I'm trying to understand as the difference between layer 3 switches and routers.
The difference between a layer 3 switch and a router is mostly nuance and detail of the specific platform/product in question. If you simplify things to an abstract concept, a layer 3 switch is a router. There is no need to make a distinction until you want to discuss actual products and their features.
The main difference between the two is that layer 3 switches uses hardware optimized for the routing while routers use general purpose CPUs.
That is incorrect. Many/most routers use specialized hardware that is purpose designed for network traffic forwarding.
I'm sure there are many jobs that the hardware is optimized for but I believe its main purpose is doing a fast lookup for a <address, port> table.
This is the beginning of your confusion. There are more than 1 type of address and 1 type of port. Switch port is a general term for the network interface port on a switch where you connect a network cable of some type or a transceiver where you connect a cable. Network devices have more than 1 kind of 'port' so it is important to clarify what you are talking about. A port on a switch is not the same thing as a port as used in Network Address Translation. In reference to NAT, the port is a TCP or UDP or other logical identifier for the distinction of specific network traffic.
There are over 65000 possible network service ports (0-65535) that are usually used as a sending or receiving identifier for a network connection. Ports below 1024 are considered to be 'well-known' as belonging to commonly defined services such as 80 for HTTP and 443 for HTTPS type TCP traffic, 25 for SMTP, etc. Some are actually reserved, assigned, etc. by IANA for specific services. Ports over 1024 to 49151 are 'registered' by IANA for specific services/application but you can use them for other things or dynamic use in NAT etc., though you may encounter issues with protocols that use those ports. Ports from 49152–65535 are 'ephemeral' and cannot be registered or assigned for specific services and are intended specifically for use in NAT or in dynamic connection setup, etc.
As for addresses, when discussing a switch, an address is usually a reference to a hardware address (Media Access Control or MAC address). Hardware addresses are also called 'burned in addresses' because they are usually set on a device during manufacture of the device and are not easily changed after manufacture on most devices (though it is possible on some). The MAC address of a device is learned by the switch and used so the switch can decide where to forward network frames destined for that MAC address. Layer 2 switches do not know what IP address equates to which MAC address, the sending or receiving device connected to the switch must make that determination (IP address to MAC address lookup via ARP). The sending device must have a MAC address to send to or it will fail to deliver the traffic. The layer 2 switch simply accepts the frames destined for a MAC address, and determines which physical switch port (interface is probably a better term) to deliver them to and forwards them. It does not know or care about IP addresses or TCP/UDP service ports.
Yes, layer 3 switches also exist and they do deal with IP addresses. That is why people usually specify which they are discussing. Layer 3 switches (or routers) do not, at their most basic level, deal with TCP/UDP ports either during their primary function. They simply perform the duty of checking their forwarding tables for destination networks/paths. If a device wants to send to an IP address that is not part of the local, connected network (otherwise it could be delivered via ARP resolution to a destination MAC, ie. layer 2 switch style function), then the router performs the duty of 'gateway' and accepts traffic from the sender and checks its forwarding table for any route that matches the intended destination IP address. Most simple routers will have maybe 2 entries on their forwarding table: their LAN network, and the default route (0.0.0.0/0) which it learns from the ISP.
Once you add in the concept of firewall and NAT capabilities, of course, you have to account for more than simple IP addresses and TCP/UDP service ports come into the discussion.
But in a configuration where you have 'WAN - NAT capable gateway - Switch - client' The NAT is essentially storing a table of <address,port> and so when you receive internet from the WAN, NAT is doing a table lookup first to find the private address of the client, which is negating the benefit of the switch. So I'm confused on 1)how we are avoiding redundant work, and 2)why we aren't overloading the switch to do all the lookup duties
Again you are confusing hardware network interface ports and TCP/UDP ports that relate to network protocols. They are two different things.
An incoming connection to a router (really a firewall) that performs NAT will generally have 2 possible actions.
The connection to the router WAN interface will be denied/dropped because it was not a reply to a previously initiated connection from a device on the protected LAN network, or it does not qualify to pass through an open port (TCP/UDP or similar network service port) that has been configured to forward traffic to an IP address and associated TCP/UDP network service port on a LAN IP address.
The connection is a reply to a connection initiated by a device with an IP address on the protected LAN or it matches an open port rule previously configured on the firewall so there is a qualified NAT table entry that allows and forwards the inbound connection.
- How do the table entries work? TCP is connection/session oriented so the router/firewall can have entries in its NAT table to match TCP sessions and UDP connections trigger NAT table entries for a timed period and then expire but can be re-opened by a LAN client as needed, recreating the NAT table entry and resetting the timer for the entry.
As a separate function, after that connection has been allowed through the firewall, it may then need to be delivered to a physical switch interface given that many small business or home firewalls include a built in switch with a few ports. The switch functionality is separate from the router/firewall functionality, including NAT. Firewall and NAT functions are performed first and once completed, the traffic can then be 'routed' (this is the lookup of the appropriate interface for a destination IP network) and ARP can be performed to discover which MAC address should be used as destination for a desired IP address on the LAN. The traffic is then dispatched to the switch for delivery to a connected LAN device. The switch will then perform any layer 2 functions needed to find a destination MAC on a specific interface and forward the frames to that interface for delivery to the destination device.
As for the concept of a layer 3 switch 'behind' a router, that is a completely separate concern and is usually done to provide for better performance or traffic management in a complex LAN design and does not play a factor in NAT or other functions performed on the internet edge gateway device (router/firewall).
Consider the concept of a large office building housing multiple departments of staff. You may have a security guard outside the building to direct people to other parts of the campus if they are lost or do not have permission to enter. This is the firewall.
Inside the building, for those who have permission to enter, they will find a reception desk where they will need to wait and be directed to the office where they will meet their intended party. This is the layer 3 switch 'behind' the firewall/router at the edge of the network. If the building is large enough or the destined office is large enough, there may even be an additional reception desk (layer 3 switch) at the offices on the second floor for a specific department, etc. There may also be secure departments where another security staff again qualifies visitors who were allowed into the building and directed to the destination office but fail additional qualification at the door to the more secure area. This is another firewall inside the LAN.
Each of those job roles in that imagined office building is performed by a separate person and though some of their roles seem very similar at a distant glance, they are quite different and have different responsibilities and requirements for their roles. One cannot know the job of the other, nor replace the other without abandoning their primary function. They do different but similar things to work as a team to accomplish the desired results.
