Network Architectures: Two-Tier, Three-Tier, and Spine-Leaf

The three-tier campus design separates access, distribution, and core into distinct layers so that each one can be optimized for a single job. A two-tier collapsed core merges the distribution and core roles into one pair of switches for sites too small to justify a dedicated core. Spine-leaf is a data center fabric in which every leaf switch connects to every spine switch, no leaf connects to another leaf, and no spine connects to another spine, which makes the hop count between any two racks identical. All three designs are tested by recall rather than calculation, and they belong to the domain that opens the blueprint with a twenty percent share.

Three-tier campus layers

Access layer. This is where end devices attach: workstations, IP phones, wireless access points, printers, and cameras. Access switches supply Power over Ethernet, assign ports to VLANs, and enforce edge features such as port security and BPDU guard. They do not aggregate anything and they do not carry transit traffic for other buildings.

Distribution layer. Distribution switches aggregate the uplinks from a group of access switches and act as the policy boundary. Route summarization happens here, so the core learns a small number of prefixes instead of every access VLAN. Filtering, quality of service classification, and the Layer 3 boundary for user VLANs belong here as well, which is normally a multilayer switch rather than a router, a distinction drawn out in Layer 3 switch versus router. An access block plus its distribution pair is treated as one repeatable unit, the distribution block, and the pair shares one default gateway address for each user VLAN through a first-hop redundancy protocol.

Core layer. The core exists to move traffic between distribution blocks at the highest speed and lowest latency available, with as little packet manipulation as possible. Design guidance follows from that single purpose: keep CPU-intensive features such as extensive access lists off the core, and build redundant high-bandwidth paths so that losing one core device does not split the campus in half. The core does not terminate user access ports and does not act as the default gateway for user VLANs.

Core layer scaling

A collapsed core combines distribution and core functions in one pair of switches, and access switches uplink directly to that pair. For a single building with a handful of wiring closets this is the right answer: it removes an entire layer of hardware and its cost, and no traffic pattern in the building needs a dedicated transport tier.

The argument for adding a core is link arithmetic. Once a campus has several distribution blocks, connecting them directly to one another means a mesh, and a mesh of N blocks needs N(N-1)/2 interconnections. Four blocks need six, eight blocks need twenty-eight, and every new block forces new cabling into every existing block. A core layer gives each distribution block exactly one high-speed aggregation point to attach to, so growth adds a fixed number of links per block and the existing blocks are untouched. Adding a core does not enable Layer 3 routing on distribution switches (they already do it), does not let a VLAN span more switches, and does not remove the need for a routing protocol between buildings.

SOHO

At the far small end, a SOHO (small office/home office) network collapses routing, switching, wireless, and firewall filtering into one integrated device, usually supplied by the Internet service provider. A single box with four Ethernet ports, a wireless radio, and basic filtering is not a miniature three-tier campus and not a collapsed core; the defining trait is that every network function lives inside one device.

Spine-leaf

Data center traffic changed shape. In a campus, most flows are north-south: a client talks to something outside the building. In a data center, application tiers talk to each other, so most flows are east-west between servers in different racks. A hierarchy tuned for north-south handles that badly, because two servers three racks apart may traverse access, distribution, core, distribution, and access, and the hop count depends on which racks are involved.

Spine-leaf is built for the east-west case, with strict cabling rules:

• Every leaf switch connects to every spine switch.
• Leaf switches never connect to each other.
• Spine switches never connect to each other.
• Servers connect only to leaves, never to spines.

Two consequences follow. First, every flow between two different leaves crosses exactly two hops, leaf to spine to leaf, so latency between any pair of racks is the same and is predictable regardless of which racks are involved. Second, because all uplinks are Layer 3 links carrying equal-cost paths, every leaf uplink forwards traffic simultaneously. In a Layer 2 campus access block, Spanning Tree Protocol keeps redundant uplinks in a blocking state and the redundant bandwidth sits idle until a failure. The fabric runs a routing protocol between leaves and spines, so equal-cost multipath, not spanning tree, decides what forwards. That routed fabric is the underlay, and tenant segments ride above it in tunnels, a split described in underlay versus overlay.

