Layer 2 vs Layer 3 Switches: What’s the Difference and When You Need Layer 3

A Layer 3 switch is an Ethernet switch that can also route IP packets between VLANs and subnets, in hardware and at close to the full speed of its ports. It combines the MAC-address forwarding of a Layer 2 switch with the IP routing of a router, which lets one device both connect the devices in each network segment and move traffic between those segments.

The names come from the OSI model, the layers at which a switch makes its forwarding decisions. A Layer 2 switch works at the data link layer and forwards Ethernet frames by MAC address. A Layer 3 switch adds the network layer and can forward by IP address as well. In practice the question is simple: can the switch move traffic between separate subnets on its own, or does it need a router to do that?

This guide sets out what each kind of switch does, with a master comparison against a router, a short explainer on the layers, a worked inter-VLAN routing example, static and dynamic routing, gateway redundancy with VRRP, the difference between Layer 2+, light Layer 3 and full Layer 3, and when an industrial network needs Layer 3 at the edge. It ends with examples from our range and a checklist for specifying one.

The table is the quick reference. Real products blur the edges, so read it as typical behaviour and check the datasheet of the model you are considering.

For the managed side of the picture, our guide to managed vs unmanaged switches covers VLANs, QoS and redundancy, and our FAQ on Layer 3 switch vs router gives the short answer to the most common question.

The OSI model splits networking into seven layers. Switches and routers work in the bottom three, and each layer has its own kind of address.

A MAC address is burned into each network interface and is 48 bits long, which allows about 281 trillion addresses. It only means something within one network. An IP address is assigned and is hierarchical, so a router can tell from the address alone which network a packet belongs to. When a device wants to reach an IP address on its own subnet, it uses ARP to ask which MAC address owns it; when the address is on another subnet, it sends the frame to its default gateway, which is where a router or Layer 3 switch comes in. Our FAQ on packet switching covers the wider idea.

A Layer 2 switch learns which device sits on which port by reading source MAC addresses, builds a forwarding table, and sends each frame only to the port it needs to reach. It supports VLANs (IEEE 802.1Q), which split one physical switch into several separate broadcast domains. Everything it does stays within a network: traffic that needs to cross from one VLAN or subnet to another has to be handed to a router. Layer 2 switching is fast, low-latency and the backbone of every LAN, and most ports in most networks are Layer 2 ports.

Layer 2 switches come in three broad kinds.

• Unmanaged. Plug-and-play switches with no settings: every port is in one network, with no VLANs, monitoring or loop protection.
• Managed Layer 2. Adds the features that make a segmented network work: VLANs, quality of service, IGMP snooping for multicast video and industrial protocols, spanning tree or ring protection against loops, link aggregation, port security and SNMP monitoring.
• Layer 2+. A managed Layer 2 switch with a little routing added, usually static routes between VLANs and DHCP features such as Option 82, but without dynamic routing protocols such as OSPF.

In an industrial network, most switches in cabinets and on machines are managed Layer 2 or Layer 2+ switches, and only the aggregation point needs full Layer 3. Our explainer on what a managed switch adds covers those settings in more detail.

How a Layer 2 switch learns

Each time a frame arrives, the switch records its source MAC address against the port it came in on. When a frame arrives for a destination it already knows, the switch sends it out of that one port. When the destination is unknown, or the frame is a broadcast, the switch floods it to every port in the VLAN and learns the answer from the reply. Entries age out after a few minutes without traffic, 300 seconds by default on many switches, so a device moved to another port is found again automatically.

A Layer 3 switch does everything a Layer 2 switch does and adds IP routing in hardware. Because the routing runs in the switching chip rather than in software on a general-purpose processor, it routes between VLANs and subnets at close to wire speed, which is far faster than a software router handles local traffic. Every Layer 3 switch supports static routes; many add dynamic routing protocols such as OSPF or RIP, gateway redundancy and access control lists. The result is a single device that both switches within VLANs and routes between them.

On the switch, each VLAN that needs routing gets a virtual interface with an IP address, often called a switch virtual interface or VLAN interface. Devices in that VLAN use the address as their default gateway. When a packet arrives for another subnet, the switch looks up the destination in its routing table, rewrites the frame with the next MAC address and forwards it, all in hardware.

Layer 2+, light Layer 3 and full Layer 3

Datasheets use several names for partial routing, and the difference matters when a network has more than a couple of VLANs or two paths between sites.

If a network has one switch routing a few VLANs and a single path to the outside, static routes are simpler and easier to audit. If it has several routed switches, redundant paths or a gateway that must survive a switch failure, plan on full Layer 3.

Inter-VLAN routing is the job that most often turns a Layer 2 network into a Layer 3 one. The example below is a production cell split into four VLANs, with a Layer 3 switch as the gateway for all of them.

