Advanced Ethernet and Campus Switching

Introduction and Context

Ethernet has evolved from a shared medium into the dominant access technology for enterprise campus networks. Modern Ethernet switching provides high bandwidth, segmentation, redundancy, policy enforcement, and increasingly sophisticated traffic engineering. A campus network must support users, wireless access points, voice systems, servers, Internet connectivity, and operational technologies while remaining secure, available, and manageable.

The central design challenge is that Layer 2 networks are simple to deploy but can form loops, create large broadcast domains, and complicate fault isolation. Layer 3 networks scale and contain failure domains, but they require routing design and IP planning. Advanced campus switching therefore combines VLANs, trunks, spanning-tree protocols, link aggregation, multilayer switching, and hierarchical architecture.

This chapter uses Ethernet terminology from IEEE 802 standards and common enterprise practice. Exact command syntax differs among vendors; configuration examples are deliberately vendor-neutral or Cisco-like where this helps illustrate the logic.

Learning Objectives

After completing this chapter, a student should be able to:

1. Explain VLAN operation, 802.1Q tagging, trunking, and native VLAN issues.
2. Design and troubleshoot inter-VLAN routing using router-on-a-stick and multilayer switching.
3. Compare STP, RSTP, and MSTP and select appropriate root-bridge and protection strategies.
4. Configure and evaluate link aggregation using LACP.
5. Apply segmentation, redundancy, and hierarchical campus-design principles.
6. Analyze faults involving VLAN membership, trunks, spanning tree, routing, and EtherChannel.
7. Evaluate security, governance, and operational implications of campus switching.

1. Ethernet Switching as a Campus Foundation

An Ethernet switch learns source MAC addresses from incoming frames and records them in a forwarding database (FDB). If the destination MAC address is known, the frame is forwarded only through the associated port. If it is unknown, the frame is flooded within the relevant VLAN. Broadcast and certain multicast frames are also flooded within that VLAN.

A switch therefore creates separate collision domains, but ordinary Layer 2 switching does not automatically create separate broadcast domains. A VLAN is the logical broadcast domain used to divide a switched infrastructure. Each VLAN normally represents a distinct IP subnet, although the relationship is a design convention rather than a physical law.

A campus design must distinguish three boundaries:

• A collision domain is the set of devices sharing a contention domain. With modern full-duplex switched Ethernet, each switch port is normally its own collision domain.
• A broadcast domain is the set of interfaces receiving a Layer 2 broadcast. A VLAN defines this boundary.
• A failure domain is the set of services affected by a device, link, control-plane, or configuration failure. VLANs, routing boundaries, and hierarchical design can reduce failure-domain size.

The effective payload throughput of a link is less than its nominal line rate because of Ethernet headers, inter-frame gaps, preambles, VLAN tags, and higher-layer headers. For a practical estimate:

Here, goodput is useful application data per second; line rate is the physical bit rate; protocol efficiency is the fraction remaining after protocol overhead; and utilization represents the proportion of capacity actually carrying traffic. The formula is an engineering estimate, not a replacement for measurement. Its variables are dimensionless except for line rate and goodput, which must use consistent units.

2. VLANs and 802.1Q Trunking

VLAN membership and design

An access port assigns untagged ingress frames to one VLAN. A trunk carries multiple VLANs over one physical link by adding an IEEE 802.1Q tag to frames that traverse the trunk. The tag identifies the VLAN and includes priority information. The receiving switch removes or interprets the tag before delivering the frame on an access port.

A VLAN plan should be based on business and security requirements rather than arbitrary numbering. Typical VLANs include:

A VLAN should not be stretched across the entire campus without a clear reason. Excessive Layer 2 scope increases broadcast propagation, spanning-tree complexity, and the impact of misconfiguration.

Native VLAN and tagging behavior

On many platforms, the native VLAN on an 802.1Q trunk is transmitted untagged. Both ends must agree on the native VLAN. A native-VLAN mismatch can cause traffic to enter the wrong broadcast domain and usually generates a control-plane warning. Best practice is to use an unused, explicitly configured native VLAN, tag native traffic where supported, and never use the native VLAN for ordinary endpoints.

