Managed vs Unmanaged Switch

Unmanaged switches: who are they for and what are they used for?

An unmanaged switch, also known as a 'dumb switch' or 'plug-and-play switch,' is an Ethernet switch that works immediately when connected, with no configuration required. It switches Ethernet frames at a basic Layer 2 level using a self-learning MAC table and forwarding traffic to the appropriate port. It provides no VLAN, QoS, SNMP, CLI, or firmware update capabilities. Simply connect it, and it works. Example: Netgear GS108 (8× 1G ports, ~€30).

Legitimate use cases include an employee's home office (3-5 devices), an isolated test lab, a temporary extension at a trade show, or an IoT prototyping environment. Outside these scenarios, using an unmanaged switch in a business environment is professional negligence—and here is why.

Why a managed switch is essential in a business environment

Security: the primary consideration

An unmanaged switch has no network security mechanisms. Anyone can connect a laptop to a network outlet and access the entire network—there is no 802.1X, port security, DHCP snooping, or BPDU guard. In an NIS2 context (applicable in 2026), this constitutes immediate non-compliance. An auditor who finds an unmanaged switch in a network cabinet will flag it as a critical risk.

VLANs: mandatory segmentation

Without VLANs, all devices share the same broadcast domain. Your IP camera, printer, the intern's laptop, and ERP server are all on the same network. Malware on the intern's laptop can scan and compromise the ERP server in 30 seconds. With a managed switch, you can segment the network as follows: VLAN 10 = office users, VLAN 20 = IP phones, VLAN 30 = cameras, VLAN 40 = IoT, VLAN 99 = management.

QoS: prioritizing voice and video

An unmanaged switch handles all packets in the same way. When one user starts a 10 GB download while another is in a Teams video conference, both compete for the same bandwidth. The result is a pixelated video call. A managed switch with QoS automatically prioritizes VoIP (DSCP EF) and video (AF4x) traffic, keeping the video conference smooth even when the network is saturated.

Monitoring: essential visibility

An unmanaged switch is a black box. You cannot determine which ports are active, which devices are connected, how much bandwidth is being used, or whether a port has CRC errors. A managed switch provides full visibility through SNMP, CLI (show interface), syslog, and NetFlow—essential for troubleshooting and capacity planning.

Management levels

Smart-managed (Web UI only)

An intermediate tier offering a web interface for configuring VLANs, PoE, and basic QoS. It has no full CLI, stacking, or L3 routing. Examples: Cisco CBS250, Aruba Instant On 1960, and Juniper EX2300-C (simplified mode). Price: €200-500 for 24 ports. Suitable for SMBs with fewer than 50 users.

Fully managed L2

Full CLI, VLANs, STP/RSTP, LACP, 802.1X, QoS DiffServ, SNMP v3, DHCP snooping, BPDU guard, and port mirroring. No inter-VLAN routing (L2 only). Examples: Cisco Catalyst 9200L, Juniper EX2300, and Aruba CX 6100. Price: €1,500-3,500 for 24-48 PoE+ ports. Suitable for standard campus access.

Fully managed L2/L3

All L2 capabilities plus inter-VLAN routing (OSPF, BGP, static routes, VRF), PBR (Policy-Based Routing), and multicast routing. Examples: Cisco Catalyst 9300, Juniper EX4400, and Aruba CX 6300. Price: €4,000-12,000 for 48 PoE++ ports. Suitable for enterprise access, campus distribution, and data center ToR.

Practical comparison for an SMB with 80 users

Scenario: an office with 80 employees, 3 VLANs (office users + IP phones + Wi-Fi), 6 Wi-Fi 6 APs, 10 IP cameras, and 1 NAS.

• Unmanaged option: 4× Netgear GS348 (48 ports, ~€150 each) = €600. NO VLANs and no PoE, requiring separate injectors for the 6 APs and 10 cameras: 16 injectors × €50 = €800. NO monitoring. Total: ~€1,400. HOWEVER: no segmentation, no security, no support, and not NIS2-compliant.
• Managed option: 2× Cisco Catalyst 9200-48P (48× 1G PoE+ ports, ~€3,400 each) = €6,800. Configured VLANs, integrated PoE with no injectors required, QoS, 802.1X, and SNMP monitoring. Total: €6,800. Difference: €5,400—amortized over 7 years = €770/year = €64/month to secure a network for 80 people.
• Budget-friendly managed alternative: 2× Aruba Instant On 1960-48G-PoE (smart-managed, ~€800 each) = €1,600. Basic VLANs, PoE, and Web UI. No full CLI, but sufficient for a straightforward SMB environment. A mid-range option.

When an unmanaged switch is acceptable

• Home office: 1 employee, 3-5 devices, and no sensitive data. A 5-8-port unmanaged switch costing €30 is sufficient.
• Isolated test lab: not connected to the production network. No risk of propagation.
• Short-term extension: a trade show, event, or temporary installation lasting less than 1 week.
• Downstream of a managed switch: if a managed switch handles the VLAN and security controls and you need additional ports in a rack, a cascaded unmanaged mini-switch may be tolerated, although it is not recommended.

OPTINOC recommendations

• SMB with a limited budget (<50 users): Aruba Instant On 1960 (smart-managed, ~€800/switch, free cloud management). The best price-to-feature ratio.
• Standard SMB (50-200 users): Cisco Catalyst 9200-48P or Juniper EX2300-48P. Fully managed L2, PoE+, and stackable.
• Mid-market/Enterprise: Cisco Catalyst 9300-48P-A or Juniper EX4400-48P. L2/L3, MACsec, SD-Access/Mist, and PoE++.
• Absolute rule: if you have IP phones, cameras, or enterprise Wi-Fi, a managed switch is mandatory.

OPTINOC supplies all these switches with the manufacturer's warranty. Request a network sizing assessment based on your number of users and PoE requirements.