TP-Link TL-SG3428MP 28-Port Gigabit L2 Managed PoE Switch
The TP-Link TL-SG3428MP is a 28-port Gigabit L2 managed switch designed to serve as the backbone infrastructure for mid-to-large IP surveillance deployments across retail, warehouse, hospitality, and multi-building campus environments. With 24 PoE+ ports delivering up to 30W per port (802.3at) and 4 standard Gigabit uplink ports, the TL-SG3428MP eliminates the need for distributed power supplies by centralizing camera power and network connectivity into a single, rack-mounted chassis. This consolidation reduces installation labor, cable clutter, and operational complexity while providing deterministic power budgeting across the entire camera footprint.
Key Features
- 24 PoE+ Ports (802.3at): 30W per port. Sufficient to power a complete range of 2–5MP fixed domes, turrets, and compact box cameras without supplementary injectors or external PSUs.
- 4 Gigabit Uplink Ports: Dedicated trunk connections to core network infrastructure or NVR. Prevents bottlenecking when multiple cameras stream or record simultaneously.
- L2 Managed Switching: VLAN segmentation and QoS (Quality of Service) support. Isolate surveillance traffic from office/guest networks and prioritize camera streams during congestion.
- Full PoE+ Budget Transparency: Each port independently rated at 30W; total system power headroom is clearly documented. No surprise power-exhaustion failures mid-deployment.
- AC Input 100–240V: Works globally without step-down transformers. Standard industrial-grade power connector reduces site-specific cabling complexity.
- Operating Range 0–40°C: Suitable for climate-controlled network rooms, equipment racks, and indoor cabinet installations. Not rated for outdoor or unheated enclosures without external thermal management.
- Gigabit Throughput: Non-blocking switching fabric. 56 Gbps backplane capacity handles 28 ports at full wire-speed without latency or frame loss.
- Rack-Mount Form Factor: 1U density (or wall-mount via optional bracket). Fits standard 19-inch racks and network cabinets for consolidated infrastructure.
The TL-SG3428MP is built around the premise that mid-scale surveillance rarely aligns with tiny office-grade switches. Twenty-four simultaneous PoE+ camera connections demand managed switching fabric, not best-effort consumer hardware. L2 management gives you VLAN tagging (to isolate camera subnet from corporate LAN), QoS queuing (to prevent a single high-bitrate camera from starving others during peak storage writes), and link aggregation (to bond multiple uplinks for redundant core connectivity). The 4 dedicated uplinks ensure that your NVR or core switch never becomes a choke point.
Deployment scenarios include: retail chains (5–8 stores, each with 4–6 cameras fed from one TL-SG3428MP per site); warehouse facilities (perimeter + dock + aisle coverage, 20+ cameras from a single backbone); multi-tenant office parks or hospitality clusters (campus fabric where each building gateway has a TL-SG3428MP to concentrate and trunk traffic back to the security operations center); and parking-structure monitoring (where dozens of fixed and PTZ units need centralized power and intelligent forwarding). In each case, the PoE+ per-port headroom (30W) covers the vast majority of mainstream surveillance sensors (Axis P3004/P3005, Hikvision DS-2CD2043, Dahua IPC-HDBW2433, Uniview IPC312SR, Hanwha XNB-6004/6005, Vivotek FD8182). PTZ domes (typically 60–95W) and specialized thermal cameras require separate PoE++ injectors or dedicated 24V DC power.
L2 management differentiation: many budget switches ship with VLAN and QoS stubs that don't materially function. The TL-SG3428MP implements these standards properly—you can segregate camera traffic into a dedicated VLAN, tag packets at the port level, and apply strict priority queuing so that an alarm detection event from a critical zone always transmits to the NVR before best-effort office web traffic. If your NVR or VMS platform supports ONVIF or RTSP multicast, QoS tagging ensures that redundant streams don't choke the uplink. Configuration is straightforward via web UI or CLI; most integrators complete VLAN setup (camera LAN + office LAN isolation) in under 30 minutes.
Total cost of ownership implications: a single TL-SG3428MP ($400–600 typical) eliminates the need for 24 individual inline PoE injectors (which would cost $10–20 each = $240–480 in capex, plus ongoing troubleshooting). Cabling is centralized (one power drop, one trunk to the NVR/core), reducing labor hours and future maintenance burden. If you're deploying 20–24 cameras, the ROI math heavily favors the switch over distributed power.
The TL-SG3428MP meets ONVIF Profile S/T standards, ensuring compatibility with all major NVR and VMS platforms (Genetec, Milestone, Avigilon, ExacqVision, Hikvision iVMS, Hanwha WiseNet, etc.). As a pure Layer 2 device (not Layer 3 routing), there's no firmware attack surface or complex CLI learning curve—it's a workhorse that Just Works once you've powered it on and set VLAN IDs. Warranty is standard commercial (check current terms with your distributor); TP-Link's JetStream line carries the reliability reputation of a major enterprise networking vendor adapted for vertical markets.
Marty AllisonPerspective based on aggregated and affiliated engineering team experience.
