Layer 2 vs Layer 3 Switch: Where Each Belongs

01 /What each layer does

A Layer 2 switch reads the destination MAC of each frame, looks it up in a table it built by watching source addresses, and forwards out the matching port. Unknown destinations are flooded within the VLAN. It runs spanning tree, aggregates links and may filter or prioritise on Layer 2 through 4 headers, but it never changes the frame and never crosses a VLAN boundary.

A Layer 3 switch does all of that and also terminates IP subnets. Each VLAN gets a switched virtual interface (SVI) with an IP address that hosts use as their gateway. Packets addressed to the SVI MAC are routed: the switch looks up the destination IP, rewrites source and destination MACs, decrements the TTL and forwards into the target VLAN. It runs OSPF, RIP, static routes and often BGP, and it does the forwarding in hardware.

02 /Where each sits

In the classic three-tier design, the access layer in each wiring closet is Layer 2: cheap ports, PoE, port security, uplinks to distribution. The distribution layer terminates the VLANs from several closets, routes between them and applies access lists and QoS. The core connects distribution blocks over routed links and does nothing else. Layer 3 at distribution keeps the spanning-tree domain of each closet small and lets links to the core be routed rather than blocked.

03 /Routing in hardware versus software routers

A traditional router receives a packet, interrupts a general-purpose CPU, walks a software routing table and sends the packet on. Throughput is bounded by the CPU, historically in the low hundreds of thousands of packets per second for enterprise boxes. A Layer 3 switch programs the routing table into ternary content-addressable memory (TCAM) inside its forwarding ASIC and makes the lookup in a fixed number of clock cycles per packet, on every port simultaneously. Line rate on 48 gigabit ports is routine.

The control plane still runs in software: OSPF adjacencies, BGP sessions and ARP resolution happen on the management CPU, which writes results into the ASIC. The split explains a common failure: a Layer 3 switch under a control-plane flood keeps forwarding known flows at line rate while its routing protocols time out.

04 /Worked example: three closets and a distribution pair

Three closets with about 180 hosts each get VLANs 21, 22 and 23, one /24 apiece, plus voice VLAN 30 across all three. The access switches are Layer 2: ports untagged in the closet VLAN, phones tagged in 30, one two-member bundle per closet up to distribution. The distribution pair, D1 and D2, are Layer 3 switches with an SVI in every VLAN. D1 is VRRP master for VLANs 21 and 30 at priority 120 and D2 for 22 and 23, so both forward. Each has a routed /31 link to each core router in OSPF area 0 and advertises one summary, 10.20.0.0/16, instead of four /24s. Nothing at the core knows a closet exists.

switch# show ip route summary
switch# show platform tcam usage
$ traceroute -n 10.20.22.40

05 /When a Layer 3 switch replaces a router

Inside a building or campus, almost always. Inter-VLAN routing, routing between sites over Ethernet, and first-hop redundancy with VRRP are all Layer 3 switch territory. The router keeps its place where the feature list demands it: serial or cellular WAN interfaces, NAT at scale, IPsec VPN termination, deep packet inspection, very large BGP tables, and traffic shaping on slow links. Some of those have moved into firewalls; the remainder is why core routers still exist.

06 /Decision table

07 /Foundry heritage: the Layer 2/3 closet and the Layer 3 backbone

Foundry organised its catalogue along exactly this line. The Layer 2/3 wiring closet family, meaning FastIron Edge and Workgroup switches and the lower-cost EdgeIron line, sold as access switches with optional Layer 3 routing. The BigIron chassis was the Layer 3 backbone switch for distribution and core, and NetIron carried the router label for service providers. Foundry extended the metaphor upward and called the ServerIron a Layer 4-7 switch because it made forwarding decisions on TCP ports and HTTP content. Most of the switching library sits on the Layer 2 side of this line, while routing protocols and redundancy at Layer 3 have their own section.

! Layer 2 access: ports in a VLAN, nothing routed
vlan 20 name users by port
 untagged ethernet 1/1 to 1/24
 tagged ethernet 1/25
!
! Layer 3 switch: the same VLAN gets a routed virtual interface
vlan 20 name users by port
 tagged ethernet 1/1 to 1/2
 router-interface ve 20
interface ve 20
 ip address 10.20.0.1 255.255.255.0
router ospf
 area 0

show ip route
show ip interface

08 /Layer 2 vs layer 3 switch pitfalls and expert tips

• TCAM exhaustion. Routes or access list entries beyond the table fall to software and throughput drops by orders of magnitude with no link error to point at. Check utilisation before adding a route feed or a long ACL.
• Asymmetric paths with a redundant gateway. Outbound leaves through the master, return traffic arrives through the backup. Harmless for plain routing, fatal through a stateful firewall that sees half the conversation.
• MTU mismatch. Jumbo frames on routed uplinks and 1500 on the SVIs, or the reverse, produce fragmentation or black holes for packets marked do-not-fragment.

Keep the closet VLANs terminated at distribution, run the gateway election between the distribution pair, and make the routed core uplinks point to point so no VLAN spans a core link. Buy the Layer 3 switch for the routes and access lists it must hold at end of life, and read the datasheet line that says which features run in hardware before believing the throughput figure.