CCNA online course

Cisco Three-Layer Hierarchical Network Design Model

Learn how Cisco access, distribution, and core layers organize campus networks for scalability, routing, policy control, performance, and resiliency.

A hierarchical network model is a structured approach to organizing network devices and traffic flows by assigning related functions to specific layers. Cisco's traditional campus design uses three functional layers: the access layer, distribution layer, and core layer.

A campus network serves one or more nearby buildings, floors, departments, or facilities. Dividing it into functional layers makes growth, troubleshooting, policy enforcement, and redundancy easier to manage. The model is a design framework, not a rule that every network must contain three physically separate tiers. In a small network, distribution and core functions may be combined in a collapsed core.

Why Use a Hierarchical Network Design?

Separating network roles creates predictable traffic paths and limits the effect of failures. Instead of treating every switch as an interchangeable device, the design assigns each layer a clear responsibility.

• Scalability: Users, endpoints, switches, bandwidth, and buildings can be added with less redesign.
• Modularity: Repeatable network blocks can be deployed for floors, departments, wiring closets, or buildings.
• Simplified troubleshooting: Clear device roles make it easier to determine whether a problem is at the endpoint, aggregation, routing, or backbone level.
• Resiliency: Redundant devices and paths can isolate failures and maintain service.
• Performance: Local access switching is separated from high-speed backbone forwarding.
• Operational consistency: VLAN gateways, ACLs, routing boundaries, and other policies can be placed in predictable locations.

The three layers should be viewed as functional roles. A multilayer switch can perform more than one role, especially in a small or medium-sized campus.

Comparison of Access, Distribution, and Core Layers

Access Layer

The access layer is the network edge where endpoint devices connect. Access switches provide Ethernet connectivity and apply settings specific to connected devices.

Typical access-layer endpoints include:

• Desktop and laptop computers
• IP phones
• Wireless access points
• Printers
• Security cameras
• Badge readers
• Building-management and other IoT devices

Access-Layer Functions

• Port connectivity: Provides wired Ethernet connections and negotiates speed and duplex settings.
• VLAN assignment: Places an endpoint into a data, voice, guest, management, or IoT VLAN.
• Power over Ethernet: Supplies power to compatible phones, access points, cameras, and sensors.
• Port security: Restricts which MAC addresses may use a port and can limit the number of learned addresses.
• Endpoint authentication: Uses mechanisms such as 802.1X where identity-based access is required.
• Voice VLANs: Separates phone traffic from workstation traffic on a shared physical connection.
• QoS trust boundaries: Determines whether markings from an endpoint or phone should be trusted and carried into the network.
• Edge-port settings: PortFast or an equivalent edge setting can allow an endpoint port to transition quickly to forwarding. It should not be used indiscriminately on switch-to-switch links.
• Link aggregation: EtherChannel can combine multiple physical uplinks into one logical connection when supported by the topology and configuration.

Access switches normally connect upward to one or more distribution switches. Redundant uplinks prevent a single cable or upstream interface from disconnecting an entire closet. The design must also account for physical cable paths, power sources, and the behavior of Layer 2 or Layer 3 redundancy.

Example: Phone and Workstation on One Access Port

An IP phone can receive PoE from an access switch. The phone uses a voice VLAN, while a workstation connected through the phone uses a data VLAN. The access switch therefore provides physical connectivity, VLAN separation, PoE, and possibly QoS classification at the edge.

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport voice vlan 30
 spanning-tree portfast
 ! Example only: apply a suitable security or 802.1X policy
 power inline auto

This is a conceptual illustration, not a complete production configuration. Port security, 802.1X, voice-device behavior, and QoS trust should be selected according to the organization's requirements and switch platform.

Distribution Layer

The distribution layer is the aggregation and policy boundary between the access and core layers. It collects uplinks from multiple access switches and controls traffic entering the rest of the campus.

Routing and Policy

• Aggregation: Multiple access switches and their uplinks connect to distribution devices.
• Inter-VLAN routing: The distribution layer commonly hosts switched virtual interfaces (SVIs), which act as Layer 3 gateways for VLANs.
• Default gateway placement: Endpoints use a distribution SVI or a virtual gateway address as their default gateway.
• Route summarization: Contiguous address ranges can be summarized toward the core to reduce routing information.
• Route filtering and redistribution boundaries: The distribution layer can control which routes enter or leave a campus block and where different routing domains meet.
• Policy enforcement: ACLs, QoS policies, VLAN boundaries, and traffic classification are commonly applied here.
• Fault-domain separation: A problem in one access or distribution block can be prevented from affecting the entire campus.

Because the distribution layer controls traffic between VLANs and blocks, it is a natural location for most campus routing and policy decisions. Some security services may be distributed elsewhere when requirements demand it, but unnecessary packet inspection and complex processing should not be placed in the core.

