The question that stalls most industrial switch rollouts is the simplest one: at the access layer, do you put a layer 2 or a layer 3 box? Short answer — a layer 2 network switch handles same-subnet forwarding and VLAN isolation, while a layer 3 switch adds IP routing on top so different VLANs can actually talk. In surveillance and factory builds they aren't ranked by "better"; they work different floors.
A layer 2 switch lives at the data link layer (OSI layer 2) and reads MAC addresses. It does three jobs: forward frames out the right port, carve VLANs by IEEE 802.1Q, and block loops with STP/RSTP. Only managed models support this; an unmanaged one is plug-and-play.
Walk into a workshop cabinet feeding cameras, PLCs, and office PCs and you'll mostly find a layer 2 industrial ethernet switch. It keeps the broadcast domains of the surveillance, control, and office VLANs apart — but it won't let those three VLANs chat. That's deliberate; it's not its job.
In the field, access gear is almost always DIN-rail, fanless, and rated -40 to 75°C. A 12-port layer 2 unit like the 3onedata TNS5800 (4 Gigabit + 8 Fast Ethernet, M12 connectors, EN 50155 certified) is the typical rail or vehicle access point.
A layer 3 switch is layer 2 switching plus network-layer routing. Beyond the MAC table it keeps an IP routing table and an ARP table, and can run static routes, RIP, OSPF, even VRRP for gateway redundancy.
The key trick is Vlanif: a layer-3 logical interface per VLAN acts as its gateway. Give the surveillance VLAN gateway 192.168.10.1 and the office VLAN 192.168.20.1, and the layer 3 box consults its routing table to move cross-subnet traffic — the VLANs intercommunicate. A layer 2 device can't do this.
Industrial layer 3 units usually ship with 10G uplinks. The 3onedata ICS5028G / ICS5428 series is a 28-port 10G layer 3 switch with four 10G SFP+ uplinks, static/RIP/OSPF/VRRP, ERPS ring failover under 20 ms, and -40 to 75°C fanless. The cisco switch IE3200 line and MOXA's MDS-G4020-L3 (modular, up to 20 Gigabit ports, OSPF + static, 16K MAC, 256 VLANs, 8 priority queues, IEC 62443 and EN 50155) are regulars in the core.
One test only: do your endpoints need to reach across subnets?
A workshop with twenty-odd cameras, no split between surveillance and office, single segment → a layer 2 poe switch at access plus an upstream router is enough. Going layer 3 there just burns money.
The moment you cut "surveillance / control / office" into three VLANs, and the control net needs to pull camera feeds while office checks recordings, the core has to be layer 3 — otherwise the VLANs never connect. Forcing layer 3 into a small network adds roughly 2–3× the budget and one more config layer for zero gain.
The core does two things: aggregate every access switch below it, and act as the whole-network gateway running internal routing. Drop a layer 2 device at the core and all those VLANs stay isolated — cross-VLAN traffic can't get out, so you'd bolt on a router anyway. A layer 3 network switch does inter-VLAN routing in hardware, far lower latency than a router-on-a-stick, which is why campuses and factory backbones rely on it.
Core uplinks usually need 10G to reach the OLT or core router — exactly what the four 10G SFP+ ports on an ICS5028G are for. Rayin's industrial ethernet switch lineup specs its layer 3 models the same way.
Take a workshop with 48 cameras + 16 PLCs + 20 office PCs, split into surveillance, control, and office VLANs:
Access-surveillance: layer 2 industrial PoE switch, 24× Gigabit PoE (802.3at), DIN-rail, 30 W per port / 370 W total, -40 to 75°C; no routing, trunk uplink.
Access-control: layer 2 industrial switch, 8–16× Gigabit, DIN-rail, -40 to 75°C, no PoE, no routing.
Access-office: layer 2 non-PoE switch, 24× Gigabit, rack, room temp.
Core: layer 3 industrial switch, 28-port 10G (4× 10G SFP+ uplink), 1U rack, -40 to 75°C fanless, dual power redundant; static/OSPF, three VLAN gateways.
One trap: 48 cameras on 802.3af (about 12.95 W each) is 48 × 13 ≈ 624 W, plus 20% headroom ≈ 750 W. A single 24-port PoE switch commonly budgets only 370 W, so split surveillance across two access units — don't try to run the whole floor on one. That surveillance-access box is essentially a PoE access unit; pick by power budget before port count.
1、Can a layer 2 switch cross VLANs?
No. VLANs are isolated at layer 2; crossing them needs a layer 3 device (or router) with a Vlanif gateway. A layer 2 switch reads MAC, not IP subnets.
2、Layer 3 switch vs router — what's the difference?
A layer 3 switch does internal VLAN routing in hardware: low latency, LAN-friendly. A router carries NAT and WAN interfaces; leaving the public network is still the router or firewall's job. Don't expect a layer 3 switch to do your NAT.
3、Does a small factory need layer 3?
Twenty-odd cameras, no departments, single segment — no. One layer 2 poe switch at access plus an upstream router is enough. Step up to layer 3 only when the network grows and you need VLAN isolation.
4、How do industrial and data-center switches differ?
Industrial units need -40 to 75°C, fanless, DIN-rail, EMC and surge certification, redundant power. Data-center switches sit in air-con and are cheap per port. Temperature and power redundancy are the hard gates on the factory floor — and the easiest thing to overlook when specifying an industrial ethernet switch.
There's no "better" between layer 2 and layer 3, only a division of labor: layer 2 at access to connect endpoints and carve VLANs, layer 3 at core to be the gateway and run routing. Settle "do I need cross-VLAN?" first and the model and budget follow.
This article is compiled by Rayin, a specialist in industrial communication equipment. For more product solutions visit www.szrayin.com.