Each device keeps its own subnet and points at its VLAN’s gateway address. The switch routes an HMI request to a PLC in hardware, without the packet leaving the cabinet, and access control lists stop the camera VLAN reaching the controllers at all. Broadcasts from the cameras stay in VLAN 30, so the PLCs never see them.

Without a Layer 3 switch, the same design needs a router connected to the switch over a trunk port, often called router on a stick. Every packet between VLANs then crosses that one link twice, once to the router and once back, which adds latency, makes the router a single point of failure and limits throughput to the trunk speed. That is fine for light traffic and a common starting point; it becomes the bottleneck once video or historian traffic moves between VLANs.

Do I need a Layer 3 switch for VLANs?

No, not to create them. Any managed Layer 2 switch can separate traffic into VLANs. You need Layer 3, in a switch or a router, only when devices in different VLANs have to talk to each other.

A routing table can be written by hand or learned from neighbouring routers. Industrial networks use both, and the choice depends on how often the network changes and how many paths it has.

A plant with one routed switch and a firewall at the boundary is usually best served by static routes. A site with several routed segments, a ring of Layer 3 switches or two paths to the control room is where OSPF earns its keep, because it finds a new path on its own when a link fails. Whatever the method, document the routing design alongside the VLAN plan; it is the first thing an integrator needs when the network changes.

In the inter-VLAN example, every device depends on one gateway address. If the switch holding it fails, the whole cell loses routing. VRRP, the Virtual Router Redundancy Protocol, solves that by sharing one virtual gateway address between two Layer 3 switches.

One switch is the active router for the virtual address and sends regular advertisements; the other listens. If the advertisements stop, the backup takes over the virtual IP and MAC address, and devices keep sending to the same gateway without being reconfigured. VRRP version 3 (RFC 5798) covers IPv4 and IPv6. With default timers, failover typically takes about three seconds, and shorter advertisement intervals can bring that down where the switches support them.

Pair VRRP with a ring or redundant links underneath it, so a cable failure is handled at Layer 2 in milliseconds and a switch failure at Layer 3 in seconds. Our FAQ on network redundancy covers the layers together.

Both a Layer 3 switch and a router forward IP, so the distinction is one of role rather than capability. A Layer 3 switch routes in hardware, at high throughput and high port density, and is built for fast routing inside a site, a vehicle or a machine. It usually has no WAN interfaces, no VPN and only access control lists for filtering. A router may route in software at lower throughput, but it connects networks to the outside world, with WAN and cellular links, NAT, VPNs, firewalling and a wider protocol set, and far fewer ports. Our FAQ on what a router does covers its side.

Can a Layer 3 switch replace a router?

Inside the LAN, yes: a Layer 3 switch can take over all routing between VLANs and subnets. At the edge of the site, usually not. A few industrial Layer 3 switches add NAT, but VPN tunnels, stateful firewalling and WAN or cellular interfaces stay with a router or firewall. The usual pattern is a Layer 3 switch for fast routing on site and a router or firewall at the boundary to everything beyond it.

Is a Layer 3 switch faster than a router?

For traffic between local subnets, typically yes, because the switch routes in hardware at close to wire speed on every port. Routers built for WAN work trade raw throughput for features such as encryption and deep inspection. For traffic to the internet or a remote site, the WAN link is usually the limit, not the device.

Once a network is segmented into several VLANs or subnets, with control on one, video on another and business traffic on a third, something has to route between them. Doing that on a Layer 3 switch at the edge, rather than hauling every cross-subnet packet back to a central router and out again, cuts latency, removes a single point of failure and keeps the local network routing even if the uplink drops. In distributed industrial, vehicle and defence networks, where segments are many and the link back to a central site is neither fast nor guaranteed, local Layer 3 routing is often what keeps the system deterministic and resilient.

Security frameworks point the same way. IEC 62443 organises an OT network into zones and the conduits between them, and routing with access control lists at each zone boundary is a practical way to enforce that design inside the plant. A Layer 3 switch can do it at full speed for internal traffic, with a firewall still guarding the conduits to the business network and the internet.

Determinism adds a further layer on top. Our guides to Time-Sensitive Networking and IEEE-1588 PTP explain how some Layer 3 switches also schedule traffic and share a precise clock, and what Precision Time Protocol is gives the short version.

The table compares Layer 3 switches across our industrial, rack, board-level and rugged ranges. Facts come from each product’s own page.

Antaira designs and builds its switches, and we supply and specify them, pre-configuring IP addressing, VLANs, routing and ring settings where you ask. Diamond Systems builds its switch boards, modules and rugged switches in full, and we supply them; our guide to embedded Ethernet switch modules explains the board-level route. Browse our managed industrial switches, rack mount industrial switches, embedded Ethernet switches and rugged Ethernet switches, or the wider industrial Ethernet switches range. For fibre uplinks, our FAQ on SFP covers the modules.