Table of Contents

Router vs Switch: Key Differences, Layer 2 vs Layer 3, VLANs and Real Network Examples

Routers and switches are two of the most important devices in computer networking, but the traditional explanation—“a switch connects devices while a router connects networks”—is no longer enough.

Modern enterprise networks frequently use Layer 3 switches that can perform IP routing directly in hardware. A switch can therefore provide traditional Layer 2 Ethernet forwarding while also routing traffic between VLANs. Meanwhile, routers remain particularly important at WAN boundaries, Internet edges, branch connections, VPN gateways, and locations where advanced routing or edge services are required.

The real difference between a router and a switch is therefore best understood through forwarding behavior, network role, interfaces, VLANs, MAC tables, routing tables, and the architecture in which the device operates.

This guide explains router vs switch from the packet level upward, including Layer 2 switching, Layer 3 routing, MAC addresses, IP addresses, VLANs, broadcast domains, SVIs, inter-VLAN routing, router-on-a-stick, default gateways, Layer 3 switches, and real network designs.

For the broader foundation, start with Computer Networking Explained and TCP/IP Explained.

Router vs Switch in Simple Terms

The traditional explanation is:

A switch connects devices inside a network, while a router connects different networks.

That remains useful as a starting point, but it needs an important qualification.

A traditional Layer 2 switch forwards Ethernet frames primarily according to destination MAC addresses.

A router forwards IP packets between Layer 3 networks according to destination IP addresses and its routing information.

However, a Layer 3 switch can perform both functions.

A more accurate model is therefore:

Layer 2 Switching
        |
        v
Ethernet frames
MAC addresses
VLANs
MAC address table


Layer 3 Routing
        |
        v
IP packets
IP networks
Routing table
Next hops

A physical device called a “switch” may support both layers.

This distinction matters because modern enterprise switches often perform routing between VLANs without sending traffic to a separate external router.

Cisco documentation describes this model explicitly: hosts in the same VLAN can communicate through switching, while communication between different VLANs requires Layer 3 forwarding; that routing function can be provided by an external router or by a routing-capable switch.

Router vs Switch: Quick Comparison

Feature	Layer 2 Switch	Layer 3 Switch	Router
Primary forwarding	Ethernet frames	Frames + IP packets	IP packets
Main lookup	MAC table	MAC + routing tables	Routing table
Typical OSI role	Layer 2	Layers 2 and 3	Layer 3
VLAN support	Yes	Yes	Platform-dependent
Inter-VLAN routing	No	Yes	Yes
Default gateway role	No	Yes	Yes
WAN role	Usually limited	Sometimes	Common
NAT	Usually not primary	Platform-dependent	Common
VPN features	Limited/platform-dependent	Platform-dependent	Common
High-density LAN ports	Common	Common	Less central to role
Internet edge	Uncommon	Possible in some designs	Common

The table shows why:

Switch = Layer 2
Router = Layer 3

is an incomplete rule.

The actual capabilities depend on the device.

The OSI Layers Behind Routing and Switching

Understanding the difference becomes easier when mapped to the OSI model.

A simplified stack is:

Layer 7  Application
Layer 6  Presentation
Layer 5  Session
Layer 4  Transport
Layer 3  Network
Layer 2  Data Link
Layer 1  Physical

Traditional Ethernet switching primarily operates at:

Layer 2

IP routing primarily operates at:

Layer 3

At Layer 2, Ethernet cares about:

Source MAC
Destination MAC
EtherType
VLAN information

At Layer 3, IP routing cares about information including:

Source IP
Destination IP
Routing table
Next hop

The distinction between these layers explains most router-vs-switch behavior.

How a Layer 2 Switch Actually Works

Consider four computers connected to a switch:

PC-A ----\
          \
PC-B ------ SWITCH ------ PC-C
          /
PC-D ----/

Suppose:

PC-A
IP: 192.168.10.10
MAC: AA:AA:AA:AA:AA:AA

and:

PC-B
IP: 192.168.10.20
MAC: BB:BB:BB:BB:BB:BB

If both hosts are in the same IP subnet and VLAN, traffic between them normally does not need to pass through a router.

PC-A constructs an Ethernet frame whose destination MAC ultimately corresponds to PC-B.

The switch receives the frame and examines the destination MAC address.

Conceptually:

Ethernet Frame

+------------------+
| Destination MAC  |
+------------------+
| Source MAC       |
+------------------+
| EtherType        |
+------------------+
| Payload          |
+------------------+
| FCS              |
+------------------+

The switch uses its forwarding information to decide which port should receive that frame.

MAC Address Tables Explained

A Layer 2 switch learns MAC addresses from the source MAC address of frames arriving on its ports.

Suppose the switch observes:

Port 1:
Source MAC = AA:AA:AA:AA:AA:AA

It can learn:

AA:AA:AA:AA:AA:AA → Port 1

Later it sees:

Port 4:
Source MAC = BB:BB:BB:BB:BB:BB

and learns:

BB:BB:BB:BB:BB:BB → Port 4

Its table might look like:

MAC Address	VLAN	Port
AA:AA:AA:AA:AA	10	Gi1/0/1
BB:BB:BB:BB:BB	10	Gi1/0/4
CC:CC:CC:CC:CC	20	Gi1/0/8

This table is commonly called a:

MAC address table
forwarding database
FDB

When a known unicast destination appears, the switch can forward the frame toward the associated port rather than transmitting it everywhere.

