Korthveil reads a managed switch over SNMP and shows, on Network › Switches:

• every port, with its link state, speed, VLAN and error counters;
• the VLAN table;
• which device (MAC address) is on which port.

This guide connects a switch on its own firewall port, turns SNMP on in the switch, and adds it to Korthveil. The example is a home network: a 24-port 2.5G PoE switch (RealHD PSW24-25G-MG) cabled to korthmain's spare port enp3s0.

Step 1: A firewall port for the switch's management

Give the switch's management its own small network on a spare firewall port, so its web page and SNMP are not on your LAN.

1. Network › Interfaces, zones & routes, the spare port (enp3s0) › Edit: on, IPv4 static 192.168.250.1/24, IPv6 none.
2. A new zone for it, for example SWITCH-MGMT: not a management zone; ping allowed.
3. Save to pending changes and Commit.
4. Cable the port to a switch port (here port 1) and set the switch's own address to 192.168.250.2/24, gateway 192.168.250.1, in the switch's web page.

Step 2: Turn SNMP on in the switch

Many switches ship with SNMP off: Korthveil then sees nothing, and a test read says port unreachable.

On the PSW24-25G-MG: open http://192.168.250.2, sign in, Security › Management Access › Management Service, tick SNMP: Enable, Apply, then Save (top right) and OK, so it stays on after a restart. Under Management › SNMP › Community, a read-only community must exist (the switch ships with one).

SNMPv3 or v2c? Korthveil accepts SNMPv3 only with SHA-256 or better and AES encryption. This switch offers only MD5/SHA-1 with DES, which Korthveil refuses as too weak. So use v2c, read-only. The community and the switch data then travel in clear text, but only on the cable between the firewall and the switch.

Step 3: Add the switch in Korthveil

1. Network › Switches, turn the add-in on, then Add switch.
2. Fill in: - Name: for example switch-1. - Management address: 192.168.250.2, the switch's address on its own network, not an old LAN address. - SNMP version: SNMP v2c (clear text, read-only). - Community: type the switch's read-only community. Korthveil stores it as a secret and shows only set. - Allow VLAN changes: off. With v2c it must be off, and the commit refuses it otherwise.
3. Save to pending changes and Commit.

Rename a switch in a separate commit from other changes to it. The stored community belongs to the switch's name. If a commit says SNMP v2c needs a community string after a rename, type the community again (or discard the pending changes and start again).

Step 4: Check what Korthveil reads

Press Refresh on the switch's card. Korthveil reads it every 5 minutes (Read switches every). The card shows:

• the model and uptime;
• every port: link up or down, speed, VLAN (PVID), tagged VLANs and errors;
• the devices on each port, when the switch reports its MAC table.

Good to know

• Who can reach the switch: your firewall rules decide which LAN devices may open the switch's web page and SNMP. On a home network, consider allowing only your own computer and the firewall to reach 192.168.250.0/24: the switch's web sign-in is plain http.
• VLAN changes from Korthveil need SNMPv3 with SHA-256 or better and AES. A switch that offers less is read-only in Korthveil; change its VLANs in its own web page.
• In a failover pair, the switch settings go to the standby with the rest of the configuration. Each firewall reads the switch itself when it can reach it.
• Remove a switch: the bin icon on its card, then Save to pending changes and Commit.

The pictures are from the home rack firewall korthmain with a RealHD PSW24-25G-MG switch, 2 November 2026.