1. Layer 2 Switch Operations

1.1 Overview of Layer 2 Switches

A Layer 2 Switch is a network device that operates primarily at Layer 2 — Data Link Layer of the OSI model.

The primary functions of a Layer 2 switch include:

• Connecting end devices within the same Local Area Network (LAN).
• Forwarding Ethernet frames based on destination MAC addresses.
• Mitigating collisions by micro-segmenting each port into a separate collision domain.
• Supporting VLANs to logically divide broadcast domains.

Summary: A Layer 2 switch processes and forwards frames within a single LAN or VLAN based entirely on MAC addresses.

Example:

1

PC1 ---- SW1 ---- PC2

When PC1 and PC2 are in the same VLAN, a Layer 2 switch can forward frames between the two devices by relying on its MAC address table.

1.2 Protocol Data Unit (PDU) Processing

A Layer 2 switch processes frames, not packets (which are handled at Layer 3).

Standard Ethernet frame structure:

1

Source MAC      Destination MAC      Data      FCS

A Layer 2 switch extracts the Destination MAC to determine the specific outbound port for the frame.

1.3 MAC Address Table (CAM Table)

Layer 2 switches utilize a MAC Address Table (also known as a CAM Table - Content Addressable Memory) to map MAC addresses to their corresponding switch ports.

Example:

Upon receiving a frame with a Destination MAC of BB:BB:BB:BB:BB:BB, the switch looks up the table and forwards the frame exclusively out of Fa0/2.

This fundamental mechanism makes switches significantly more efficient than legacy hubs, which simply flood electrical signals out of all ports.

1.4 Fundamental Operations of a Layer 2 Switch

1.4.1 Learning (MAC Address Learning)

When a frame enters a switch port, the switch reads the Source MAC address and records it in the MAC Address Table along with the receiving port.

Example: PC1 with MAC address AA:AA:AA:AA:AA:AA connects to Fa0/1. When PC1 transmits its first frame, the switch learns the mapping: AA:AA:AA:AA:AA:AA → Fa0/1

Important Note: A switch always performs the “learning” process using the Source MAC of an incoming frame. It never learns from the Destination MAC.

1.4.2 Forwarding and Filtering

After checking the Source MAC, the switch evaluates the Destination MAC. If the destination MAC exists in the MAC Address Table, the switch forwards the frame out the corresponding mapped port.

Special Case: If the destination device is connected to the same physical port from which the frame originated, the switch will filter (drop) the frame, as there is no need to transmit the signal back out the receiving port.

1.4.3 Flooding

A switch will flood a frame under three specific conditions:

• It encounters a Broadcast frame (Destination MAC: FF:FF:FF:FF:FF:FF).
• It encounters an Unknown Unicast frame (the destination MAC is not yet in the MAC table).
• It encounters certain types of Multicast frames.

When flooding, the switch duplicates and forwards the frame out of all ports within the same VLAN, except the port on which the frame was received.

Sơ đồ: Layer 2 Switch

1.5 Collision Domains and Broadcast Domains

1.5.1 Collision Domains

Every individual port on a switch operates as an independent collision domain. In modern Ethernet networks, end devices and switch ports negotiate to operate in full-duplex mode, thereby eliminating collisions almost entirely compared to traditional hub environments.

Key Takeaway: Switches micro-segment networks, ensuring that each physical port is its own collision domain.

1.5.2 Broadcast Domains

By default, all ports on a switch belong to a single, shared broadcast domain. However, when an administrator configures VLANs to logically segment the network, each VLAN becomes an isolated broadcast domain.

Example: Broadcast traffic originating from PC1 in VLAN 10 will never be forwarded to PC2 in VLAN 20.

Key Takeaway: Each VLAN represents a distinct and separate broadcast domain.

Sơ đồ: VLAN và Broadcast Domain

2. VLANs and Trunking

2.1 VLANs on Layer 2 Switches

A VLAN (Virtual LAN) is a technology that allows a single physical switch to be logically partitioned into multiple independent networks (broadcast domains).

Example design:

• VLAN 10: Finance and Accounting
• VLAN 20: Engineering and R&D
• VLAN 30: Guest Wi-Fi

Devices belonging to different VLANs are completely isolated at Layer 2. For inter-VLAN communication to occur, a Layer 3 capable device (such as a Router or Layer 3 Switch) is mandatory.

2.2 Access Ports and Trunk Ports

2.2.1 Access Ports

An Access port is a physical port statically assigned to a single VLAN. It is typically used to connect end devices such as PCs, printers, or IP phones.