What Happens with an Unknown Destination MAC?

Suppose the switch receives a frame destined for:

DD:DD:DD:DD:DD:DD

but it has not learned that MAC address yet.

For an unknown unicast destination, the switch generally floods the frame through appropriate ports in the same VLAN, excluding the ingress port.

Conceptually:

             +---- Port 2
             |
Frame ---- SWITCH ---- Port 3
             |
             +---- Port 4

This flooding is constrained by the VLAN.

It is not supposed to cross arbitrarily into every VLAN.

Once the destination responds, the switch can learn where that MAC address resides.

Broadcast Traffic on a Switch

Ethernet broadcast uses:

FF:FF:FF:FF:FF:FF

A Layer 2 switch normally floods broadcasts within the relevant VLAN.

For example:

VLAN 10

PC-A ----\
          \
PC-B ------ SWITCH ------ PC-C
          /
PC-D ----/

A broadcast from PC-A can reach the other ports belonging to VLAN 10.

This is why VLANs are closely related to broadcast domains.

How a Router Actually Works

A router operates primarily with Layer 3 information.

Consider:

Network A
192.168.10.0/24
       |
       v
     ROUTER
       |
       v
Network B
192.168.20.0/24

PC-A:

192.168.10.10/24

wants to communicate with PC-B:

192.168.20.20/24

PC-A determines that the destination is not on its local subnet.

It therefore sends the packet toward its default gateway.

Suppose the gateway is:

192.168.10.1

The router receives the frame, processes the IP packet, examines:

Destination IP:
192.168.20.20

and performs a routing lookup.

If it knows that:

192.168.20.0/24

is reachable through another interface, it forwards the packet accordingly.

Routing Tables Explained

A router uses a routing table to determine how destinations can be reached.

A simplified routing table might contain:

Destination	Next Hop / Interface
192.168.10.0/24	LAN1
192.168.20.0/24	LAN2
10.10.0.0/16	192.168.20.254
0.0.0.0/0	ISP Gateway

When a packet arrives for:

192.168.20.50

the router finds the most appropriate route.

Routers generally use longest prefix match when multiple routes match a destination.

For example:

10.0.0.0/8
10.20.0.0/16
10.20.30.0/24

Destination:

10.20.30.50

matches all three.

The most specific route is:

10.20.30.0/24

so that route is preferred for the forwarding lookup, assuming it is installed and otherwise usable.

This is fundamentally different from Layer 2 MAC-table forwarding.

MAC Address Table vs Routing Table

This distinction is essential.

MAC Address Table	Routing Table
Layer 2	Layer 3
MAC addresses	IP prefixes
Maps MACs to ports	Maps networks/prefixes to next hops/interfaces
Used for switching	Used for routing
Usually scoped by VLAN	Represents Layer 3 reachability

A Layer 3 switch may maintain both.

That is one reason the simple router-versus-switch distinction becomes blurry on modern equipment.

What Happens When Two Devices Are on the Same Subnet?

Consider:

PC-A
192.168.10.10/24

PC-B
192.168.10.20/24

PC-A determines that PC-B belongs to the same subnet.

It needs the destination’s Layer 2 address.

For IPv4 Ethernet networks, ARP is commonly used to discover the MAC associated with the local IPv4 destination.

Conceptually:

PC-A
 |
 | "Who has 192.168.10.20?"
 v
Broadcast
 |
 v
PC-B
 |
 | "192.168.10.20 is at BB:BB:BB..."
 v
PC-A

PC-A can then send the Ethernet frame toward PC-B.

The switch forwards it based on Layer 2 information.

The default gateway is not required for this same-subnet communication.

What Happens When Devices Are on Different Subnets?

Now consider:

PC-A
192.168.10.10/24

PC-B
192.168.20.20/24

PC-A recognizes that PC-B is not local.

Therefore it does not normally ARP directly for PC-B’s MAC across the router.

Instead it needs the Layer 2 address of its next hop—typically the default gateway.

Conceptually:

PC-A
192.168.10.10
      |
      | Ethernet frame
      | Destination MAC = Gateway
      |
      v
Router
192.168.10.1
      |
      | Route lookup
      v
192.168.20.0/24
      |
      v
PC-B
192.168.20.20

An important detail is that the IP destination remains the remote host during normal forwarding:

Destination IP:
192.168.20.20

while the Layer 2 frame changes as the packet crosses Layer 3 hops.

This is one of the core differences between switching and routing.

Routers Do Not Forward Ordinary Layer 2 Broadcasts Between Subnets

Suppose VLAN 10 contains:

192.168.10.0/24

and VLAN 20 contains:

192.168.20.0/24

An ordinary Ethernet broadcast in VLAN 10 is not simply forwarded by the router into VLAN 20.

Conceptually:

VLAN 10
   |
Broadcast
   |
   v
Router
   |
   X
   |
VLAN 20

This is one reason routers and VLANs create broadcast-domain boundaries.

However, some protocols need controlled assistance across those boundaries.

DHCP is a classic example.

