Course contents

Chapter 5: LAN SwitchingLesson 5 of 11

Layer 2 vs Layer 3 switch

What a multilayer switch adds: SVIs, routed ports and ip routing, with the configuration and where each type belongs.

Intermediate · 9 min read

Technical definition

Layer 3 switch is a switch that can also route IP packets. It forwards frames by MAC address within a VLAN like a Layer 2 switch, and routes between VLANs and subnets using a routing table, with the routing done by the switching hardware.

What a Layer 2 switch does

A Layer 2 switch works with frames. It learns source MAC addresses into a table, and forwards each frame to the port that leads to the destination MAC within the same VLAN. It never looks at IP addresses to decide where a frame goes. Devices in different VLANs are in different networks, so something else has to route between them.

What a Layer 3 switch adds

Layer 2 switch and Layer 3 (multilayer) switch
Layer 2 switch and Layer 3 (multilayer) switchA Layer 2 switch builds a MAC address table, forwards frames within each VLAN and needs a router to move traffic between VLANs. A Layer 3 switch does the same and also has a routing table, routed ports and SVIs, so it routes between VLANs in hardware.Layer 2 switchMAC address tableVLANs, trunks, STP, EtherChannelOne management address (SVI)Forwards by destination MACNeeds an external routerto move traffic between VLANsLayer 3 switchEverything the Layer 2 switch hasRouting table, static and dynamic routesSVIs and routed ports, ip routingRoutes between VLANs in hardwareInter-VLAN routing at wire speedNo router on a stick needed
The Layer 3 switch is a Layer 2 switch plus a router. The extra job is switched on with ip routing and is carried out by the switching hardware, which is why it is much faster than a router on a stick.

A Layer 3 (multilayer) switch is a Layer 2 switch that also has a routing table and can route between VLANs. It does this in specialised hardware, so routing between VLANs runs at the same speed as switching. It gets there with two kinds of Layer 3 interface:

  • SVI (switch virtual interface): a virtual interface for a VLAN, such as interface Vlan10. Its IP address is the default gateway for devices in that VLAN.
  • Routed port: a physical port changed to a Layer 3 interface with no switchport, used for point-to-point links to routers or other Layer 3 switches.

Side by side

Layer 2 switch and Layer 3 switch compared
Layer 2 switch and Layer 3 switch compared; Layer 2 switch; Layer 3 switch. Forwards by: Destination MAC Destination MAC inside a VLAN; destination IP between subnets Tables: MAC address table MAC table, routing table, ARP table Between VLANs: Needs an external router Routes internally through SVIs Layer 3 interfaces: One management SVI at most Many SVIs and routed ports Routing protocols: None Static routes and usually OSPF, EIGRP and others Typical place: Access layer Distribution and core layers Cost: Lower HigherLayer 2 switchLayer 3 switchForwards byDestination MACDestination MAC inside a VLAN;destination IP between subnetsTablesMAC address tableMAC table, routing table, ARP tableBetween VLANsNeeds an external routerRoutes internally through SVIsLayer 3 interfacesOne management SVI at mostMany SVIs and routed portsRouting protocolsNoneStatic routes and usually OSPF, EIGRPand othersTypical placeAccess layerDistribution and core layersCostLowerHigher

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across. The one-line summary: a Layer 3 switch is a Layer 2 switch plus routing.

How to configure a Layer 3 switch

Commands are based on Cisco IOS documentation and have not been run on a lab device here.

ip routing ! interface Vlan10 ip address 192.168.10.1 255.255.255.0 no shutdown interface Vlan20 ip address 192.168.20.1 255.255.255.0 no shutdown ! interface GigabitEthernet1/0/48 no switchport ip address 10.0.0.2 255.255.255.252 ! ip route 0.0.0.0 0.0.0.0 10.0.0.1

ip routing turns routing on. Each SVI is the gateway for its VLAN. The routed port connects to the upstream router, and a default route sends everything else there.

An SVI comes up only when its VLAN exists and at least one port in that VLAN is up (an access port, or a trunk that carries it). If show ip interface brief shows Vlan10 up/down, check that.

Example output · based on Cisco documentation; exact format varies by platform and software version
SW1#show ip route
C    192.168.10.0/24 is directly connected, Vlan10
C    192.168.20.0/24 is directly connected, Vlan20
C    10.0.0.0/30 is directly connected, GigabitEthernet1/0/48
S*   0.0.0.0/0 [1/0] via 10.0.0.1
Example output. The connected routes come from the SVIs and the routed port, and the static default route sends everything else to the upstream router.

Which to use where

  • Access layer: Layer 2 switches. Cheap, many ports, and they keep VLANs local to a wiring closet.
  • Distribution and core: Layer 3 switches, so VLANs are routed at wire speed and links between switches can be routed instead of switched.
  • Small office: a single Layer 3 switch can do the job of a switch and a router, as long as there are no WAN services to run.
  • WAN edge: a router or firewall for NAT, VPN and the provider interfaces.

Layer 2 vs Layer 3 switch in short

  • Layer 2 forwards by MAC within a VLAN; Layer 3 also routes between VLANs by IP.
  • SVIs are VLAN gateways; no switchport makes a routed port.
  • ip routing must be on for the switch to route.
  • An SVI is up only when its VLAN exists and a port in it is up.

Test yourself

Predict · scenario 1

Which command allows a Layer 3 switch to route between its SVIs?

Predict · scenario 2

What turns a switch port into a routed port?

Predict · scenario 3

A Layer 2 switch forwards a frame based on which field?

Predict · scenario 4

interface Vlan10 shows up/down. What is a likely cause?

Predict · scenario 5

Where does a Layer 3 switch typically sit in a campus?

FAQ

Can a Layer 2 switch have an IP address?
Yes, but only for management. A management SVI lets you reach the switch over SSH; the switch still does not route traffic between VLANs, and its default gateway points to a real router.
Why is a Layer 3 switch faster than router-on-a-stick?
Routing is done in the switching hardware at wire speed, and inter-VLAN traffic never has to cross a single trunk to an external router and back.
Does a Layer 3 switch replace a router?
Inside the campus, usually yes. At the WAN edge you still use a router or firewall for services such as NAT, VPN and WAN interfaces, although some Layer 3 switches support part of that.