Cisco IOS Configuration Example:

1
2
3

interface fa0/1
 switchport mode access
 switchport access vlan 10

2.2.2 Trunk Ports

A Trunk port is a point-to-point link capable of carrying traffic for multiple VLANs simultaneously. It is primarily configured on uplinks (Switch-to-Switch or Switch-to-Router connections).

2.3 IEEE 802.1Q (VLAN Tagging)

When a frame traverses a trunk link, the receiving device must be able to identify which VLAN the frame belongs to. To achieve this, the IEEE 802.1Q standard inserts a VLAN tag into the header of the original Ethernet frame.

This encapsulation protocol ensures the strict isolation of VLAN traffic, even when it is multiplexed over a single physical link.

Sơ đồ: Trunk Port và 802.1Q

2.4 Native VLAN

Within the 802.1Q protocol, the Native VLAN serves a special purpose. When traffic belonging to the Native VLAN traverses a trunk port, it is transmitted untagged (without an 802.1Q header).

By default on Cisco devices, the Native VLAN is VLAN 1. For security best practices, the Native VLAN should be changed to an unused “dummy” VLAN.

Security Warning: The Native VLAN configuration must match on both ends of a trunk link. A Native VLAN mismatch can lead to traffic leakage (VLAN hopping) and spanning-tree issues.

3. Spanning Tree Protocol (STP)

Redundant physical links between Layer 2 switches are essential for reliability but inherently introduce the risk of creating Layer 2 loops. Layer 2 loops cause devastating broadcast storms, MAC table instability, and will ultimately bring down the entire network.

To prevent this, switches utilize the STP (Spanning Tree Protocol). STP applies an algorithm to discover the network topology and actively blocks redundant paths to maintain a loop-free environment. If a primary active link fails, STP will dynamically unblock a standby port to restore connectivity.

Sơ đồ: Spanning Tree Protocol (STP)

4. Layer 3 Switches and Inter-VLAN Routing

4.1 Concept of a Layer 3 Switch

A Layer 3 Switch (or Multilayer Switch) is specialized hardware that integrates the processing capabilities of two OSI layers:

• High-speed frame switching based on MAC addresses (Layer 2).
• Packet routing based on IP addresses (Layer 3).

Summary: Layer 3 Switch = Layer 2 Switch + Integrated Routing Capabilities.

4.2 The Necessity of Layer 3 Switches

In large-scale enterprise networks, VLAN segmentation creates numerous isolated broadcast domains. For devices across different networks (e.g., VLAN 10 and VLAN 20) to communicate, traffic must be routed. While a traditional router can perform this function, a Layer 3 switch delivers vastly superior performance in campus environments. It minimizes bottlenecks and achieves wire-speed packet forwarding.

4.3 Interface Classifications on a Layer 3 Switch

4.3.1 SVI (Switched Virtual Interface)

A logical Layer 3 routing interface that represents a specific VLAN. It serves as the default gateway to route traffic internally between different VLANs.

4.3.2 Routed Port

A physical switch port can be converted into a pure routing interface using the no switchport command. The port is disassociated from all VLANs and can be directly assigned an IP address. It is typically used for Layer 3 point-to-point links.

4.4 Inter-VLAN Routing Configuration

The most prominent application of a Layer 3 switch in the CCNA curriculum is Inter-VLAN Routing. Instead of using physical router interfaces, a Layer 3 switch employs logical routing interfaces called SVIs (Switched Virtual Interfaces) to serve as default gateways for respective VLANs.

Configuration Example:

1
2
3
4
5
6
7
8
9

ip routing

interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

Configuration Alert: The ip routing command issued in global configuration mode is strictly required to enable the Layer 3 routing engine on a Cisco switch.

Sơ đồ: Inter-VLAN Routing bằng SVI

4.5 Cisco Express Forwarding (CEF)

Unlike traditional routers that process packet routing via the CPU (process switching), a Layer 3 switch relies on dedicated ASIC (Application-Specific Integrated Circuit) hardware for forwarding. Cisco utilizes CEF as its primary routing technology. CEF pre-builds two critical data structures directly into hardware:

• FIB (Forwarding Information Base): Contains optimized routing paths derived from the routing table.
• Adjacency Table: Contains Layer 2 next-hop MAC address information.

Key Takeaway: The combination of CEF and ASIC hardware enables a Layer 3 switch to maintain wire-speed routing performance.

