Industrial Ethernet switches are specified by port count, operating temperature, EMC immunity, PoE class, and Layer 2/3 feature set, with managed DIN-rail units (typically 5-8 RJ45 ports) standard for any automation cell above 50 EtherNet/IP devices [S2].
Selection starts with the network profile: traffic type (unicast vs multicast), node count, environment (-40°C to +75°C is the common industrial band), power input range (dual 9-60 V DC or 24 V AC non-polarity is typical), and whether the switch sits in a remote I/O cabinet, on a ring, or at the OT/IT boundary [S3][S4][S5].
Switch Class: Unmanaged, Lite-Managed, Fully Managed
Unmanaged switches are plug-and-play Layer 2 devices with no configuration, no VLAN, and no diagnostics, making them acceptable only for small, flat, single-subnet cells where every device uses unicast traffic [S1][S2].
Lite-managed (or "Web-managed") switches add port monitoring, loop detection, RSTP/ERPS ring support, basic VLANs, SNMP, and a browser UI, which is enough for most remote I/O cabinets in EtherNet/IP or PROFINET Conformance Class A (CC-A) networks [S3][S4]. Fully managed switches layer on Layer 3 routing, ACLs, DSCP/QoS, NAT, port mirroring, and full SNMP/Modbus TCP diagnostics, and belong at the core ring, at the OT/IT boundary, or anywhere cybersecurity segmentation is required [S2][S3].
Decision Criteria Comparison
Four selection criteria separate the three classes cleanly: configuration overhead, diagnostic depth, traffic control, and cybersecurity posture. Unmanaged scores zero across configuration, diagnostics, traffic control, and cybersecurity; lite-managed adds basic diagnostics (port status, error counters, loop detection) and limited traffic control (VLAN, basic QoS); fully managed adds full Layer 2/3, granular QoS with DSCP, ACLs, NAT, and full SNMP/Modbus TCP telemetry [S2][S3].
For PROFINET CC-A cells, unmanaged switches with built-in IEEE 802.1p QoS that prioritises Real-Time (RT) frames are a documented fit, because the QoS function runs transparently at Layer 2 and needs no TIA Portal configuration [S5]. For EtherNet/IP cells running unicast only, IGMP snooping adds negligible value, so a managed switch is justified mainly for diagnostics, VLAN segmentation, and port security rather than multicast optimisation [S2].
Port Count, PoE, and Power Input Sizing
Port count is the first hard constraint: 5-port 10/100Base-TX covers a small remote I/O drop, 8-port covers a typical machine cell, and 8-port Gigabit is the practical ceiling for unmanaged PROFINET switches at the machine level, with 9 kB jumbo-frame support on the gigabit models for SCADA diagnostic traffic [S5].
Power-over-Ethernet (PoE) budget matters whenever the switch feeds wireless access points, IP cameras, or PoE-class sensors; industrial PoE switches commonly support 802.3af/at with per-port power budgets that must be summed against the connected device class. Power input on industrial DIN-rail units is almost always dual 9-60 V DC or 24 V AC with reverse-polarity protection, so the same unit can be wired from a 24 V DC panel supply or a 24 V AC transformer without risk of burnout [S4][S5]. Power consumption at 24 V DC is typically under 1 W for a 5-port 100 M switch and under 3.2 W for an 8-port Gigabit, so thermal loading inside a sealed cabinet stays low and fanless designs are realistic [S5].
Environmental and EMC Hardening
Industrial switches are derated relative to commercial switches on three axes: temperature, shock/vibration, and EMC immunity. The common operating-temperature band is -40°C to +75°C, with fanless corrugated aluminum housings rated IP40 for cabinet mounting, a practical floor for most unconditioned control panels and outdoor cabinets [S4][S5].