A DHCP relay can intentionally relay DHCP communication between subnets.

For that workflow, see the CorgiNetwork DHCP Troubleshooting Guide and the existing DHCP material.

VLANs Explained in the Router vs Switch Context

A VLAN creates a logical Layer 2 broadcast domain.

Consider one physical switch:

             SWITCH
        /      |       \
       /       |        \
VLAN 10    VLAN 20    VLAN 30
Sales      Finance     IT

Even though all devices connect to the same physical switch, VLAN membership logically separates their Layer 2 traffic.

Example:

VLAN 10
192.168.10.0/24

VLAN 20
192.168.20.0/24

A traditional Layer 2 switch can switch traffic within each VLAN.

But communication between those VLANs requires Layer 3 forwarding.

Cisco’s current interface documentation similarly notes that devices within a VLAN can communicate directly through switching, whereas different VLANs require routing; on a routing-capable switch, configured Layer 3 VLAN interfaces can provide that routing function.

VLAN Is Not the Same Thing as a Subnet

In common enterprise design, there is often a relationship such as:

VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24

But VLAN and subnet describe different concepts.

A VLAN is primarily a:

Layer 2 construct

while an IP subnet is a:

Layer 3 construct

They are frequently mapped one-to-one because that produces a clean and understandable network design.

Do not define VLAN as simply “another word for subnet.”

Access Ports vs Trunk Ports

A switch port connecting a typical endpoint often behaves as an access port associated with one VLAN.

Conceptually:

PC
 |
 | Access VLAN 10
 |
Switch

A trunk can carry traffic for multiple VLANs between network devices.

Switch A
   |
   | VLAN 10
   | VLAN 20
   | VLAN 30
   |
  TRUNK
   |
Switch B

IEEE 802.1Q tagging is widely used for VLAN trunks.

Cisco’s inter-VLAN documentation describes trunking as carrying traffic for multiple VLANs over a point-to-point link and uses IEEE 802.1Q for this purpose.

Why VLANs Need Routing to Communicate

Suppose:

VLAN 10
192.168.10.0/24

VLAN 20
192.168.20.0/24

Host A:

192.168.10.10

needs to reach Host B:

192.168.20.20

Because the destination belongs to another IP subnet, Layer 3 forwarding is required.

There are several common architectural ways to provide it:

1. External router
2. Router-on-a-stick
3. Layer 3 switch

Understanding these designs is essential for understanding router vs switch.

Method 1: Traditional Router Between VLANs

A simple design can use separate router interfaces:

VLAN 10
   |
Switch
   |
   | Interface 1
   v
 Router
   ^
   | Interface 2
   |
Switch
   |
VLAN 20

The router has Layer 3 connectivity to both networks.

For example:

Router Interface 1:
192.168.10.1/24

Router Interface 2:
192.168.20.1/24

Hosts in VLAN 10 use:

192.168.10.1

as their gateway.

Hosts in VLAN 20 use:

192.168.20.1

as their gateway.

The router forwards traffic between the two networks according to policy and routing configuration.

Method 2: Router-on-a-Stick

Router-on-a-stick allows multiple VLANs to share a physical router connection using VLAN tagging.

Architecture:

VLAN 10 ----\
             \
VLAN 20 ----- SWITCH
             /
VLAN 30 ----/
              |
              | 802.1Q trunk
              |
           ROUTER

The router can use logical subinterfaces such as:

Physical Interface
       |
       +---- Subinterface VLAN 10
       |
       +---- Subinterface VLAN 20
       |
       +---- Subinterface VLAN 30

Each subinterface acts as a Layer 3 gateway for the associated VLAN.

Cisco maintains official documentation for configuring inter-VLAN routing with an external router, including 802.1Q trunking.

Router-on-a-Stick Example

Suppose:

VLAN 10:
192.168.10.0/24

VLAN 20:
192.168.20.0/24

The router might conceptually provide:

VLAN 10 gateway:
192.168.10.1

VLAN 20 gateway:
192.168.20.1

Traffic:

PC-A VLAN 10
      |
      v
Switch
      |
      | tagged trunk
      v
Router
      |
      | route
      |
      v
Switch
      |
      v
PC-B VLAN 20

This design is useful for understanding VLAN routing and can be appropriate in smaller environments, but larger networks frequently use Layer 3 switching for local inter-VLAN routing.

Method 3: Layer 3 Switch

A Layer 3 switch combines Layer 2 switching with Layer 3 routing capabilities.

Architecture:

           LAYER 3 SWITCH

      VLAN 10     VLAN 20
         |           |
         |           |
         +-----+-----+
               |
        Inter-VLAN Routing

Instead of sending local inter-VLAN traffic to an external router, the switch can route between VLAN interfaces internally.

Cisco describes modern Layer 3 switching in this way: enabling routing and providing Layer 3 VLAN interfaces allows traffic to be forwarded between VLANs without requiring the external-router model.

What Is an SVI?

An SVI is a:

Switched Virtual Interface

It provides a Layer 3 interface associated with a VLAN on supported switches.

Example:

VLAN 10
SVI: 192.168.10.1/24

VLAN 20
SVI: 192.168.20.1/24

Hosts might use:

VLAN 10 clients
Gateway → 192.168.10.1

VLAN 20 clients
Gateway → 192.168.20.1

The Layer 3 switch then routes between the VLAN interfaces.

