Network Devices, VLANs, Subnets, Layer 2 and Layer 3 Switches, and Routers
From AI tools as IS.
Modern computer networks are built from several different kinds of devices and several different kinds of logical boundaries. This can become confusing because terms such as switch, router, VLAN, subnet, LAN, Layer 2, and Layer 3 are closely related but do not mean the same thing.
A particularly common source of confusion is the relationship between a VLAN and an IP subnet. In a typical corporate network, one VLAN is normally paired with one IP subnet, making them look almost interchangeable. Technically, however, they operate at different layers and solve different problems.
Similarly, a modern Layer 3 switch can perform routing, which makes it look very much like a router. Yet Layer 3 switches and routers are normally designed for somewhat different jobs.
The easiest way to understand all of this is to start with how devices communicate on a simple Ethernet network and gradually build up from there.
The Main Types of Network Devices
A modern network can include many kinds of devices.
Some of the most important are:
- end devices or hosts;
- servers;
- Ethernet switches;
- wireless access points;
- routers;
- firewalls;
- gateways;
- modems and optical network terminals.
End Devices or Hosts
An end device, often called a host, is a device that produces or consumes network communication.
Examples include:
- desktop computers;
- laptops;
- smartphones;
- tablets;
- printers;
- IP phones;
- security cameras;
- smart TVs;
- servers;
- IoT devices.
A laptop opening a website is an end device.
A smartphone making a VoIP call is an end device.
A printer receiving a print job is an end device.
Servers
A server is also a host, but it normally provides services to other devices.
Examples include:
- web servers;
- database servers;
- email servers;
- file servers;
- DNS servers;
- DHCP servers;
- authentication servers;
- application servers.
The distinction between a client and a server is therefore mainly about the role of the device or application, not necessarily different hardware.
What Does a Layer 2 Switch Do?
An Ethernet switch primarily works at Layer 2, the Data Link layer.
Its basic job is to move Ethernet frames between devices.
A Layer 2 switch primarily makes forwarding decisions based on:
MAC addresses
Suppose four computers are connected to one switch:
PC-A ─┐
PC-B ─┤
Switch
PC-C ─┤
PC-D ─┘
Each Ethernet network interface has a MAC address.
For example:
PC-A = AA:AA:AA:AA:AA:AA
PC-B = BB:BB:BB:BB:BB:BB
When frames arrive, the switch learns which MAC addresses are reachable through which ports.
Its MAC address table might eventually look like:
| MAC address | Switch port |
|---|---|
| AA:AA:AA:AA:AA:AA | Port 1 |
| BB:BB:BB:BB:BB:BB | Port 2 |
| CC:CC:CC:CC:CC:CC | Port 3 |
If a frame destined for PC-B arrives on Port 1, the switch sees:
Destination MAC = BB:BB:BB:BB:BB:BB
checks its MAC address table and forwards the frame through Port 2.
This process does not require the switch to examine the destination IP address.
Ubiquiti’s current networking documentation describes the same basic process: Layer 2 switches learn source MAC addresses, build forwarding tables, and use those tables to decide where Ethernet frames should be sent.
Does a Layer 2 Switch Need an IP Address?
Interestingly:
A basic Layer 2 switch does not need an IP address to switch Ethernet frames.
It can learn MAC addresses and forward frames without having an IP address of its own.
For example:
PC-A ─ Switch ─ PC-B
PC-A and PC-B can exchange Ethernet traffic through the switch even if the switch itself has no management IP address.
Managed switches are usually assigned an IP address so administrators can:
- connect using SSH;
- access a web interface;
- use SNMP;
- collect telemetry;
- perform configuration and monitoring.
That IP address is for management.
It is not what allows ordinary Layer 2 frame forwarding to happen.
Is a MAC Address Required?
For normal Ethernet communication, MAC addresses are fundamental.
An Ethernet frame contains source and destination MAC addresses.
For example:
Destination MAC
Source MAC
EtherType
Payload
Frame Check Sequence
So Ethernet devices generally require MAC addressing to deliver frames.
However:
IP networking itself does not universally require MAC addresses.
MAC addresses belong to technologies such as Ethernet.
IP can also operate over other Layer 2 technologies that do not use Ethernet MAC addressing in the same way.
Examples include certain:
- point-to-point links;
- tunnels;
- PPP links;
- virtual interfaces.
Therefore:
Ethernet → normally requires MAC addressing
but:
IP → does not inherently require Ethernet MAC addresses
Can MAC Communication Exist Without IP?
Yes.
Ethernet is not dependent on IP.
Two devices can exchange Layer 2 Ethernet frames using MAC addresses without running IPv4 or IPv6.
