Three layers
A campus network is built in three layers, like the floors of a building. The access layer is where people plug in. The distribution layer joins and controls the access switches. The core carries traffic fast between everything.
Access layer
A staff laptop plugs into a port on an access switch: one cable per desk. The port is an access port in VLAN 10 (staff), so the laptop joins the staff network without any setup of its own.
The same cable can carry power. With Power over Ethernet (PoE, IEEE 802.3), the access switch first checks that the Wi-Fi access point is built for it, then feeds it about 48 volts. No power socket is needed on the ceiling.
Distribution layer
The laptop wants a server in another subnet, so it sends the packet to its default gateway, 192.168.10.1. The access switch only forwards frames. The gateway lives on the distribution switches, which route between VLANs.
Distribution is also where the rules live. A guest phone on the Wi-Fi (VLAN 20) tries to reach the staff servers, and Dist 1's access list drops it. Guests may only go out to the internet.
Core layer
Dist 1 routes the laptop's packet up to the core. The core has one job: move packets fast between distribution blocks, the server room and the internet. It applies no filters, so it stays simple and fast.
Wireless
Dozens of access points are run from one wireless LAN controller. Each AP builds a CAPWAP tunnel to it (RFC 5415) and gets its Wi-Fi names, channels and security settings from there.
Redundancy
Now redundancy. Every access switch has two uplinks, one to each distribution switch. Spanning tree keeps one forwarding and the other on standby, so a broken cable or switch never cuts a floor off.
The two distribution switches are joined by two cables, bundled with LACP (IEEE 802.1AX) into one 20 Gbit/s link. If one cable breaks, the link stays up, just slower.
192.168.10.1 is a virtual address shared by both switches using VRRP (RFC 9568). Dist 1 has the higher priority, so it is Active and answers for it. It tells Dist 2 so with an advertisement every second.
Dist 1 loses power. After about 3.6 seconds without advertisements, Dist 2 becomes Active and takes over 192.168.10.1 and its MAC address. The standby uplink starts forwarding, and the laptop carries on unchanged.
Smaller sites
A small site, one building with a few access switches, can skip the separate core. The distribution pair does both jobs: a collapsed core. That is two tiers instead of three, with the same redundancy.
Inside the network
;; step 1/12 · three-layers · overview
hierarchical (three-tier) campus design
access where users and devices plug in · VLANs, PoE
distribution routes between VLANs · policy · gateway
core fast transport between distribution blocks,
the server room and the internet
each layer has one job, so each can grow on its own
VRRP version 3 is RFC 9568, which replaced RFC 5798 and renamed the "Master" router "Active". Advertisements go to 224.0.0.18; the IPv4 virtual MAC is 00:00:5e:00:01 followed by the VRID. Dist 2 takes over after Active_Down_Interval: 3 × the 1 s advertisement interval plus a skew of (256 - priority)/256 s, 3.609 s at priority 100. Preemption is on by default, so Dist 1 takes the role back when it returns.