Switch Diagram in Networking: Topology, VLANs, and Port Connections

Switch Diagram in Networking: Topology, VLANs, and Port Connections — interactive diagram. Open it in the editor to customise components and wiring.

This is a free printable switch diagram in networking: download the diagram as SVG or open it and print to paper or PDF.

A network switch is a Layer 2 device that forwards Ethernet frames between connected devices using MAC address tables, creating dedicated collision domains per port and forming the foundation of modern local area network infrastructure.

A network switch operates at Layer 2 (Data Link Layer) of the OSI model. Unlike a hub, which broadcasts every received frame out all ports simultaneously, a switch learns the MAC addresses of connected devices by inspecting the source MAC address of each incoming frame and associating it with the receiving port — this process is called MAC address learning. Subsequent frames destined for a known MAC address are forwarded only to the specific port where that device resides, dramatically improving network efficiency and eliminating unnecessary traffic.

In a network switch diagram, each physical port is represented as a connection point on the switch symbol. End devices (computers, servers, printers, IP phones) connect to access ports. Connections to other switches, routers, or upstream network devices connect via uplink ports — typically designated ports with higher-bandwidth transceivers (SFP or QSFP for fibre or high-speed copper). The switch enclosure icon in a diagram is typically a rectangle with multiple port connectors shown.

VLANs (Virtual Local Area Networks) are a fundamental feature of managed switches. A VLAN logically partitions the physical switch into multiple isolated broadcast domains without requiring separate physical switches. Ports are configured as access ports (belonging to a single VLAN, used for end devices) or trunk ports (carrying traffic for multiple VLANs simultaneously, tagged with IEEE 802.1Q VLAN IDs, used for switch-to-switch or switch-to-router links). In a network diagram, VLANs are often shown as coloured zones or labelled groups of ports.

Spanning Tree Protocol (STP) and its variants (RSTP, MSTP) are automatically negotiated between switches to prevent Layer 2 forwarding loops when redundant physical paths exist in the network topology. Without STP, broadcast frames would loop indefinitely, consuming all available bandwidth.

Layer 3 switches add routing capability, allowing inter-VLAN routing without a separate router. They examine IP headers in addition to MAC addresses and maintain a routing table alongside the MAC address table.

How to wire switch diagram in networking

Identify all network devices and their connectivity requirements List all devices to be connected: servers, workstations, printers, IP phones, wireless access points, and network storage. Note the speed requirement (100Mbps, 1GbE, 10GbE) and whether PoE (Power over Ethernet) is needed for phones and access points.
Determine the number of switch ports required Count all end devices plus required uplinks (one per upstream switch or router, plus additional for redundancy). Add 20–30% spare ports for growth. Select a switch with sufficient port count, speed, and PoE budget if required.
Plan the VLAN structure Define VLANs for each traffic type or department (e.g., VLAN 10 for data, VLAN 20 for voice, VLAN 30 for management, VLAN 40 for IoT). Assign a VLAN ID and IP subnet to each. This defines which ports are access ports for which VLAN and which ports carry trunk traffic.
Draw the physical topology diagram Show each switch as a rectangle with port icons. Draw lines connecting each end device to its switch port, and each switch-to-switch or switch-to-router connection. Label each connection with the port number, speed, and cable type (Cat6, Cat6A, OM3 fibre, etc.).
Draw the logical diagram overlaying VLANs On a separate logical diagram (or as an overlay), colour-code or zone devices by VLAN membership. Show trunk links between switches. Show the router or Layer 3 switch handling inter-VLAN routing with the appropriate interface IP addresses from each VLAN's subnet.
Configure switch ports per the diagram Access the switch CLI or management interface. Configure each access port with the correct VLAN: 'switchport mode access; switchport access vlan X'. Configure trunk ports: 'switchport mode trunk; switchport trunk allowed vlan X,Y,Z'. Set native VLAN on trunks per your design.
Verify MAC address table population and connectivity After connecting devices, display the switch MAC address table ('show mac address-table' on Cisco IOS syntax) and verify each device's MAC appears on the expected port. Test inter-device connectivity with ping and verify VLAN isolation with cross-VLAN ping tests.

Specifications

OSI layer of operation	Layer 2 (Data Link) for standard switches; Layer 2 and Layer 3 for multilayer switches
Frame forwarding method	Store-and-forward (full frame received and checked before forwarding) or cut-through (forwarding begins before full frame received)
MAC address table size (typical managed switch)	8,000 – 32,000 MAC addresses
VLAN standard	IEEE 802.1Q (VLAN tagging on trunk ports)
Spanning Tree Protocol standard	IEEE 802.1D (STP), 802.1W (RSTP), 802.1S (MSTP)
PoE standards and power per port	PoE (802.3af): 15.4W; PoE+ (802.3at): 30W; PoE++ (802.3bt): 60W or 90W
Common uplink speeds	1GbE (RJ45 or SFP), 10GbE (SFP+), 25GbE (SFP28), 40GbE (QSFP+)

