in force since 15 August 2026, must take appropriate measures for their networks, and a hardened, monitored switch infrastructure is part of that.
🧭 How do you commission a managed switch?
- Design first - define the VLANs, IP addresses, redundancy protocols and priorities you need, matched to the fieldbus protocol: MRP for PROFINET, DLR for EtherNet/IP.
- Base configuration offline - hostname, management IP in the management VLAN, time synchronisation via NTP, and a personal admin account instead of the default account.
- Harden - SSH, HTTPS and SNMPv3 only; unused ports disabled; port security or 802.1X on access ports.
- Test redundancy - pull a ring cable during the FAT and check that the O reports no communication fault. The watchdog time of the devices must be longer than the ring’s recovery time (for example 200 ms with the common MRP profile).
- Connect monitoring - Syslog to a central server (UDP 514, or TLS on 6514), SNMP traps for link loss and power supply alarms, and optionally a SPAN port for the IDS.
- Record - save the configuration as the startup config, make a backup and register the firmware version and serial number in the asset inventory.
A common mistake is IGMP snooping without a querier: without a device that periodically sends IGMP queries, multicast registrations expire and multicast traffic drops out after a few minutes or is flooded to every port again.
❓ Frequently asked questions
What is the difference between a managed and an unmanaged switch?
A managed switch is configurable and supports functions such as VLANs, QoS, redundancy protocols, port security and monitoring via SNMP and Syslog. An unmanaged switch only forwards frames, with no settings or diagnostics. In OT networks connected to SCADA or the business network, a managed switch is therefore the norm.
Is a managed switch the same as an industrial switch?
A managed switch and an industrial switch are not the same: “managed” refers to the management and configuration functions, “industrial” to rugged hardware for temperature, vibration and EMC. In OT you usually combine them in a managed industrial switch. Unmanaged industrial switches and managed office switches also exist.
Can a managed switch replace a firewall?
A managed switch cannot replace a firewall. With VLANs and ACLs a (layer 3) switch restricts traffic, but it does not inspect industrial protocols or track session state the way a firewall does. Use the switch for segmentation inside a zone and an industrial firewall for the transition between zones.
Which management protocols should you disable on a managed switch?
On a managed switch you disable Telnet, HTTP and SNMPv1/v2c, because these protocols send passwords or community strings in clear text. Use SSH, HTTPS and SNMPv3 with authentication and encryption instead. Also restrict management access to a separate management VLAN.
Why does PROFINET need a managed switch?
A simple switch is enough for PROFINET conformance class A, but conformance class B requires network diagnostics via SNMP and topology information via LLDP, functions an unmanaged switch does not provide. This lets the control system see which devices are connected to which switch port and automatically assign a name to a replaced device. Ring redundancy with MRP also requires a managed switch.
How do you back up the configuration of a managed switch?
You back up a managed switch by exporting the startup config through the web interface, the CLI or a management tool and storing it under version control. Many industrial switches can also write the configuration to a removable memory module, so a replacement switch starts up correctly straight away. Make a new backup after every change.
📌 In summary
A managed switch is a configurable network switch that, with VLANs, QoS, redundancy, port security and monitoring, forms the backbone of a secure, stable and manageable OT network. Combine it with a hardened configuration, central logging and a firewall between zones, and the switch turns from a pass-through into an active part of your segmentation, monitoring and redundancy.