Core: Layer 2 Control Plane

Layer 2 multipath and switch clustering

Miro Kosut

Miro Kosut

— 4 min read
Share

Requirement / business driver

Use all redundant links (not STP-blocked ones) and remove single points of failure, without creating loops.

Options

  • LACP / EtherChannel - bundle parallel links between two devices into one logical link.
  • MLAG / vPC - two switches present a single LAG to a dual-homed device; both forward (dual-active) with independent control planes joined by a peer-link/keepalive.
  • VSS / StackWise-Virtual - two chassis act as one logical switch (single control plane).
  • VXLAN + EVPN fabric - a routed (L3) underlay with an overlay; ECMP everywhere, no L2 loops to block (see Overlays and BGP EVPN).

Comparison

l2-multipath-matrix

Tradeoffs

The crucial distinction is control-plane fate: VSS/StackWise is simplest to operate but a shared control plane shares fate (a software bug or upgrade can take both halves); MLAG/vPC keeps per-switch control planes (more resilient, more config); a VXLAN/EVPN fabric scales furthest (CLOS) at higher operational complexity.

At L3 the same parallel links can be a bundle (one logical interface), ECMP (n routed links), or a single higher-speed link - and the choice is really about what the routing protocol can see. A bundle collapses n links into one adjacency (less peering, less control-plane overhead), but a member failure is invisible to the IGP: the bundle stays up at reduced capacity, EIGRP does not re-cost it and OSPF re-costing is platform-dependent, so traffic can overload the survivors with no reroute ever triggered. LACP min-links is the guardrail - below a member floor the whole bundle is declared down, forcing the protocol to converge to an alternate (Fast convergence techniques). ECMP gives the IGP full per-link visibility at the cost of n adjacencies; a single fat link gives visibility and removes the bundle's other ceiling - no single flow can exceed one member's speed, because hashing pins each flow to one member (Load balancing and hashing - ECMP and entropy). Keep bundle member counts at powers of two or the hash distributes unevenly. Bundles still earn their place removing link/port single points of failure where a speed upgrade is not available.

The clustering pole keeps evolving, in a telling direction. The FHRP-based design, standards-based EVPN ESI multi-homing (mLAG without a proprietary cluster), and the single-logical-switch cluster form a ladder of how much you centralise - and the newest rung rebuilds clustering itself on standard, routable machinery: next-generation stacking (Smart Stacking / NG-SVL class) replaces proprietary backplane protocols with an IS-IS SPF control plane and VXLAN-GPE encapsulation over ordinary Ethernet links, front-panel or dedicated, so stack links become normal ports, membership becomes dynamic, and SSO/upgrade convergence improves. The design lesson: even the cluster is becoming a small routed fabric - which softens the classic shared-fate objection over time, but does not remove today's rule of judging control-plane fate first.

Recommendation / justification

  • Two devices, parallel links -> LACP.
  • Dual-homed access without STP blocking, resilience matters -> MLAG/vPC.
  • Collapse a distribution pair into one logical node for simplicity -> VSS/StackWise (accept shared fate).
  • DC/campus at scale -> VXLAN/EVPN fabric.

    Justify by scale and how much control-plane independence the failure domain needs. Keep STP on underneath as a backstop (Spanning Tree - types, tuning, and loop mitigation).

What would change this (mid-scenario twist)

  • High-availability mandate, can't tolerate shared-fate -> MLAG over VSS.
  • Growth beyond a pair / multi-tenant -> VXLAN/EVPN fabric.

Validation checks

  • Does the design avoid shared control-plane fate where the SLA forbids it?
  • Are orphan ports / single-homed devices in MLAG handled, and the peer-link sized?

IPv6 / dual-stack note

All of these forward v4/v6 transparently; a VXLAN/EVPN underlay can itself be v6.

Spaced repetition

The key resilience difference between MLAG/vPC and VSS/StackWise-Virtual is [...].

The key resilience difference between MLAG/vPC and VSS/StackWise-Virtual is MLAG keeps independent per-switch control planes; VSS/Stack share one control plane (and therefore share fate).

The option that removes L2 loops entirely by using a routed underlay with ECMP is [...].

The option that removes L2 loops entirely by using a routed underlay with ECMP is a VXLAN + EVPN fabric.

Even when multipath/fabric carries traffic, STP should remain [...].

Even when multipath/fabric carries traffic, STP should remain enabled as a safety net.

Why can an EtherChannel member failure overload a network that ECMP would have saved?

The bundle stays up as one logical interface, so the IGP never sees the capacity loss (EIGRP will not re-cost it) and keeps sending the full load; LACP min-links fails the whole bundle below a member floor, forcing an actual reroute.

Next-gen stacking (Smart Stacking class) rebuilds device clustering on [...] - the cluster itself becomes a small routed fabric.

Next-gen stacking (Smart Stacking class) rebuilds device clustering on an IS-IS SPF control plane with VXLAN-GPE over standard Ethernet links - the cluster itself becomes a small routed fabric.

Sources

  • Cisco Live BRKENS-2500 (S. Wargo, J. Matela), Advanced Campus Network Design (2026 deck, user-supplied PDF; all 197 pages passed 2026-07-26) - Smart Stacking / NG-SVL architecture and the FHRP/ESI-mLAG/cluster ladder.
  • Cisco Live BRKCRS-2031 (Cisco Plus Canada 2012): Multilayer Campus Architectures and Design Principles - EtherChannel vs ECMP routing visibility, min-links, per-flow member ceiling
  • Cisco Press, Cisco LAN Switching; Building Data Centers with VXLAN BGP EVPN.

domain: Core · blueprint-ref: Core 2.2.c/2.2.d Multipath and switch clustering · type: design-decision · status: complete · tags: [core, core/l2, tradeoff/scale, tradeoff/convergence]

Read more