Growth follows the cabling rules. Adding racks means adding leaf switches. Adding bandwidth between racks means adding a spine switch and one more uplink from every leaf, which is done in the aggregation layer and does not touch installed server cabling. Adding leaves without adding spines is the mistake: each new rack contends for the same fixed uplink capacity, so the oversubscription ratio gets steadily worse as the fabric grows.

Characteristic	Three-tier campus	Spine-leaf fabric
Traffic it is tuned for	North-south, out of the access layer toward the core	East-west, server to server across leaves
Hop count between two edge ports	Varies with where the endpoints sit	Always two switch hops between different leaves
Redundant path usage	Spanning tree blocks redundant Layer 2 uplinks	Equal-cost paths, all leaf uplinks forwarding
Layers	Access, distribution, core	Leaf and spine only
Adding capacity	Add a distribution block, then uplinks to the core	Add a spine and one uplink per leaf
Broadcast handling	VLANs per access block	Routed between leaves; a leaf does not share one broadcast domain with all others

WAN topologies

Point-to-point. One circuit joining two sites. Simple, predictable, and expensive to replicate as site count grows.

Hub and spoke. Every branch has a single circuit to a central site. A branch talking to another branch sends its traffic to the hub, which routes it back out to the destination branch, so every branch-to-branch flow crosses the hub twice and consumes hub bandwidth in both directions. The topology is cheap and easy to manage, and the hub is a single point of failure for everything.

Full mesh. Every site holds a direct circuit to every other site. Link count is n(n-1)/2, so eight sites need 8 times 7 divided by 2, which is 28 circuits. Adding a ninth site adds eight more circuits, which is why full mesh rarely survives past a small number of sites.

Partial mesh. Direct circuits between the site pairs that actually exchange significant traffic, with the rest reached through a hub. This is the practical compromise between hub-and-spoke latency and full-mesh cost.

How the 200-301 exam tests this

• Definition matching. A stem defines one topology and offers four descriptions. Collapsed core means distribution and core merged into one pair with access switches attached to it, and the wrong answers usually describe a flat mesh or invert the roles of distribution and core.
• Layer responsibility. You are asked which function belongs to a named layer. Aggregation, summarization, and policy go to distribution; high-speed low-touch transport and redundancy go to the core; user ports and PoE go to access.
• Constraint-driven design. A scenario supplies numbers: percentage of east-west traffic, a requirement for equal latency between any two racks, growth from a small rack count to a large one, and a fixed oversubscription ratio. Spine-leaf satisfies all four only if the growth plan adds spines along with leaves.
• Cabling rules as a true or false test. Statements claiming leaf-to-leaf links, spine-to-spine links, or a single spine per leaf are all wrong by definition.
• Link arithmetic. A full-mesh WAN question gives a site count and asks for circuits. Apply n(n-1)/2 and watch for n(n-1) among the choices.

Recall topics like this one are the cheapest points on the exam, and a pass through 200-301 practice questions confirms the definitions are locked in.

Quick reference

• Access provides user ports and PoE; distribution aggregates and applies policy; core transports between blocks at speed.
• Two-tier collapsed core merges distribution and core into one pair of switches.
• A dedicated core is added so that interconnections do not grow combinatorially as distribution blocks are added.
• SOHO means routing, switching, wireless, and firewalling inside one device.
• Spine-leaf: every leaf to every spine, no leaf-to-leaf, no spine-to-spine, servers on leaves only.
• Any leaf-to-leaf flow is exactly two switch hops, giving predictable rack-to-rack latency.
• Spine-leaf uses equal-cost routed paths, so every uplink forwards; campus Layer 2 blocks redundant uplinks with spanning tree.
• Scale a fabric by adding spines plus one uplink per leaf; adding leaves alone worsens oversubscription.
• Hub-and-spoke sends branch-to-branch traffic through the hub twice.
• Full mesh needs n(n-1)/2 circuits: 8 sites require 28.