The allowed VLAN list on a trunk should be limited to VLANs that are genuinely required. Pruning reduces unnecessary broadcasts and reduces the opportunity for unauthorized access. However, pruning must be documented because an omitted VLAN can appear as a routing or endpoint failure.

Access and trunk configuration logic

A generic configuration sequence is:

interface access-port
  switchport mode access
  switchport access vlan 20
  spanning-tree portfast
  spanning-tree bpduguard enable

interface uplink
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30,99
  switchport trunk native vlan 999

PortFast should be used only on ports connected to end devices, not switch-to-switch links. BPDU Guard should disable an edge port if a spanning-tree BPDU is received, protecting the topology from an unauthorized switch. The exact commands and default behaviors vary by vendor.

3. Inter-VLAN Routing and Multilayer Switching

Hosts in different VLANs cannot communicate through Layer 2 switching alone. A Layer 3 gateway must receive the packet, consult a routing table, and forward it into the destination VLAN.

Router-on-a-stick

In router-on-a-stick, one router interface is configured with multiple logical subinterfaces. Each subinterface is associated with a VLAN and an IP address, while the switch-to-router link is an 802.1Q trunk. This approach is inexpensive and useful in small environments, but all inter-VLAN traffic shares one physical link and one router interface.

Example logic:

interface router.20
  encapsulation dot1q 20
  ip address 192.0.2.1 255.255.255.0

interface router.30
  encapsulation dot1q 30
  ip address 198.51.100.1 255.255.255.0

The default gateway for hosts in VLAN 20 is 192.0.2.1; the gateway for VLAN 30 is 198.51.100.1. Subnet addresses are illustrative and should be replaced with an organization’s assigned addressing plan.

Switched virtual interfaces

A multilayer switch uses a switched virtual interface (SVI) as the Layer 3 gateway for a VLAN. The physical switch ports remain Layer 2 access or trunk ports, while the SVI performs routing in hardware when supported.

interface vlan 20
  ip address 192.0.2.1 255.255.255.0
  no shutdown

ip routing

An SVI may remain down if the VLAN does not exist, no active member port or trunk carries the VLAN, or the platform has additional activation requirements. The gateway address must be unique within the subnet, and hosts must use the correct default gateway.

Routing and forwarding analysis

When a host sends to a destination in another subnet, it uses ARP or Neighbor Discovery to resolve the gateway’s local Layer 2 address. The gateway removes the incoming Ethernet frame, decrements the IP time-to-live or hop limit, selects a route, and constructs a new Ethernet frame for the next segment. The destination MAC address changes at every routed hop, while the source and destination IP addresses generally remain unchanged except where translation or tunneling is applied.

A multilayer campus often uses a first-hop redundancy protocol (FHRP), such as HSRP, VRRP, or an equivalent, so hosts use a virtual gateway address shared by redundant devices. If one gateway fails, the surviving device assumes the virtual address. FHRP improves gateway availability but does not replace routing-protocol design, Layer 2 redundancy, or failure testing.

4. Spanning Tree and Loop Prevention

Redundant Layer 2 links are valuable because they provide alternate paths, but a physical loop can cause broadcast storms, duplicate frames, MAC-table instability, and severe control-plane load. Spanning Tree Protocol (STP) creates a loop-free logical topology by placing selected ports into forwarding or blocking states.

Common spanning-tree concepts

The root bridge is the reference point for the spanning-tree topology. Each non-root switch selects a root port, which is its best path toward the root. On each segment, one designated port provides the best path away from the root. Redundant alternatives are placed into a non-forwarding state.

Bridge ID is determined primarily by bridge priority and MAC address. The switch with the lowest bridge ID becomes root. Consequently, root placement should be intentional rather than left to a random election. A campus designer commonly makes a distribution switch the primary root and another distribution switch the secondary root.

