Routers and switches are two of the most important devices in computer networking, but the traditional explanation—“a switch connects devices while a router connects networks”—is no longer enough.
Modern enterprise networks frequently use Layer 3 switches that can perform IP routing directly in hardware. A switch can therefore provide traditional Layer 2 Ethernet forwarding while also routing traffic between VLANs. Meanwhile, routers remain particularly important at WAN boundaries, Internet edges, branch connections, VPN gateways, and locations where advanced routing or edge services are required.
The real difference between a router and a switch is therefore best understood through forwarding behavior, network role, interfaces, VLANs, MAC tables, routing tables, and the architecture in which the device operates.
This guide explains router vs switch from the packet level upward, including Layer 2 switching, Layer 3 routing, MAC addresses, IP addresses, VLANs, broadcast domains, SVIs, inter-VLAN routing, router-on-a-stick, default gateways, Layer 3 switches, and real network designs.
For the broader foundation, start with Computer Networking Explained and TCP/IP Explained.
The traditional explanation is:
A switch connects devices inside a network, while a router connects different networks.
That remains useful as a starting point, but it needs an important qualification.
A traditional Layer 2 switch forwards Ethernet frames primarily according to destination MAC addresses.
A router forwards IP packets between Layer 3 networks according to destination IP addresses and its routing information.
However, a Layer 3 switch can perform both functions.
A more accurate model is therefore:
Layer 2 Switching
|
v
Ethernet frames
MAC addresses
VLANs
MAC address table
Layer 3 Routing
|
v
IP packets
IP networks
Routing table
Next hopsA physical device called a “switch” may support both layers.
This distinction matters because modern enterprise switches often perform routing between VLANs without sending traffic to a separate external router.
Cisco documentation describes this model explicitly: hosts in the same VLAN can communicate through switching, while communication between different VLANs requires Layer 3 forwarding; that routing function can be provided by an external router or by a routing-capable switch.
| Feature | Layer 2 Switch | Layer 3 Switch | Router |
|---|---|---|---|
| Primary forwarding | Ethernet frames | Frames + IP packets | IP packets |
| Main lookup | MAC table | MAC + routing tables | Routing table |
| Typical OSI role | Layer 2 | Layers 2 and 3 | Layer 3 |
| VLAN support | Yes | Yes | Platform-dependent |
| Inter-VLAN routing | No | Yes | Yes |
| Default gateway role | No | Yes | Yes |
| WAN role | Usually limited | Sometimes | Common |
| NAT | Usually not primary | Platform-dependent | Common |
| VPN features | Limited/platform-dependent | Platform-dependent | Common |
| High-density LAN ports | Common | Common | Less central to role |
| Internet edge | Uncommon | Possible in some designs | Common |
The table shows why:
Switch = Layer 2
Router = Layer 3is an incomplete rule.
The actual capabilities depend on the device.
Understanding the difference becomes easier when mapped to the OSI model.
A simplified stack is:
Layer 7 Application
Layer 6 Presentation
Layer 5 Session
Layer 4 Transport
Layer 3 Network
Layer 2 Data Link
Layer 1 PhysicalTraditional Ethernet switching primarily operates at:
Layer 2IP routing primarily operates at:
Layer 3At Layer 2, Ethernet cares about:
Source MAC
Destination MAC
EtherType
VLAN informationAt Layer 3, IP routing cares about information including:
Source IP
Destination IP
Routing table
Next hopThe distinction between these layers explains most router-vs-switch behavior.
Consider four computers connected to a switch:
PC-A ----\
\
PC-B ------ SWITCH ------ PC-C
/
PC-D ----/Suppose:
PC-A
IP: 192.168.10.10
MAC: AA:AA:AA:AA:AA:AAand:
PC-B
IP: 192.168.10.20
MAC: BB:BB:BB:BB:BB:BBIf both hosts are in the same IP subnet and VLAN, traffic between them normally does not need to pass through a router.
PC-A constructs an Ethernet frame whose destination MAC ultimately corresponds to PC-B.
The switch receives the frame and examines the destination MAC address.
Conceptually:
Ethernet Frame
+------------------+
| Destination MAC |
+------------------+
| Source MAC |
+------------------+
| EtherType |
+------------------+
| Payload |
+------------------+
| FCS |
+------------------+The switch uses its forwarding information to decide which port should receive that frame.
A Layer 2 switch learns MAC addresses from the source MAC address of frames arriving on its ports.
Suppose the switch observes:
Port 1:
Source MAC = AA:AA:AA:AA:AA:AAIt can learn:
AA:AA:AA:AA:AA:AA → Port 1Later it sees:
Port 4:
Source MAC = BB:BB:BB:BB:BB:BBand learns:
BB:BB:BB:BB:BB:BB → Port 4Its table might look like:
| MAC Address | VLAN | Port |
|---|---|---|
| AA:AA:AA:AA:AA | 10 | Gi1/0/1 |
| BB:BB:BB:BB:BB | 10 | Gi1/0/4 |
| CC:CC:CC:CC:CC | 20 | Gi1/0/8 |
This table is commonly called a:
When a known unicast destination appears, the switch can forward the frame toward the associated port rather than transmitting it everywhere.