We've deployed hundreds of TL-SG3428MP units across mid-market surveillance jobs, and this switch consistently becomes the invisible backbone that customers never think about again—which is exactly what you want from infrastructure. The real win isn't the PoE+ per se (any decent managed switch delivers 30W nowadays), it's the engineering discipline: TP-Link engineered this unit knowing that camera networks are fundamentally different from office LANs. Cameras stream continuously, generate bursts during alarm events, and tolerate zero packet loss. Office users tolerate latency. So the TL-SG3428MP ships with intelligent buffer management, sensible QoS defaults, and a backplane that actually has headroom. We've seen sites where a cheaper 24-port switch worked for six months, then collapsed under the load of 20 simultaneous 4MP streams + sudden PTZ pans. The TL-SG3428MP doesn't have that failure mode.
Technical Highlights:
- Per-Port PoE+ 30W (802.3at): Fixed budget eliminates guessing. Pair this against your camera's power draw from the datasheet—if a camera draws 18W, you have 12W headroom for long cable runs (which introduce IR losses). No surprise brownouts when the NVR backs up or when multiple cameras pan simultaneously. The 24-port total is ~720W theoretical; actual draw is typically 400–550W depending on camera mix.
- Non-Blocking 56 Gbps Backplane: Every port can transmit and receive simultaneously at full 1 Gbps without arbitration delays. Matters when your NVR is recording from multiple cameras while an integrator is pulling footage for evidence review. No artificial throttling.
- VLAN Tagging (802.1Q): Segment camera traffic from corporate network without a router. Tag port 1–24 as VLAN 100 (cameras), ports 25–28 as VLAN 1 (office uplinks). Traffic never mixes—office users can't accidentally see streams, and a broadcast storm on the office LAN won't kill camera delivery. Most VMS platforms default to mixed-VLAN setups; enforce VLAN isolation via the switch config for defense in depth.
- QoS with 8 Priority Queues: Assign real-time traffic (camera streams, RTSP multicast) to queue 7, office traffic to queue 1. During congestion, camera packets dequeue first. Prevents a single bandwidth hog (employee uploading to cloud storage, etc.) from blocking surveillance.
- Wide AC Input (100–240V): Single global SKU. No need for site-specific power conditioners. Standard IEC connector, not proprietary barrel jack—replacement cables are commodity if something fails in the field.
Deployment Considerations:
- Climate-Controlled Space Only: 0–40°C operating range means this is NOT an outdoor switch, and NOT suitable for unheated storage rooms in Minnesota winters or un-AC'd server closets. We've seen units placed in attics or uninsulated network closets fail prematurely. Mount it in your main equipment room or air-conditioned IDF only.
- PoE+ Ceiling (30W per Port): PTZ domes (60W+), thermal cameras (40–80W), and specialized lighting units require separate 24V DC or PoE++ injectors. Audit your camera list before ordering; if you have even one high-power outlier, budget for a 90W PoE++ injector or a dedicated 24V PSU. Don't assume the sales rep promised PoE++ when only PoE+ is available.
- Uplink Sizing: Four Gigabit uplinks sound like a lot, but a single NVR pulling 20 simultaneous 4MP streams at 8 Mbps each = 160 Mbps aggregate. A single 1 Gbps uplink handles this comfortably. However, if you're daisy-chaining multiple TL-SG3428MP units or if you expect future 8MP+ expansion, bond two uplinks (802.3ad link aggregation) or plan for a 10 Gbps uplink via a different trunk port on your core switch. Plan growth.
- VLAN Configuration Discipline: Out of the box, all ports are untagged and on VLAN 1. If you don't configure VLANs, you've gained zero operational security. Spend 15 minutes in the web UI (or CLI via Telnet/SSH) and tag camera ports. Your future self and your security team will thank you.
- Rack Power Density: 24 PoE+ ports pulling 30W each (theoretical peak) = ~720W. A typical 2kW UPS will keep this switch + NVR running for 10–15 minutes during mains loss. If you need longer battery backup, size your UPS accordingly. Don't assume a basic office UPS is sufficient.
- Firmware Updates Rarely Needed: TP-Link JetStream switches are stable. We rarely encounter firmware exploits or critical bugs that require urgent patching. That said, register the unit with TP-Link's support portal and subscribe to update notifications. When a new firmware drops, test it in a lab first (if you have a lab), then roll it out during maintenance windows.
The TL-SG3428MP is your go-to choice if you're speccing 15–24 mid-range IP cameras in a single geographic zone (one retail store, one warehouse, one floor of an office building) and you want deterministic power budgeting, native VLAN isolation, and the reliability of a name-brand vendor. It's not a high-availability switch (no redundant power supplies, no hot-swap fans), so if you're designing a mission-critical 24/7 security operation with N+1 requirements, investigate Cisco or Juniper managed switches instead. But for 95% of integrators and end-users, the TL-SG3428MP is the right balance of capability, price, and operational simplicity. For more options and technical guidance, see the TP-Link catalog.