Various Layer 2 control protocols also operate without depending on ordinary IP forwarding.
Examples include protocols associated with:
- spanning tree;
- link discovery;
- link aggregation.
So:
MAC addressing can exist without IP addressing.
Can IP Exist Without Ethernet?
Yes.
IP is a Layer 3 protocol and is not limited to Ethernet.
An IP packet can be transported over:
- Ethernet;
- Wi-Fi;
- cellular systems;
- point-to-point links;
- tunnels;
- many other underlying technologies.
This is one of the great strengths of IP.
The Layer 3 packet does not need to know whether one particular segment of its journey uses copper Ethernet, fiber, Wi-Fi, or another technology.
What Is a VLAN?
VLAN means:
Virtual Local Area Network
A VLAN logically separates one physical switched Ethernet infrastructure into multiple Layer 2 networks.
Suppose a company owns one switch:
Port 1 → Employee PC
Port 2 → Employee PC
Port 3 → Accounting PC
Port 4 → Accounting PC
Port 5 → Guest device
Port 6 → Guest device
Instead of putting everyone into the same Layer 2 network, the administrator could configure:
VLAN 10 → Employees
VLAN 20 → Accounting
VLAN 30 → Guests
The physical switch is one device, but logically there are three separate Ethernet networks.
A VLAN Is a Broadcast Domain
One important property of a VLAN is that each VLAN normally forms a separate Layer 2 broadcast domain.
Suppose a computer in VLAN 10 sends an Ethernet broadcast.
The switch forwards that broadcast to other appropriate ports in:
VLAN 10
but not normally to:
VLAN 20
VLAN 30
Therefore:
A VLAN creates Layer 2 separation.
Devices connected to the same physical switch can behave as though they were connected to separate switches.
One Physical Switch, Several Logical LANs
Conceptually:
Physical Switch
┌──────────────────────────┐
│ VLAN 10 VLAN 20 │
│ Staff Accounting │
│ │
│ VLAN 30 │
│ Guests │
└──────────────────────────┘
This is why VLANs are so useful.
Organizations do not need a completely separate physical switch for every department or network.
What Is an IP Subnet?
A subnet is a Layer 3 concept.
It defines a group of IP addresses belonging to the same logical IP network.
For example:
192.168.10.0/24
is an IPv4 subnet.
Addresses might include:
192.168.10.1
192.168.10.2
192.168.10.3
...
Another subnet could be:
192.168.20.0/24
These are different IP networks.
A router or Layer 3 device is normally required to forward packets between them.
VLAN and Subnet: Are They the Same Thing?
No.
They frequently correspond to each other, but they are different concepts.
| VLAN | Subnet |
|---|---|
| Layer 2 | Layer 3 |
| Ethernet concept | IP concept |
| Creates a broadcast domain | Defines an IP network |
| Identified by VLAN ID | Identified by network prefix |
| Example: VLAN 10 | Example: 192.168.10.0/24 |
| Switches enforce separation | Routers route between subnets |
| Uses MAC-based forwarding | Uses IP-based forwarding |
A good way to remember the distinction is:
A VLAN groups and separates Ethernet devices.
while:
A subnet groups and separates IP addresses.
Why Do VLANs and Subnets Seem Like the Same Thing?
Because normal network design commonly maps them one-to-one.
For example:
VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24
This is a very clean design.
Each VLAN represents:
- one Layer 2 broadcast domain;
- normally one IP subnet.
Cisco documentation describes this common design explicitly: individual IP subnetworks are commonly mapped to individual VLANs, while routing is required to communicate between VLANs.
So in practice:
One VLAN = one subnet
is a very useful design rule.
But it is not a definition saying VLAN and subnet are technically identical.
Does Subnetting Create VLANs?
No.
Subnetting creates IP networks.
It does not automatically create Layer 2 VLANs.
Consider a router:
Router
/ \
192.168.10.0/24 192.168.20.0/24
Each router interface could connect to a separate physical Ethernet network.
There might be no VLAN configuration anywhere.
Yet there are clearly two IP subnets.
Therefore:
A subnet can exist without a VLAN.
Can a VLAN Exist Without a Subnet?
Yes.
A VLAN can exist entirely at Layer 2 without any IP subnet being assigned to it.
For example:
VLAN 100
may be configured on a switch and contain Ethernet devices that use some non-IP protocol.
Or an administrator may create a VLAN before any devices or IP addresses have been assigned.
Therefore:
A VLAN does not technically require an IP subnet.
However, if hosts in that VLAN are going to use normal IPv4 or IPv6 communication, the VLAN will ordinarily be associated with an IP subnet.