Path selection uses the cumulative cost of links. The exact cost table depends on the STP implementation and link speed. A simplified analysis is:

The summation applies to each link on a candidate path. The preferred path has the lowest total cost, subject to bridge-ID and port-ID tie breakers. This is not a bandwidth equation; it is a protocol metric whose values are implementation-defined.

STP, RSTP, and MSTP

Classic 802.1D STP can converge slowly after a topology change. Rapid STP (802.1w, incorporated into later standards) uses roles and proposal/agreement mechanisms to achieve much faster convergence in correctly designed topologies. It identifies alternate and backup ports and can rapidly transition appropriate edge and point-to-point links.

Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s and related provisions) maps groups of VLANs to a smaller number of spanning-tree instances. VLANs in the same instance share a topology, reducing control-plane overhead. All switches in an MST region must agree on the region name, revision level, and VLAN-to-instance mapping. A mismatch can place a switch outside the region and produce unexpected topology behavior.

Protection features

• BPDU Guard disables an edge port that receives a BPDU.
• Root Guard prevents a port from accepting a superior BPDU and becoming an unexpected path toward the root.
• Loop Guard helps prevent a non-designated port from incorrectly entering forwarding when expected BPDUs disappear.
• BPDU Filter suppresses BPDUs and is dangerous if applied carelessly; it should not be treated as a general security feature.
• PortFast or edge mode accelerates host-port transition but must not be used on switch links.

STP protection is effective only when interfaces are correctly classified and violations are monitored. Automatic err-disable recovery, if enabled, should be accompanied by alerting and root-cause investigation.

5. Link Aggregation and EtherChannel

Link aggregation combines multiple physical links into one logical bundle. It increases aggregate capacity and provides resilience against failure of an individual member. LACP, specified by IEEE 802.1AX, negotiates and monitors aggregation membership.

A useful planning approximation is:

Here, N is the number of active member links and C is the capacity of one member link. This represents aggregate capacity across multiple flows. It does not mean that one ordinary flow will use every member. A hashing algorithm normally selects one member using fields such as source and destination MAC, IP addresses, and transport ports. Thus, a single large flow may be limited to C even when the bundle’s aggregate capacity is N × C.

All members must normally have compatible speed, duplex, VLAN mode, allowed VLAN list, native VLAN, and negotiation parameters. A mismatch may cause a link to remain individual, be suspended, or create unpredictable forwarding.

Example logic:

interface range uplink-1 - uplink-2
  channel-group 10 mode active

interface port-channel 10
  switchport mode trunk
  switchport trunk allowed vlan 10,20,30

LACP active mode initiates negotiation; passive mode responds but does not initiate. At least one side must be active. Configuration should be applied consistently to the logical port-channel, with member interfaces inheriting or matching its operational parameters.

6. Scalable Campus Architecture

A traditional hierarchical campus uses access, distribution, and core layers.

• The access layer connects endpoints, applies edge security and QoS, and supplies Power over Ethernet where required.
• The distribution layer aggregates access switches, provides policy enforcement, terminates VLANs, performs routing, and supports redundancy.
• The core layer provides fast, resilient Layer 3 transport between distribution blocks and major services.

In a small campus, distribution and core functions may be collapsed. In a larger campus, a routed-access design can eliminate many Layer 2 links above the access layer. Access switches then use routed uplinks, and VLANs terminate at the access or distribution boundary. This reduces spanning-tree scope and allows dynamic routing, equal-cost paths, and clearer failure domains.

A sound architecture follows several principles:

1. Keep Layer 2 domains as small as operationally practical.
2. Use redundant devices and diverse physical paths for critical services.
3. Prefer Layer 3 boundaries where they improve convergence and fault isolation.
4. Separate user, voice, guest, management, and infrastructure traffic.
5. Standardize configurations and document intentional exceptions.
6. Design for observability: logs, telemetry, counters, topology data, and tested alerts.

