Three-Tier Network Design
Enterprise networks are built in a hierarchy of three layers: access (where devices plug in), distribution (policy and routing between VLANs), and core (fast transport between distribution blocks). Hierarchy is what makes networks scalable, resilient and troubleshootable.
What each layer does
| Layer | Job | Typical features |
|---|---|---|
| Access | Connect end devices | Switch ports, port security, PoE, VLAN assignment |
| Distribution | Aggregate access; apply policy | Inter-VLAN routing, ACLs, HSRP |
| Core | Move packets fast between blocks | High-speed redundant L3 links — no policy, just speed |
The golden rule: the core stays simple. Policy, filtering and complexity live at distribution; the core just forwards as fast as possible.
Why hierarchy wins
- Scale — add an access switch without redesigning anything: plug it into distribution.
- Resilience — redundant links between layers (with STP/EtherChannel at L2, equal-cost routing at L3) mean single failures don't drop users.
- Troubleshooting — problems isolate to a layer: a user issue is access, an inter-VLAN issue is distribution, a site-wide issue is core. The layered method maps straight onto the design.
Collapsed core — the two-tier variant
Most small and mid-size networks don't need a separate core: the collapsed-core design merges core and distribution into one layer of (redundant) switches, with access below. Same principles, less hardware — and the design the CCNA expects you to recognise for a typical campus.
Where the design is heading
Modern campuses overlay automation on this hierarchy — controller-based management and fabrics (SD-Access) — while data centres moved to spine-leaf. But the three-tier mental model remains the foundation every design conversation starts from.
Frequently asked questions
What are the three layers of hierarchical network design?
Access (connects end devices), distribution (aggregates access switches and applies routing/policy), and core (high-speed transport between distribution blocks).
What is a collapsed core?
A two-tier design where core and distribution functions merge into one redundant switch layer — the standard choice for small and mid-size networks that don't need a separate core.
Why should the core layer be simple?
Its only job is fast, reliable transport. Adding policy or filtering there creates bottlenecks and failure risk; complexity belongs at the distribution layer.
Where does inter-VLAN routing happen?
At the distribution layer, typically on multilayer switches, along with ACLs and first-hop redundancy (HSRP/VRRP).
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.