Conceptually:

PC-A
192.168.10.10
     |
 VLAN 10
     |
     v
+------------------+
| Layer 3 Switch   |
|                  |
| SVI VLAN10       |
| 192.168.10.1     |
|                  |
| Routing          |
|                  |
| SVI VLAN20       |
| 192.168.20.1     |
+------------------+
     |
 VLAN 20
     |
     v
PC-B
192.168.20.20

This is one of the most common ways enterprise campus networks implement inter-VLAN routing.

Layer 3 Switch vs Router

Now we reach the important modern question.

If a Layer 3 switch can route, why use a router?

Because the distinction is increasingly about network role and feature set, not simply whether IP forwarding exists.

A Layer 3 switch is typically optimized for high-density LAN switching plus fast local Layer 3 forwarding.

A router is typically designed around Layer 3 connectivity and may provide extensive features for:

WAN connectivity
Internet edge
Advanced routing
VPNs
Tunneling
NAT
Traffic engineering
Branch connectivity
Service-provider connectivity

Capabilities vary considerably by platform, so none of these should be interpreted as universal hardware limitations.

Layer 3 Switch vs Router Comparison

Requirement	Layer 3 Switch	Router
LAN switching	Excellent	Not primary role
High port density	Common	Usually lower
VLANs	Excellent	Supported where relevant
Inter-VLAN routing	Excellent	Yes
Static routes	Yes	Yes
Dynamic routing	Platform-dependent, often yes	Common
WAN interfaces	Less central	Common
NAT	Platform-dependent	Common
VPN termination	Platform-dependent	Common
Internet edge	Possible	Common
Campus distribution/core	Common	Possible
Branch WAN edge	Less common	Common

The exact answer always depends on the product.

Never select a device purely because its marketing category says:

Router

or:

Switch

Evaluate the actual forwarding capacity, interfaces, route scale, security features, redundancy, licensing, protocols, and operational requirements.

Does a Layer 3 Switch Replace a Router?

Sometimes.

Not always.

Consider a campus LAN:

Access Switches
      |
      v
Layer 3 Distribution
      |
      v
Firewall / Edge Router
      |
      v
Internet

The Layer 3 switch may handle:

VLAN 10 ↔ VLAN 20
VLAN 20 ↔ VLAN 30
VLAN 30 ↔ Server VLAN

while the router/firewall handles:

Internet connectivity
WAN
VPN
NAT
External routing
Security policy

The two devices perform complementary roles.

Real Enterprise Network Example

Consider this architecture:

                   INTERNET
                       |
                       v
                +-------------+
                | Edge Router |
                +-------------+
                       |
                       v
                 +----------+
                 | Firewall |
                 +----------+
                       |
                       v
             +------------------+
             | Layer 3 Switch   |
             +------------------+
               /       |       \
              /        |        \
             v         v         v
          VLAN 10   VLAN 20   VLAN 30
           Users     Voice     Servers

The edge router might manage external connectivity.

The firewall enforces security policy.

The Layer 3 switch performs local routing between internal VLANs according to the architecture and policy.

Access switches can provide endpoint connectivity farther downstream.

This is much closer to real network design than:

Switch connects computers.
Router connects Internet.

Where Does the Default Gateway Live?

The default gateway is a Layer 3 function.

In a simple home network, it may live on the home router:

PC
192.168.1.50
     |
     v
Router
192.168.1.1

In an enterprise VLAN, the gateway might instead be an SVI on a Layer 3 switch:

VLAN 10 Client
192.168.10.50
      |
      v
Layer 3 Switch
SVI VLAN10
192.168.10.1

Or it could be provided through a redundant gateway architecture involving multiple network devices.

Therefore:

The default gateway is always a separate physical router.

is incorrect.

It needs to be a Layer 3 next-hop function reachable by the client; the physical device providing it can vary.

Router vs Switch and DHCP

DHCP provides an excellent example of the relationship between switching and routing.

Suppose:

Client VLAN 10
      |
      v
Access Switch
      |
      v
Layer 3 Switch
      |
      v
DHCP Server VLAN 100

The client’s initial DHCP broadcast cannot simply cross Layer 3 boundaries by ordinary switching.

A DHCP relay can be configured on the Layer 3 gateway.

Conceptually:

Client
   |
DHCPDISCOVER
   |
   v
VLAN 10 Gateway
   |
DHCP Relay
   |
   v
DHCP Server

This connects directly to the troubleshooting concepts covered in the previous DHCP Troubleshooting Guide.

Router vs Switch and ARP

ARP is another area where Layer 2 and Layer 3 interact.

Suppose:

PC-A:
192.168.10.10/24

Gateway:
192.168.10.1

PC-A wants to reach:

8.8.8.8

PC-A determines that 8.8.8.8 is outside the local subnet.

It does not need the destination MAC address of Google’s remote host.

Instead, it needs the Layer 2 address of the local next hop:

192.168.10.1

Conceptually:

Destination IP:
8.8.8.8

Destination MAC on first Ethernet hop:
Gateway MAC

The switch forwards the Ethernet frame toward the gateway.

The router then performs the Layer 3 forwarding decision.