Can a Network Exist Without IP?
Yes.
A computer network does not have to use Internet Protocol.
Ethernet itself is a networking technology and can carry protocols other than IPv4 or IPv6.
Historically, many networks used protocols such as:
- IPX;
- AppleTalk;
- various proprietary networking protocols.
Specialized industrial environments can also use communication mechanisms that are not ordinary IP networks.
Today, however, IP dominates general-purpose computer networking.
Can Multiple VLANs Use One IP Subnet?
Under normal network design:
They should not.
Suppose:
VLAN 10
PC-A = 192.168.1.10/24
and:
VLAN 20
PC-B = 192.168.1.20/24
Both hosts believe they are on:
192.168.1.0/24
PC-A examines:
192.168.1.20
and concludes:
“That address belongs to my local subnet.”
So PC-A tries to discover PC-B’s MAC address using ARP.
It broadcasts:
Who has 192.168.1.20?
But the broadcast remains within VLAN 10.
PC-B is in VLAN 20 and never receives it.
Communication therefore fails under normal circumstances.
This is why the normal design is:
VLAN 10 → Subnet A
VLAN 20 → Subnet B
rather than putting the same subnet into two isolated VLANs.
Specialized techniques can change this behavior, but they are exceptions rather than the normal design.
Can One VLAN Contain Multiple IP Subnets?
Technically, yes.
For example, devices in one VLAN could be configured using:
192.168.10.0/24
and:
192.168.20.0/24
on the same Layer 2 broadcast domain.
But this is generally not the preferred design.
It complicates:
- addressing;
- gateway configuration;
- troubleshooting;
- security;
- broadcast-domain design.
The normal design remains:
One VLAN mapped to one IP subnet.
What Happens When Two Computers Are in the Same VLAN and Subnet?
Suppose:
PC-A
IP: 192.168.10.10
MAC: AA-AA-AA-AA-AA-AA
and:
PC-B
IP: 192.168.10.20
MAC: BB-BB-BB-BB-BB-BB
Both belong to:
VLAN 10
Subnet: 192.168.10.0/24
and are connected through a Layer 2 switch.
The communication process is roughly as follows.
Step 1: PC-A examines the destination IP
PC-A sees:
192.168.10.20
Its subnet mask tells it that the destination is on the same subnet.
Therefore, PC-A does not send the packet to its router.
Step 2: PC-A Needs the Destination MAC Address
Ethernet delivers frames using MAC addresses.
PC-A therefore needs to determine which MAC address corresponds to:
192.168.10.20
It uses ARP for IPv4.
Conceptually:
Who has 192.168.10.20?
This is transmitted as an Ethernet broadcast.
Step 3: The Switch Floods the Broadcast
Because it is a broadcast, the switch sends it to the other ports belonging to VLAN 10.
PC-B receives the request.
Step 4: PC-B Replies
PC-B responds:
192.168.10.20 is at BB-BB-BB-BB-BB-BB
PC-A now knows PC-B’s MAC address.
Step 5: PC-A Builds an Ethernet Frame
The frame contains approximately:
Destination MAC: BB-BB-BB-BB-BB-BB
Source MAC: AA-AA-AA-AA-AA-AA
Inside the frame:
Source IP: 192.168.10.10
Destination IP: 192.168.10.20
Step 6: The Layer 2 Switch Forwards the Frame
The switch looks at:
Destination MAC
checks its MAC address table, and sends the frame toward PC-B.
The router is not involved.
This is Layer 2 switching.
What If Two Physical LAN Segments Are Connected by a Layer 2 Switch?
Suppose:
LAN Segment A ─── Layer 2 Switch ─── LAN Segment B
If both sides belong to the same VLAN, the switch can bridge Ethernet frames between them.
Conceptually, the switch has turned those physical segments into one larger Layer 2 network.
For example:
Segment A:
PC-A
PC-B
Layer 2 Switch
Segment B:
PC-C
PC-D
If all are in VLAN 10, they can belong to the same Layer 2 broadcast domain.
Calling them “LAN A” and “LAN B” is therefore somewhat ambiguous.
Physically, they may be separate Ethernet segments.
Logically, after bridging them through the switch, they can be one LAN.
What If They Are Truly Separate LANs?
If “LAN 1” and “LAN 2” means:
LAN 1 = VLAN 10 / 192.168.10.0/24
LAN 2 = VLAN 20 / 192.168.20.0/24
then a Layer 2 switch cannot by itself provide communication between them.
A Layer 3 device is required.
That could be:
- a router;
- a Layer 3 switch;
- a firewall capable of routing.
What Is a Layer 3 Switch?