Suppose the switch receives a frame destined for:
DD:DD:DD:DD:DD:DDbut it has not learned that MAC address yet.
For an unknown unicast destination, the switch generally floods the frame through appropriate ports in the same VLAN, excluding the ingress port.
Conceptually:
+---- Port 2
|
Frame ---- SWITCH ---- Port 3
|
+---- Port 4This flooding is constrained by the VLAN.
It is not supposed to cross arbitrarily into every VLAN.
Once the destination responds, the switch can learn where that MAC address resides.
Ethernet broadcast uses:
FF:FF:FF:FF:FF:FFA Layer 2 switch normally floods broadcasts within the relevant VLAN.
For example:
VLAN 10
PC-A ----\
\
PC-B ------ SWITCH ------ PC-C
/
PC-D ----/A broadcast from PC-A can reach the other ports belonging to VLAN 10.
This is why VLANs are closely related to broadcast domains.
A router operates primarily with Layer 3 information.
Consider:
Network A
192.168.10.0/24
|
v
ROUTER
|
v
Network B
192.168.20.0/24PC-A:
192.168.10.10/24wants to communicate with PC-B:
192.168.20.20/24PC-A determines that the destination is not on its local subnet.
It therefore sends the packet toward its default gateway.
Suppose the gateway is:
192.168.10.1The router receives the frame, processes the IP packet, examines:
Destination IP:
192.168.20.20and performs a routing lookup.
If it knows that:
192.168.20.0/24is reachable through another interface, it forwards the packet accordingly.
A router uses a routing table to determine how destinations can be reached.
A simplified routing table might contain:
| Destination | Next Hop / Interface |
|---|---|
| 192.168.10.0/24 | LAN1 |
| 192.168.20.0/24 | LAN2 |
| 10.10.0.0/16 | 192.168.20.254 |
| 0.0.0.0/0 | ISP Gateway |
When a packet arrives for:
192.168.20.50the router finds the most appropriate route.
Routers generally use longest prefix match when multiple routes match a destination.
For example:
10.0.0.0/8
10.20.0.0/16
10.20.30.0/24Destination:
10.20.30.50matches all three.
The most specific route is:
10.20.30.0/24so that route is preferred for the forwarding lookup, assuming it is installed and otherwise usable.
This is fundamentally different from Layer 2 MAC-table forwarding.
This distinction is essential.
| MAC Address Table | Routing Table |
|---|---|
| Layer 2 | Layer 3 |
| MAC addresses | IP prefixes |
| Maps MACs to ports | Maps networks/prefixes to next hops/interfaces |
| Used for switching | Used for routing |
| Usually scoped by VLAN | Represents Layer 3 reachability |
A Layer 3 switch may maintain both.
That is one reason the simple router-versus-switch distinction becomes blurry on modern equipment.
Consider:
PC-A
192.168.10.10/24
PC-B
192.168.10.20/24PC-A determines that PC-B belongs to the same subnet.
It needs the destination’s Layer 2 address.
For IPv4 Ethernet networks, ARP is commonly used to discover the MAC associated with the local IPv4 destination.
Conceptually:
PC-A
|
| "Who has 192.168.10.20?"
v
Broadcast
|
v
PC-B
|
| "192.168.10.20 is at BB:BB:BB..."
v
PC-APC-A can then send the Ethernet frame toward PC-B.
The switch forwards it based on Layer 2 information.
The default gateway is not required for this same-subnet communication.
Now consider:
PC-A
192.168.10.10/24
PC-B
192.168.20.20/24PC-A recognizes that PC-B is not local.
Therefore it does not normally ARP directly for PC-B’s MAC across the router.
Instead it needs the Layer 2 address of its next hop—typically the default gateway.
Conceptually:
PC-A
192.168.10.10
|
| Ethernet frame
| Destination MAC = Gateway
|
v
Router
192.168.10.1
|
| Route lookup
v
192.168.20.0/24
|
v
PC-B
192.168.20.20An important detail is that the IP destination remains the remote host during normal forwarding:
Destination IP:
192.168.20.20while the Layer 2 frame changes as the packet crosses Layer 3 hops.
This is one of the core differences between switching and routing.
Suppose VLAN 10 contains:
192.168.10.0/24and VLAN 20 contains:
192.168.20.0/24An ordinary Ethernet broadcast in VLAN 10 is not simply forwarded by the router into VLAN 20.
