On this page
What each layer doesWhere each sitsRouting in hardware versus software routersWhen a Layer 3 switch replaces a routerDecision tableFoundry heritage: the Layer 2/3 closet and the Layer 3 backboneQuestions01 /What each layer does
A Layer 2 switch reads the destination MAC of each frame, looks it up in a table it built by watching source addresses, and forwards out the matching port. Unknown destinations are flooded within the VLAN. It runs spanning tree, aggregates links and may filter or prioritise on Layer 2 through 4 headers, but it never changes the frame and never crosses a VLAN boundary.
A Layer 3 switch does all of that and also terminates IP subnets. Each VLAN gets a switched virtual interface (SVI) with an IP address that hosts use as their gateway. Packets addressed to the SVI MAC are routed: the switch looks up the destination IP, rewrites source and destination MACs, decrements the TTL and forwards into the target VLAN. It runs OSPF, RIP, static routes and often BGP, and it does the forwarding in hardware.
02 /Where each sits
In the classic three-tier design, the access layer in each wiring closet is Layer 2: cheap ports, PoE, port security, uplinks to distribution. The distribution layer terminates the VLANs from several closets, routes between them and applies access lists and QoS. The core connects distribution blocks over routed links and does nothing else. Layer 3 at distribution keeps the spanning-tree domain of each closet small and lets links to the core be routed rather than blocked.
03 /Routing in hardware versus software routers
A traditional router receives a packet, interrupts a general-purpose CPU, walks a software routing table and sends the packet on. Throughput is bounded by the CPU, historically in the low hundreds of thousands of packets per second for enterprise boxes. A Layer 3 switch programs the routing table into ternary content-addressable memory (TCAM) inside its forwarding ASIC and makes the lookup in a fixed number of clock cycles per packet, on every port simultaneously. Line rate on 48 gigabit ports is routine.
The control plane still runs in software: OSPF adjacencies, BGP sessions and ARP resolution happen on the management CPU, which writes results into the ASIC. The split explains a common failure: a Layer 3 switch under a control-plane flood keeps forwarding known flows at line rate while its routing protocols time out.
04 /When a Layer 3 switch replaces a router
Inside a building or campus, almost always. Inter-VLAN routing, routing between sites over Ethernet, and first-hop redundancy with VRRP are all Layer 3 switch territory. The router keeps its place where the feature list demands it: serial or cellular WAN interfaces, NAT at scale, IPsec VPN termination, deep packet inspection, very large BGP tables, and traffic shaping on slow links. Some of those have moved into firewalls; the remainder is why core routers still exist.
Check which features a Layer 3 switch does in hardware and which fall back to the CPU. Policy-based routing, NAT, tunnelling and some ACL types are software paths on many models and collapse throughput when enabled.
05 /Decision table
| Requirement | Layer 2 switch | Layer 3 switch | Router |
|---|---|---|---|
| Host ports in a closet | Yes | Overkill | No |
| Inter-VLAN routing at line rate | No | Yes | Only small sites |
| Routed uplinks, OSPF, VRRP | No | Yes | Yes |
| Full internet BGP table | No | Some high-end models | Yes |
| NAT, IPsec, WAN interfaces | No | Rarely, in software | Yes |
| Cost per gigabit port | Lowest | Low | Highest |
06 /Foundry heritage: the Layer 2/3 closet and the Layer 3 backbone
Foundry organised its catalogue along exactly this line. The Layer 2/3 wiring closet family, meaning FastIron Edge and Workgroup switches and the lower-cost EdgeIron line, sold as access switches with optional Layer 3 routing. The BigIron chassis was the Layer 3 backbone switch for distribution and core, and NetIron carried the router label for service providers. Foundry extended the metaphor upward and called the ServerIron a Layer 4-7 switch because it made forwarding decisions on TCP ports and HTTP content.
! Layer 2 access: ports in a VLAN, nothing routed vlan 20 name users by port untagged ethernet 1/1 to 1/24 tagged ethernet 1/25 ! ! Layer 3 switch: the same VLAN gets a routed virtual interface vlan 20 name users by port tagged ethernet 1/1 to 1/2 router-interface ve 20 interface ve 20 ip address 10.20.0.1 255.255.255.0 router ospf area 0 show ip route show ip interface
07 /Questions
Can a Layer 3 switch do everything a router does?
No. It routes IP between Ethernet interfaces at wire speed and runs standard routing protocols. It usually lacks WAN interfaces, large-scale NAT, IPsec and deep inspection, and advanced features often fall back to slow software paths. For a campus or data centre interior it is enough.
Do I need Layer 3 in the wiring closet?
Usually not. Routing at the closet fragments the address plan and adds licence cost per switch. Route at distribution, keep the closet Layer 2, and let VRRP at distribution provide the gateway. Routed access suits very large campuses that want tiny spanning-tree domains.
What is an SVI?
A switched virtual interface is a logical Layer 3 interface bound to a VLAN on a Layer 3 switch. Hosts in the VLAN use its address as their gateway. IronWare called it a virtual Ethernet (ve) interface and bound it to the VLAN with router-interface.
What is a multilayer switch?
Another name for a Layer 3 switch, emphasising that it operates at Layer 2 and Layer 3, and often filters on Layer 4 headers, in the same forwarding hardware. The terms are interchangeable in current use.
Why did Foundry call the ServerIron a Layer 4-7 switch?
Because it chose the destination server using TCP and UDP port numbers (Layer 4) and, later, HTTP headers and cookies (Layer 7), while forwarding in switch-style hardware. The device is what the industry now calls a load balancer or application delivery controller.
Sources
- IEEE Std 802.1D and 802.1Q, MAC Bridges and Virtual Bridged LANs (Layer 2 forwarding behaviour)
- IETF RFC 1812, Requirements for IP Version 4 Routers, 1995
- IETF RFC 2328, OSPF Version 2, 1998
- Foundry Networks, product overview pages for Layer 2/3 wiring closet and Layer 3 backbone switches (original Foundry documentation, historical, around 2002 to 2007)