VMware ESXi and vSphere Cluster Management

Cisco Three-Layer Hierarchical Network Design Model

Learn how Cisco access, distribution, and core layers organize enterprise networks, including device roles, traffic flow, redundancy, troubleshooting, and collapsed-core designs.

The Cisco three-layer hierarchical network model organizes an enterprise network into three logical layers: access, distribution, and core. Each layer has a focused responsibility, which makes a growing network easier to design, operate, troubleshoot, secure, and expand.

This model is a logical design framework. It does not require every organization to deploy exactly three separate physical tiers. In a small office, for example, distribution and core functions may be combined in a collapsed-core design.

Why Use Hierarchical Network Design?

Large networks become difficult to manage when endpoint connections, routing, security policy, and backbone transport are mixed together without a clear structure. A hierarchical approach divides these responsibilities into functional blocks.

• Scalability: New users, switches, buildings, and services can be added to an appropriate block without redesigning the entire network.
• Reliability: Redundant uplinks, paired devices, and alternate paths can be planned at each important boundary.
• Performance: High-volume backbone traffic can use specialized, fast devices, while edge devices focus on endpoint connectivity.
• Simpler management: Each layer has a predictable role, making configuration and troubleshooting more systematic.
• Cost-conscious growth: An organization can deploy a simple design initially and add capacity or redundancy where it is needed.

Layer separation also limits unnecessary complexity. The access layer should not usually perform complex backbone policy processing, and the core should not usually be burdened with detailed endpoint security rules.

Overview of the Three Layers

The normal enterprise path is:

1. An endpoint connects to an access switch.
2. The access layer forwards local Layer 2 traffic or sends traffic for another network to an upstream distribution device.
3. The distribution layer applies routing and policy. If the destination is in another major network area, traffic is sent through the core.
4. The receiving distribution and access layers deliver the traffic to its destination.

Not every packet reaches all three layers. Same-VLAN traffic can remain at the access layer. Traffic between VLANs in the same distribution block may stop at distribution. The core is normally used when traffic must cross between major campus or building blocks.

Access Layer

The access layer is the network edge where end-user devices and local resources connect. Common connected devices include PCs, printers, IP phones, wireless access points, cameras, and, in smaller designs, servers.

Typical access-layer equipment includes Layer 2 access switches and wireless access points. An access switch commonly provides the following functions:

• Connects endpoint devices through Ethernet ports.
• Assigns ports to the appropriate VLAN. A VLAN is a logical Layer 2 network segment that separates a broadcast domain.
• Forwards traffic within the local VLAN using MAC addresses.
• Sends traffic for another VLAN or subnet toward an upstream distribution gateway.
• Applies edge security, such as port security, which restricts or monitors devices allowed on a port.
• Enforces user or device access policies where authentication or authorization is deployed.
• Creates separate Ethernet collision domains for switch ports. A collision domain is an Ethernet segment where simultaneous transmissions could conflict.

For example, a workstation connected to an access-switch port may be placed in the employee VLAN. If it communicates with another workstation in that VLAN, the access switch can forward the frames locally. If it contacts a server in a different VLAN, the switch sends the packet toward the default gateway at the distribution layer.

Distribution Layer

The distribution layer aggregates multiple access switches and acts as the boundary between local access networks and the backbone. It is commonly the main control and policy point in a campus design.

Common distribution-layer responsibilities include:

• Inter-VLAN routing: A multilayer switch or router forwards traffic between separate VLANs or IP subnets.
• Layer 3 forwarding: The device examines the destination IP address and selects a route.
• Route selection: It determines whether the destination is local to the distribution block or should be sent toward the core or an external network.
• Filtering: An access control list, or ACL, permits or denies selected traffic according to defined rules.
• Routing policy: The distribution layer can influence which paths are used or which routes are advertised.
• WAN and external connectivity: Connections to remote sites, the internet, or other external networks commonly attach at or near this boundary.
• Aggregation: It concentrates uplinks from many access switches into a smaller number of high-capacity connections.

Redundant gateway and uplink designs are often concentrated here. Two distribution devices can provide alternate paths, and a first-hop gateway redundancy approach can allow endpoints to continue using a virtual default gateway if one device fails.

Core Layer

The core layer is the high-speed enterprise backbone. It interconnects distribution-layer blocks and transports large volumes of traffic between them.

The core is designed for:

• Fast, predictable Layer 3 forwarding.
• High availability through redundant devices and links.
• Minimal forwarding delay.
• Resilient connections between buildings, campus areas, or major distribution blocks.