A Layer 3 switch combines traditional Ethernet switching with IP routing capabilities.
It can perform:
Layer 2 switching
MAC address → switch port
and:
Layer 3 routing
Destination IP network → next hop/interface
Modern Layer 3 switches commonly perform routing directly in switching hardware, making inter-VLAN communication extremely fast.
Ubiquiti, for example, describes current Layer 3 switches as providing hardware-accelerated inter-VLAN routing.
What Is an SVI?
One common way for a Layer 3 switch to route between VLANs is through Switched Virtual Interfaces, usually abbreviated SVIs.
Suppose:
VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
The Layer 3 switch could have:
interface VLAN 10
IP address 192.168.10.1
and:
interface VLAN 20
IP address 192.168.20.1
The hosts use those addresses as their default gateways.
Conceptually:
VLAN 10
192.168.10.0/24
│
│ 192.168.10.1
│
Layer 3 Switch
│
│ 192.168.20.1
│
VLAN 20
192.168.20.0/24
How Does a Layer 3 Switch Move Data Between VLANs?
Suppose:
PC-A
192.168.10.10/24
VLAN 10
needs to contact:
PC-B
192.168.20.20/24
VLAN 20
PC-A examines the destination.
It sees that:
192.168.20.20
is outside its local subnet.
Therefore, rather than trying to find PC-B’s MAC address, PC-A sends the packet to its default gateway:
192.168.10.1
which belongs to the Layer 3 switch.
The First Ethernet Frame
PC-A transmits approximately:
Ethernet:
Destination MAC = MAC of VLAN 10 gateway
Source MAC = MAC of PC-A
IP:
Source IP = 192.168.10.10
Destination IP = 192.168.20.20
Notice something very important:
The destination MAC address is the gateway’s MAC address, but the destination IP address remains PC-B’s IP address.
The Layer 3 Switch Routes the Packet
The Layer 3 switch:
- receives the Ethernet frame;
- removes the Layer 2 Ethernet header;
- examines the destination IP address;
- checks its routing table;
- determines that
192.168.20.0/24is reachable through VLAN 20; - discovers PC-B’s MAC address if necessary;
- constructs a new Ethernet frame;
- sends the packet into VLAN 20.
The new frame might contain:
Destination MAC = PC-B's MAC
Source MAC = Layer 3 switch VLAN 20 MAC
Source IP = 192.168.10.10
Destination IP = 192.168.20.20
The Ethernet addresses changed.
The source and destination IP addresses normally did not.
This illustrates a fundamental principle:
MAC addresses normally change as packets cross routed Layer 3 boundaries, while end-to-end IP addresses normally remain the same unless something such as NAT changes them.
Layer 2 Switch vs. Layer 3 Switch
| Capability | Layer 2 Switch | Layer 3 Switch |
|---|---|---|
| Ethernet switching | Yes | Yes |
| MAC address table | Yes | Yes |
| VLANs | Yes | Yes |
| Layer 2 broadcast separation | Yes | Yes |
| IP routing | Normally no | Yes |
| Routing table | Normally no forwarding role | Yes |
| Inter-VLAN routing | No | Yes |
| SVI/default gateway | Management only or limited | Yes |
| Static/dynamic routes | No or very limited | Usually supported to varying degrees |
| Typical use | Access switching | Distribution/core + access in some designs |
Cisco’s training material similarly contrasts a Layer 2 Catalyst 2960 with a Layer 3-capable switch and notes that enabling IP routing allows the Layer 3 switch to perform routing functions.
What Is a Router?
A router is fundamentally a Layer 3 device.
Its main job is:
to connect different IP networks and forward packets between them based on destination IP addresses and routing information.
For example:
LAN A
192.168.10.0/24
│
Router
│
LAN B
192.168.20.0/24
or:
Corporate LAN
│
Router
│
ISP
│
Internet
Routers maintain routing tables showing how different networks can be reached.
A Router Is Not Defined as “LAN to WAN”
It is common to think:
Switch = LAN
Router = LAN to Internet
That is an oversimplification.
A router can connect:
- LAN to LAN;
- subnet to subnet;
- VLAN to VLAN;
- LAN to WAN;
- WAN to WAN;
- branch office to headquarters;
- enterprise network to ISP;
- one ISP to another ISP.
For example, two subnets inside the same building may communicate through a router.
No WAN is necessary.
If a Layer 3 Switch Routes, Why Do We Need Routers?
This is an important question.
A modern Layer 3 switch and a router overlap substantially.
Both can:
- maintain routing tables;
- forward IP packets;
- support static routes;
- support routing protocols;
- route between networks.