Gateway Redundancy

Two distribution switches can provide a shared virtual default gateway using a first-hop redundancy protocol. HSRP, VRRP, and GLBP allow endpoints to use one virtual gateway address while physical devices share active, standby, or forwarding responsibilities.

interface Vlan20
 ip address 10.20.0.2 255.255.255.0
 standby 20 ip 10.20.0.1
 standby 20 priority 110
 standby 20 preempt

interface Vlan30
 ip address 10.30.0.2 255.255.255.0
 standby 30 ip 10.30.0.1

In this conceptual HSRP example, endpoints use the virtual address, such as 10.20.0.1, as their default gateway. One distribution switch is active for the group and another is standby. If the active device fails, the standby can assume the gateway role.

Core Layer

The core layer is the high-speed, highly available backbone that transports traffic between distribution blocks. It should provide fast and reliable forwarding with minimal policy processing.

A well-designed core emphasizes:

• Redundant paths and devices
• High-capacity links
• Rapid routing convergence
• Predictable forwarding behavior
• Low latency and high availability

The core commonly connects building distribution blocks, data center connectivity, WAN edge services, and shared enterprise resources. Complex filtering, extensive packet inspection, address manipulation, and other latency-producing services are generally avoided in the core. Those functions belong closer to the traffic boundary, usually at distribution or a dedicated security or WAN edge service.

Traffic Flow and Layer Relationships

Traffic behavior depends on whether the destination is in the same VLAN, another VLAN, another distribution block, or an external network.

• Same-VLAN traffic: The access switch forwards frames using MAC addresses. If the destination is local, the traffic may never reach distribution.
• Inter-VLAN traffic: The source sends traffic to its default gateway. The distribution-layer SVI routes the packet into the destination VLAN and can apply an ACL.
• Between access blocks: Traffic may travel from the source access switch to distribution, across a routed or switched campus path, and then toward the destination access block.
• Between buildings or distribution blocks: Traffic commonly crosses the core backbone.
• North-south traffic: Traffic moves toward shared services, a data center, the WAN, the Internet, or another external network.
• East-west traffic: Traffic moves between internal users, servers, devices, or campus blocks.

For example, an employee in VLAN 20 accessing a server in VLAN 50 normally sends the packet to the distribution gateway. The distribution switch routes it and evaluates the applicable policy. A user accessing another device in the same VLAN may be switched locally without inter-VLAN routing.

Modular Campus Design

Modularity is the ability to build and expand a network using repeatable functional blocks. A distribution block consists of access switches and their distribution-layer pair or stack. A campus may deploy one block per building, floor group, department, or set of wiring closets.

Each block can use consistent VLAN, addressing, uplink, routing, and redundancy patterns. New blocks can then be added to the core without redesigning every existing area. This approach supports incremental expansion and makes failure boundaries easier to understand.

In a multi-building campus, each building may have access switches connected to a dedicated distribution pair. The core interconnects those distribution blocks and provides the backbone for inter-building traffic.

Layer 2 and Layer 3 Design Choices

A campus can extend Layer 2 VLANs across access and distribution links, or it can use routed access, in which access-to-distribution links operate as Layer 3 routed connections rather than extended Layer 2 trunks. Neither design is universally correct; the choice depends on application requirements, operational goals, and platform capabilities.

Extended Layer 2 Design

Layer 2 redundancy can support VLAN mobility and particular application requirements, but it increases the scope of broadcast domains and Spanning Tree Protocol. Redundant Layer 2 paths also require careful loop prevention and root-bridge placement.

Routed Access Design

Routed links provide smaller broadcast domains, a smaller spanning-tree scope, and faster fault isolation. Routing protocols can use equal-cost paths and select alternate routes after a failure. This design may require different endpoint gateway placement and may not suit applications that require a VLAN to span multiple access switches or locations.

EtherChannel

EtherChannel is a logical aggregation of multiple physical Ethernet links. It can increase available bandwidth and provide resiliency when one member link fails. The member interfaces must have compatible speed, duplex, VLAN, trunk, and channel settings.

show etherchannel summary
show spanning-tree
show ip route
show standby brief

In a Layer 2 design, EtherChannel and Spanning Tree work together: the bundle appears as one logical path to spanning tree, reducing the chance that individual member links create a loop. In a Layer 3 design, routed uplinks avoid Layer 2 loops and can use routing protocol convergence and equal-cost paths instead.

Collapsed Core Design

A collapsed core combines core and distribution functions on the same devices. Access switches connect to a redundant pair of multilayer switches that provide VLAN gateways, policy, aggregation, and connectivity to shared networks.

This model is common in small and medium-sized campus networks because they may have limited scale, few access blocks, modest traffic volumes, and budget constraints. It can provide useful redundancy without the cost and operational complexity of a dedicated core.

A dedicated core becomes more appropriate as the organization grows in number of buildings, traffic demand, geographic scope, or resiliency requirements. It is also useful when distribution blocks need to be added independently or when the backbone requires separate capacity and maintenance boundaries.

High Availability and Resiliency

Resiliency is the ability of a network to continue operating or recover quickly when a component or path fails. Resiliency must be designed across logical, physical, and power domains.