Conceptually:
VLAN 10
|
Broadcast
|
v
Router
|
X
|
VLAN 20This is one reason routers and VLANs create broadcast-domain boundaries.
However, some protocols need controlled assistance across those boundaries.
DHCP is a classic example.
A DHCP relay can intentionally relay DHCP communication between subnets.
For that workflow, see the CorgiNetwork DHCP Troubleshooting Guide and the existing DHCP material.
A VLAN creates a logical Layer 2 broadcast domain.
Consider one physical switch:
SWITCH
/ | \
/ | \
VLAN 10 VLAN 20 VLAN 30
Sales Finance ITEven though all devices connect to the same physical switch, VLAN membership logically separates their Layer 2 traffic.
Example:
VLAN 10
192.168.10.0/24
VLAN 20
192.168.20.0/24A traditional Layer 2 switch can switch traffic within each VLAN.
But communication between those VLANs requires Layer 3 forwarding.
Cisco’s current interface documentation similarly notes that devices within a VLAN can communicate directly through switching, whereas different VLANs require routing; on a routing-capable switch, configured Layer 3 VLAN interfaces can provide that routing function.
In common enterprise design, there is often a relationship such as:
VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24But VLAN and subnet describe different concepts.
A VLAN is primarily a:
Layer 2 constructwhile an IP subnet is a:
Layer 3 constructThey are frequently mapped one-to-one because that produces a clean and understandable network design.
Do not define VLAN as simply “another word for subnet.”
A switch port connecting a typical endpoint often behaves as an access port associated with one VLAN.
Conceptually:
PC
|
| Access VLAN 10
|
SwitchA trunk can carry traffic for multiple VLANs between network devices.
Switch A
|
| VLAN 10
| VLAN 20
| VLAN 30
|
TRUNK
|
Switch BIEEE 802.1Q tagging is widely used for VLAN trunks.
Cisco’s inter-VLAN documentation describes trunking as carrying traffic for multiple VLANs over a point-to-point link and uses IEEE 802.1Q for this purpose.
Suppose:
VLAN 10
192.168.10.0/24
VLAN 20
192.168.20.0/24Host A:
192.168.10.10needs to reach Host B:
192.168.20.20Because the destination belongs to another IP subnet, Layer 3 forwarding is required.
There are several common architectural ways to provide it:
1. External router
2. Router-on-a-stick
3. Layer 3 switchUnderstanding these designs is essential for understanding router vs switch.
A simple design can use separate router interfaces:
VLAN 10
|
Switch
|
| Interface 1
v
Router
^
| Interface 2
|
Switch
|
VLAN 20The router has Layer 3 connectivity to both networks.
For example:
Router Interface 1:
192.168.10.1/24
Router Interface 2:
192.168.20.1/24Hosts in VLAN 10 use:
192.168.10.1as their gateway.
Hosts in VLAN 20 use:
192.168.20.1as their gateway.
The router forwards traffic between the two networks according to policy and routing configuration.
Router-on-a-stick allows multiple VLANs to share a physical router connection using VLAN tagging.
Architecture:
VLAN 10 ----\
\
VLAN 20 ----- SWITCH
/
VLAN 30 ----/
|
| 802.1Q trunk
|
ROUTERThe router can use logical subinterfaces such as:
Physical Interface
|
+---- Subinterface VLAN 10
|
+---- Subinterface VLAN 20
|
+---- Subinterface VLAN 30Each subinterface acts as a Layer 3 gateway for the associated VLAN.
Cisco maintains official documentation for configuring inter-VLAN routing with an external router, including 802.1Q trunking.
Suppose:
VLAN 10:
192.168.10.0/24
VLAN 20:
192.168.20.0/24The router might conceptually provide:
VLAN 10 gateway:
192.168.10.1
VLAN 20 gateway:
192.168.20.1Traffic:
PC-A VLAN 10
|
v
Switch
|
| tagged trunk
v
Router
|
| route
|
v
Switch
|
v
PC-B VLAN 20This design is useful for understanding VLAN routing and can be appropriate in smaller environments, but larger networks frequently use Layer 3 switching for local inter-VLAN routing.
A Layer 3 switch combines Layer 2 switching with Layer 3 routing capabilities.
Architecture:
LAYER 3 SWITCH
VLAN 10 VLAN 20
| |
| |
+-----+-----+
|
Inter-VLAN RoutingInstead of sending local inter-VLAN traffic to an external router, the switch can route between VLAN interfaces internally.
Cisco describes modern Layer 3 switching in this way: enabling routing and providing Layer 3 VLAN interfaces allows traffic to be forwarded between VLANs without requiring the external-router model.
An SVI is a:
Switched Virtual InterfaceIt provides a Layer 3 interface associated with a VLAN on supported switches.
