Layer 2 and Layer 3 switching are different forwarding decisions that can happen in the same chassis
The useful distinction is not “cheap switch versus expensive switch.” A Layer 2 switch forwards Ethernet frames inside a Layer 2 domain using MAC-address information. A Layer 3 or multilayer switch can do that same switching work and can also forward IP packets between networks using Layer 3 interfaces and a routing table. The AP Networking skill is recognizing which forwarding decision the traffic requires at that moment.
Compare what each function knows and what question it answers
| Capability or artifact | Layer 2 switching | Layer 3 switching |
|---|---|---|
| Forwarding object | Ethernet frame | IP packet between networks |
| Primary forwarding key | Destination MAC | Destination IP prefix |
| Core table | MAC/CAM table | Routing table / Layer 3 forwarding information |
| VLAN-local forwarding | Yes | Yes—the device still contains Layer 2 switching functions |
| Inter-VLAN forwarding | Not by a pure Layer 2 function | Yes, when Layer 3 interfaces/routing are configured |
| Host gateway role | Not as a pure L2 forwarding function | An SVI or routed interface can be a gateway |
| Security boundary | VLAN separates Layer 2 domains | Layer 3 policy can control traffic crossing networks |
Swipe horizontally to see the full table.
A Layer 2 switch learns where MAC addresses appear, not which remote IP route to use
When a frame enters a switch, the source MAC gives the switch evidence about where that source is reachable in the relevant VLAN. For a known destination MAC, the switch can use its learned table to select an outgoing port. VLAN context matters: the same physical switch can maintain logically separate Layer 2 forwarding domains.
Switch-1# show mac address-table VLAN MAC Address Type Port 10 00aa.1111.2222 DYNAMIC Gi1/0/4 10 00bb.3333.4444 DYNAMIC Gi1/0/8 20 00cc.5555.6666 DYNAMIC Gi1/0/12
This hypothetical table can help trace a host through the switched network. It cannot, by itself, prove that VLAN 10 can route to VLAN 20.
VLANs separate Layer 2 forwarding, but VLAN creation alone does not create inter-VLAN communication
Suppose ports Gi1/0/4 and Gi1/0/8 are access ports in VLAN 10 while Gi1/0/12 belongs to VLAN 20. Hosts in VLAN 10 can exchange frames through Layer 2 switching when their addressing and local path are correct. A host in VLAN 10 does not simply send a normal VLAN 10 frame directly to the VLAN 20 host as though the VLAN boundary were absent.
When VLANs correspond to different IP networks, communication between them requires a Layer 3 forwarding function. Review VLANs Explained and Network Switching for the Layer 2 mechanics.
An SVI gives a VLAN a Layer 3 presence on a multilayer switch
A switched virtual interface is a logical Layer 3 interface associated with a VLAN. In a common design, VLAN 10 might use network 10.10.10.0/24 with an SVI address of 10.10.10.1, while VLAN 20 uses 10.10.20.0/24 with an SVI at 10.10.20.1. Hosts can use the appropriate SVI address as their default gateway.
interface Vlan10 ip address 10.10.10.1 255.255.255.0 interface Vlan20 ip address 10.10.20.1 255.255.255.0 Host A: 10.10.10.25/24 gateway 10.10.10.1 Host B: 10.10.20.80/24 gateway 10.10.20.1
The important concept is functional: the VLAN now has an IP interface capable of participating in Layer 3 forwarding.
Follow one packet from VLAN 10 to VLAN 20
The IP destination remains the final host. The Layer 2 header is local to the relevant segment and is not simply carried unchanged across the Layer 3 boundary.
Connected VLAN interfaces can create directly connected Layer 3 networks
L3-Switch# show ip route C 10.10.10.0/24 is directly connected, Vlan10 L 10.10.10.1/32 is directly connected, Vlan10 C 10.10.20.0/24 is directly connected, Vlan20 L 10.10.20.1/32 is directly connected, Vlan20 S 10.50.0.0/16 via 10.10.20.254
In this hypothetical output, 10.10.10.0/24 and 10.10.20.0/24 are directly connected networks. A destination in 10.50.0.0/16 instead uses the listed next hop. The presence of these routes is evidence that the device has Layer 3 forwarding information; it is not proof that every policy, return path, or application works.