The difference is increasingly about design, interfaces, features, scale, and intended role rather than a rigid Layer 2-versus-Layer 3 distinction.
Layer 3 Switch: Optimized for High-Speed LAN Routing
Layer 3 switches are commonly optimized for:
- many Ethernet ports;
- very high switching throughput;
- VLANs;
- inter-VLAN routing;
- campus networks;
- data centres;
- access/distribution/core switching.
For example:
Employees VLAN
\
Servers VLAN ─ Layer 3 Switch ─ Campus Core
/
Guest VLAN
The device can switch and route enormous volumes of traffic locally.
Router: Optimized for Connecting Networks and WANs
Routers are typically designed for broader Layer 3 connectivity.
Depending on the router, features may include:
- sophisticated routing protocols;
- BGP;
- MPLS;
- WAN interfaces;
- VPN;
- SD-WAN;
- NAT;
- QoS;
- tunneling;
- traffic engineering;
- carrier-scale routing tables;
- Internet peering;
- cellular WAN connections.
A branch router, for example, may connect:
Office LAN
│
Branch Router
├── Fiber ISP
├── Secondary ISP
└── 5G Backup
That role is different from simply switching thousands of local Ethernet devices.
Layer 3 Switch vs. Router
A useful practical comparison is:
| Layer 3 Switch | Router |
|---|---|
| Primarily optimized for LAN/campus/data-centre Ethernet | Primarily optimized for inter-network/WAN/edge routing |
| Usually many Ethernet switch ports | Often fewer but more flexible routed interfaces |
| Extremely fast inter-VLAN routing | Rich WAN and routing capabilities |
| Common in campus distribution/core | Common at network boundaries and WAN edges |
| Heavy emphasis on VLANs | Heavy emphasis on routing |
| Often ASIC-based local forwarding | Also hardware accelerated on modern enterprise/provider routers |
| Usually does not perform Internet NAT/firewall duties as its primary role | May provide NAT, VPN, WAN, SD-WAN and related services |
But these are tendencies—not absolute laws.
Modern high-end networking hardware increasingly blurs the distinction.
Can a Layer 3 Switch Replace a Router?
Sometimes.
Consider an office containing several VLANs:
Staff VLAN
Finance VLAN
Server VLAN
Guest VLAN
A Layer 3 switch can route among these networks efficiently.
There may be no reason to send every internal packet through a separate external router.
For example:
Layer 3 Switch
/ | \
Staff Servers Finance
This is one of the most common uses of Layer 3 switching.
But when traffic needs to leave the organization:
Layer 3 Switch
│
Firewall / Edge Router
│
ISP
│
Internet
a dedicated edge router, firewall, or integrated security gateway is often used.
Can a Router Perform Layer 2 Switching?
Some routers can.
Modern network appliances frequently combine many functions.
One physical box might contain:
- router;
- Ethernet switch;
- firewall;
- VPN gateway;
- Wi-Fi access point;
- DHCP server.
A typical home “wireless router” is a good example.
Internally, it often contains:
Router
+
Ethernet switch
+
Wi-Fi access point
+
Firewall/NAT
+
DHCP server
So the product name does not necessarily reveal every internal function.
What Is an Access Switch?
An access switch connects end devices to the network.
Examples include:
- desktop computers;
- printers;
- IP phones;
- Wi-Fi access points;
- security cameras.
A typical corporate access layer looks like:
PC ─┐
IP Phone ─┤
Printer ──┤ Access Switch
Wi-Fi AP ─┤
Camera ───┘
Access switches often provide Power over Ethernet (PoE) so the Ethernet cable can provide both data and electrical power to:
- IP phones;
- access points;
- cameras.
Distribution and Core Switches
Larger networks often use hierarchical designs.
A simplified traditional campus architecture is:
End Devices
│
Access Switches
│
Distribution Switches
│
Core
│
WAN/Internet
Distribution and core switches are often Layer 3 switches.
They can route between many VLANs and aggregate traffic from many access switches.
Current Cisco campus families illustrate this separation. Cisco positions Catalyst 9200 and 9300 systems for access and branch/campus use, while Catalyst 9400, 9500, and 9600 families serve increasingly large distribution and core roles.
A Small-Business Network
A small office might have only:
Internet
│
Router/Firewall
│
Managed Switch
┌─┼────┬─────┐
PC AP Printer Phone
The router/firewall might perform:
- Internet routing;
- NAT;
- DHCP;
- VPN;
- firewalling.
The switch provides:
- Ethernet connectivity;
- VLANs;
- PoE;
- perhaps some Layer 3 functionality.
Current examples aimed at smaller environments include Cisco Catalyst 1300 switches, which Cisco describes as designed for small and medium-sized businesses.
