What do access, distribution, and core each do?

Access sets the conditions for endpoints to join the network ↑

Access connects devices such as PCs, phones, and APs—both endpoints and access equipment—to the network. To understand the role, start not with the uplink, but with the endpoint-facing port and the conditions applied there.

When PC-A connects to a business port on A1, that port's speed, VLAN, and access policies establish the starting conditions for communication. Wireless endpoints connect through an AP, so the AP's wired connection and power also belong in the access design. Changes in endpoint location and use change the resources access must provide.

In this example, PC-A and PC-C share VLAN10 on A1. If A1 can forward frames directly between the two endpoints, communication stays within that switch. An upstream device's existence does not mean every frame must first travel to distribution or core and back.

Designs can include access-layer routing. Treating access as synonymous with L2 equipment would make routed access impossible to explain. The tier name describes the position responsible for endpoint connectivity; L2 or L3 describes how it forwards traffic.

Check policy scope alongside endpoint placement. A business PC and a guest endpoint on the same physical switch need not have identical permissions. Decide which endpoints may reach which networks and services, then apply the policies to the relevant ports and wireless networks.

Troubleshooting also starts where the endpoint connects. If only one PC cannot communicate, compare that PC's link, address, VLAN, and access policy with a working endpoint. If several users connected to an AP lose connectivity together, inspect shared points such as AP power and its wired connection. Before examining the entire network, identify the access group where results differ.

Distribution links access segments and shared services ↑

Distribution aggregates access segments and connects them to other segments and services. Look at which access segments are brought together and where they lead; this explains distribution more clearly than traffic volume alone.

Suppose access switches A1, A2, and A3 in one building connect to D1 and D2. D1 and D2 aggregate traffic from those switches and forward it toward servers or other blocks. This aggregation segment needs a combined review of uplink capacity, addressing, and maintenance scope for its access switches.

In a traditional L2 access design, a business VLAN's gateway can sit at distribution. A packet from PC-A to App-S in another subnet reaches that gateway, where routing takes place. This example places the gateway at distribution, but another design could place it at access.

Moving the gateway to access gives distribution a different job: aggregating upstream routing. The same role names can therefore have different points for frame decapsulation, routing, and policy enforcement. Alongside tier names, mark the gateway, VLAN boundaries, and routed connections separately.

Nor must all policies reside on distribution devices. User admission conditions can sit at access, while service protection sits at a separate service boundary. If several policies apply to the same packet, record each location's purpose and permitted traffic to identify unintended duplicate blocking.

Because multiple access segments depend on the same distribution devices, assess the impact of both device failures and configuration changes. Check how much demand moves to D2 during D1 maintenance and how far a particular VLAN extends. Bringing access segments together tidies the wiring, but also concentrates traffic and spreads a device failure's impact across more access segments.

Core forwards traffic between distribution blocks ↑

Core connects distribution blocks. It is not a mandatory set of separate devices at every site, but a role separated out when forwarding between blocks needs independent treatment.

Suppose block A contains D1, D2, and their access segments, while block B contains D3, D4, and other access segments. PC-A in A needs a path to App-B in B. With C1 and C2 as a shared forwarding tier between them, each block can connect to the core instead of connecting individually to every other block.

This structure lets you maintain endpoint access within a block separately from transport between blocks. But the new core can fail too. Several blocks share its core devices, links, and power. Decide which failures of core equipment, links, or power the design must withstand while maintaining communication.

Configure the core to focus on forwarding between distribution blocks. Before adding inspection or service functions, assess their resource use and whether a failure or configuration change would affect overall forwarding. Moving functions that each block could handle into the core can increase shared failure impact.

Directly connecting two small blocks may meet the requirements. Do not make a core mandatory just because there are several buildings. Compare connection counts, fiber paths, capacity, maintenance scope, and operational complexity. If you choose a separate core, record the function separated out and the equipment and paths the blocks now share.

Place access, distribution, and core roles alongside the actual equipment. This shows why device counts and logical role counts can differ.

Compare paths within a VLAN, to another VLAN, and to another block ↑

The tiers a communication path crosses depend on the source, destination, and chosen boundaries. Comparing the three paths below shows that not every packet passes through access, distribution, and core in sequence.

First is PC-A to PC-C. If both endpoints share VLAN10 on A1 and frames can be forwarded directly, the round trip stays within access. If the destination is on another access switch, traffic in that same VLAN may use an upstream path over which the VLAN extends. Being in the same VLAN does not by itself determine path length.

Second is PC-A to App-S at 10.60.20.10. Here, the VLAN10 and 20 gateways sit on D1, so traffic goes from A1 through D1 to the server segment. D1 uses forwarding information for the destination IP and puts the next hop's MAC address in the destination address field of the Ethernet header. There is no need to reach the core.

Third is App-B at 10.70.20.10 in another block. The path runs from A1 through D1, the core, and block B's distribution. The return direction also needs App-B's gateway and a route to PC-A's subnet. Reaching the server is not enough: communication fails if the response has no return path.

Sharing a subnet does not mean communication stays within one switch. Check how far the VLAN extends across switches and where the frame's destination sits. Distinguishing the address relationship from the physical devices traversed turns diagram lines into understandable forwarding paths.

Label which paths use L2 forwarding and where IP routing takes place. A switch checking ACL or QoS rules against IP fields is not doing the same thing as selecting the next network using the destination IP. Record both the header fields read and the decision made to distinguish switching from routing.

Putting all three destinations on one topology shows where each communication path ends. PC-C is reached within A1, App-S through D1 within the same block, and only App-B's path crosses the core.

Compare PC-A's paths to PC-C in the same VLAN, App-S in the same block, and App-B in another block. Follow which tiers each destination requires.

Read diagrams where roles and device counts differ ↑

One device can serve multiple roles, and multiple devices can share one role. A design must explain both possibilities to keep tier counts distinct from device counts.

If a small site needs no dedicated distribution because access equipment can provide its LAN, it can use a single-tier design. A design that aggregates several access segments without a separate core is two-tier: it combines distribution with central forwarding. This combination is commonly called a collapsed core.

Conversely, a separate core role can use both C1 and C2 to provide alternate paths. Two devices do not create two core tiers. Their control relationship and independent power and cabling are redundancy conditions to check separately from tier count.

Show access, aggregation, and inter-block forwarding on the logical diagram; show equipment, ports, fiber paths, and power on the physical diagram. Using the same device identifiers in both reveals roles drawn separately that actually share one device or power circuit.

If one device name appears in several roles, it may mean the device provides those functions together. The diagram is not necessarily wrong, but it must show which functions stop together if that device fails.

Next, the integrated small-office design examines what to check when these roles share one device. The same names then reappear in an example with separate switches and APs. Distinguishing roles first lets us explain which functions moved and which stayed in place as device counts changed.