A multilayer switch does not route every frame merely because routing is enabled
If 10.10.10.25 sends to 10.10.10.80 and both are correctly placed in VLAN 10 with the same subnet, their exchange can remain a Layer 2 switched flow. If 10.10.10.25 sends to 10.10.20.80, the source identifies a remote network and sends to its gateway; that traffic requires the Layer 3 function.
Layer 3 switching is not limited to SVIs
SVIs are especially useful when a Layer 3 interface represents a VLAN, but multilayer switches can also support routed physical interfaces depending on platform and design. A routed interface participates as a Layer 3 link rather than acting as an ordinary Layer 2 access port for a user VLAN.
For AP Networking reasoning, focus on the artifact: an IP-addressed Layer 3 interface plus routing information indicates a routed function. Do not assume every physical port on a multilayer switch behaves identically.
A trunk can carry multiple VLANs without itself proving that inter-VLAN routing works
A trunk is a Layer 2 mechanism for carrying traffic associated with multiple VLANs across a link. Seeing VLAN 10 and VLAN 20 allowed on a trunk is evidence about Layer 2 carriage. Inter-VLAN communication still depends on an available Layer 3 gateway, routes, policy, and return path.
Why place Layer 3 forwarding inside a campus switching design?
Routing close to VLAN boundaries can reduce unnecessary path length and provide high-capacity inter-VLAN forwarding. It can also make the distribution/core design more structured because IP boundaries can constrain Layer 2 failure domains. But the best design depends on requirements: policy enforcement, redundancy, operational skills, failure behavior, hardware capabilities, WAN/Internet connectivity, and where security inspection must occur.
A Layer 3 switch is therefore not “better” in every position. It is useful where both switching and routed boundaries fit the network's requirements.
Segmentation is only useful when the permitted crossing paths match policy
Putting students, staff, servers, and management systems into separate VLANs creates logical boundaries, but it does not answer which groups should communicate. Once Layer 3 forwarding exists between those networks, ACLs, firewall policy, or other controls may be required to enforce the intended access model.
A strong verification plan therefore includes both a positive test for required traffic and a negative test for traffic that must remain blocked. Routing success without policy verification is incomplete.
Two VLAN 10 hosts fail: the route table is not the first unresolved dependency
Host A and Host B are intended to be in VLAN 10. Both use 10.10.10.0/24 addresses, but they cannot communicate. Before changing an SVI or adding routes, verify link state, access-port VLAN membership, host prefix configuration, local address resolution, and MAC learning.
If Host A appears in the MAC table on the expected VLAN 10 port but Host B appears under VLAN 20, that artifact points to an attachment/segmentation mismatch. Adding a route would treat the symptom as a Layer 3 problem even though the intended same-VLAN path is wrong.
Same-VLAN traffic works, but VLAN 10 cannot reach VLAN 20
Host A can reach another VLAN 10 host and can reach 10.10.10.1, its SVI gateway. Those successes preserve substantial evidence: Host A's local attachment, VLAN 10 path, and tested gateway reachability are working. The next discriminating artifacts are the Layer 3 switch's SVI state, route table, policy, destination VLAN path, and return path.
This is more efficient than restarting troubleshooting at the cable because successful local tests have already bounded the failure.
The route exists, but an ACL blocks the required application
VLAN 10 has 10.10.10.0/24, VLAN 20 has 10.10.20.0/24, and the Layer 3 switch shows both as connected. Ping to the gateway succeeds, but TCP traffic to a server in VLAN 20 fails. A valid connected route is not enough to label this a routing failure.
Policy evidence (hypothetical): permit tcp 10.10.10.0/24 10.10.20.50 eq 443 deny ip 10.10.10.0/24 10.10.20.0/24 Required service: TCP/8443
The required port is not covered by the permit. The smallest justified change would target the actual requirement rather than broadly allowing all inter-VLAN traffic. Verification should prove TCP/8443 works and unrelated denied traffic remains denied.
The SVI is unavailable while local Layer 2 switching still works
Two hosts in VLAN 30 can communicate with each other, but neither can reach remote networks through the expected VLAN 30 gateway. This pattern is compatible with a failure in a dependency required for routed traffic but not same-VLAN traffic—such as gateway/SVI availability or Layer 3 configuration.