Example:
VLAN 10
SVI: 192.168.10.1/24
VLAN 20
SVI: 192.168.20.1/24Hosts might use:
VLAN 10 clients
Gateway → 192.168.10.1
VLAN 20 clients
Gateway → 192.168.20.1The Layer 3 switch then routes between the VLAN interfaces.
Conceptually:
PC-A
192.168.10.10
|
VLAN 10
|
v
+------------------+
| Layer 3 Switch |
| |
| SVI VLAN10 |
| 192.168.10.1 |
| |
| Routing |
| |
| SVI VLAN20 |
| 192.168.20.1 |
+------------------+
|
VLAN 20
|
v
PC-B
192.168.20.20This is one of the most common ways enterprise campus networks implement inter-VLAN routing.
Now we reach the important modern question.
If a Layer 3 switch can route, why use a router?
Because the distinction is increasingly about network role and feature set, not simply whether IP forwarding exists.
A Layer 3 switch is typically optimized for high-density LAN switching plus fast local Layer 3 forwarding.
A router is typically designed around Layer 3 connectivity and may provide extensive features for:
WAN connectivity
Internet edge
Advanced routing
VPNs
Tunneling
NAT
Traffic engineering
Branch connectivity
Service-provider connectivityCapabilities vary considerably by platform, so none of these should be interpreted as universal hardware limitations.
| Requirement | Layer 3 Switch | Router |
|---|---|---|
| LAN switching | Excellent | Not primary role |
| High port density | Common | Usually lower |
| VLANs | Excellent | Supported where relevant |
| Inter-VLAN routing | Excellent | Yes |
| Static routes | Yes | Yes |
| Dynamic routing | Platform-dependent, often yes | Common |
| WAN interfaces | Less central | Common |
| NAT | Platform-dependent | Common |
| VPN termination | Platform-dependent | Common |
| Internet edge | Possible | Common |
| Campus distribution/core | Common | Possible |
| Branch WAN edge | Less common | Common |
The exact answer always depends on the product.
Never select a device purely because its marketing category says:
Routeror:
SwitchEvaluate the actual forwarding capacity, interfaces, route scale, security features, redundancy, licensing, protocols, and operational requirements.
Sometimes.
Not always.
Consider a campus LAN:
Access Switches
|
v
Layer 3 Distribution
|
v
Firewall / Edge Router
|
v
InternetThe Layer 3 switch may handle:
VLAN 10 ↔ VLAN 20
VLAN 20 ↔ VLAN 30
VLAN 30 ↔ Server VLANwhile the router/firewall handles:
Internet connectivity
WAN
VPN
NAT
External routing
Security policyThe two devices perform complementary roles.
Consider this architecture:
INTERNET
|
v
+-------------+
| Edge Router |
+-------------+
|
v
+----------+
| Firewall |
+----------+
|
v
+------------------+
| Layer 3 Switch |
+------------------+
/ | \
/ | \
v v v
VLAN 10 VLAN 20 VLAN 30
Users Voice ServersThe edge router might manage external connectivity.
The firewall enforces security policy.
The Layer 3 switch performs local routing between internal VLANs according to the architecture and policy.
Access switches can provide endpoint connectivity farther downstream.
This is much closer to real network design than:
Switch connects computers.
Router connects Internet.The default gateway is a Layer 3 function.
In a simple home network, it may live on the home router:
PC
192.168.1.50
|
v
Router
192.168.1.1In an enterprise VLAN, the gateway might instead be an SVI on a Layer 3 switch:
VLAN 10 Client
192.168.10.50
|
v
Layer 3 Switch
SVI VLAN10
192.168.10.1Or it could be provided through a redundant gateway architecture involving multiple network devices.
Therefore:
The default gateway is always a separate physical router.
is incorrect.
It needs to be a Layer 3 next-hop function reachable by the client; the physical device providing it can vary.
DHCP provides an excellent example of the relationship between switching and routing.
Suppose:
Client VLAN 10
|
v
Access Switch
|
v
Layer 3 Switch
|
v
DHCP Server VLAN 100The client’s initial DHCP broadcast cannot simply cross Layer 3 boundaries by ordinary switching.
A DHCP relay can be configured on the Layer 3 gateway.
Conceptually:
Client
|
DHCPDISCOVER
|
v
VLAN 10 Gateway
|
DHCP Relay
|
v
DHCP ServerThis connects directly to the troubleshooting concepts covered in the previous DHCP Troubleshooting Guide.
ARP is another area where Layer 2 and Layer 3 interact.
Suppose:
PC-A:
192.168.10.10/24
Gateway:
192.168.10.1PC-A wants to reach:
8.8.8.8PC-A determines that 8.8.8.8 is outside the local subnet.
It does not need the destination MAC address of Google’s remote host.
Instead, it needs the Layer 2 address of the local next hop:
192.168.10.1Conceptually:
Destination IP:
8.8.8.8
Destination MAC on first Ethernet hop:
Gateway MACThe switch forwards the Ethernet frame toward the gateway.