• Use redundant access-to-distribution connections where service availability requires them.
• Use redundant distribution switches and diverse physical paths.
• Provide gateway redundancy with HSRP, VRRP, or GLBP.
• Use routing protocol convergence and equal-cost paths where a Layer 3 design is appropriate.
• Use Spanning Tree Protocol and correct root placement when redundant Layer 2 paths exist.
• Use EtherChannel where multiple links should operate as one logical connection.
• Provide diverse cable routes instead of placing all links in one conduit or pathway.
• Use redundant power supplies, circuits, and uninterruptible power where required.

A fault domain is the portion of the network affected by a particular failure. Distribution blocks help limit fault domains so that an access-switch or building problem does not unnecessarily disrupt the entire campus.

Example: Failed Distribution Uplink

An access switch has one uplink to each of two distribution switches. If one uplink fails, traffic can continue through the surviving path, provided that the backup path, VLAN or routing configuration, gateway redundancy, and convergence behavior are correct.

Service and Policy Placement by Layer

Capacity Planning and Oversubscription

Oversubscription occurs when the potential traffic from many downstream links exceeds the capacity of an upstream link. Some oversubscription is expected because endpoints are not normally transmitting at full rate simultaneously. However, excessive oversubscription can cause congestion, packet loss, and poor voice or video quality.

Plan access-to-distribution and distribution-to-core capacity using endpoint counts, application behavior, uplink speeds, peak utilization, growth forecasts, and availability requirements. Validate the design with interface utilization, error counters, queue statistics, and application performance rather than relying only on port speed.

Common Design Mistakes

• Allowing a growing environment to remain a flat network with no clear device roles.
• Extending large Layer 2 VLANs farther than applications actually require.
• Creating redundant Layer 2 paths without correct loop prevention.
• Applying heavy packet inspection or extensive filtering in the core.
• Providing only one uplink or one distribution switch for important users.
• Failing to provide gateway redundancy for critical VLANs.
• Ignoring diverse physical paths, redundant power, or cable-route failures.
• Treating the three-layer model as mandatory when a collapsed core better fits the scale and requirements.
• Ignoring oversubscription between access, distribution, and core links.

Troubleshooting the Hierarchical Design

Access Users Lose Connectivity After an Uplink Failure

Likely causes include no redundant uplink, a blocked or misconfigured backup path, inconsistent EtherChannel members, or a routing or spanning-tree convergence problem.

1. Check physical and interface status.
2. Verify the EtherChannel state if link aggregation is used.
3. For a Layer 2 design, inspect spanning-tree roles, states, and recent topology changes.
4. For a Layer 3 design, check routing neighbors, routes, and equal-cost paths.
5. Confirm that the surviving path carries the required VLANs or has the correct IP addressing.

Devices in Different VLANs Cannot Communicate

Check for a missing or down SVI, an incorrect endpoint default gateway, a VLAN that is not carried to the appropriate switch, an ACL or routing policy denial, or a misconfigured first-hop redundancy address.

1. Verify VLAN membership and trunk status.
2. Check SVI status, IP addresses, and subnet masks.
3. Confirm the endpoint default gateway.
4. Inspect the routing table and ACL counters.
5. Verify the virtual gateway and active/standby state.
6. Test reachability from the distribution gateway itself.

Poor Voice Quality During Peak Usage

Insufficient uplink capacity, excessive oversubscription, an incorrect QoS trust boundary, missing classification, or congestion between access and distribution can affect voice quality.

1. Review interface utilization, drops, errors, and queue statistics.
2. Verify the voice VLAN and phone connectivity.
3. Confirm that QoS markings are trusted only at the intended boundary.
4. Check whether uplink capacity matches peak voice and data demand.

Broadcast Storms or Intermittent Connectivity

Investigate Layer 2 loops, incorrect spanning-tree configuration, unauthorized edge switches, and inconsistent trunk VLAN allowances.

1. Inspect spanning-tree topology and root placement.
2. Check for MAC address-table instability or rapid MAC movement.
3. Review err-disabled ports and edge-port protections.
4. Validate trunk mode and allowed VLAN settings.

Exam-Relevant Summary

• The access layer connects endpoints and provides edge services such as VLAN assignment, PoE, port security, authentication, voice VLANs, and edge QoS.
• The distribution layer aggregates access switches and commonly provides inter-VLAN routing, default gateways, ACLs, summarization, policy, and fault-domain boundaries.
• The core layer is a fast, redundant transport backbone with minimal policy processing.
• A collapsed core combines distribution and core functions and is often suitable for smaller campuses.
• Same-VLAN traffic is switched at Layer 2; traffic between VLANs is routed at Layer 3.
• Routed access reduces broadcast and spanning-tree scope, while extended Layer 2 may be appropriate for specific requirements.
• EtherChannel bundles physical links; Spanning Tree prevents Layer 2 loops; HSRP, VRRP, and GLBP provide resilient default gateways.
• Redundancy must include devices, uplinks, physical paths, power, gateways, and convergence behavior.