Evidence boundary: local success does not prove the SVI is healthy. It proves the tested local switched path works. Inspect the gateway address, SVI operational state, and routing function next.
A trunk carries both VLANs, yet inter-VLAN traffic still fails
An uplink shows VLANs 10 and 20 allowed, and MAC addresses from both VLANs are learned across it. That is useful Layer 2 evidence. If VLAN 10 still cannot reach VLAN 20, inspect whether the Layer 3 gateway interfaces exist and are usable, whether routing is enabled/configured as required, whether policy permits the flow, and whether the destination can return traffic.
The trunk artifact narrows the problem; it does not finish the diagnosis.
Use successful tests to decide which switching layer to inspect next
| Observation | What it supports | Next discriminating evidence |
|---|---|---|
| No link on access port | Little Layer 1 evidence | NIC, cable, port state |
| Link works; same-VLAN peer fails | Physical attachment exists | VLAN membership, IP/prefix, ARP, MAC table |
| Same-VLAN peer works; SVI gateway fails | Local Layer 2 path works | Gateway address, SVI state, local gateway resolution |
| Gateway works; other VLAN fails | Host-to-gateway path works | Route, policy, destination VLAN, return path |
| Other VLAN numeric IP works; service fails | Tested IP path works | Exact service, ACL/firewall, listener/state |
Swipe horizontally to see the full table.
One artifact should never be allowed to prove an unrelated function
| Artifact/result | Reasonable inference | What remains unproven |
|---|---|---|
| MAC learned in VLAN 10 | Layer 2 learning for that source/context | SVI/routing/policy |
| VLAN 10 allowed on trunk | Configured Layer 2 carriage permits VLAN 10 | End-to-end VLAN path and Layer 3 reachability |
| Host reaches VLAN 10 SVI | Tested host-to-gateway path works | Route and policy beyond gateway |
| Connected route for VLAN 20 | Device has a Layer 3 forwarding entry for network | Destination host/service and security permission |
| Required app succeeds | Tested service path works | That forbidden paths remain blocked |
Swipe horizontally to see the full evidence table.
Six Layer 2 vs. Layer 3 switch traps to avoid
- “A Layer 3 switch routes everything.” Same-VLAN traffic can still be switched locally.
- “Creating VLANs automatically enables communication between them.” It does not.
- “A trunk is a route.” A trunk carries Layer 2 VLAN traffic; routing is a different function.
- “A connected route proves the application works.” Policy, return path, and service state remain separate.
- “If it is called a switch, it cannot be a default gateway.” An SVI on a multilayer switch can serve that role.
- “If routing works, segmentation is secure.” Required and forbidden flows still need policy verification.
Build answers from the observed artifact instead of reciting device definitions
Claim: identify whether the failure or forwarding action is Layer 2 or Layer 3.
Exact evidence: cite the VLAN, MAC entry, SVI, route, gateway test, or policy result that supports the claim.
Mechanism: explain how that artifact affects frame or packet forwarding.
Boundary: state what the evidence does not yet prove.
Next evidence: choose the test that separates the remaining plausible causes.
Verification: retest the required traffic and, for policy changes, verify prohibited traffic remains blocked.
Choose Layer 2 or Layer 3 placement from requirements, not from a device-name preference
| Requirement | Likely design implication | Evidence to validate |
|---|---|---|
| Endpoints share one VLAN | Layer 2 access forwarding is central | Port/VLAN state and MAC learning |
| Multiple VLANs must communicate | Layer 3 gateway/routing function required | SVIs/interfaces, routes, policy |
| Failure domains should be bounded | Consider deliberate Layer 3 boundaries | Topology plus controlled failure behavior |
| Sensitive VLANs need restricted access | Place enforceable policy at crossing path | Positive and negative flow tests |
| High inter-VLAN demand | Capacity of Layer 3 path matters | Utilization, latency, loss, failover capacity |
Swipe horizontally to see the complete decision table.
24 Layer 2 vs. Layer 3 switch digital flashcards
Use these cards to practice forwarding keys, MAC and route tables, VLANs, SVIs, gateways, inter-VLAN routing, troubleshooting boundaries, policy, and verification. The goal is not just recall: say what evidence would prove each answer before revealing it.