Access Switching for UK Networks: Design, PoE, VLANs and Edge Security

Access switching is the layer where every laptop, phone, camera and access point joins the network, which makes it the place where most security and reliability problems start. A sound access switching design for a UK organisation does five things: it picks a two tier or three tier structure that fits the site, it controls who and what can connect to each port, it blocks rogue DHCP servers and broadcast storms at the edge, it plans PoE power per switch, and it reports problems before users do. This guide takes each in turn, with references to vendor documentation and the NCSC's Cyber Essentials requirements.

Codeeo Tech supplies switching hardware from Dubai, with UK delivery on request. We do not design or install networks in the UK, so treat this as a buyer's and planner's view, and have your installer confirm the configuration for your site.

Where the access layer sits: two tier or three tier

Classic campus design has three layers. The access layer connects end devices. A distribution layer aggregates groups of access switches and applies policy between them. A core layer moves traffic between distribution blocks, the server room and the internet edge as fast as possible.

Most UK offices do not need all three. In a two tier design, often called a collapsed core, the distribution and core roles merge into one pair of switches, and every access switch uplinks directly to that pair. Cisco positions the Catalyst 9500 family for exactly that role, describing it as a fixed platform for enterprise core and aggregation.

A rough way to decide:

• Two tier suits a single building or campus where all access switches can reach one central comms room over fibre. It is cheaper, has fewer hops and is easier to troubleshoot.
• Three tier earns its place when there are several buildings, each with many access switches, so that a separate distribution pair per building keeps the number of fibre runs into the core manageable and contains failures inside one building.

Whichever you choose, the access layer design below stays largely the same. The difference is only where its uplinks land.

VLANs at the edge: separate traffic by purpose

An access port should carry only what the device on it needs. That usually means separate VLANs for staff devices, voice, guests, cameras and building systems, and printers or other shared devices if there are many. A desk port with an IP phone and a PC behind it carries a data VLAN and a voice VLAN; a camera port carries only the camera VLAN.

Separation matters for UK compliance as well as tidiness. The NCSC's Cyber Essentials Requirements for IT Infrastructure v3.3 defines a sub set as part of the organisation whose network is segregated from the rest by a firewall or VLAN, and allows unsupported software to be taken out of scope by placing it in a defined sub set that prevents all traffic to or from the internet. An old building management controller that cannot be patched can therefore sit in its own VLAN with no internet route, rather than dragging the whole network out of compliance. Our walkthrough of segmenting a small office network with VLANs covers a practical VLAN plan.

Two habits keep the VLAN plan clean. Shut down unused ports and place them in an unused VLAN, so a free socket in a meeting room is not a free connection. And keep trunk ports, which carry many VLANs, only on uplinks and on ports that genuinely need them, such as access points.

Port security and 802.1X: controlling who connects

There are two levels of control at an access port.

Port security limits how many device addresses a port will accept and what happens when that limit is broken. It stops someone plugging a small unmanaged switch into a desk socket to connect several devices, and it is quick to configure. It does not prove who a device is, only how many there are.

802.1X with network access control asks each device to authenticate before the port forwards its traffic, typically against a RADIUS server tied to your directory. A company laptop with the right certificate lands in the staff VLAN; an unknown device lands in a guest or quarantine VLAN, or nowhere. Devices that cannot run 802.1X, such as many printers and cameras, can be handled by MAC address based authentication with a tighter VLAN. NAC takes more planning than port security, but it is the stronger answer where staff and visitors share open plan space.

For a smaller UK office, a reasonable path is port security and shut down unused ports now, with 802.1X added once the directory and certificate setup are ready. Make sure the switches you buy support it at the licence tier you are ordering.

DHCP snooping, ARP inspection and IP Source Guard

A device that answers DHCP requests on a user port, whether a misconfigured home router someone brought in or a deliberate attacker, can hand out wrong gateway addresses and take a floor offline. DHCP snooping stops that. Cisco's guide to DHCP snooping on Catalyst 9000 switches describes it as acting as a firewall between untrusted user ports and DHCP server ports, notes that all interfaces are untrusted by default, and explains that uplinks towards the legitimate DHCP server must be set as trusted.

Snooping also builds a binding table of which address was issued to which device on which port. Cisco notes that Dynamic ARP Inspection and IP Source Guard use that same table. Dynamic ARP Inspection blocks forged ARP replies, which are a common way to intercept traffic on a local network. IP Source Guard stops a device sending traffic from an address it was not issued. Turning on snooping first, and checking that the binding table looks right, is the foundation for the other two.

One caution from Cisco's documentation: trust only the ports that genuinely face the DHCP server. A trusted port pointing at user devices undoes the protection.

Storm control: containing loops and floods

A patch lead plugged into two wall sockets, or a faulty device flooding the network, can create a broadcast storm that saturates every link in the VLAN. Spanning tree should stop loops, but storm control is a second line of defence at each access port.

