Planning a network refresh: switches, wireless, and what to replace first

Reference article · 5 min read

Network hardware fails quietly. A switch past its last date of support keeps forwarding traffic, an access point that no longer receives firmware keeps accepting clients, and nothing on a dashboard turns red. The pressure to replace usually comes from somewhere else: a camera project that needs more power per port, an audit finding about unsupported software, or grant money with a spending deadline. Equipment then gets chosen under time pressure, which is how closets end up holding three generations of switches and no spares.

A refresh plan takes that decision back. It has three parts: an inventory that includes vendor support dates, a replacement order based on risk and dependency, and a realistic view of the power, cabling, and closet conditions that decide what you can actually install.

Start with an inventory that includes support dates

An asset list of model and purchase date will not tell you what to replace. For each switch, access point, controller, and uplink, capture:

Identity and location. Model, serial number, site, closet, rack position.
Software. Running version, the version the manufacturer recommends now, and whether the device can still run supported code.
Support milestones. End of sale, end of software maintenance or security patching, and last date of hardware support. Manufacturers publish these, and they are usually different dates; patching ends first.
Capacity in use. Ports used against ports available, power drawn against the switch power budget, uplink type and speed.
What depends on it. Cameras, door controllers, phones, radio equipment, building automation, and any public safety traffic.

Pull what you can from the devices and your monitoring system, then reconcile it against purchasing records. The dependency column is the one people skip and the one that drives sequencing.

Sequence by risk and dependency, not by age

Age is a weak criterion. An older switch in a storage room with idle ports is a smaller problem than a newer switch carrying every camera in a courthouse with no redundant power supply. Rank by risk first:

Devices no longer receiving security patches, especially anything reachable from the internet or from guest networks.
Single points of failure with no redundancy and no spare on the shelf.
Hardware supporting life safety, public safety, or regulated operations.
Models whose replacement parts have become hard to source.

Then apply dependency. Core and distribution layers come before access layers, because new access switches with faster uplinks and larger power budgets need upstream capacity to feed them. Electrical and cooling work comes before hardware. Cabling comes before wireless. Standardizing on fewer models reduces spares, configuration templates, and training load, often worth more than a better unit price.

Size for power over Ethernet before you size the switch

Power over Ethernet is a common reason a refresh comes up short. The IEEE standards 802.3af, 802.3at, and 802.3bt deliver progressively more power per port, on the order of fifteen watts, thirty watts, and up to about ninety watts at the source depending on type. Newer cameras, outdoor access points, and heated pan tilt zoom units push into the higher classes.

Two figures matter. Per port class tells you whether a device will power up; switch power budget tells you whether all of them can draw at once. Check that budget with one power supply out of service, the condition redundancy exists for. Added PoE load also changes uninterruptible power supply sizing and runtime, and adds heat to a closet that may already run warm.

Wireless is mostly a wired problem

Access point refreshes fail on the wired side more often than the radio side. Before selecting radios, confirm the uplink each access point will get, whether the switch port supports multi-gigabit speeds, and whether the cable run will carry them. Then plan coverage:

Distinguish coverage from capacity. Council chambers, courtrooms, libraries, and classrooms need density, not reach.
Treat the 6 GHz band as added capacity with shorter effective range, not a replacement for existing coverage.
Require a validation survey after installation, not only a predictive design.

Look at the cabling and the closets

Balanced twisted pair channels are specified to one hundred meters including patch cords, and older Category 5e plant will limit both higher Ethernet speeds and higher PoE classes. Tightly bundled cable carrying heavy PoE also runs warmer. Walk every closet with a checklist: cooling, physical security and key control, dedicated circuits, battery age, rack space, grounding, water or dust exposure, labeling, and whether records match reality. Between buildings, confirm fiber strand counts, type, and condition. Budgets are often set before anyone opens those doors, and the remediation becomes an unfunded surprise.

What to ask vendors and put in writing

Ask for published support milestones for the exact models quoted, not the product family. Ask whether licenses are perpetual or subscription, and what the hardware does if a subscription is not renewed. Ask for lead times, replacement terms, and response windows in writing. Ask whether firmware and security updates require an active support contract.

In the contract, consider requiring acceptance tied to installation and testing rather than shipment; as built documentation, labeling, and configuration files delivered to the agency; warranty beginning at acceptance; pricing held or indexed across a multi year refresh; and coordination with your surplus and sanitization process for removed gear. If federal funds are involved, confirm current restrictions on covered telecommunications and video surveillance equipment with the funding agency, because those rules change.

Start with one representative closet: finish the inventory and site checklist, install to the standard you intend to use everywhere, and use the real cost to build the multi year schedule.

HQT works with state and local government agencies on technology advisory and systems engineering, including infrastructure assessment and refresh planning.

Frequently asked questions

How often should an agency replace network switches and access points?

There is no correct fixed interval. Drive replacement by the manufacturer's published support milestones, by capacity and power needs, and by the risk each device carries, rather than by purchase date alone. Many agencies plan a rolling multi year cycle so a portion of the plant is replaced each budget year instead of all at once, which smooths both funding and staff workload.

What is the difference between end of sale, end of support, and end of security patching?

End of sale means the manufacturer stopped selling the model but usually continues supporting it. End of software maintenance or security patching means the device no longer receives fixes, including security fixes, which is the milestone that matters most for risk. Last date of support means hardware replacement and technical assistance stop entirely. These are separate published dates, so check all three for the exact model and part number you own.

How do we know whether our existing cabling will support new access points and higher PoE devices?

Start with the cable category and the length of the runs, since balanced twisted pair channels are specified to one hundred meters including patch cords and older Category 5e plant limits both higher Ethernet speeds and higher power classes. Have a cabling contractor test a representative sample of runs rather than assuming the installed records are accurate. Also consider heat, because tightly bundled cable carrying heavy PoE runs warmer than the same bundle carrying data alone.

Should we replace core switches or access switches first?

Generally the core and distribution layers come first, because new access switches with faster uplinks and larger power budgets need upstream capacity and power to be useful. The exception is any access layer device that is unsupported, unpatched, or carrying life safety or public safety traffic with no redundancy, which should be addressed on its own risk timeline. Sequence the work so each phase can be placed in service without waiting on the next one.

Can grant funding pay for a network refresh?

Some federal and state programs can fund network infrastructure, and schools and libraries may be able to use the federal E-Rate program for internal connections such as switches and access points. Eligibility rules, application windows, and cost allocation requirements vary by program and change over time, so confirm current terms with the funding agency or program administrator before planning a purchase. Federal funds also carry procurement requirements and restrictions on certain covered telecommunications and video surveillance equipment that should be verified before award.