Cloud-managed platforms are also common in this market. Cisco Meraki, for example, offers smaller security/SD-WAN appliances for branches ranging from tens to hundreds of users.
Ubiquiti UniFi is another commonly encountered architecture in small and medium environments, offering Layer 2 and Layer 3 switching along with gateway and Wi-Fi systems.
A Medium-Sized Corporate Network
A medium-sized organization might have:
Internet
│
Firewall/Edge Router
│
Layer 3 Core
/ \
Access Switch Access Switch
/ | \ / | \
PCs APs Phones PCs APs Cameras
There may be several VLANs:
VLAN 10 → Corporate users
VLAN 20 → Voice
VLAN 30 → Servers
VLAN 40 → Wi-Fi
VLAN 50 → Guests
VLAN 60 → Cameras
A Layer 3 switch may route among these networks.
A firewall may control which VLANs are permitted to communicate.
The edge router or firewall handles connectivity toward:
- Internet providers;
- branch offices;
- cloud services;
- VPNs.
Representative current enterprise switching platforms include Cisco Catalyst 9200 and 9300 systems. Cisco describes the 9200 family as enterprise access switching for branches and midsize campuses and the 9300 family as campus access systems with greater scale and capabilities.
For branch/WAN routing, Cisco’s current Catalyst 8300 platform is designed for SD-WAN, SASE, 5G and cloud-edge applications.
A Large Corporate Campus
A large corporation may have thousands or tens of thousands of devices.
A simplified architecture could be:
Internet / WAN
│
Edge Routers
│
Firewalls
│
Core L3 Switches
/ \
Distribution Distribution
/ \ / \
Access Access Access Access
│ │ │ │
Users/APs Phones Servers Cameras
At this scale, redundancy becomes essential.
Organizations may use:
- redundant core switches;
- redundant routers;
- multiple ISPs;
- dynamic routing protocols;
- high-speed fiber links;
- link aggregation;
- hundreds or thousands of VLANs;
- large routing tables.
Cisco currently positions Catalyst 9500 and 9600 systems for midsize-to-large campus core roles.
What Happens in a Data Centre?
Data-centre networks can be much larger and faster.
Instead of the traditional access/distribution/core hierarchy, many data centres use leaf-spine architectures.
A simplified model is:
Spine Spine
/|\ /|\
/ | \ / | \
Leaf Leaf Leaf Leaf
│ │ │ │
Servers Servers
These devices often perform both sophisticated Layer 2 and Layer 3 functions.
Cisco’s Nexus 9000 family, for example, is designed for data-centre switching and currently supports interfaces reaching 800 Gb/s on some platforms.
At this scale, the old idea that:
“switch = simple Layer 2 device”
becomes increasingly inadequate.
Modern data-centre switches often perform extensive Layer 3 routing as well.
What Devices Make Up the Internet?
The Internet is fundamentally a network of networks.
A simplified path might be:
Home/Office
│
Access Router
│
ISP Edge Router
│
ISP Core
│
Internet Peering Router
│
Another ISP
│
Data Centre
│
Server
Internet-scale routers must manage enormous quantities of traffic and very large routing tables.
They commonly use:
- BGP;
- MPLS;
- segment routing;
- high-speed optical Ethernet;
- 100G;
- 400G;
- increasingly 800G links.
Representative service-provider platforms include Cisco’s 8000 Series and Juniper’s MX and PTX families.
Cisco positions its 8000 systems for carrier core, aggregation and Internet peering applications.
Juniper’s MX family is used for service-provider edge, broadband, peering and related applications, while the PTX family is designed for high-capacity core and WAN environments. Current PTX platforms support 400G and 800G architectures.
Are There Switches Inside the Internet?
Certainly.
The Internet is not built only from routers.
Switches are heavily used inside:
- data centres;
- ISP facilities;
- Internet exchanges;
- carrier Ethernet networks;
- aggregation networks.
The distinction depends on what function is being performed at that point.
For communication between IP networks or autonomous systems, routing is central.
Within a data-centre fabric or local Layer 2 domain, switching may be central.
Modern hardware can perform both.
Common Equipment in Networking Labs
Networking laboratories often use either real hardware or network simulators/emulators.
Historically and still in many training environments, Cisco devices such as:
- Catalyst 2960 Layer 2 switches;
- Catalyst 3560/3650 Layer 3 switches;
- Cisco 1941/2900-series routers
are frequently encountered.
These should be understood as training and legacy platforms, not necessarily recommendations for new corporate deployments in 2026.