Segmentation is not achieved merely by creating VLAN numbers. Effective segmentation requires routing policy, access-control lists, firewall enforcement, identity-based access, endpoint posture controls, and careful management-plane protection. A guest VLAN with unrestricted routing to internal services is not a secure guest design.

7. Troubleshooting Methodology

Troubleshooting should proceed from physical state to Layer 2, then Layer 3, policy, and application behavior. Begin by defining the symptom precisely: which source, destination, VLAN, time, protocol, and path are affected?

Physical and data-link checks

Check interface state, speed, duplex, optical levels, errors, drops, CRC counters, and link flaps. A dirty fiber connector or mismatched transceiver can resemble a switching fault. Confirm that the correct cable reaches the expected device and port.

VLAN and trunk checks

Verify that the VLAN exists, the endpoint port is assigned correctly, and the VLAN is active. On each trunk, compare operational mode, native VLAN, allowed VLANs, tagging behavior, and the spanning-tree state. A VLAN permitted on one side but not the other is a common fault.

Spanning-tree checks

Identify the root bridge, root and designated ports, blocked ports, topology changes, and recent BPDU events. Determine whether a supposedly redundant link is intentionally blocking or unexpectedly blocking. Repeated topology changes often indicate an unstable edge device, a misconfigured port, or a physical fault.

Routing checks

Confirm SVI state, IP addressing, subnet masks, default gateways, ARP or Neighbor Discovery entries, routing-table entries, and access-control lists. Test progressively: same VLAN, gateway, remote VLAN, and external destination. A successful ping to a gateway proves local Layer 3 reachability, not end-to-end application availability.

EtherChannel checks

Confirm that every intended member is bundled and collecting/distributing traffic. Compare LACP state, partner information, hashing behavior, and configuration consistency. Do not assume that a physically up interface is forwarding as part of the logical bundle.

Useful evidence includes MAC-address tables, interface counters, spanning-tree detail, ARP tables, routing tables, LACP status, packet captures, and timestamped logs. Change one variable at a time and record the before-and-after state.

8. Applied Case: Illustrative University Campus Upgrade

Background

An illustrative university has three buildings, 2,400 users, wireless access throughout, IP telephony, and a small data center. Its network uses a single large Layer 2 domain. Users report intermittent connectivity, and a loop in one building recently caused a broadcast storm.

Problem analysis

The investigation finds that VLANs are stretched across all buildings, the root bridge was selected by default priority, access ports lack BPDU Guard, and two distribution uplinks are configured inconsistently. Inter-VLAN routing occurs through a congested router-on-a-stick link. The design has redundancy in hardware but not in control-plane behavior.

Approach and solution

The university creates separate user, voice, wireless, guest, server, and management VLANs. VLANs are terminated on two redundant multilayer distribution switches using SVIs and a first-hop redundancy protocol. Distribution switches are configured with deliberate primary and secondary STP roles, while MSTP maps stable VLAN groups to a small number of instances. Access uplinks use LACP trunks with explicitly allowed VLANs.

The guest VLAN is routed only toward an Internet firewall. Management interfaces are reachable from an administrative subnet through policy controls. Edge ports receive PortFast and BPDU Guard; switch links receive appropriate root and loop protection. Where building boundaries permit, routed uplinks replace extended Layer 2 trunks.

Outcome

A failure of one uplink no longer interrupts the access switch because LACP maintains the logical connection. A distribution-switch failure is handled by the redundant gateway design. Broadcast traffic is contained by smaller VLAN scopes, and the former single router bottleneck is removed. Monitoring records topology changes, bundle membership, gateway state, and interface errors.

Learning points

The case demonstrates that availability is not obtained by adding cables alone. Redundancy must be coordinated with spanning tree, gateway behavior, routing, consistent configuration, and operational monitoring. Segmentation improves security only when routing and policy enforce the intended boundaries.

9. Security, Governance, and Contemporary Practice

Campus switches are part of the security boundary. Common controls include DHCP snooping, Dynamic ARP Inspection, IP Source Guard, storm control, MAC limiting, 802.1X network access control, secure management protocols, and role-based administration. These features can disrupt legitimate traffic if bindings, trusted ports, timers, or exception processes are poorly designed.

