Industrial Ethernet Switch Commissioning Checklist

Why switch commissioning deserves attention

Managed Ethernet switches are often treated as passive hardware until something stops talking. In a SCADA or automation network, the switch is part of the control system. It carries PLC traffic, HMI traffic, historian collection, remote I/O, drives, protocol gateways, engineering workstations, and sometimes vendor package equipment.

A switch can be physically installed and still be poorly commissioned. Wrong VLANs, unused default credentials, blocked multicast, mismatched port speed, missing time sync, and undocumented fiber paths can create faults that look like PLC, SCADA, or device problems. A short commissioning checklist prevents many late-night troubleshooting sessions.

Record the switch identity

Start with asset information before touching configuration. The switch should be traceable in drawings, backups, labels, and monitoring tools.

Record:

Manufacturer and model.
Hardware revision, if relevant.
Serial number.
Firmware version.
Cabinet or panel location.
Switch hostname.
Management IP address and subnet.
Default gateway, if used.
Uplink ports and destination switches.
Power source or redundant power sources.

Use the same name in the switch configuration, network diagram, SCADA notes, and backup file. A hostname like SW-WTP-MCC1-01 is more useful than a default name or a vague cabinet reference.

Confirm physical installation

Many network faults begin as physical problems. Check the installation before investigating protocols.

Copper ports

Verify that each copper cable is landed in the expected port and labeled at both ends. Confirm cable category and route are appropriate for the environment. Look for tight bends, damaged jackets, loose boots, or patch cords stretched across doors.

Check port link speed and duplex. Most modern devices use auto-negotiation, but older PLCs, radios, converters, or embedded devices may behave differently. A speed or duplex mismatch can cause intermittent timeouts that are difficult to diagnose from the HMI.

Fiber ports

For fiber uplinks, record the transceiver type and fiber path. Confirm single-mode versus multimode, connector type, and expected distance. If the switch provides optical diagnostics, note receive levels during commissioning. Marginal light levels may work during startup and fail later after patching or temperature changes.

Power and grounding

Confirm the switch power input matches the design and that redundant supplies are actually connected to independent sources when redundancy is claimed. Check grounding and cabinet bonding according to the site electrical standard. Industrial switches often survive harsh conditions, but they still need correct installation.

Lock down management access

Do not leave production switches with default credentials or unmanaged access.

Minimum checks:

Change default passwords.
Disable unused management services.
Prefer secure management protocols where supported.
Restrict management access to the engineering or maintenance network.
Configure user roles if the switch supports them.
Record credential ownership according to site policy.
Confirm remote access paths are approved.

Avoid building a network that can only be managed from one engineer's laptop. The site needs a controlled way to support the switch after handover.

Configure addressing and names

Give the management interface a documented static IP address unless the site has a deliberate DHCP reservation process. Confirm subnet mask and gateway. If DNS or NTP hostnames are used, verify name resolution from the switch.

Set the switch hostname, location, and contact fields if supported. These values appear in monitoring systems, logs, SNMP tools, and backup files. Good names reduce confusion during outages.

Validate VLANs and port roles

VLAN errors are common during commissioning. A device can show link up while sitting in the wrong logical network.

For each port, document the role:

Access port for PLC, HMI, drive, remote I/O, camera, or gateway.
Trunk or tagged uplink to another switch.
Spare port.
Disabled port.
Mirror or diagnostic port.

For access ports, confirm the untagged VLAN. For trunk ports, confirm allowed VLANs and native VLAN behavior. Do not assume vendor defaults match the project design. If quality of service, priority tagging, or industrial protocol profiles are used, verify the configuration against the official documentation for the equipment involved.

Disable unused ports when site policy requires it, or at least document them as spare. Open spare ports in a control cabinet can become undocumented network changes later.

Check loops and redundancy

Redundant network paths need deliberate configuration. Do not connect redundant links and hope the network sorts itself out.

Verify the intended redundancy method, such as a ring protocol, spanning tree variant, or vendor-specific redundancy feature. Confirm it is enabled only where intended and that all participating switches support the chosen method. Mixing features without design review can create outages.

Test practical behavior where safe:

Disconnect one uplink and confirm communication recovers as expected.
Reconnect the uplink and confirm the network stabilizes.
Check switch logs for topology changes.
Confirm PLC, HMI, historian, and gateway communication after failover.
Record observed recovery time if the process depends on it.

Perform these tests in a controlled window. Some devices tolerate network interruptions better than others.

Review multicast and broadcast behavior

Industrial networks may use multicast or broadcast for discovery, I/O, time sync, redundancy, or vendor-specific functions. Incorrect filtering can break communication; no filtering can flood weak devices.

Review features such as IGMP snooping, multicast querier settings, storm control, and broadcast limits. Use conservative settings that match the site architecture and vendor recommendations. If a protocol requires multicast, verify it across the exact ports and VLANs where it must operate.

Watch for symptoms such as devices visible from one cabinet but not another, I/O connections dropping when a laptop is plugged in, or camera traffic affecting PLC scans. These are network design issues, not operator problems.

Enable time, logs, and monitoring

A switch without time sync produces logs that are hard to use. Configure NTP or the site-approved time source where supported. Confirm time zone or UTC handling so event review is consistent.

Enable useful diagnostics:

Syslog destination, if available.
SNMP or monitoring integration, if approved.
Link up/down events.
Authentication events.
Redundancy topology changes.
Port error counters.
Temperature and power supply alarms.

SCADA does not need to show every switch detail, but critical network health should be visible somewhere. At minimum, operations and maintenance should know when an uplink is down, a ring is broken, or a switch is running on one power supply.

Back up the configuration

Before handover, export the running configuration and store it with the project backups. Include firmware version and any license files if applicable. If the switch has separate running and startup configurations, confirm changes are saved so they survive a power cycle.

A good backup name includes site, switch hostname, date, and firmware version. Example: WTP_SW-MCC1-01_2026-06-07_fw-x.y.z.cfg. Follow the site naming convention if one exists.

Final field test

After configuration, test from the systems that actually use the network:

HMI client reaches SCADA server.
SCADA server reaches PLCs and OPC UA servers.
Historian receives expected values.
Engineering workstation reaches approved devices.
Remote I/O or drive connections are stable.
Protocol gateways pass traffic across intended VLANs.
Network monitoring sees the switch.
Unused or restricted ports behave according to policy.

Do not sign off based only on ping from a laptop. Ping is useful, but it does not prove the application path, VLAN design, redundancy behavior, or monitoring coverage.

Handover notes

Leave the next technician enough information to recover. Provide the network diagram, switch configuration backup, port map, credential process, firmware note, and known limitations. If any ports are temporary, patched around, or reserved for later equipment, mark them clearly.

A commissioned switch should be boring. When the network is documented, backed up, monitored, and tested, SCADA troubleshooting can focus on the real fault instead of guessing what the cabinet network is doing.