Cisco’s own networking lab material has used Catalyst 2960 switches and Cisco ISR routers in hands-on exercises, while Layer 2-versus-Layer 3 comparison material uses the 2960 alongside Layer 3-capable Catalyst platforms.
Today, many labs are also virtual.
Common approaches include:
- Cisco Packet Tracer;
- GNS3;
- EVE-NG;
- vendor virtual router images;
- cloud networking labs.
Virtual labs make it possible to construct networks containing many routers and switches without owning large amounts of physical hardware.
Representative Devices by Environment
The following is not a strict purchasing guide; it illustrates the kinds of equipment encountered at different scales.
| Environment | Typical switching | Typical routing/gateway role |
|---|---|---|
| Home | Integrated Ethernet switch | Consumer gateway/router |
| Small business | Managed L2/L3 switch | Firewall/router appliance |
| Medium enterprise | Enterprise access switches | Branch router/firewall |
| Large campus | Access + L3 distribution/core | Enterprise WAN edge routers |
| Data centre | High-speed L2/L3 leaf-spine switches | Edge/peering routers |
| ISP | Carrier Ethernet/aggregation switches | Edge/core/peering routers |
| Internet backbone | Very high-capacity switching fabrics | Carrier-class BGP/core routers |
Representative current families include:
- Small/medium switching: Cisco Catalyst 1300, Catalyst 9200, UniFi switching;
- Enterprise campus: Cisco Catalyst 9300, 9400, 9500, 9600;
- Branch/WAN: Cisco Catalyst 8300 and comparable platforms;
- Data centre: Cisco Nexus 9000, Juniper QFX and comparable systems;
- Service-provider edge/core: Cisco 8000, Juniper MX and PTX.
Cisco’s current Catalyst portfolio explicitly divides its families among access, distribution, and core roles, while Juniper positions its MX/PTX families for edge, peering, WAN and core routing.
Putting VLAN, Subnet, Switch and Router Together
Consider a corporate network with three departments.
Employees
VLAN 10
192.168.10.0/24
\
\
Layer 3 Switch
/ | \
Accounting | Servers
VLAN 20 | VLAN 30
192.168.20.0/24 | 192.168.30.0/24
|
Firewall
|
Router
|
ISP
|
Internet
This architecture demonstrates all of the concepts.
Inside VLAN 10
Frames are switched using MAC addresses.
Between VLAN 10 and VLAN 20
Packets are routed using IP addresses.
Between the company and the Internet
A router/firewall forwards traffic toward the ISP.
VLAN
Defines the Layer 2 logical network.
Subnet
Defines the Layer 3 IP network.
Layer 2 switch
Moves frames within VLANs.
Layer 3 switch
Moves frames within VLANs and routes packets between IP subnets.
Router
Connects IP networks and is commonly used at WAN and Internet boundaries.
What Addresses Are Actually Used During Communication?
A useful summary is:
Inside one Ethernet LAN
Both are used:
IP address → identifies the Layer 3 endpoint
MAC address → identifies the local Ethernet destination
Suppose:
192.168.10.10
sends something to:
192.168.10.20
The IP addresses identify the endpoints.
The MAC addresses allow the Ethernet frame to cross the local LAN.
Across a Router
Suppose:
192.168.10.10
communicates with:
8.8.8.8
The destination is not local.
The computer creates a frame whose:
Destination IP = 8.8.8.8
Destination MAC = MAC address of local gateway
The router receives it.
At the next Ethernet link, a different pair of MAC addresses is normally used.
Therefore:
IP addresses identify Layer 3 source/destination communication, while MAC addresses generally identify the next Ethernet hop.
That is why MAC addresses normally change at routed boundaries while IP addresses can remain end-to-end.
Does Every Router Need a MAC Address?
Not inherently.
A router performing IP routing over Ethernet has MAC addresses on its Ethernet interfaces because Ethernet requires them.
But a router could also have a non-Ethernet point-to-point interface where Ethernet MAC addressing is irrelevant.
So:
Routing requires Layer 3 addressing, but Ethernet MAC addressing is only required when the relevant link technology is Ethernet or uses comparable MAC mechanisms.
Does Every Switch Need an IP Address?
No.
A Layer 2 switch can forward frames with no IP address configured.
A managed switch normally receives an IP address so administrators can manage it.
A Layer 3 switch, however, needs Layer 3 addresses on interfaces or SVIs when it is actually performing IP routing.
The Most Important Relationships
These concepts can be summarized as:
Layer 2
│
├── Ethernet
├── MAC addresses
├── Switch
└── VLAN
│
│ commonly mapped 1:1
▼
Layer 3
│
├── IPv4 / IPv6
├── IP addresses
├── Subnet
├── Layer 3 switch
└── Router
This one-to-one VLAN-to-subnet relationship is a design convention, not a statement that VLAN and subnet are identical.
