Managed vs Unmanaged Switch

Choose an unmanaged switch for more Ethernet ports on one shared home LAN; our simple-expansion pick is the TP-Link TL-SG108S-M2 V2. Choose managed for a named control—VLAN assignments, port diagnostics or link aggregation—and consider the Zyxel XMG1915-10EP when you also need PoE. Guest or IoT separation needs a compatible router and AP configuration too.

Quick picks

Compare specifications and all conditions

More sockets on the same LAN

Clear choice

Keep a working unmanaged switch; choose TL-SG108S-M2 V2 for new 2.5G expansion

Main limit

No configurable VLAN membership

VLANs plus powered APs

Clear choice

XMG1915-10EP

Main limit

Configure the complete path; switch management alone is insufficient

Full comparison table ↔

Swipe to compare. Row labels stay visible.

Your need	Clear choice	Main limit
More sockets on the same LAN	Keep a working unmanaged switch; choose TL-SG108S-M2 V2 for new 2.5G expansion	No configurable VLAN membership
VLANs plus powered APs	XMG1915-10EP	Configure the complete path; switch management alone is insufficient

Your need	Clear choice	Main limit
More sockets on the same LAN	Keep a working unmanaged switch; choose TL-SG108S-M2 V2 for new 2.5G expansion	No configurable VLAN membership
VLANs plus powered APs	XMG1915-10EP	Configure the complete path; switch management alone is insufficient

Buying guide: compare controls, not labels

An unmanaged switch forwards traffic without an administration interface. “Smart,” “easy managed” and “fully managed” describe feature tiers; read the exact model's manual rather than treating the label as a checklist (TP-Link's tier explanation).

Zyxel's feature list and series manual document these model-specific controls. NETGEAR explains the gigabit port limit.

Aggregation trap: Zyxel supports static aggregation and LACP, but its documented distribution algorithm keeps matching source/destination traffic on the same member link. Do not buy it expecting one file transfer to double in speed; configure both ends before connecting parallel cables.

Simple expansion: TP-Link TL-SG108S-M2 V2

The official V2 specification lists eight 100 Mbps/1G/2.5G RJ45 ports, fanless cooling and plug-and-play operation. Reserving a port for the router leaves seven device connections, calculated from that port count.

Ordinary single-LAN connection

Connect a router LAN port to the switch, then cable each wired device to its own switch port. This adds connections on the same LAN; it does not create a guest or IoT boundary. The router remains the internet gateway (router and switch roles).

Tap a label to explore. You can also hover or use your keyboard.

1. 01Internet via router+

   Use a router LAN port for the switch connection.

   Sources: 1: The router provides WAN connectivity; switches connect LAN devices.
2. Ethernet from router LAN
   02TL-SG108S-M2 V2+

   Plug-and-play expansion; no VLAN membership configuration.

   Sources: 2: The selected TP-Link switch is plug and play., 3: An ordinary unmanaged switch operates on a flat network.
3. Separate Ethernet cables
   03Desktop, NAS or console+

   These devices share the LAN; the switch creates no IoT boundary.

   Sources: 3: An ordinary unmanaged switch operates on a flat network.

Illustrative layout. Wired clients use separate switch ports on the same LAN.

Source notes3 references+

1. 1

   The router provides WAN connectivity; switches connect LAN devices.

   www.tp-link.com ↗ — source for The router provides WAN connectivity; switches connect LAN devices.

   In a typical office network, a router handles WAN connectivity and inter-network routing, while switches handle device connectivity within the LAN.

2. 2

   The selected TP-Link switch is plug and play.

   www.omadanetworks.com ↗ — source for The selected TP-Link switch is plug and play.

   Plug and Play . Allows for easy deployment without the need for a technician.

3. 3

   An ordinary unmanaged switch operates on a flat network.

   www.tp-link.com ↗ — source for An ordinary unmanaged switch operates on a flat network.

   Every port operates on the same flat network.

Revision matters: this pick covers TL-SG108S-M2 V2. Match the full suffix and revision in the hardware selector.

A manufacturer conflict worth catching: TP-Link's generic tier article says unmanaged switches have no QoS. This exact V2 page lists 802.1p/DSCP QoS, IGMP snooping and loop prevention. Those automatic features do not give you configurable VLAN membership.

VLANs and PoE: Zyxel XMG1915-10EP

The 10EP specifications list eight 2.5G PoE copper ports, two 1G/10G SFP+ slots and fanless cooling. Power is up to 60 W per port within a shared 130 W budget; the per-port maximum is not simultaneously available across every port.

NebulaFlex offers standalone web management or optional Nebula cloud management. Check feature availability: Zyxel says some Nebula features require an additional license. The example uses the local web interface.

Variants: XMG1915-10E omits PoE; XMG1915-18EP changes the port count, power budget and cooling. SFP+ slots are not RJ45 sockets; do not mistake the uplink rating for the copper ports' speed.

Complete VLAN example: router, switch and AP

This worked kit adds a UniFi Cloud Gateway Ultra and U7 Pro XG Black to the Zyxel. Keep an existing router/AP if they expose the same controls; ordinary mesh backhaul support is not evidence of SSID-to-VLAN mapping.

The gateway runs UniFi Network and has four gigabit ports plus a default 2.5 GbE WAN port: this example's gateway uplink is 1 Gbps. The AP supports 10/5/2.5/1 GbE, uses PoE+, and requires UniFi Network 9.1.120 or later for Black. It can therefore use a Zyxel 2.5G powered copper port; this kit does not provide an end-to-end 10G path (AP link rates).

Our illustrative configuration uses Home on native VLAN 1 and IoT on tagged VLAN 20. These are example assignments, not new factory defaults. Create IoT in Settings > Networks, choose its VLAN ID and a separate subnet, and configure DHCP on the gateway (VLAN creation).