The router then performs the Layer 3 forwarding decision.
This illustrates how switching and routing cooperate rather than compete.
A router does not simply forward the original Ethernet frame unchanged through every network.
Simplified:
LAN A Ethernet Frame
+---------------------+
| Destination MAC: R1 |
| Source MAC: PC-A |
| IP Packet |
+---------------------+
|
v
Router
|
v
LAN B Ethernet Frame
+---------------------+
| Destination MAC: B |
| Source MAC: Router |
| IP Packet |
+---------------------+The Layer 2 encapsulation is appropriate to each link.
Meanwhile, the IP packet continues toward the destination, with normal Layer 3 forwarding changes such as TTL/Hop Limit processing occurring as appropriate.
This distinction is fundamental:
MAC addressing → link/local forwarding context
IP addressing → end-to-end Layer 3 addressing and routing contextA Layer 2 VLAN represents a broadcast domain.
Suppose a switch has:
VLAN 10
VLAN 20
VLAN 30You effectively have separate Layer 2 broadcast domains:
+----------+
| VLAN 10 |
+----------+
+----------+
| VLAN 20 |
+----------+
+----------+
| VLAN 30 |
+----------+Routing connects the Layer 3 networks associated with those VLANs without merging their ordinary Layer 2 broadcast domains.
This provides:
Segmentation
Smaller broadcast domains
Policy boundaries
More structured addressingbut VLANs alone should not be treated as a complete security system.
Routing and security policy must still be designed correctly.
For the security side of network segmentation, see Network Security Basics and Firewalls Explained.
A hub is fundamentally different from a modern Ethernet switch.
A hub essentially repeats incoming electrical/physical-layer traffic toward its other ports.
Conceptually:
PC-A
|
v
HUB
/ | \
v v v
B C DA switch learns Layer 2 forwarding information:
MAC A → Port 1
MAC B → Port 2
MAC C → Port 3and can forward known unicast traffic selectively.
A router performs Layer 3 forwarding between networks.
| Device | Traditional Layer | Main Forwarding Basis |
|---|---|---|
| Hub | Layer 1 | Repeats signal/traffic |
| Switch | Layer 2 | MAC address |
| Router | Layer 3 | IP destination/prefix |
| Layer 3 Switch | Layers 2 + 3 | MAC + IP routing |
This table is educational rather than absolute because modern network appliances often implement features across several OSI layers.
Usually not.
A typical consumer “router” often combines several functions:
Router
+
Ethernet switch
+
Wireless access point
+
DHCP server
+
NAT
+
Firewall
+
DNS forwarding/cacheArchitecture:
INTERNET
|
v
+--------------+
| Home Gateway |
|--------------|
| Router |
| NAT |
| Firewall |
| DHCP |
| Wi-Fi AP |
| Switch |
+--------------+
/ | \
PC TV PhoneThis explains why home-network terminology can be confusing.
The box is called a router because routing is one of its major functions, but it is actually an integrated network appliance.
It depends.
A basic Layer 2 switch does not need an IP address simply to forward ordinary Ethernet frames.
However, a managed switch may have an IP address for:
Management
SSH
Web interface
SNMP
Monitoring
AutomationA Layer 3 switch additionally uses IP addresses on Layer 3 interfaces and SVIs for routing.
Therefore:
Switches do not have IP addresses.
is false.
A better statement is:
Layer 2 forwarding itself is based primarily on MAC/VLAN information, but managed switches can have management IP addresses, and Layer 3 switches can have multiple routed IP interfaces.
Yes, Ethernet interfaces on routers have Layer 2 addressing where Ethernet is used.
Saying:
Switch = MAC
Router = IPis useful only as a description of the primary forwarding lookup.
It does not mean routers somehow operate without Layer 2 encapsulation.
On an Ethernet LAN, the router interface participates in Ethernet.
For example:
PC
|
| Ethernet
v
Router Ethernet Interface
|
| Other link/network
v
Next networkThe router processes Layer 2 framing on the interface and Layer 3 routing for the packet.
A pure Layer 2 forwarding decision does not require IP routing information.
But modern managed switches may inspect or maintain IP-related information for many features, including:
Management
Layer 3 routing
ACLs
DHCP snooping
ARP inspection
Telemetry
SecurityAgain, device capabilities should not be reduced to a single OSI-layer label.
The OSI model helps explain functions; it does not mean modern hardware must implement only one layer.
This comparison is often more useful than router vs switch.
| Capability | Layer 2 Switch | Layer 3 Switch |
|---|---|---|
| MAC learning | Yes | Yes |
| VLAN switching | Yes | Yes |
| Access ports | Yes | Yes |
| 802.1Q trunks | Usually | Usually |
| IP routing | No/limited by platform | Yes |
| SVIs | Management only or limited | Routing-capable |
| Inter-VLAN routing | Requires L3 device | Yes |
| Routing table | Not for normal L2 forwarding | Yes |
| Default gateway for clients | No | Yes |
A Layer 3 switch is therefore not merely a “faster switch.”
