Walk me through the three-layer hierarchical model. What does each layer do?
Show the answer
Say this first
Access is where endpoints plug in and where edge policy lives: PoE, VLAN assignment, 802.1X, port security, DHCP snooping and QoS marking at the trust boundary. Distribution aggregates a group of access switches, is usually the layer 2 to layer 3 boundary, hosts the redundant gateway and summarizes routes toward the core. Core moves traffic between distribution blocks fast and redundantly, with no per-user policy and no endpoints attached.
Go deeper
Access layer
- Ports for PCs, phones, APs, printers and cameras. Port count and PoE budget drive the hardware.
- Edge security: 802.1X or MAB, port security, BPDU Guard, DHCP snooping, dynamic ARP inspection.
- QoS classification and marking. The trust boundary sits here: trust the IP phone, re-mark the PC.
- Usually two uplinks, one to each distribution switch.
Distribution layer
- Aggregates one building or one group of closets. A distribution pair plus its access switches is called a distribution block.
- The layer 2 to layer 3 boundary when access is layer 2: SVIs, HSRP or VRRP, STP root for its VLANs.
- Policy that belongs between groups: ACLs, QoS policing, route filtering.
- Summarizes the block's subnets toward the core, so a flapping access subnet does not ripple out.
Core layer
- Connects distribution blocks, the data center, the WAN edge and the internet edge.
- Only fast, simple, redundant layer 3 forwarding. No endpoints, no layer 2 loops, no policy that needs regular tuning.
- It must never be the reason anything is slow or down, so changes here are rare and careful.
What the model buys you
Each layer has a clear job, so you know where a feature or a problem lives. Blocks are copied, not redesigned, when you grow. Failures stay inside a block because the boundaries are layer 3 with summaries.
Real life
It is a model, not an order to buy three tiers of boxes. Small sites merge core and distribution (collapsed core). Many modern campuses push layer 3 down to the access switch (routed access). The roles stay the same even when the boxes merge.
They will ask next
Why should the core not run policy like ACLs or deep inspection?
Everything crosses the core, so extra processing there affects everyone and any mistake has the biggest blast radius. Policy belongs at the edge or at distribution, close to the traffic it is for. The core's job is fast, predictable forwarding and quick convergence.
In a layer 2 access design, where do you put the STP root and the HSRP active gateway?
On the same distribution switch for each VLAN. If the root is DSW1 but HSRP active is DSW2, traffic crosses the link between them for no reason. A common pattern splits the load: odd VLANs rooted and active on DSW1, even VLANs on DSW2.
Traps
- Saying the core does inter-VLAN routing. In the classic model that happens at distribution.
- Treating the three tiers as three mandatory sets of boxes. Collapsed core and routed access are normal.