We currently have a flat network with a bunch of unmanaged switches. I would like to use VLANs to segregate certain users like guests and I would like to use 802.1x. However, I'm not sure if what I need is a layer 3 or a level 2 switch.

From what I understand a layer 3 switch does routing between VLANs. I don't think I need this at the moment but as I said I'm not sure since this is all new to me. What else would a layer 3 switch do for me? Our network is relatively small, less than a 100 users. What exactly does a layer 3 switch do that I can't get with a layer 2 switch? When would I need a layer 3?

  • 4
    Please note that it is Layer 2 or Layer 3 and this is a reference to OSI layers. Layer 3 switches have a internal router that has vlan interfaces (as opposed to physical interfaces). – Mircea Vutcovici Jun 4 '10 at 2:45

Unmanaged, is a basic switch, just passes packets from A to B.
L2, will do basic segregation based on things like vLan, and usually will do QoS, and might do other things like GVRP. This is most useful when used in conjunction with a L3 core switch, or a router that fully supports vLans.
L3, will do routing between different subnets on different vLans and might do basic traffic shaping (depends on manufacturer and model). It may support ACLs, but it's not terribly common. This is most useful as a switching core in a semi-complicated network.
L4, is basically a simple router with a ton of ports. These allow for very complicated networks, and the price reflects it. Usually these have every feature mentioned above plus all the features commonly found in cheaper (business grade) routers.

Generally people use vLans to separate different types of traffic. It's common for VoIP phones to use a different vLan for voice traffic than "normal" network traffic. Also it's common to separate SAN and Management networks from the rest of the network. Particularly with the management features it's convenient to have a L3/4 switch with ACLs so that only Admin computers can access the Management controllers (iLO/iLOM, network connected UPSes). Before anyone launches into a "don't you trust your employees" argument, sometimes it's better to just know who can/can't access things.

Also you can use vLans to make a visitors' network. That way certain ports (in conference rooms, waiting rooms, or public areas) can be used by guests/visitors without letting them on your network.

Most of these things can be accomplished with a L2 switch and a vLan aware router. However going this option will reduce your vLan switching fabric to the links to the router; which may not be enough bandwidth (depends on your network and requirements).

  • 11
    A layer 1 device wouldn't be considered a switch. It would be considered a hub. It also wouldn't pass from A to B. It would receive packets from A and repeat them to every other port it has. A layer 2 switch is still a layer 2 switch even if it doesn't do VLANs and QOS. A layer 2 switch will pass traffic from port 1 to port 2 without repeating it to every other port. – Jason Berg Jun 4 '10 at 6:14
  • I will add that L4 is more something like Load Balancing functionalities. There is lot of switch sold as L3 with ton of ports – radius Jun 4 '10 at 6:35
  • @Radius: a Load Balancing device might be a L4 switch, but I wouldn't go so far as to say that all (or even most) L4 switches are Load Balancers. – Chris S Jun 4 '10 at 12:48
  • So if I do not need communication between subnets or VLANs then I don't have a need for a layer 3 switch correct? What kind of real world applications would a small network have for a layer 3 switch? – eekmeter Jun 5 '10 at 0:09
  • @eekmeter: see the edit to my original answer. – Chris S Jun 5 '10 at 3:27

a layer 3 switch is basically a layer 2 switch with routing function. If you do multiple vlan and want them to exchange data, you need routing function. So you have 2 choice for this:

  1. Take a Layer 3 switch
  2. Keep your existing Layer 2 switchs and buy a router. This could be cheaper as most Layer 3 switch are generally high end

If you have users in different Vlans (different IP ranges) and want them to talk to each other you need at least one layer 3 device in your network. If you don't have a router with you already you will need to go for layer 3 switch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.