Common Misconceptions
Several statements sound reasonable but are technically incorrect.
“A VLAN is a subnet.”
Not exactly.
A VLAN is Layer 2.
A subnet is Layer 3.
They are normally paired.
“Subnetting creates VLANs.”
No.
Subnetting creates IP subnets.
VLANs are configured separately at Layer 2.
“A VLAN requires IP.”
No.
A VLAN can exist without IP.
“IP requires Ethernet MAC addresses.”
No.
IP can operate over technologies other than Ethernet.
“A Layer 2 switch requires an IP address.”
No.
It requires no IP address for ordinary frame forwarding.
“A switch connects devices while a router connects LANs.”
Too simplistic.
A Layer 3 switch can route between networks, and a router can connect networks within the same building.
“Routers are only for LAN-to-WAN communication.”
No.
A router can connect any appropriate different Layer 3 networks.
“Different VLANs can normally use the same subnet.”
No.
Separate VLANs isolate Layer 2 broadcasts such as ARP, so one IP subnet spread across independently isolated VLANs normally will not function correctly without special mechanisms.
A Useful Mental Model
The simplest way to keep everything straight is to ask three different questions.
Question 1: What Layer 2 network am I in?
Think:
VLAN
and:
MAC address
and:
switch
Question 2: What Layer 3 network am I in?
Think:
subnet
and:
IP address
Question 3: How do I reach another Layer 3 network?
Think:
router
or:
Layer 3 switch
and:
default gateway
and:
routing table
Final Thought
The boundaries between switches and routers have become less rigid as networking hardware has evolved.
A traditional Layer 2 switch primarily forwards:
Ethernet frames based on MAC addresses.
A router primarily forwards:
IP packets between networks based on IP addresses and routing tables.
A Layer 3 switch combines both capabilities:
Layer 2 switching + Layer 3 routing.
Likewise, a VLAN and a subnet often appear together but represent different things:
VLAN = Layer 2 logical separation
Subnet = Layer 3 logical addressing
The normal modern design is:
One VLAN
↓
One IP subnet
↓
Layer 3 gateway
↓
Other VLANs/subnets
Within the VLAN, switches use MAC addresses.
Between subnets, routers or Layer 3 switches use IP addresses.
At the edge of the organization, routers, firewalls, or integrated gateways connect the internal network to WANs, service providers, cloud networks, and ultimately the Internet.
Once these layers are separated conceptually, much of networking becomes easier to understand:
MAC addresses and VLANs organize local Layer 2 communication. IP addresses and subnets organize Layer 3 communication. Switches move frames locally. Routers and Layer 3 switches move packets between networks.
Modern networking equipment may combine these functions in one physical device, but the underlying concepts remain distinct.
References and Further Reading
- Cisco — Catalyst 9000 Switching Family. Current enterprise access, distribution, and core switching families, including Catalyst 9200, 9300, 9400, 9500, and 9600.
- Cisco — Campus LAN Core and Distribution Switches. Current positioning of enterprise Layer 3 switching platforms for small, midsize, and large campus networks.
- Cisco — Catalyst 8300 Series Edge Platforms. Current enterprise branch, SD-WAN, WAN edge, security, and 5G-capable routing platform.
- Cisco — Nexus 9000 Series. Modern high-performance data-centre switching platforms supporting high-speed Ethernet up to 800G on current systems.
- Cisco — Cisco 8000 Series. Carrier-class routing platforms designed for core, aggregation, peering, ISP and cloud-scale applications.
- Cisco Networking Academy — Comparing Layer 2 and Layer 3 Devices. Discussion of Layer 2 switches, Layer 3 switches and routers, including inter-VLAN routing concepts.
- Cisco — VLAN and IP Routing Configuration. Documentation explaining that hosts within the same VLAN can communicate through switching while communication between different VLANs requires Layer 3 routing.
- Juniper Networks — MX Series Universal Routing Platforms. Service-provider and enterprise routing systems for broadband edge, peering, mobile backhaul and data-centre edge roles.
- Juniper Networks — PTX Series Routers. High-capacity WAN/core and peering platforms supporting current 100G, 400G and 800G architectures.
- Ubiquiti — Switching, Routing and STP. Modern explanation of Layer 2 MAC learning and Layer 3 routing concepts.
- Ubiquiti — Layer 3 Routing. Documentation showing practical inter-VLAN routing using Layer 3 switches.
- Cisco — Catalyst 1300 Series. Managed switching family aimed at small and medium-sized business networks.
