Layer-3 Switch
the multilayer switchA layer-3 switch switches frames at wire speed and routes between VLANs like a router. It forwards locally by MAC, routes between subnets by IP, and does both in hardware — the campus network’s workhorse.
A layer-3 switch switches within VLANs and routes between them — routing at switching speed.
How it works
in silicon
Within a VLAN it behaves as a switch, forwarding by MAC. When traffic must cross VLANs it routes by IP — all in hardware, so there’s no router bottleneck between subnets.
What a layer-3 switch does, step by step
A frame arrives on one of the ports.
If the destination is in the same VLAN, forward by MAC as usual.
If it must cross VLANs, look up the destination IP and pick the egress VLAN.
A dedicated ASIC does the lookup and forwarding at line rate.
In cybersecurity
It’s a routing choke point inside the campus, so it enforces segmentation — and misconfigured, it can bridge networks that shouldn’t meet.
Separate trust zones cleanly by subnet.
Filter exactly what is allowed to cross between VLANs.
Guard against double-tagging and trunk-negotiation attacks.
Secure the routing adjacencies it forms.
Lock down administrative access tightly.
Its rules must match the perimeter router’s.
