Three-tier campus design: access, distribution, and core
Why enterprise LANs are built as three layers, and what each one is and is not allowed to do.
Three jobs, three layers
The three-tier hierarchical model splits a campus LAN into three layers so that each one does exactly one job well. The access layer is where end devices connect: PCs, phones, printers, and access points. It is a Layer 2 edge focused on port density, Power over Ethernet, and assigning each port to a VLAN, and it is where port-level security like port security and 802.1X belongs.
The distribution layer aggregates many access switches. It is the boundary between Layer 2 and Layer 3: it terminates VLANs on switch virtual interfaces (SVIs), routes between those VLANs, and enforces policy such as access control lists and QoS marking. It is also where first-hop gateway redundancy lives, so end devices keep a working default gateway if one distribution switch fails.
The core layer is a high-speed Layer 3 backbone whose only job is to forward as fast as possible between distribution blocks and the campus edge. Deliberately, the core carries no access ports and applies no user-facing policy; keeping it simple keeps it fast and stable.
Three-tier campus: three layers, three jobs
Trace
The hierarchical model splits the campus so each layer does one job. The access layer is the Layer 2 edge for end devices (port density, PoE, VLAN assignment, port security/802.1X). The distribution layer is the Layer 2/Layer 3 boundary (SVIs, inter-VLAN routing, ACL/QoS policy, first-hop redundancy). The core is a policy-free high-speed Layer 3 backbone with no access ports. Redundant distribution and core pairs keep the design fault-tolerant.
How a frame becomes a routed packet
Follow a single flow. A client sits on an access port that carries one VLAN. The link from the access switch up to the distribution switch is an 802.1Q trunk, which tags frames so a single physical uplink can carry many VLANs. Because campuses build redundant uplinks, spanning tree runs across them to prevent loops, leaving one path forwarding and holding the others as standby; where more bandwidth is needed, link aggregation bundles several physical links into one logical trunk.
The client's default gateway is not on the access switch. It is the SVI for that VLAN on the distribution switch, which is the first device that routes between VLANs. A pair of distribution switches share one virtual gateway address through a first-hop redundancy protocol, so failover is invisible to the client.
This is the core-versus-distribution split in one picture: reaching the internet is north-south traffic that climbs client, access, distribution, core, edge firewall, and out. Reaching a server in a different VLAN on the same campus is east-west traffic that the distribution layer routes between VLANs, often without ever touching the core.
Three-tier campus: access, distribution, core
Trace
A client on VLAN 20 reaches the internet north-south by crossing an 802.1Q trunk to the distribution layer, being routed by the distribution SVI, and passing through the core to the edge firewall. Reaching the VLAN 40 server is east-west traffic that the distribution switch routes between VLANs without ever touching the core.
Collapsed core and exam takeaways
Not every site needs three physical layers. In a collapsed core design, the core and distribution functions are combined into a single layer, giving a two-tier topology of access plus a merged core/distribution. This suits smaller campuses where a separate core would add cost and latency without adding value; the tradeoff is that the merged layer now carries both aggregation policy and backbone forwarding, so it must be sized and made redundant carefully.
For the exam, anchor on which layer owns which job. Access equals end-device connectivity, VLAN assignment, PoE, and port security. Distribution equals VLAN termination at SVIs, inter-VLAN routing, policy, and first-hop redundancy. Core equals fast Layer 3 forwarding with no policy. Then keep the two traffic directions straight: north-south crosses the layers toward the edge or a remote destination, while east-west stays between devices inside the campus, and in the three-tier model that east-west routing between VLANs is the distribution layer's work.
Collapsed core: two-tier access plus merged core/distribution
Trace
At a smaller site, a separate core adds cost and latency without value, so the core and distribution functions collapse into one layer. The result is two tiers: an unchanged access layer plus a merged core/distribution that now carries BOTH aggregation policy (SVIs, inter-VLAN routing, ACL/QoS, FHRP) AND backbone forwarding. North-south reaches the internet in two hops instead of three; east-west inter-VLAN traffic is routed by the merged layer. Because one tier does two jobs, it must be sized and made redundant carefully.