It adds Layer 3 forwarding functionality.
Consider:
VLAN 10
192.168.10.0/24
VLAN 20
192.168.20.0/24Configure conceptual gateways:
SVI VLAN10:
192.168.10.1
SVI VLAN20:
192.168.20.1Traffic path:
PC-A
192.168.10.10
|
v
VLAN 10 switching
|
v
SVI VLAN 10
|
| Layer 3 route
v
SVI VLAN 20
|
v
VLAN 20 switching
|
v
PC-B
192.168.20.20No external router is necessary for that local inter-VLAN path if the Layer 3 switch is configured and capable of routing it.
Cisco provides an official inter-VLAN routing with Catalyst switches example illustrating this architecture.
Modern enterprise switches often perform forwarding using specialized hardware.
That makes Layer 3 switching suitable for high-throughput campus and data-center environments.
However, avoid the simplistic statement:
Layer 3 switches are always faster than routers.
High-end routers can also use sophisticated hardware forwarding.
Performance depends on:
Platform
ASIC architecture
Interface speeds
Packet sizes
Features enabled
Route scale
ACL scale
NAT
Encryption
QoS
Traffic patternsThe correct comparison is between specific platforms and workloads—not device labels.
A Layer 2 switch can be appropriate when the device primarily needs to provide endpoint connectivity.
Example:
Layer 3 Gateway
|
v
Access Switch
/ | \
/ | \
PC Phone PrinterThe access switch provides:
Ethernet connectivity
VLAN membership
Trunk uplinks
MAC forwardingwhile another device provides Layer 3 routing.
This remains a common architecture.
Layer 3 switches are particularly useful when local routing needs to occur at high throughput between internal network segments.
Examples include:
Campus distribution
Campus core
Server networks
Data-center fabrics
Inter-VLAN routing
Internal segmentationdepending on the architecture and product capabilities.
A simplified design:
Access Layer
|
v
Layer 3 Distribution
|
v
Core / Firewall / WANallows the distribution layer to provide gateways and routing for multiple VLANs.
Routers remain especially useful when connecting different network domains and services such as:
Branch ↔ Headquarters
Enterprise ↔ ISP
WAN circuits
Internet edge
VPN tunnels
BGP edge connectivity
Specialized WAN servicesA router may also provide:
NAT
QoS
Tunneling
Advanced routing
Policy routing
VPN
Traffic engineeringdepending on platform.
The correct device is determined by requirements.
Consider a small office:
ISP
|
v
ROUTER
|
v
SWITCH
/ | \
/ | \
PC Printer APThe router provides connectivity between:
Office LAN
and
Internet/WANThe switch provides local Ethernet connectivity.
If the office has multiple VLANs, the routing could occur on:
Routeror:
Layer 3 switchdepending on design.
A larger design might look like:
INTERNET
|
Edge Router
|
Firewall
|
Core / L3 Switching
/ \
/ \
Distribution Distribution
/ \ / \
/ \ / \
Access Access Access AccessDifferent layers serve different roles.
The network is not designed around:
"Should we use routers OR switches?"It is designed around:
Where should Layer 2 exist?
Where should Layer 3 boundaries exist?
Where should security policy be enforced?
Where should WAN routing occur?
Where should gateways live?
How should redundancy work?That is the architectural way to think about router vs switch.
Cloud environments abstract physical routers and switches.
You may work with concepts such as:
VPC / VNet
Subnet
Route table
Internet gateway
NAT gateway
Virtual firewall
Load balancerwithout touching a physical switch.
But the fundamental Layer 3 principles remain.
For example:
Cloud Subnet A
|
v
Virtual Routing
|
v
Cloud Subnet BCloud networking therefore does not eliminate routing.
It virtualizes and automates much of the underlying network architecture.
For more, see Cloud Networking Explained and Cloud Computing Explained.
Incorrect as a general statement.
A Layer 3 switch can route.
Too simplistic.
Router Ethernet interfaces necessarily interact with Layer 2 framing even though routing decisions are primarily Layer 3.
Incorrect.
Managed switches can have management addresses, and Layer 3 switches use routed IP interfaces.
Incorrect.
Performance depends on architecture and platform.
Not through ordinary Layer 2 switching if the traffic requires communication between separate IP networks.
A Layer 3 function is needed.
Not exactly.
VLAN is Layer 2; IP subnet is Layer 3.
Usually incorrect.
Consumer gateways commonly integrate routing, switching, Wi-Fi, DHCP, NAT and firewall functions.