Cisco's Catalyst 9300 security configuration guide says storm control prevents traffic on a LAN from being disrupted by a broadcast, multicast or unicast storm. Thresholds can be set as a percentage of port bandwidth, in packets per second or in bits per second. When the rising threshold is reached the port blocks that traffic, and you can choose to have the port shut down into an error disabled state or to send an SNMP trap. The guide also warns that multicast storm control can block routing protocol traffic, so apply it with care on ports that carry routing.

On user facing ports, broadcast storm control with a trap is a sensible default. Whether to shut the port is a judgement: it contains the problem, but it also cuts off a user until someone brings the port back up.

Loop protection on edge ports

Storm control limits the damage from a loop; spanning tree settings on the edge ports stop most loops forming in the first place. Three settings are standard practice on ports that face end devices rather than other switches.

• Edge port mode. Cisco calls it PortFast. It lets a port that connects a single device start forwarding straight away instead of waiting through the spanning tree listening and learning stages, so laptops get an address quickly and PXE boot works.
• BPDU guard. If a port in edge mode ever receives a spanning tree message, it means another switch has been plugged in. BPDU guard shuts the port rather than letting an unknown switch join the topology.
• Root protection on uplinks. Fix the spanning tree root at the core or distribution layer, and protect it so that no access switch can take over the role by accident.

These settings belong in the standard port template, alongside the VLAN, port security and storm control lines, so every new switch on every floor goes in configured the same way. A written template also makes it far easier for a second engineer, or an auditor, to see what the edge is meant to look like and spot a port that has drifted from it.

PoE planning at the edge

Most new access switching estates are mainly PoE, because access points, phones, cameras and meeting room panels all draw power from the switch. Two numbers need planning: the maximum each port can deliver, and the total the switch can supply.

Cisco's Catalyst 9300 data sheet gives 15.4 W per port for PoE, 30 W for PoE+, 60 W for Cisco UPOE and 90 W for Cisco UPOE+ on specific models. The Catalyst 9200 family delivers PoE+ at up to 30 W a port. Check what each device class actually needs: a current wireless access point may want more than PoE+, while a desk phone needs far less. Our PoE standards explainer lists the classes.

Then compare the total. Add up the worst case draw for every powered device on a switch and compare it with the PoE budget of the installed power supplies. Cisco notes that the Catalyst 9300 supports dual redundant power supplies but ships with one, so the budget you get depends on what you order. Leave margin for the devices you will add, and remember that the UPS behind the switch has to carry the PoE load as well.

Monitoring and patching at the edge

An edge layer that nobody watches tends to fail quietly. At minimum, send syslog and SNMP traps from every access switch to a central collector, and alert on ports going into an error disabled state, storm control events, DHCP snooping drops, power supply failures and PoE budget warnings. Those events are often the first sign of a loop, a rogue device or a failing access point.

Patching is the other half. The NCSC requirements say software on in scope devices, which explicitly includes network software and router and firewall firmware, must be licensed and supported, and updated within 14 days of release where the update fixes critical or high risk vulnerabilities. A switch family past its end of support cannot meet that. Plan software upgrades as routine maintenance, and read our piece on firmware updates that break networks before scheduling the first one.

Frequently asked questions

What is the difference between access switching and core switching?

Access switching connects end devices and enforces edge policy such as VLANs, 802.1X and storm control. Core switching moves traffic between access blocks, servers and the internet edge, and is built for throughput and redundancy rather than port count.

Do small UK offices need 802.1X?

Not on day one. Port security, disabled unused ports and a sensible VLAN plan cover the basics. 802.1X is worth adding where visitors or contractors can reach network sockets, and when the directory and certificates are ready for it.

Can a VLAN help with Cyber Essentials?

Yes, in a specific way. The NCSC defines a sub set as part of a network segregated by a firewall or VLAN, and a sub set that prevents all internet traffic can take unsupported devices out of scope.

Should storm control shut ports down?

On user ports, many teams start with traffic blocking plus an SNMP trap, then move to shutdown for ports where a loop would be serious. Cisco's guide supports both actions.

Which switches does Codeeo Tech supply for access switching?

Codeeo Tech lists Cisco Catalyst access models and HPE Aruba CX ranges among others, all through Add to Quote, supplied from Dubai with UK delivery on request.

What to send with an access switching enquiry

Models on the Codeeo Tech store include the Catalyst C9300X-48HX for high power PoE, the C9200L-48P-4X for standard PoE+ desks, and the Aruba CX 6100 series. With an enquiry, send:

1. Whether the site is two tier or three tier, and the core or distribution switch model the access layer will uplink to.
2. Port counts per switch and a list of powered devices with their PoE class.
3. Which edge features you need at launch: 802.1X, DHCP snooping, storm control.
4. Whether Cyber Essentials applies, so supported software dates can be checked.
5. The UK delivery address and EORI number for import.

Send those through the Codeeo Tech contact form and the reply can match models, licence tiers and power supplies to the design.

Cover photo: Ethernet connector, via Wikimedia Commons (CC0).