Administrative access should use authenticated, encrypted protocols such as SSH and should be integrated with centralized identity and accounting where feasible. Configuration changes should be authorized, logged, peer-reviewed for high-risk systems, and recoverable through tested backups. Network diagrams and VLAN-to-subnet mappings should be treated as controlled operational documentation.

Automation and AI-assisted operations can compare configurations, detect unusual topology changes, classify alerts, and recommend likely causes. They should not be granted unrestricted authority to change production switching without validation, staged deployment, rollback, and human approval. Training data, device credentials, telemetry privacy, and explainability are governance concerns.

Current campus trends include Wi-Fi 6/6E and Wi-Fi 7 capacity demands, multi-gigabit access ports, cloud-managed switching, network access control, intent-based configuration, IPv6 dual stack, and increasing use of telemetry. These developments do not remove the need to understand VLANs, loops, routing, and failure domains; they make correct foundations more important.

Best-Practice Checklist

• Establish an explicit VLAN and IP addressing plan.
• Restrict trunk VLANs and standardize native VLAN behavior.
• Use multilayer switching for scalable inter-VLAN routing.
• Choose and document STP roots and MSTP region parameters.
• Apply edge protection only to genuine edge ports.
• Use LACP for redundant parallel links and verify member state.
• Prefer routed boundaries where they reduce Layer 2 scope.
• Protect management and guest traffic with routing policy and identity controls.
• Monitor errors, topology changes, gateway state, and configuration drift.
• Test failure scenarios and maintain rollback procedures.

Chapter Summary

Advanced campus switching combines Layer 2 segmentation with Layer 3 routing, loop prevention, link aggregation, and hierarchical design. VLANs create logical broadcast domains, while 802.1Q trunks transport selected VLANs between devices. Inter-VLAN communication requires a router, SVI, or multilayer switch. STP prevents physical loops; RSTP improves convergence; MSTP reduces the number of spanning-tree instances while requiring consistent regional configuration. LACP combines physical links into a logical bundle, improving resilience and aggregate capacity, although a single flow may remain limited to one member.

Scalable designs deliberately place VLAN and routing boundaries, use redundant gateways and paths, and apply security controls at access, routing, and management layers. Effective troubleshooting moves systematically from physical conditions through VLANs, trunks, spanning tree, EtherChannel, routing, and policy. Professional practice also requires documentation, change governance, observability, testing, and cautious use of automation.

Key Terms

VLAN: A logical Layer 2 broadcast domain.

802.1Q: IEEE VLAN tagging method used on Ethernet trunks.

Access port: A switch port assigned to one VLAN for an endpoint.

Trunk: A link carrying multiple VLANs.

Native VLAN: The VLAN transmitted untagged on some 802.1Q trunks.

Broadcast domain: Devices that receive a Layer 2 broadcast.

SVI: A switched virtual interface providing a Layer 3 VLAN gateway.

Router-on-a-stick: Inter-VLAN routing through subinterfaces on one trunked router link.

Multilayer switch: A switch that performs both Layer 2 switching and Layer 3 routing.

STP: Spanning Tree Protocol, which prevents Layer 2 loops.

RSTP: Rapid Spanning Tree Protocol with faster convergence.

MSTP: Multiple Spanning Tree Protocol, which maps VLAN groups to instances.

Root bridge: The elected reference switch for a spanning-tree topology.

BPDU Guard: Protection that disables an edge port receiving a BPDU.

LACP: Link Aggregation Control Protocol.

Port-channel: The logical interface representing an aggregated link.

Failure domain: The set of services affected by a particular failure.

FHRP: First-hop redundancy protocol providing a resilient virtual gateway.

Broadcast storm: Excessive broadcast or looping traffic that consumes network resources.

Routed access: A campus design using Layer 3 uplinks from access switches.