This illustrates how switching and routing cooperate rather than compete.

What Happens to the Ethernet Frame at a Router?

A router does not simply forward the original Ethernet frame unchanged through every network.

Simplified:

LAN A Ethernet Frame
+---------------------+
| Destination MAC: R1 |
| Source MAC: PC-A    |
| IP Packet           |
+---------------------+
          |
          v
        Router
          |
          v
LAN B Ethernet Frame
+---------------------+
| Destination MAC: B  |
| Source MAC: Router  |
| IP Packet           |
+---------------------+

The Layer 2 encapsulation is appropriate to each link.

Meanwhile, the IP packet continues toward the destination, with normal Layer 3 forwarding changes such as TTL/Hop Limit processing occurring as appropriate.

This distinction is fundamental:

MAC addressing → link/local forwarding context

IP addressing → end-to-end Layer 3 addressing and routing context

Router vs Switch and Broadcast Domains

A Layer 2 VLAN represents a broadcast domain.

Suppose a switch has:

VLAN 10
VLAN 20
VLAN 30

You effectively have separate Layer 2 broadcast domains:

+----------+
| VLAN 10  |
+----------+

+----------+
| VLAN 20  |
+----------+

+----------+
| VLAN 30  |
+----------+

Routing connects the Layer 3 networks associated with those VLANs without merging their ordinary Layer 2 broadcast domains.

This provides:

Segmentation
Smaller broadcast domains
Policy boundaries
More structured addressing

but VLANs alone should not be treated as a complete security system.

Routing and security policy must still be designed correctly.

For the security side of network segmentation, see Network Security Basics and Firewalls Explained.

Router vs Switch vs Hub

A hub is fundamentally different from a modern Ethernet switch.

A hub essentially repeats incoming electrical/physical-layer traffic toward its other ports.

Conceptually:

PC-A
  |
  v
 HUB
 / | \
v  v  v
B  C  D

A switch learns Layer 2 forwarding information:

MAC A → Port 1
MAC B → Port 2
MAC C → Port 3

and can forward known unicast traffic selectively.

A router performs Layer 3 forwarding between networks.

Device	Traditional Layer	Main Forwarding Basis
Hub	Layer 1	Repeats signal/traffic
Switch	Layer 2	MAC address
Router	Layer 3	IP destination/prefix
Layer 3 Switch	Layers 2 + 3	MAC + IP routing

This table is educational rather than absolute because modern network appliances often implement features across several OSI layers.

Is a Home Wi-Fi Router Really Just a Router?

Usually not.

A typical consumer “router” often combines several functions:

Router
+
Ethernet switch
+
Wireless access point
+
DHCP server
+
NAT
+
Firewall
+
DNS forwarding/cache

Architecture:

                 INTERNET
                    |
                    v
             +--------------+
             | Home Gateway |
             |--------------|
             | Router       |
             | NAT          |
             | Firewall     |
             | DHCP         |
             | Wi-Fi AP     |
             | Switch       |
             +--------------+
               /    |    \
              PC   TV   Phone

This explains why home-network terminology can be confusing.

The box is called a router because routing is one of its major functions, but it is actually an integrated network appliance.

Does a Switch Have an IP Address?

It depends.

A basic Layer 2 switch does not need an IP address simply to forward ordinary Ethernet frames.

However, a managed switch may have an IP address for:

Management
SSH
Web interface
SNMP
Monitoring
Automation

A Layer 3 switch additionally uses IP addresses on Layer 3 interfaces and SVIs for routing.

Therefore:

Switches do not have IP addresses.

is false.

A better statement is:

Layer 2 forwarding itself is based primarily on MAC/VLAN information, but managed switches can have management IP addresses, and Layer 3 switches can have multiple routed IP interfaces.

Does a Router Have MAC Addresses?

Yes, Ethernet interfaces on routers have Layer 2 addressing where Ethernet is used.

Saying:

Switch = MAC
Router = IP

is useful only as a description of the primary forwarding lookup.

It does not mean routers somehow operate without Layer 2 encapsulation.

On an Ethernet LAN, the router interface participates in Ethernet.

For example:

PC
 |
 | Ethernet
 v
Router Ethernet Interface
 |
 | Other link/network
 v
Next network

The router processes Layer 2 framing on the interface and Layer 3 routing for the packet.

Does a Switch Know IP Addresses?

A pure Layer 2 forwarding decision does not require IP routing information.

But modern managed switches may inspect or maintain IP-related information for many features, including:

Management
Layer 3 routing
ACLs
DHCP snooping
ARP inspection
Telemetry
Security

Again, device capabilities should not be reduced to a single OSI-layer label.

The OSI model helps explain functions; it does not mean modern hardware must implement only one layer.

Layer 2 Switch vs Layer 3 Switch

This comparison is often more useful than router vs switch.

Capability	Layer 2 Switch	Layer 3 Switch
MAC learning	Yes	Yes
VLAN switching	Yes	Yes
Access ports	Yes	Yes
802.1Q trunks	Usually	Usually
IP routing	No/limited by platform	Yes
SVIs	Management only or limited	Routing-capable
Inter-VLAN routing	Requires L3 device	Yes
Routing table	Not for normal L2 forwarding	Yes
Default gateway for clients	No	Yes

A Layer 3 switch is therefore not merely a “faster switch.”