Typical core equipment includes high-capacity Layer 3 switches and routers connected with resilient links. The core generally avoids complex packet manipulation and nonessential policy features. Detailed filtering, endpoint controls, and other processing are usually placed at distribution so the backbone remains fast and stable.

How the Layers Relate

Access switches feed distribution devices. Distribution blocks connect to one another through the core when traffic must cross a major network boundary. This creates a repeatable structure:

• Access: connectivity and edge control.
• Distribution: aggregation, routing, and policy.
• Core: fast, reliable transport.

Redundancy can be added through multiple access uplinks, paired distribution devices, and multiple resilient core connections. The exact technologies may include VLAN trunking, EtherChannel, routing protocols, spanning-tree design, and first-hop redundancy, but the hierarchical model describes where the responsibilities belong rather than requiring one specific configuration.

Traffic-Flow Examples

Same VLAN

Host A and Host B are connected to access switches and belong to the same VLAN. Host A resolves Host B's local Layer 2 address and sends an Ethernet frame. The access switch forwards the frame within the VLAN. Routing and the core are not required.

Different VLANs in One Distribution Block

A user requests a file from a server in another VLAN. The user sends the packet to the default gateway because the destination is outside the local IP subnet. The distribution multilayer switch receives the packet, routes it between the user and server VLANs, and may apply an ACL. The packet can then return through the distribution device and access layer.

Different Buildings or Campus Blocks

A user in Building A accesses a resource in Building B. Each building's access switches connect to its local distribution devices. Building A's distribution layer forwards the traffic into the core. The core transports it across the backbone to Building B's distribution layer, which forwards it toward the destination access switch.

WAN or External Destination

For an external destination, the distribution or WAN-edge routing function selects the appropriate external path. The core may carry the traffic across the campus, but it does not necessarily provide the external policy or internet gateway itself.

Three-Tier and Collapsed-Core Designs

A full three-tier design is useful when a network has many users, access switches, buildings, or traffic flows. A small branch may not need a separate physical core. One or two multilayer switches can combine distribution and core responsibilities while access switches connect endpoints.

A collapsed core is not a failure of hierarchical design. It applies the same functional ideas with fewer physical tiers because the network scale does not justify a standalone core.

Illustrative Configuration Locations

The model is conceptual; no particular configuration is mandatory. The following examples show where common functions usually belong:

• Assigning an edge switch port to a VLAN: access layer.
• Enabling port security on an endpoint port: access layer.
• Creating switched virtual interfaces for VLAN gateways: distribution layer.
• Applying an ACL between user and server networks: usually distribution layer.
• Configuring redundant uplinks and gateway redundancy: access-to-distribution boundary and distribution layer.

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport port-security

This sample illustrates an access-port assignment and edge control. The exact commands and design depend on the platform, software version, security policy, and topology.

Troubleshooting by Layer

Same VLAN Works, Other VLAN Fails

Likely area: distribution or the endpoint's gateway path.

• Verify the endpoint's default gateway.
• Confirm that inter-VLAN routing is enabled.
• Check VLAN and routed-interface status.
• Review ACLs and other filtering rules.

An Access Switch Loses Upstream Connectivity

Likely area: access-to-distribution uplink.

• Check physical link and interface status.
• Verify trunk or routed-uplink configuration.
• Confirm that expected VLANs are carried upstream when a trunk is used.
• Check whether a redundant uplink should have taken over.

One Building Cannot Reach Another

Likely area: core or distribution-to-core connectivity.

• Verify routing reachability between distribution blocks.
• Check core link status and redundant paths.
• Review route advertisements or static routes.
• Confirm that distribution policy is not denying the traffic.

A Newly Connected Device Has No Access

Likely area: access layer.

• Verify switch-port state and VLAN assignment.
• Check port-security violations or authentication policy.
• Confirm that the device has valid addressing for its VLAN.

Key Terms

• Hierarchical network model: A layered approach that assigns separate networking responsibilities to different parts of a design.
• Backbone: A central, high-capacity path used to transport traffic between major network areas.
• Multilayer switch: A switch capable of both Layer 2 switching and Layer 3 routing.
• Redundant link: An alternate network connection that supports availability if another path fails.
• WAN: A wide-area connection linking geographically separated networks.

Summary

Cisco's hierarchical model makes enterprise LAN design easier to scale and operate by assigning focused responsibilities to access, distribution, and core layers. Access switches connect and protect endpoints, distribution devices aggregate networks and perform routing and policy enforcement, and the core rapidly transports traffic between major distribution blocks. Small networks can combine distribution and core functions in a collapsed-core design while preserving the same logical separation.

Continue with the Cisco three-layered hierarchical model reference when reviewing the layer roles and traffic paths.