The difference between routing and switching also helps troubleshooting.
Suppose:
PC-A can reach PC-B in same VLANbut cannot reach:
PC-C in another VLANLayer 2 switching may be working correctly.
Investigate:
Default gateway
SVI
Routing
ACL
Firewall
Inter-VLAN configurationNow suppose:
PC-A cannot reach PC-B in same VLANInvestigate lower/local layers:
Switch port
VLAN membership
MAC learning
ARP
NIC
Cable
Port security
STP stateThis layer-based approach prevents unnecessary router configuration changes when the problem exists on the switch.
Ask:
Is the interface up?
Is the client in the correct VLAN?
Is the MAC address learned?
Is the VLAN present?
Is the trunk carrying the VLAN?
Is STP forwarding?
Are there port-security restrictions?
Are errors/drops increasing?For a Cisco-like CLI, useful commands often include platform-appropriate variants of:
show interfaces status
show vlan brief
show mac address-table
show interfaces trunk
show spanning-treeExact commands and output differ by platform and software version.
Do not copy configuration commands into production without checking the documentation for the specific device.
Ask:
Does the interface have the expected IP?
Is the interface operational?
Does the route exist?
Which route wins?
Is the next hop reachable?
Is an ACL blocking traffic?
Is NAT involved?
Is the return route present?Common Cisco-style diagnostic commands include:
show ip interface brief
show ip route
show arp
show access-listsAgain, exact syntax depends on platform.
This is a classic troubleshooting clue.
Architecture:
PC-A --------\
SWITCH
PC-B --------/
Same VLAN → works
PC-A VLAN10
|
v
Layer 3 Gateway
|
X
|
PC-C VLAN20Investigate:
SVI state
IP routing
Gateway configuration
ACL
Firewall
Subnet mask
Return routeIf using router-on-a-stick, additionally inspect:
802.1Q trunk
Subinterfaces
VLAN tagging
Native VLAN
Allowed VLANsCisco specifically warns that native VLAN configuration must match on both sides of an 802.1Q trunk in the relevant designs.
Now focus more heavily on Layer 2.
Check:
Physical connectivity
Access VLAN
MAC address table
Port state
Port security
Spanning Tree
NIC
ARPIf the switch never learns the client’s MAC address, the issue may occur before routing becomes relevant.
This is why the troubleshooting question:
Is this a switching problem or a routing problem?
is so valuable.
| Characteristic | Layer 2 Switch | Layer 3 Switch | Router |
|---|---|---|---|
| Ethernet switching | Primary | Primary | Interface-dependent |
| MAC table | Yes | Yes | May maintain L2 adjacency information |
| Routing table | Not for ordinary L2 forwarding | Yes | Yes |
| IP forwarding | No/limited | Yes | Yes |
| VLAN segmentation | Yes | Yes | Platform/design-dependent |
| Inter-VLAN routing | No | Yes | Yes |
| SVI gateways | Limited/management or unsupported | Common | Different interface model |
| Access ports | Common | Common | Not primary role |
| Trunks | Common | Common | Supported in applicable designs |
| WAN | Rare | Platform-dependent | Common |
| NAT | Rare | Platform-dependent | Common |
| VPN | Rare | Platform-dependent | Common |
| Dynamic routing | No | Often supported | Common |
| LAN port density | High | High | Usually lower |
| Campus access | Common | Common | Rare |
| Campus distribution | Limited | Common | Possible |
| Internet edge | Rare | Possible | Common |
This comparison should be read as a design guide rather than an absolute specification.
Individual products can differ dramatically.
Choose based on the role.
For endpoint connectivity:
SwitchFor VLAN segmentation with no local routing requirement:
Layer 2 switchFor high-throughput inter-VLAN routing:
Layer 3 switchFor WAN connectivity:
RouterFor Internet security policy:
Firewall / security gatewayFor Wi-Fi:
Wireless access pointIn many environments, several functions are integrated into the same physical appliance.
The network architecture matters more than the label printed on the device.
A traditional Layer 2 switch forwards Ethernet frames within Layer 2 domains using MAC-based forwarding information, while a router forwards IP packets between Layer 3 networks using routing information.
Modern Layer 3 switches can perform both functions.
Traditional switches are Layer 2 devices, but Layer 3 switches also perform IP routing.
Routing is primarily a Layer 3 function, although router interfaces also interact with lower-layer protocols such as Ethernet.
For some internal routing use cases, yes. It does not automatically replace every WAN, VPN, NAT, Internet-edge, or specialized routing function.
Not by ordinary Layer 2 switching. Communication between different IP subnets requires Layer 3 forwarding.
Yes. This is one of its primary use cases.
Inter-VLAN routing is Layer 3 forwarding between networks associated with different VLANs.
Router-on-a-stick uses a trunk between a switch and router so one physical router interface can support multiple VLANs through logical subinterfaces.