It adds Layer 3 forwarding functionality.

Inter-VLAN Routing with a Layer 3 Switch

Consider:

VLAN 10
192.168.10.0/24

VLAN 20
192.168.20.0/24

Configure conceptual gateways:

SVI VLAN10:
192.168.10.1

SVI VLAN20:
192.168.20.1

Traffic path:

PC-A
192.168.10.10
      |
      v
VLAN 10 switching
      |
      v
SVI VLAN 10
      |
      | Layer 3 route
      v
SVI VLAN 20
      |
      v
VLAN 20 switching
      |
      v
PC-B
192.168.20.20

No external router is necessary for that local inter-VLAN path if the Layer 3 switch is configured and capable of routing it.

Cisco provides an official inter-VLAN routing with Catalyst switches example illustrating this architecture.

Layer 3 Switching and Performance

Modern enterprise switches often perform forwarding using specialized hardware.

That makes Layer 3 switching suitable for high-throughput campus and data-center environments.

However, avoid the simplistic statement:

Layer 3 switches are always faster than routers.

High-end routers can also use sophisticated hardware forwarding.

Performance depends on:

Platform
ASIC architecture
Interface speeds
Packet sizes
Features enabled
Route scale
ACL scale
NAT
Encryption
QoS
Traffic patterns

The correct comparison is between specific platforms and workloads—not device labels.

When Should You Use a Layer 2 Switch?

A Layer 2 switch can be appropriate when the device primarily needs to provide endpoint connectivity.

Example:

              Layer 3 Gateway
                    |
                    v
              Access Switch
            /      |       \
           /       |        \
         PC      Phone     Printer

The access switch provides:

Ethernet connectivity
VLAN membership
Trunk uplinks
MAC forwarding

while another device provides Layer 3 routing.

This remains a common architecture.

When Should You Use a Layer 3 Switch?

Layer 3 switches are particularly useful when local routing needs to occur at high throughput between internal network segments.

Examples include:

Campus distribution
Campus core
Server networks
Data-center fabrics
Inter-VLAN routing
Internal segmentation

depending on the architecture and product capabilities.

A simplified design:

Access Layer
     |
     v
Layer 3 Distribution
     |
     v
Core / Firewall / WAN

allows the distribution layer to provide gateways and routing for multiple VLANs.

When Should You Use a Router?

Routers remain especially useful when connecting different network domains and services such as:

Branch ↔ Headquarters
Enterprise ↔ ISP
WAN circuits
Internet edge
VPN tunnels
BGP edge connectivity
Specialized WAN services

A router may also provide:

NAT
QoS
Tunneling
Advanced routing
Policy routing
VPN
Traffic engineering

depending on platform.

The correct device is determined by requirements.

Router vs Switch in a Small Office

Consider a small office:

                 ISP
                  |
                  v
              ROUTER
                  |
                  v
               SWITCH
             /    |    \
            /     |     \
          PC    Printer  AP

The router provides connectivity between:

Office LAN
and
Internet/WAN

The switch provides local Ethernet connectivity.

If the office has multiple VLANs, the routing could occur on:

Router

or:

Layer 3 switch

depending on design.

Router vs Switch in a Larger Enterprise

A larger design might look like:

                 INTERNET
                     |
                Edge Router
                     |
                  Firewall
                     |
             Core / L3 Switching
                /          \
               /            \
        Distribution     Distribution
           /    \            /    \
          /      \          /      \
       Access   Access   Access   Access

Different layers serve different roles.

The network is not designed around:

"Should we use routers OR switches?"

It is designed around:

Where should Layer 2 exist?
Where should Layer 3 boundaries exist?
Where should security policy be enforced?
Where should WAN routing occur?
Where should gateways live?
How should redundancy work?

That is the architectural way to think about router vs switch.

Router vs Switch in Cloud Networking

Cloud environments abstract physical routers and switches.

You may work with concepts such as:

VPC / VNet
Subnet
Route table
Internet gateway
NAT gateway
Virtual firewall
Load balancer

without touching a physical switch.

But the fundamental Layer 3 principles remain.

For example:

Cloud Subnet A
      |
      v
Virtual Routing
      |
      v
Cloud Subnet B

Cloud networking therefore does not eliminate routing.

It virtualizes and automates much of the underlying network architecture.

For more, see Cloud Networking Explained and Cloud Computing Explained.

Common Router vs Switch Misconceptions

“A Switch Cannot Route”

Incorrect as a general statement.

A Layer 3 switch can route.

“A Router Cannot Switch Ethernet Frames”

Too simplistic.

Router Ethernet interfaces necessarily interact with Layer 2 framing even though routing decisions are primarily Layer 3.

“A Switch Never Has an IP Address”

Incorrect.

Managed switches can have management addresses, and Layer 3 switches use routed IP interfaces.

“A Router Is Always Slower Than a Switch”

Incorrect.

Performance depends on architecture and platform.

“Different VLANs Can Communicate Through a Layer 2 Switch Alone”

Not through ordinary Layer 2 switching if the traffic requires communication between separate IP networks.

A Layer 3 function is needed.

“A VLAN Is an IP Subnet”

Not exactly.