Tap a label to explore. You can also hover or use your keyboard.

1. 01Cloud Gateway Ultra+

   Create separate networks and enforce inter-VLAN isolation here.

   Sources: 1: UniFi networks have configurable VLAN, subnet and DHCP settings., 4: UniFi Network Isolation creates rules blocking inter-VLAN traffic.
2. Home native; IoT tagged
   02XMG1915-10EP+

   Configure VLAN membership on uplinks and access ports.

   Sources: 2: Trunk ports carry multiple VLANs; access ports carry one., 3: AP VLAN assignments must be permitted across the path to the gateway.
3. Same VLANs, plus PoE
   03U7 Pro XG Black+

   Map the IoT SSID to its VLAN in UniFi Network.

   Sources: 3: AP VLAN assignments must be permitted across the path to the gateway., 5: The U7 Pro XG uses PoE+ power.
4. Join the IoT SSID
   04IoT Wi-Fi clients+

   SSID assignment puts clients in IoT; gateway policy controls routed access.

   Sources: 3: AP VLAN assignments must be permitted across the path to the gateway., 4: UniFi Network Isolation creates rules blocking inter-VLAN traffic.

Example assignments, not factory defaults. The port table also shows the wired IoT and administration branches.

Source notes5 references+

1. 1

   UniFi networks have configurable VLAN, subnet and DHCP settings.

   help.ui.com ↗ — source for UniFi networks have configurable VLAN, subnet and DHCP settings.

   Optionally configure settings such as VLAN ID, subnet range, DHCP, isolation, content filtering, and DNS.

2. 2

   Trunk ports carry multiple VLANs; access ports carry one.

   help.ui.com ↗ — source for Trunk ports carry multiple VLANs; access ports carry one.

   Trunk ports allow traffic for multiple VLANs, while access ports handle traffic for a single VLAN

3. 3

   AP VLAN assignments must be permitted across the path to the gateway.

   help.ui.com ↗ — source for AP VLAN assignments must be permitted across the path to the gateway.

   Ensure all ports between your selected APs and gateway are configured to allow the specified network’s VLAN ID (see below).

4. 4

   UniFi Network Isolation creates rules blocking inter-VLAN traffic.

   help.ui.com ↗ — source for UniFi Network Isolation creates rules blocking inter-VLAN traffic.

   Network Isolation , which automatically configures the necessary firewall rules to block inter-VLAN traffic.

5. 5

   The U7 Pro XG uses PoE+ power.

   techspecs.ui.com ↗ — source for The U7 Pro XG uses PoE+ power.

   Power Method PoE+

Configure the selected gateway LAN port and Zyxel ports to agree:

In Zyxel's SWITCHING > VLAN > VLAN Setup, make the intended ports Fixed members and enable Tx Tagging for tagged membership. Forbid VLAN 1 on port 3; forbid VLAN 20 everywhere except ports 1, 2 and 3. Set PVID for incoming untagged traffic, enable Ingress Check, and use Untag Only on endpoint access ports. Leave VLAN Trunking off here: Zyxel defines this checkbox as forwarding unknown VLANs.

The manual's early example confusingly says PVID 2 sends traffic to VLAN 1; its formal PVID definition assigns untagged frames to the VLAN the tag defines. Use that definition when applying the table above.

Adopt the AP on Home, then in Settings > WiFi map an IoT SSID to the IoT network. Keep VLAN 20 tagged across the entire AP-to-gateway path; making it the AP port's native VLAN breaks this configuration (SSID instructions, port terminology).

Enforce the boundary and protect administration

Keep inter-VLAN routing on the gateway in this example; do not add a second routing path on the Zyxel. On IoT, enable Network Isolation, which creates firewall rules blocking inter-VLAN traffic. It does not imply isolation between devices within IoT; AP client isolation has a different scope (isolation controls).

Keep switch and AP administration on Home. Restrict Zyxel management services to trusted computers using SECURITY > Access Control > Remote Management. Protect gateway administration separately: UniFi's Gateway zone includes management, DHCP and DNS, so preserve necessary services when restricting IoT access. Zone-based rules require gateway software 4.1 or newer. Check both IPv4 and IPv6 policies (firewall directions and exceptions).

Migrate gradually and verify

Verify before moving the remaining devices.

1. 1

   Keep a recovery path

   Back up configurations and keep an administration computer on Home while changing ports.

2. 2

   Check assignment

   Move a pilot wired device and an IoT Wi-Fi client. Renew their leases; confirm the intended subnet, gateway, DNS and internet access.

3. 3

   Check allowed and denied traffic

   Verify Home services still work. Attempt a known reachable Home service from IoT by IP, then check the matching firewall log; repeat for IPv6 if enabled. A failed ping alone is insufficient evidence.

4. 4

   Save and recheck

   On the Zyxel, Apply writes to runtime memory; use Save for persistence. Reboot after saving and repeat the checks before migrating the remaining devices.

If Wi-Fi clients cannot obtain addresses, trace every upstream port's tagging back to the gateway (VLAN troubleshooting). Retain an unmanaged switch downstream of an access port when everything connected to it should share that VLAN; do not use it as the segmentation enforcement point.

For hardware selection after this decision, compare 2.5G and 10G switches, PoE budgets and access points.

How we choose

This documentation-based comparison uses official specifications and configuration manuals, checked November 2, 2026. The layouts are suggested configurations; the spare-port count is arithmetic. Recommendations reflect documented controls and compatibility, without physical performance testing. See our research method.

Verdict

Keep unmanaged for a shared LAN. Pick TL-SG108S-M2 V2 for simple 2.5G expansion or XMG1915-10EP for configurable VLANs with PoE. Buy management when you need its controls, then configure and verify the complete network boundary.