Router, Layer 3 Switch, Firewall, AP, WLC: Which Device Does What

A router moves packets between networks and supports WAN media plus the deep feature set that goes with an edge: address translation, tunnels, and broad QoS. A Layer 3 switch does the same routing job in switching silicon at far higher aggregate speed, but only over Ethernet ports, which makes it the campus distribution device. Firewalls enforce policy between security zones, intrusion sensors inspect for attack signatures, access points provide the radio, and wireless LAN controllers centrally manage those access points. Selection questions are answered by matching the stated requirement to the one device whose defining job it is.

Router and Layer 3 switch

Both build a routing table, run routing protocols, and forward packets based on a longest-prefix lookup. The difference is where the lookup happens and what physical interfaces exist to plug into.

A Layer 3 switch (also called a multilayer switch) performs the lookup in ASICs, so forwarding rate scales with the switching fabric rather than with CPU. It provides dozens of Ethernet ports at 1, 10, 25, or 40 Gb/s, populated with whichever pluggable transceivers the runs require. Routing is enabled with ip routing, and traffic moves between VLANs through switched virtual interfaces or through physical ports converted with no switchport.

A general-purpose router has a handful of interfaces, but those interfaces can be serial, DSL, cellular, or fiber WAN handoffs, and the software supports the features an edge needs.

	Router	Layer 3 switch
Forwarding	Software or CPU-assisted, throughput limited by the processor	ASIC hardware, line rate across many ports
Interface types	Ethernet plus serial, cellular, DSL, and other WAN media	Ethernet only
Port density	Low, typically a few interfaces	High, 24 to 48 ports plus uplinks
Feature depth	Full NAT, IPsec VPN, extensive QoS shaping and policing, PPP, MPLS CE	Routing, ACLs, marking and queuing; NAT and VPN limited or absent
Layer 2 services	Minimal	VLANs, STP, EtherChannel, port security, PoE
Typical placement	WAN edge, Internet edge, branch	Campus distribution and core, data center
Cost per gigabit	High	Low

The rule the exam applies: if the requirement mentions WAN circuits, address translation, or encryption, it is a router. If the requirement is high-volume traffic between many VLANs inside one building with nothing but Ethernet involved, it is a Layer 3 switch. Routing between VLANs on a router using 802.1Q subinterfaces still works, but funneling many VLANs through one or two physical links creates a bottleneck the switch does not have. See inter-VLAN routing for both configurations side by side.

Firewalls

A stateful firewall records each permitted session in a connection table and uses that table to allow the return traffic automatically. Outbound TCP 443 from a workstation opens an entry; the server’s replies match it and pass without a separate inbound rule. Policy is written in terms of source, destination, port, and zone. Address translation is a normal part of the job.

A next-generation firewall keeps every one of those behaviors and adds inspection above Layer 4:

• Application visibility and control. The firewall identifies the actual application from traffic characteristics, so a policy can permit one application and deny another even though both ride TCP 443. Port numbers stop being the classification method.
• Integrated intrusion prevention. A signature engine examines the payload and drops traffic matching a known exploit, without a separate appliance.
• URL filtering and reputation, user identity awareness tied to a directory rather than to IP addresses, TLS decryption, and advanced malware protection with file sandboxing.

What is not a next-generation addition: stateful connection tracking (that is the older generation’s defining feature), NAT (routers and stateful firewalls have done it for decades), and MAC address learning (a Layer 2 switch function unrelated to firewalls at any generation).

Intrusion detection and intrusion prevention

The functional difference is placement in the traffic path, and everything else follows from it.

An intrusion detection system (IDS) is passive. It receives a copy of traffic, either from a SPAN (Switched Port Analyzer) session that mirrors a port or VLAN, or from a physical network tap. The original packet has already been forwarded by the time the sensor examines the copy, so an IDS can raise an alert and can ask another device to block subsequent traffic, but it can never stop the packet that triggered the match.

An intrusion prevention system (IPS) is inline. Traffic must transit the sensor to reach the destination, so a signature match can result in the packet being dropped before the target ever sees it. That is the only deployment that satisfies a requirement worded as “discard before it reaches the server.”

The trade-offs are real in both directions. Inline placement adds latency and puts the sensor in the failure path, and a false positive drops legitimate production traffic. Passive placement is risk-free to availability but purely observational. A syslog collector is neither: it records events other devices report and performs no inspection at all.

Access points and wireless LAN controllers

An access point (AP) provides the 802.11 radio and bridges wireless clients onto the wired VLAN. Two operating models exist.