VLAN is Layer 2; IP subnet is Layer 3.

“A Home Router Is Only a Router”

Usually incorrect.

Consumer gateways commonly integrate routing, switching, Wi-Fi, DHCP, NAT and firewall functions.

Router and Switch Troubleshooting

The difference between routing and switching also helps troubleshooting.

Suppose:

PC-A can reach PC-B in same VLAN

but cannot reach:

PC-C in another VLAN

Layer 2 switching may be working correctly.

Investigate:

Default gateway
SVI
Routing
ACL
Firewall
Inter-VLAN configuration

Now suppose:

PC-A cannot reach PC-B in same VLAN

Investigate lower/local layers:

Switch port
VLAN membership
MAC learning
ARP
NIC
Cable
Port security
STP state

This layer-based approach prevents unnecessary router configuration changes when the problem exists on the switch.

Useful Switch Troubleshooting Questions

Ask:

Is the interface up?
Is the client in the correct VLAN?
Is the MAC address learned?
Is the VLAN present?
Is the trunk carrying the VLAN?
Is STP forwarding?
Are there port-security restrictions?
Are errors/drops increasing?

For a Cisco-like CLI, useful commands often include platform-appropriate variants of:

show interfaces status
show vlan brief
show mac address-table
show interfaces trunk
show spanning-tree

Exact commands and output differ by platform and software version.

Do not copy configuration commands into production without checking the documentation for the specific device.

Useful Router / Layer 3 Troubleshooting Questions

Ask:

Does the interface have the expected IP?
Is the interface operational?
Does the route exist?
Which route wins?
Is the next hop reachable?
Is an ACL blocking traffic?
Is NAT involved?
Is the return route present?

Common Cisco-style diagnostic commands include:

show ip interface brief
show ip route
show arp
show access-lists

Again, exact syntax depends on platform.

Same VLAN Works, Different VLAN Fails

This is a classic troubleshooting clue.

Architecture:

PC-A --------\
              SWITCH
PC-B --------/

Same VLAN → works


PC-A VLAN10
      |
      v
Layer 3 Gateway
      |
      X
      |
PC-C VLAN20

Investigate:

SVI state
IP routing
Gateway configuration
ACL
Firewall
Subnet mask
Return route

If using router-on-a-stick, additionally inspect:

802.1Q trunk
Subinterfaces
VLAN tagging
Native VLAN
Allowed VLANs

Cisco specifically warns that native VLAN configuration must match on both sides of an 802.1Q trunk in the relevant designs.

Devices in the Same VLAN Cannot Communicate

Now focus more heavily on Layer 2.

Check:

Physical connectivity
Access VLAN
MAC address table
Port state
Port security
Spanning Tree
NIC
ARP

If the switch never learns the client’s MAC address, the issue may occur before routing becomes relevant.

This is why the troubleshooting question:

Is this a switching problem or a routing problem?

is so valuable.

Router vs Switch: Complete Comparison

Characteristic	Layer 2 Switch	Layer 3 Switch	Router
Ethernet switching	Primary	Primary	Interface-dependent
MAC table	Yes	Yes	May maintain L2 adjacency information
Routing table	Not for ordinary L2 forwarding	Yes	Yes
IP forwarding	No/limited	Yes	Yes
VLAN segmentation	Yes	Yes	Platform/design-dependent
Inter-VLAN routing	No	Yes	Yes
SVI gateways	Limited/management or unsupported	Common	Different interface model
Access ports	Common	Common	Not primary role
Trunks	Common	Common	Supported in applicable designs
WAN	Rare	Platform-dependent	Common
NAT	Rare	Platform-dependent	Common
VPN	Rare	Platform-dependent	Common
Dynamic routing	No	Often supported	Common
LAN port density	High	High	Usually lower
Campus access	Common	Common	Rare
Campus distribution	Limited	Common	Possible
Internet edge	Rare	Possible	Common

This comparison should be read as a design guide rather than an absolute specification.

Individual products can differ dramatically.

Which Device Should You Choose?

Choose based on the role.

For endpoint connectivity:

Switch

For VLAN segmentation with no local routing requirement:

Layer 2 switch

For high-throughput inter-VLAN routing:

Layer 3 switch

For WAN connectivity:

Router

For Internet security policy:

Firewall / security gateway

For Wi-Fi:

Wireless access point

In many environments, several functions are integrated into the same physical appliance.

The network architecture matters more than the label printed on the device.

Frequently Asked Questions

What is the main difference between a router and a switch?

A traditional Layer 2 switch forwards Ethernet frames within Layer 2 domains using MAC-based forwarding information, while a router forwards IP packets between Layer 3 networks using routing information.

Modern Layer 3 switches can perform both functions.

Is a switch Layer 2 or Layer 3?

Traditional switches are Layer 2 devices, but Layer 3 switches also perform IP routing.

Is a router Layer 3?

Routing is primarily a Layer 3 function, although router interfaces also interact with lower-layer protocols such as Ethernet.

Can a Layer 3 switch replace a router?

For some internal routing use cases, yes. It does not automatically replace every WAN, VPN, NAT, Internet-edge, or specialized routing function.

Can a Layer 2 switch route between VLANs?