4.6 Real-World Scenario: Inter-VLAN Packet Walk

Let’s analyze the packet traversal process in the following topology:

1
2

PC1 ---- SW-L3 ---- PC2
        VLAN 10    VLAN 20

Parameters:

• PC1: IP: 192.168.10.10/24 | Default Gateway: 192.168.10.1 | VLAN: 10
• PC2: IP: 192.168.20.10/24 | Default Gateway: 192.168.20.1 | VLAN: 20

Sequence of events when PC1 pings PC2:

1. PC1 determines that PC2 resides on a different subnet. Therefore, it encapsulates the packet with a destination MAC address pointing to its Default Gateway (192.168.10.1).
2. The Layer 3 switch receives the frame on the SVI for VLAN 10. It strips away the incoming Layer 2 header.
3. The switch inspects the destination IP address and consults its routing table (FIB). It determines the next hop is via the 192.168.20.0/24 network.
4. The switch encapsulates the packet into a new Layer 2 frame on the SVI for VLAN 20, using the destination MAC of PC2, and forwards it out the appropriate port.
5. PC2 successfully receives and processes the ICMP packet.

This inter-VLAN routing process would be impossible to execute if the central device were merely a standard Layer 2 switch without an external router.

5. Network Design and Operations

5.1 Network Device Comparison

5.1.1 Router vs. Layer 3 Switch

5.1.2 Layer 2 Switch vs. Layer 3 Switch

5.2 Hierarchical Network Design

For enterprise environments, Cisco recommends deploying switches following a three-tier hierarchical model:

• Access Layer: Provides direct connectivity for end-user devices. Layer 2 switches are heavily utilized here to enforce Port Security, VLAN assignment, and PoE.
• Distribution Layer: Aggregates traffic from the access layer. Layer 3 switches are deployed to perform Inter-VLAN routing, ACL (Access Control List) filtering, and provide redundancy.
• Core Layer: The high-speed backbone of the network. High-performance Layer 3 switches are used exclusively to transport packets as rapidly as possible without applying heavy policies.

Sơ đồ: Mô hình mạng 3 lớp (Three-Tier)

5.3 Power over Ethernet (PoE)

PoE (Power over Ethernet) is a technology heavily featured on Access switches. It enables the transmission of electrical power directly over standard UTP Ethernet cables to supply power to devices such as IP Phones, Wireless Access Points, and Security Cameras, eliminating the need for independent AC adapters.

5.4 Common Switch Troubleshooting

When administering networks, engineers must frequently troubleshoot the following issues:

• Duplex Mismatch: A synchronization error where one end operates at Full-duplex and the other at Half-duplex. This causes severe collisions, packet loss, and degraded bandwidth.
• Speed Mismatch: An incorrect physical speed configuration between two connected interfaces.
• Access VLAN Misconfiguration: An end-device is statically assigned to the wrong VLAN, preventing access to required network resources.
• Trunking Issues: Trunk link failures commonly caused by Native VLAN mismatches, incorrect DTP (Dynamic Trunking Protocol) negotiation, or restricted VLANs (VLANs not allowed on the trunk).

5.5 Cisco IOS Verification Commands

A summary of CLI commands used to verify system state:

Simulation: Cisco IOS CLI cơ bản trên Switch

6. Conclusion

6.1 Knowledge Check

1. Where does a switch learn MAC addresses from? → A switch learns strictly by inspecting the Source MAC field in the header of an incoming frame.
2. How does a switch handle an Unknown Unicast frame? → It will flood the frame out of all active ports in the same VLAN, except for the receiving port.
3. What is the relationship between a VLAN and a Broadcast Domain? → Logically, one VLAN defines exactly one distinct broadcast domain.
4. What is the function of an SVI? → An SVI serves as a logical Layer 3 routing interface that represents a specific VLAN, typically acting as the Default Gateway for devices within that VLAN.
5. What is the purpose of the 802.1Q protocol? → It inserts a VLAN tag into the Ethernet frame header to identify and isolate traffic traversing a trunk link.

6.2 Chapter Summary

Layer 2 Switch Operations:

• Operates strictly at Layer 2, forwarding frames by analyzing the MAC Address Table.
• Default behaviors: Learns via Source MAC; Floods Broadcasts and Unknown Unicasts.
• Provides traffic isolation by dividing Collision Domains at the port level and dividing Broadcast Domains at the VLAN level.

Layer 3 Switch Operations:

• A hybrid device combining Layer 2 Switching throughput with Layer 3 Routing capabilities.
• Performs high-speed Inter-VLAN routing via logical SVIs, leveraging hardware-based CEF.
• Does not fully replace a Router for complex WAN edge connectivity, deep packet inspection, or advanced NAT/VPN requirements.

Core Concept: A Layer 2 switch strictly controls local traffic distribution based on MAC addresses, akin to an internal traffic coordinator. A Layer 3 switch offers enhanced traffic management by integrating an inter-network routing engine, autonomously determining optimal pathways based on IP addresses.