An autonomous AP holds its entire configuration locally. Every SSID, security policy, and radio setting is entered on that AP. Ten sites with two APs each means twenty devices configured and updated individually.

A lightweight AP holds almost nothing locally. It registers to a wireless LAN controller (WLC) and builds a CAPWAP (Control and Provisioning of Wireless Access Points) tunnel to it, using UDP 5246 for control traffic, which is DTLS-encrypted, and UDP 5247 for data. Responsibilities are split: the AP handles the real-time radio work such as beacons, acknowledgements, and encryption, while the controller handles WLAN configuration, client authentication and policy, roaming coordination, and radio resource management.

The design consequence that selection questions hinge on: CAPWAP is carried inside IP, so it is routable. The controller does not have to be in the same building, the same site, or the same city as the APs. One controller in a data center can serve APs across dozens of branch sites, which is exactly why centrally managed wireless does not require a controller at every location. Placing a controller at each small site is not wrong, it is simply more equipment than the requirement demands. The controller’s own connections are worth knowing by name, and they are laid out in WLC ports and interfaces.

Power matters too. APs, IP phones, badge readers, and cameras draw power over the Ethernet cable from a PoE-capable switch. Counting powered endpoints sets the switch requirement. Individual power injectors exist for one-off devices, but specifying dozens of injectors instead of PoE switch ports adds hardware rather than removing it.

Endpoint controls and infrastructure controls

Security controls sort into two buckets, and the dividing test is where the control runs.

An endpoint control executes on the host it protects and sees that host’s own processes, files, and sockets. Antimalware with endpoint detection and response installed on each laptop and server is an endpoint control. The personal firewall built into a workstation operating system, filtering inbound connections to that one machine from inside the machine, is an endpoint control. The practical test: it keeps working when the laptop leaves the corporate network entirely.

An infrastructure control runs on network equipment and protects hosts it is not installed on. A next-generation firewall at the Internet edge, an IPS sensor in the path to the server farm, and an ACL on a distribution switch are all infrastructure controls.

The item people misclassify is 802.1X. The host runs a supplicant, so software is involved on the endpoint, but the access switch is the authenticator and the switch decides whether to open the port. The enforcement point is the network device, which makes 802.1X an infrastructure control.

How the 200-301 exam tests this

• Requirement to device. A stem lists many VLANs, heavy east-west traffic, 10 Gb/s ports, and explicitly states there is no WAN circuit and no translation needed. The Layer 3 switch is correct. The distractor is a router with a claim that only routers can move traffic between VLANs, which is false. Another distractor puts a firewall in as the default gateway for internal traffic nobody asked to inspect.
• Firewall generation. Multi-select items ask what a next-generation firewall adds over a stateful one. Application identification independent of port and integrated payload-level intrusion prevention are the additions. Stateful return-traffic handling, NAT, and MAC learning are the traps.
• Sensor placement. The stem contains the phrase “before it reaches” or “must be discarded, not merely reported.” That wording eliminates every SPAN-fed or tap-fed option and selects the inline IPS.
• Minimum bill of materials. A site is described with a count of powered ports, a number of APs to be managed alongside APs at other sites, an uplink type, and a policy requirement. Build the answer piece by piece: powered ports means PoE switches, central management across sites means lightweight APs with the controller upstream rather than local, application-based policy means a next-generation firewall. The wrong options usually add an unnecessary local controller or downgrade the firewall to a stateful packet filter.
• Control classification. Given a mixed list, sort by where the control executes. Host software is endpoint; anything enforced by a switch, router, firewall, or sensor is infrastructure.

Requirement-to-device items reward a checklist read, and the checklist gets faster with repetition — build it against exam-style questions.

Quick reference

• Layer 3 switch: hardware routing, high Ethernet port density, campus distribution and core, no WAN media.
• Router: WAN interfaces, NAT, IPsec, deep QoS, low port count, edge placement.
• Stateful firewall: connection table permits return traffic for allowed sessions.
• NGFW adds application identification independent of port, integrated IPS, URL filtering, user identity, and TLS decryption.
• IDS is passive via SPAN or a tap and can only alert; IPS is inline and can drop the offending packet.
• Autonomous APs are configured individually; lightweight APs register to a WLC over CAPWAP (UDP 5246 control, UDP 5247 data).
• CAPWAP is routable, so one central controller can manage APs at many remote sites.
• PoE switches power APs, phones, cameras, and badge readers; injectors are a per-device exception, not a design.
• Endpoint controls run on the host and travel with it; infrastructure controls, including switch-enforced 802.1X, run on network equipment.