Safety warnings

PoE switches deliver up to 90W per port (PoE++) at 50–57V DC on Ethernet cable conductors — while not typically lethal in normal use, these voltages can deliver a noticeable shock. Ensure cables and connectors are in good condition and avoid touching bare conductor contacts on PoE-active ports.
Rack-mounted network equipment requires adequate ventilation — blocked airflow causes thermal shutdown and permanent component damage. Maintain minimum recommended clearance around switch vents and avoid stacking equipment that blocks exhaust.
SFP and QSFP laser transceivers (fibre types) emit Class 1 or Class 1M laser light from the port aperture — do not look directly into fibre port openings on active transceivers. Always fit dust caps on unused fibre ports.
Power supply and mains wiring for network equipment must be properly earthed and circuit-protected — use surge-protected power distribution units (PDUs) or UPS in racks, and ensure the rack is earthed to the building earth.
Misconfigured VLANs can inadvertently expose network segments to each other — verify VLAN isolation with connectivity tests before declaring an installation complete.

Tools needed

Network cable tester (for verifying patch cable and structured cabling continuity and wiring standards)
Console cable and terminal emulator (for switch CLI configuration)
Cable crimping tool and RJ45 connectors (if terminating cables on site)
Fibre inspection scope (for verifying cleanliness of fibre connectors before insertion)
Laptop or management workstation (for accessing switch web management interface or SSH CLI)
Rack screwdriver and cage nut tool (for mounting switch in rack)

Common mistakes

Configuring trunk ports as access ports (or vice versa), which causes traffic for VLANs to either fail to traverse inter-switch links or arrive untagged on the wrong segment.
Creating a VLAN on one switch without creating it on all switches in the network that need to carry that VLAN's traffic on trunk ports — devices in the VLAN can connect locally but cannot communicate with devices on other switches.
Leaving all ports in the default VLAN (VLAN 1) without VLAN segmentation, which places all traffic types in a single broadcast domain and reduces security and performance on larger networks.
Not enabling Spanning Tree Protocol (or assuming it is running by default when it has been disabled) in networks with redundant physical switch connections — results in a broadcast storm that disables the entire network.
Connecting two switches with a cable between access ports instead of trunk ports, which causes only the default VLAN to pass between switches.

Troubleshooting

Device cannot communicate with other devices on the same VLAN: Cause: Port is configured in the wrong VLAN, VLAN is not created on the switch, or trunk link between switches does not allow the VLAN Fix: Verify the port VLAN assignment with 'show interfaces switchport' (Cisco syntax). Verify the VLAN is in the switch VLAN database ('show vlan brief'). Verify trunk links carry the VLAN ('show interfaces trunk').
Network storm — all switch port LEDs flashing rapidly, network unusable: Cause: A Layer 2 loop exists — likely a redundant cable creating a loop with Spanning Tree either disabled or misconfigured, or a rogue switch connected without STP enabled Fix: Physically disconnect cables from the network one by one until the storm stops, identifying the loop source. Enable and verify STP on all switches. Never connect two ports of the same switch to each other or create ring topologies without STP enabled.
PoE device does not power up when connected: Cause: Switch PoE budget is exhausted (too many PoE devices), port PoE is disabled, device requires higher PoE class than switch supports, or cable is faulty Fix: Check remaining PoE budget in switch management interface. Enable PoE on the port. Verify cable with a cable tester. Verify the device's required PoE class against the switch's per-port capability.

Frequently asked questions

What is the difference between a network switch and a hub?

A hub repeats every received frame out all other ports simultaneously, creating a single shared collision domain where all devices compete for bandwidth. A switch learns MAC addresses per port and forwards frames only to the specific destination port, giving each port a dedicated collision domain and dramatically increasing effective throughput on busy networks.

What is a VLAN and why is it used in network switch diagrams?

A VLAN (Virtual Local Area Network) logically segments a physical switch into isolated broadcast domains. Devices in different VLANs cannot communicate at Layer 2 without routing. VLANs are used to separate network traffic by function (e.g., data, voice, management), improve security by isolating departments, and reduce broadcast domain size on large networks.

What is the difference between an access port and a trunk port on a switch?

An access port belongs to a single VLAN and carries untagged traffic — it is used to connect end devices (PCs, printers, IP phones). A trunk port carries traffic for multiple VLANs simultaneously, with each frame tagged with an 802.1Q VLAN ID to identify which VLAN it belongs to. Trunk ports connect switches to each other or to routers.

Why do network diagrams show an uplink port separately from access ports?

Uplink ports connect the switch to the upstream network (another switch, a router, or the internet). They are often higher-speed than access ports (e.g., 10GbE uplink on a 1GbE access switch) and may use SFP or QSFP transceivers for fibre connectivity over longer distances. Showing them separately in a diagram clarifies the network hierarchy.

What is Spanning Tree Protocol (STP) and when does it appear in network diagrams?

STP (and its faster variants RSTP and MSTP) prevents Layer 2 forwarding loops in networks with redundant switch paths. STP elects a root bridge and blocks redundant ports, keeping only one active path between any two points. In network diagrams, blocked STP ports are shown with a different symbol or notation to indicate they are standby paths.