Review Questions

Short Answer Questions

1. What is the difference between an access port and a trunk port?
2. Why must a native VLAN be consistent on both ends of a trunk?
3. What function does an SVI perform?
4. Why can a single traffic flow fail to use all members of an LACP bundle?
5. What is the purpose of BPDU Guard?

Long Answer Questions

1. Explain how VLANs, 802.1Q trunks, and inter-VLAN routing work together in a campus network.
2. Compare STP, RSTP, and MSTP, including their convergence and configuration considerations.
3. Describe a hierarchical campus architecture and explain how it limits failure domains.
4. Develop a troubleshooting procedure for a host that cannot reach a host in another VLAN.
5. Explain why hardware redundancy alone does not guarantee network availability.

Analytical / Application Questions

1. A switch has two 1-Gb/s LACP members. Explain the expected aggregate capacity and why one large flow may not achieve 2 Gb/s.
2. A trunk is up, but users in VLAN 30 cannot reach their gateway while VLAN 20 works. Identify the most likely verification steps and possible causes.
3. Design a high-level switching strategy for a three-building campus requiring guest isolation, voice support, redundant gateways, and limited Layer 2 extension. Justify the placement of VLAN and routing boundaries.

Multiple Choice Questions with Answers

Question 1

Which device function is required for communication between two different VLANs?

A. Layer 3 routing

B. MAC flooding only

C. A longer Ethernet cable

D. PortFast

Correct Answer: A. Layer 3 routing

Question 2

What is the principal purpose of an 802.1Q trunk?

A. To carry multiple VLANs over one link

B. To disable spanning tree

C. To convert IPv4 to IPv6

D. To provide wireless encryption

Correct Answer: A. To carry multiple VLANs over one link

Question 3

Which switch should normally be selected intentionally as the spanning-tree root?

A. A strategically placed distribution switch

B. The switch with the highest MAC address

C. An end-user laptop

D. A device selected randomly after every reboot

Correct Answer: A. A strategically placed distribution switch

Question 4

What does BPDU Guard typically do when an edge port receives a BPDU?

A. Disables or places the port into a protective error state

B. Makes the port the root bridge

C. Adds a new VLAN automatically

D. Increases the port speed

Correct Answer: A. Disables or places the port into a protective error state

Question 5

Which protocol negotiates dynamic link aggregation in the IEEE standard approach?

A. LACP

B. ARP

C. DHCP

D. LLDP only

Correct Answer: A. LACP

Question 6

A trunk permits VLANs 10 and 20 but not VLAN 30. What is the most direct consequence?

A. VLAN 30 traffic cannot traverse that trunk

B. VLAN 10 is converted into VLAN 30

C. All VLANs become untagged

D. The trunk automatically routes VLAN 30

Correct Answer: A. VLAN 30 traffic cannot traverse that trunk

Question 7

Which statement best describes RSTP?

A. It provides faster spanning-tree convergence than classic STP

B. It eliminates the need for VLANs

C. It aggregates physical links

D. It assigns IP addresses to hosts

Correct Answer: A. It provides faster spanning-tree convergence than classic STP

Question 8

Two 1-Gb/s links form an LACP bundle. What is the approximate aggregate capacity across multiple suitable flows?

A. 2 Gb/s

B. 500 Mb/s

C. 1 Mb/s

D. 10 Gb/s

Correct Answer: A. 2 Gb/s

Question 9

What is a major advantage of routed access design?

A. It reduces the Layer 2 and spanning-tree scope

B. It requires every VLAN to span the campus

C. It removes the need for IP addressing

D. It prevents all physical link failures

Correct Answer: A. It reduces the Layer 2 and spanning-tree scope

Question 10

Which troubleshooting sequence is generally most appropriate?

A. Physical state, Layer 2, Layer 3, policy, then application behavior

B. Application behavior, cable replacement, and then ignore routing

C. Change every configuration simultaneously

D. Replace all switches before collecting evidence

Correct Answer: A. Physical state, Layer 2, Layer 3, policy, then application behavior