Not by ordinary Layer 2 switching. Communication between different IP subnets requires Layer 3 forwarding.

Can a Layer 3 switch route between VLANs?

Yes. This is one of its primary use cases.

What is inter-VLAN routing?

Inter-VLAN routing is Layer 3 forwarding between networks associated with different VLANs.

What is router-on-a-stick?

Router-on-a-stick uses a trunk between a switch and router so one physical router interface can support multiple VLANs through logical subinterfaces.

What is an SVI?

SVI stands for Switched Virtual Interface. On a Layer 3 switch, it can provide a Layer 3 interface associated with a VLAN.

Does a switch need an IP address?

A basic unmanaged Layer 2 switch does not need an IP address to perform normal Ethernet switching. Managed switches commonly use IP addresses for management, and Layer 3 switches use IP interfaces for routing.

Does a router have a MAC address?

Router Ethernet interfaces have MAC addresses because they participate in Ethernet at Layer 2.

Does a switch use IP addresses?

Layer 2 switching primarily uses MAC addresses and VLAN information. Managed and Layer 3 switches can also use IP addressing for management and routing.

What is a MAC address table?

It is a switch forwarding table that associates learned MAC addresses with ports, usually in a VLAN context.

What is a routing table?

A routing table contains Layer 3 reachability information used to determine how IP destinations should be forwarded.

What is longest prefix match?

When multiple routing entries match a destination, routing normally selects the most specific matching prefix for the forwarding decision.

What is the difference between MAC address and IP address?

MAC addresses are used in Layer 2 link-level communication such as Ethernet, while IP addresses identify Layer 3 interfaces and networks for routed communication.

Do two devices in the same subnet need a router to communicate?

Normally not when they share the same appropriate Layer 2 domain. They can communicate through Layer 2 switching.

Do devices in different subnets need a router?

They need Layer 3 forwarding. That function can be provided by a router, Layer 3 switch, firewall, or another routing-capable system.

Is a VLAN the same as a subnet?

No. A VLAN is a Layer 2 construct; an IP subnet is Layer 3. They are commonly mapped one-to-one in network designs.

What is a trunk port?

A trunk carries traffic for multiple VLANs between devices, commonly using IEEE 802.1Q tagging.

What is an access port?

An access port typically connects an endpoint to one VLAN.

What is a broadcast domain?

A broadcast domain is the Layer 2 scope over which applicable broadcast traffic is propagated. VLANs create separate Layer 2 broadcast domains.

Do routers forward Ethernet broadcasts?

Routers do not normally forward ordinary Layer 2 broadcasts from one subnet into another. Specific relay mechanisms such as DHCP relay can intentionally provide required cross-subnet functionality.

Why can I reach devices in my VLAN but not another VLAN?

The problem may involve the default gateway, SVI, router, routing table, ACL, firewall, trunk, or inter-VLAN configuration.

Is a home Wi-Fi router also a switch?

Many home gateways integrate an Ethernet switch along with routing, Wi-Fi, NAT, DHCP and firewall functionality.

Which is faster: router or switch?

There is no universal answer. Performance depends on the specific hardware, forwarding architecture, interfaces, enabled features and traffic pattern.

Should I use a router or Layer 3 switch for inter-VLAN routing?

A Layer 3 switch is commonly used for high-throughput internal inter-VLAN routing, while routers are common at WAN and network-edge boundaries. The correct choice depends on the architecture and required features.

Conclusion

The difference between a router and a switch becomes much clearer when you stop thinking only about physical boxes and start thinking about network functions.

Layer 2 switching answers a question similar to:

Which Layer 2 port should receive this Ethernet frame?

using information such as:

Destination MAC
VLAN
MAC address table

Layer 3 routing answers:

Where should this IP packet go next?

using information such as:

Destination IP
Routing table
Prefix length
Next hop

The basic architecture is:

Same VLAN / Layer 2 domain
        |
        v
      SWITCH
        |
        v
MAC-based forwarding


Different IP networks
        |
        v
ROUTER / L3 SWITCH
        |
        v
IP-based forwarding

But modern networks frequently combine these functions:

              Layer 3 Switch
              /             \
             /               \
       Layer 2               Layer 3
       Switching             Routing
          |                     |
          v                     v
     MAC Tables           Routing Table
          |                     |
          v                     v
       VLANs             Inter-VLAN Routing

That is why:

Switch = Layer 2 and Router = Layer 3

is useful for beginners but technically incomplete.

A more accurate rule is:

Switching describes Layer 2 forwarding; routing describes Layer 3 forwarding. Modern devices may perform one or both functions.

When two hosts communicate within the same VLAN and subnet, switching normally handles their Ethernet frames.

When traffic must cross IP networks, Layer 3 forwarding becomes necessary.

That Layer 3 function may live on:

Router
Layer 3 switch
Firewall
Virtual router
Cloud gateway

depending on the architecture.

Understanding that distinction makes VLAN design, DHCP relay, default gateways, ARP, routing tables, network segmentation and troubleshooting significantly easier.

Continue with Computer Networking Explained for the overall networking foundation, TCP/IP Explained for packet-layer behavior, Routers, Switches and Network Devices for the broader device overview, Network Security Basics for segmentation and security, and Firewalls Explained for policy enforcement between networks.