Simple explanation
It's not enough to know what a device does — you need to know WHERE it belongs in a network design, and what specific features matter for that placement.
Technical explanation
- Layer 2 vs. Layer 3 switches — Layer 2 switches only forward based on MAC address within a VLAN; Layer 3 switches can also route between VLANs, blurring the line between switch and router.
- Managed vs. unmanaged switches — managed switches support VLANs, port security, and monitoring; unmanaged switches are plug-and-forward with no configuration.
- PoE (Power over Ethernet) — delivers power and data over the same cable, critical for placing devices like APs and cameras without needing a separate power outlet nearby.
- Placement considerations: a core switch belongs in a controlled, redundant location (data center); access switches belong close to end-user devices; firewalls belong at trust boundaries (internet edge, between segments of differing sensitivity); APs need placement optimized for coverage, not convenience.
- Redundancy features: dual power supplies, redundant uplinks, and protocols like STP (Spanning Tree Protocol) that prevent switching loops when redundant physical links exist.
Synonyms / related terms
| Term | Means | |---|---| | PoE | Power over Ethernet | | STP | Spanning Tree Protocol | | L3 switch | Layer 3 (routing-capable) switch |
Concept Check
"An organization wants to connect two redundant physical links between two switches for resilience, but starts experiencing a broadcast storm shortly after." This is the classic symptom of a switching loop — without STP (or a similar loop-prevention protocol) enabled, redundant physical paths between switches create loops that broadcast traffic endlessly circulates through, rather than providing the intended resilience.
Interview-style Q&A
Q: Why place a firewall between network segments of differing sensitivity, rather than just at the internet edge? A: "A single edge firewall only protects against external threats. Internal segmentation with firewalls (or at least ACLs) between, say, a finance VLAN and a general office VLAN protects against lateral movement — if one segment is compromised, the firewall at that boundary limits how far the compromise can spread internally, which an edge-only design can't provide at all."
Memory trick
"Core is Central, Access is Adjacent, Firewall is at the Frontier" — three device types, each tagged to where it physically/logically belongs in the network.