When designing an access layer, best practices today seem to indicate going toward a L3 design. I know the answers may be different depending on whether or not we're talking about a DC design or Enterprise Campus design. Please describe when you would choose L2 over L3 in the access layer and the differences in design with DC vs. campus.

I know L2 adjacency requirements between servers such as clusters (Windows, VMWare, etc) would push for L2 in the DC access. Are there other factors too? And if L2 is required, is it best practice to carry that L2 traffic up to the Aggregation layer and back down or just carry that L2 across directly connected trunks between access switches (i.e., build in looped squares instead of triangles). Do you keep L2 adjacencies limited to just a pair of access switches so as to not increase the broadcast/collision/STP domains?

In the Enterprise campus, assuming no L2 adjacency requirements, are there any cases that would indicate a design other than L3 in the access layer?

1 Answer 1


L2 Access is often needed when autonomous wireless access points are deployed across multiple switches, thus allowing users to roam from AP to AP without having to get new addresses. Current controller based wireless solutions tunnel the user traffic to a central drop-off point, so wireless APs can be connected in any subnet so long as they can communicate with the controller.

L3 in the access layer works well when there's no need for devices connected to multiple switches to access the same subnet/broadcast domain. It eliminates the need for loop prevention (STP) and VLAN trunking configuration (such as Cisco VTP or manual VLAN configuration).

L3 access layers do add their own requirements for protocols and configuration. Unless you want to do static routing you have to take on configuration of a dynamic routing protocol such as such as OSPF (standard) or EIGRP (Cisco).

In L3 access networks with dynamic routing it is also a good idea to summarize or tune advertised routes between layers of the network. For example, you can advertise only a default route from the Aggregation layer to the Access layer to limit the number of routes a simple access switch must learn and maintain. Turning off auto summarization on the Access switches can also help prevent a misconfiguration from causing one switch to advertise routes it should not. Auto summarization is disabled by default on many current software revisions, but is worth verifying for your switch and software version.

Finally, access layer diameter is a factor in choosing L2 or L3. If you want to daisy-chain one access switch off another (where one switch does not connect directly to aggregation) you may need expanded features to run dynamic routing. In Cisco switches you need a more advanced IOS license to run EIGRP in non-Stub mode, allowing it to advertise routes it learned from another switch to the rest of the network.

  • 1
    to build on this - L3 right to the edge switch also eliminates the need for HSRP and GLBP (assuming you have just one switch [4500, 3750 stack]). This lowers the convergence time should a link go away
    – knotseh
    May 30, 2013 at 21:52
  • Are you points equally valid for the DC vs. Campus? In a DC design with VMWare virtualization, L2 adjacency is required between hosts in the same cluster; for redundancy, those hosts are split on different access switches. Jun 3, 2013 at 2:39
  • 2
    I apologize for not distinguishing between Campus and DC. In my opinion, L3 access in the DC isn't an option anymore because of the point you raised - the need for L2 adjacency between virtualization hosts, as well as other services such as clustered servers. In the DC I would recommend a carefully architected L2 domain, limiting the diameter of the Spanning Tree (connect each L2 access switch direct to Aggregation so there is no daisy-chaining).
    – MJRizzo
    Jun 3, 2013 at 15:48
  • @MJRizzo, agreed L2 access to agg is preferred over daisy-chaining access. Daisy-chaining restricts where you can extend that L2 in the DC; on the other hand, I suppose some would only want a given VLAN to run on pairs of access switches (and not on just any) though the agg switches touch every VLAN. I'm curious what typical model the larger DCs use for VMhosts -- L2 possibly anywhere or clusters confined to certain pairs of access switches? Jun 6, 2013 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.