Layer 2 access or routed access? Compare them and tell me which you would pick for a new campus.
Show the answer
Say this first
In layer 2 access the access switch trunks VLANs to distribution, where the SVIs and HSRP or VRRP live, so STP and the FHRP decide failover. In routed access each uplink is a routed point-to-point link, the access switch is the gateway for its own VLANs, and a routing protocol uses both uplinks with ECMP. Routed access removes STP from the uplinks and converges faster; the costs are layer 3 features on every access switch and no VLAN spanning closets. For a new campus I lean routed access unless something truly needs layer 2 between closets.
Go deeper
| Layer 2 access | Routed access | |
|---|---|---|
| Gateway | SVI plus HSRP or VRRP on distribution | SVI on the access switch |
| Uplinks | Trunks; STP blocks one unless you use a virtual pair with MEC | Routed /31 links, both used by ECMP |
| Failover | STP and FHRP timers | Link-down detection and routing, typically sub-second when tuned |
| VLAN across closets | Possible (but a bad idea) | Not possible |
| Cost | Basic layer 2 switch | Layer 3 feature set, more IP planning |
A third option is layer 2 access to a virtual distribution pair (StackWise Virtual or VSS). The uplinks form one multichassis EtherChannel, nothing blocks, and the pair is one gateway. It keeps layer 2 flexibility but puts both distribution switches in one control plane.
Routed access uplink on IOS-XE
interface TenGigabitEthernet1/1/1
description To DSW1
no switchport
ip address 10.1.255.1 255.255.255.254
ip ospf network point-to-point
!
interface Vlan10
description USERS-FLOOR1
ip address 10.1.10.1 255.255.255.0
ip helper-address 10.2.0.10
!
router ospf 1
router-id 10.1.0.11
passive-interface default
no passive-interface TenGigabitEthernet1/1/1
no passive-interface TenGigabitEthernet1/1/2
network 10.1.0.0 0.0.255.255 area 10The second uplink, Te1/1/2 to DSW2, is configured the same way with its own /31. Area 10 is
summarized at the distribution ABRs. With EIGRP the access switch would be eigrp stub.
Why no FHRP is needed
If the access switch dies, its hosts are down anyway because each host has one cable. So the gateway on the access switch adds no new single point of failure.
Reasons to stay layer 2
Apps or devices that need the same subnet in several closets, an existing large layer 2 design, access switches without a layer 3 license, or a team that is not ready to run routing at the edge.
They will ask next
Do you still run spanning tree in routed access?
Yes, on the access ports. The uplinks are routed so STP has nothing to block there, but it still protects against someone looping two wall ports together. Keep BPDU Guard on edge ports.
What about wireless roaming if every closet has its own subnets?
With a controller, client traffic is tunneled to the controller and bridged onto the wireless VLAN there, so the client keeps its address as it moves between APs on different access switches. The access switch only needs a VLAN for the APs themselves.
Traps
- Saying routed access means no VLANs. Each access switch still has VLANs; they just end at that switch.
- Forgetting that each routed access switch now needs IP planning for loopbacks and /31 links.