SVI stands for Switched Virtual Interface. On a Layer 3 switch, it can provide a Layer 3 interface associated with a VLAN.
A basic unmanaged Layer 2 switch does not need an IP address to perform normal Ethernet switching. Managed switches commonly use IP addresses for management, and Layer 3 switches use IP interfaces for routing.
Router Ethernet interfaces have MAC addresses because they participate in Ethernet at Layer 2.
Layer 2 switching primarily uses MAC addresses and VLAN information. Managed and Layer 3 switches can also use IP addressing for management and routing.
It is a switch forwarding table that associates learned MAC addresses with ports, usually in a VLAN context.
A routing table contains Layer 3 reachability information used to determine how IP destinations should be forwarded.
When multiple routing entries match a destination, routing normally selects the most specific matching prefix for the forwarding decision.
MAC addresses are used in Layer 2 link-level communication such as Ethernet, while IP addresses identify Layer 3 interfaces and networks for routed communication.
Normally not when they share the same appropriate Layer 2 domain. They can communicate through Layer 2 switching.
They need Layer 3 forwarding. That function can be provided by a router, Layer 3 switch, firewall, or another routing-capable system.
No. A VLAN is a Layer 2 construct; an IP subnet is Layer 3. They are commonly mapped one-to-one in network designs.
A trunk carries traffic for multiple VLANs between devices, commonly using IEEE 802.1Q tagging.
An access port typically connects an endpoint to one VLAN.
A broadcast domain is the Layer 2 scope over which applicable broadcast traffic is propagated. VLANs create separate Layer 2 broadcast domains.
Routers do not normally forward ordinary Layer 2 broadcasts from one subnet into another. Specific relay mechanisms such as DHCP relay can intentionally provide required cross-subnet functionality.
The problem may involve the default gateway, SVI, router, routing table, ACL, firewall, trunk, or inter-VLAN configuration.
Many home gateways integrate an Ethernet switch along with routing, Wi-Fi, NAT, DHCP and firewall functionality.
There is no universal answer. Performance depends on the specific hardware, forwarding architecture, interfaces, enabled features and traffic pattern.
A Layer 3 switch is commonly used for high-throughput internal inter-VLAN routing, while routers are common at WAN and network-edge boundaries. The correct choice depends on the architecture and required features.
The difference between a router and a switch becomes much clearer when you stop thinking only about physical boxes and start thinking about network functions.
Layer 2 switching answers a question similar to:
Which Layer 2 port should receive this Ethernet frame?using information such as:
Destination MAC
VLAN
MAC address tableLayer 3 routing answers:
Where should this IP packet go next?using information such as:
Destination IP
Routing table
Prefix length
Next hopThe basic architecture is:
Same VLAN / Layer 2 domain
|
v
SWITCH
|
v
MAC-based forwarding
Different IP networks
|
v
ROUTER / L3 SWITCH
|
v
IP-based forwardingBut modern networks frequently combine these functions:
Layer 3 Switch
/ \
/ \
Layer 2 Layer 3
Switching Routing
| |
v v
MAC Tables Routing Table
| |
v v
VLANs Inter-VLAN RoutingThat is why:
Switch = Layer 2 and Router = Layer 3
is useful for beginners but technically incomplete.
A more accurate rule is:
Switching describes Layer 2 forwarding; routing describes Layer 3 forwarding. Modern devices may perform one or both functions.
When two hosts communicate within the same VLAN and subnet, switching normally handles their Ethernet frames.
When traffic must cross IP networks, Layer 3 forwarding becomes necessary.
That Layer 3 function may live on:
Router
Layer 3 switch
Firewall
Virtual router
Cloud gatewaydepending on the architecture.
Understanding that distinction makes VLAN design, DHCP relay, default gateways, ARP, routing tables, network segmentation and troubleshooting significantly easier.
Continue with Computer Networking Explained for the overall networking foundation, TCP/IP Explained for packet-layer behavior, Routers, Switches and Network Devices for the broader device overview, Network Security Basics for segmentation and security, and Firewalls Explained for policy enforcement between networks.
AI Agents as Code: Managing AI Agent Configurations, Prompts and Tools with Git AI agents…
Data Center Power Distribution Architecture: UPS, PDU, Redundancy and Rack Power Explained Data center power…
DNSSEC Troubleshooting: Fix SERVFAIL & DNSKEY Errors DNSSEC Troubleshooting: How to Fix SERVFAIL, DS, DNSKEY…
Terraform State Management Explained: Remote State, Locking, Backends and Best Practices Terraform makes infrastructure reproducible…
RTO vs RPO Explained: Disaster Recovery Objectives, Examples and Planning A disaster recovery plan is…
Network Intrusion Detection Explained: NIDS, Sensors, Signatures and Traffic Analysis A firewall can decide whether…