Core Access Switch Configuration

Core switches act as the high-speed backbone, while access switches connect end devices and require proper VLAN, gateway, and ACL configuration for efficient network operation.

Core and Access Switch Roles

Core Switches form the backbone of the network, aggregating traffic from distribution or access switches and providing high-speed, low-latency connectivity. They typically handle inter-VLAN routing, DHCP relay, and act as the default gateway for VLANs in the network ( ). Access Switches connect end devices such as PCs, IP phones, and wireless access points. They operate primarily at Layer 2, forwarding traffic based on MAC addresses, and can support VLAN tagging, PoE, and high port density ( ).

VLAN and Gateway Configuration

• VLAN Tagging: On core switches, all ports connecting to access switches should be configured as trunk ports with all relevant VLANs tagged. This ensures that traffic from multiple VLANs can traverse the link to access switches ( ).
• Default Gateway: The core switch typically serves as the default gateway for all VLANs. Even if clients are connected to access switches, the logical core switch IP for each VLAN can be used as the gateway ( ).
• DHCP Relay: If DHCP servers are centralized, configure DHCP relay on the core switch to forward requests from access layer devices to the DHCP server ( ).

ACL and Security Placement

• Access Control Lists (ACLs): To isolate sensitive VLANs (e.g., management or building control VLANs), ACLs can be applied either on access switches or the core switch.
  • Access Switch ACLs: Packets are filtered as close to the source as possible, reducing unnecessary traffic on the network ( ).
  • Core Switch ACLs: Provides centralized control, but traffic between devices on the same access switch may bypass the ACL if not applied locally ( ).
• Best Practice: Apply ACLs on access switches for intra-VLAN isolation and on the core for inter-VLAN traffic control.

Additional Configuration Considerations

• Port Configuration: Access switch ports connecting to end devices are usually configured as access ports assigned to a specific VLAN. Uplink ports to the core are configured as trunks ( ).
• High Availability: In stacked core switch setups, VRRP or HSRP may not be required if the stack functions as a single logical unit, providing a single gateway per VLAN ( ).
• LLDP/CDP and Voice VLANs: Enable LLDP-MED or CDP on access switches to support IP phones and ensure voice VLAN traffic is properly tagged and prioritized ( ).

Summary

1. Configure trunk ports on core switches to carry all VLANs to access switches.
2. Assign default gateway IPs for each VLAN on the core switch.
3. Apply ACLs on access switches for local isolation and on the core for inter-VLAN control.
4. Configure access switch ports as access ports for end devices and trunks for uplinks.
5. Enable DHCP relay on the core if DHCP servers are centralized.
6. Use LLDP/CDP and configure voice VLANs if IP phones are deployed. This configuration ensures efficient traffic flow, proper VLAN segmentation, and secure access control across the network hierarchy ( ).