What factors drive L2 vs L3 in the access layer?

Question

When designing an access layer, best practices today seem to indicate going toward a L3 design. I know the answers may be different depending on whether or not we're talking about a DC design or Enterprise Campus design. Please describe when you would choose L2 over L3 in the access layer and the differences in design with DC vs. campus.

I know L2 adjacency requirements between servers such as clusters (Windows, VMWare, etc) would push for L2 in the DC access. Are there other factors too? And if L2 is required, is it best practice to carry that L2 traffic up to the Aggregation layer and back down or just carry that L2 across directly connected trunks between access switches (i.e., build in looped squares instead of triangles). Do you keep L2 adjacencies limited to just a pair of access switches so as to not increase the broadcast/collision/STP domains?

In the Enterprise campus, assuming no L2 adjacency requirements, are there any cases that would indicate a design other than L3 in the access layer?

Answer 1

L2 Access is often needed when autonomous wireless access points are deployed across multiple switches, thus allowing users to roam from AP to AP without having to get new addresses. Current controller based wireless solutions tunnel the user traffic to a central drop-off point, so wireless APs can be connected in any subnet so long as they can communicate with the controller.

L3 in the access layer works well when there's no need for devices connected to multiple switches to access the same subnet/broadcast domain. It eliminates the need for loop prevention (STP) and VLAN trunking configuration (such as Cisco VTP or manual VLAN configuration).

L3 access layers do add their own requirements for protocols and configuration. Unless you want to do static routing you have to take on configuration of a dynamic routing protocol such as such as OSPF (standard) or EIGRP (Cisco).

In L3 access networks with dynamic routing it is also a good idea to summarize or tune advertised routes between layers of the network. For example, you can advertise only a default route from the Aggregation layer to the Access layer to limit the number of routes a simple access switch must learn and maintain. Turning off auto summarization on the Access switches can also help prevent a misconfiguration from causing one switch to advertise routes it should not. Auto summarization is disabled by default on many current software revisions, but is worth verifying for your switch and software version.

Finally, access layer diameter is a factor in choosing L2 or L3. If you want to daisy-chain one access switch off another (where one switch does not connect directly to aggregation) you may need expanded features to run dynamic routing. In Cisco switches you need a more advanced IOS license to run EIGRP in non-Stub mode, allowing it to advertise routes it learned from another switch to the rest of the network.