EMC immunity is published in discrete levels, typically Level 3 or Level 4 for both ESD and surge, with rail-transit and mining applications commonly demanding 4 kV common-mode surge protection on the power terminals [S4]. For hazardous-area plants, switches are not the usual Ex-certified device, but the power supplies, cabling, and field cabinets feeding them must meet ATEX 2014/34/EU or IECEx requirements; the switch itself is normally installed in the safe-area panel and feeds Ex-rated field devices through barriers.
Network Architecture and Layer 3 Boundary
The mainstream pattern for plants above 50 nodes is a tiered topology: lightly managed switches in every remote I/O cabinet, a fully managed core ring with ERPS or RSTP, and a fully managed Layer 3 boundary switch between the automation subnet and the business/IT network [S2][S3].
For 12 or more remote I/O cabinets, a Stratix-class lightly managed switch at roughly $150-200 per cabinet adds per-cabinet diagnostics during commissioning and troubleshooting, and the all-managed-cabinet configuration costs roughly $3,000-4,500 versus $1,200-2,000 for an all-unmanaged build, so the operational payback is typically under one downtime event [S2]. The Layer 3 boundary should implement VLAN separation (e.g. 192.168.10.0/24 for automation versus 192.168.1.0/24 for business), ACLs that restrict inter-VLAN traffic to essential flows, optional NAT for device isolation, and static routes for predictable traffic patterns [S2]. Avoid the default 192.168.1.0/24 subnet for automation; 10.x.x.x/16, 172.16.x.x/16, or 192.168.10.0/24-192.168.254.0/24 are the common safer alternatives [S2].
Who Should NOT Pick the Mainstream Managed Switch
Plants with fewer than ~20 nodes on a single subnet, pure unicast traffic, no cybersecurity mandate, and no requirement for per-cabinet diagnostics are better served by unmanaged or lite-managed units, because the configuration overhead of a fully managed switch (VLAN plan, ACL set, SNMP integration) is not amortised over such a small node count [S1][S2].
Similarly, machine builders shipping standard PROFINET CC-A cells with S7-1200 or S7-1500 controllers do not need IT-grade managed switches in the cell; an unmanaged switch with hardwired 802.1p QoS for RT frames is the documented match, and the saved configuration time is significant when the same machine is rolled out in volume [S5]. For hazardous-area cabinets, specifying an Ex-d rated switch is rarely necessary; locate the switch in the safe-area panel and run armoured cable to the field, which keeps the switch replacement simple and avoids the Ex-certification premium.
Selection Shortlist Logic
Use a 5-step filter: (1) port count and speed (5/8-port 100 M or 1000 M); (2) PoE class and total PoE budget; (3) temperature band (-40°C to +75°C is the industrial default); (4) EMC level (Level 3 for office-adjacent panels, Level 4 for VFD-dense or rail cabinets); (5) management class (unmanaged / lite-managed / fully managed) tied to node count and OT/IT segmentation need [S2][S3][S4][S5].
For a 50-200 node EtherNet/IP cell with mixed PLCs, drives, and remote I/O, the published recommendation is lightly managed switches in every cabinet plus a fully managed core and a Layer 3 OT/IT boundary switch, with VLAN/ACL segmentation and non-default subnets [S2]. For a small PROFINET CC-A machine cell, an unmanaged switch with 802.1p QoS, dual 9-60 V DC power, and -40°C to +75°C operation is the documented fit [S5]. Trackable signals for the next planning cycle are PROFINET CC-B/CC-C adoption, TSN (IEEE 802.1Qbv) support in managed DIN-rail switches, and the rollout of cybersecurity certifications such as IEC 62443-4-2 on the switch firmware itself. Related reading for adjacent spec work covers SCADA software suppliers and manufacturers: 2026 platform map and Welding Cell Interlock Switch Selection: Spec Map for 2026, while mechanical line builders can cross-reference Slewing Ring Bearing Selection for Packaging Lines.
Spec-level background on the components involved: linear guide, crossed roller guide, and lamps and light fittings.