Layer 2 design fundamentals
In one line
A Layer 2 domain is a single broadcast and failure domain that floods to learn - so the master rule is keep it small and push routing toward the edge.
How L2 behaves
Switches flood-and-learn: unknown unicast/broadcast/multicast floods to every port in the VLAN, source MACs populate the MAC table. Everything in the domain shares fate - a broadcast storm, a loop, or a misbehaving host hits the whole VLAN. There is no TTL at L2, so a loop is catastrophic (see Spanning Tree - types, tuning, and loop mitigation).
The core design tension
Large stretched L2 is operationally seductive (mobility, "just put it in the same VLAN") but enlarges the failure domain and leans on STP. The modern answer is routed access / "L3 to the edge" or a routed underlay with an overlay (Overlays and BGP EVPN): keep L2 segments small, route between them, and let ECMP - not blocked links - provide redundancy.
Classic STP-based access-distribution models
The classic campus L2 access-to-distribution designs trade uplink efficiency and convergence against the ability to span VLANs. All rely on STP (Spanning Tree - types, tuning, and loop mitigation) and FHRP timers, so tuning and aligning those timers is the standard mitigation; switch clustering (Layer 2 multipath and switch clustering) sidesteps the blocked-uplink problem entirely.
| Model | Main design concern | When to use |
|---|---|---|
| Looped Triangle | STP blocks an uplink - cannot use all uplinks (inefficient) | Single-homed endpoints, no high-bandwidth or fast-convergence need |
| Looped Square | Access traffic may cross the inter-switch link to the active FHRP; oversubscription spikes on a distribution failure | Non-critical single/dual-homed, no high-bandwidth need |
| Loop-Free U | Same VLAN cannot span beyond one access pair (else a loop forms) | High forwarding capacity, no VLAN-spanning requirement |
| Loop-Free Inverted U | Single point of failure if a distribution switch or the access-distribution uplink fails | Dual-homed endpoints (NIC teaming), or where low MTTR is not required |
VLAN scope and VTP
The "keep L2 small" rule has a campus-VLAN corollary: prefer local VLANs (confined to one access switch / wiring closet) over end-to-end VLANs (one VLAN following users across the whole campus). End-to-end VLANs enlarge the spanning-tree and broadcast domain and are a legacy pattern; local VLANs keep the failure domain at the closet and pair naturally with routed access (Network hierarchy and topologies). Beware VTP (VLAN Trunking Protocol): it auto-propagates the VLAN database across a domain for convenience, but a switch joined with a higher configuration-revision number (the classic returned-lab-switch accident) will overwrite and wipe the domain's VLAN database. The safe design is VTP transparent mode (each switch keeps its own VLANs) or VTPv3 (explicit primary-server control), so one mishandled switch can't erase campus-wide VLANs.
Asymmetric return and unicast flooding
Spanned VLANs plus redundant gateways (Layer 2 fault isolation and resiliency) create a quieter failure than a loop: unicast flooding. Upstream, every host sends to the one active FHRP gateway; downstream, the core sees two equal-cost paths and returns traffic through both distribution switches. The standby-side switch never hears frames from the host, so its MAC-table (CAM) entry ages out (default ~5 minutes) long before the upstream router's ARP entry does (~4 hours) - and a switch with no CAM entry floods that unicast out every port in the VLAN, continuously, for every affected flow. The same asymmetry applies to the IPv6 ND cache. The fix hierarchy mirrors the local-VLAN rule above: one data/voice VLAN per access switch confines any residual flooding to a single trunk; if VLANs must span, make CAM aging exceed the ARP/ND timeout (so the periodic refresh re-teaches the standby switch) or bias routing metrics to remove the equal-cost return path. This is also the design argument against daisy-chained access switches without a stack interconnect (Layer 2 multipath and switch clustering): return traffic has a coin-flip chance of arriving at the distribution switch with no L2 path to the host.
Where L2 still lives
Access edge (host adjacency, PoE, same-subnet services), small DCs, and within an EVPN fabric's edge segments. Bound each L2 domain and connect them at L3 (Network hierarchy and topologies).
IPv6 / dual-stack note
L2 carries v4 and v6 identically; large broadcast domains also enlarge the ND / RA scope - another reason to keep them small.
Related
Spaced repetition
Why is a Layer 2 loop catastrophic in a way a Layer 3 loop is not?
L2 frames have no TTL, so looped broadcast/unknown-unicast traffic multiplies without decrementing - a broadcast storm that melts the domain.
The single most important Layer 2 design rule is [...].
The single most important Layer 2 design rule is keep the broadcast/failure domain small and route toward the edge.
A Layer 2 domain is best understood as one [...].
A Layer 2 domain is best understood as one broadcast and failure domain (shared fate).
Name the four classic STP-based access-distribution models and their core trade.
Looped Triangle (STP blocks an uplink - inefficient), Looped Square (traffic crosses the inter-switch link to the active FHRP), Loop-Free U (a VLAN can't span beyond one access pair), Loop-Free Inverted U (SPOF on a distribution/uplink failure) - all depend on STP+FHRP timers; switch clustering avoids the blocked uplink.
Local vs end-to-end VLANs - which is preferred and why?
Local VLANs (confined to one access switch/closet) - they keep the STP/broadcast/failure domain small and suit routed access. End-to-end VLANs spanning the campus are a legacy pattern that enlarges the domain.
What is the VTP hazard and the safe design?
A switch added with a higher VTP configuration-revision number can overwrite and wipe the whole domain's VLAN database; use VTP transparent mode (or VTPv3 with explicit primary control) so one mishandled switch can't erase campus VLANs.
What causes chronic unicast flooding in a spanned-VLAN campus, and what are the fixes?
Asymmetric return - hosts send only to the active FHRP gateway but the core ECMPs returns through both distributions; the standby side's CAM entry ages out (~5 min) while ARP/ND lives (~4 h), so its downstream traffic floods the whole VLAN. Fix: VLAN per access switch, CAM aging > ARP timeout, or metric bias to remove the equal-cost return.
Sources
- Cisco Live BRKCRS-2031 (Cisco Plus Canada 2012): Multilayer Campus Architectures and Design Principles - asymmetric routing and unicast flooding, CAM vs ARP aging, VLAN-per-switch fix
- Cisco Press, Cisco LAN Switching; The Art of Network Architecture (failure domains).