Access Layer Functionality
This section describes the access layer functions and the interaction of the access layer with the distribution layer and local or remote users.
The Role of the Access Layer
The access layer is the concentration point at which clients access the network. Access layer devices control traffic by localizing service requests to the access media.
The purpose of the access layer is to grant user access to network resources. Following are the access layer's characteristics:
■ In the campus environment, the access layer typically incorporates switched LAN devices with ports that provide connectivity for workstations and servers.
■ In the WAN environment, the access layer for teleworkers or remote sites provides access to the corporate network across some wide-area technology, such as Frame Relay, Multiprotocol Label Switching (MPLS), Integrated Services Digital Network, leased lines, Digital Subscriber Line (DSL) over traditional telephone copper lines, or coaxial cable.
■ So as not to compromise network integrity, access is granted only to authenticated users or devices (such as those with physical address or logical name authentication). For example, the devices at the access layer must detect whether a telecommuter who is dialing in is legitimate, yet they must require minimal authentication steps for the telecommuter.
Layer 2 and Multilayer Switching in the Access Layer
Access can be provided to end users as part of either a Layer 2 (L2) switching environment or a multilayer switching environment.
NOTE In this book, the term multilayer switching denotes a switch's generic capability to use information at different protocol layers as part of the switching process; the term Layer 3 switching is a synonym for multilayer switching in this context.
Cisco switches implement the use of protocol information from multiple layers in the switching process in two different ways. The first way is multilayer switching (MLS) and the second way is Cisco Express Forwarding (CEF). MLS and CEF are described further in Chapter 4, "Designing Basic Campus and Data Center Networks."
Using Layer 2 Switching in the Access Layer
Access to local workstations and servers can be provided using shared or switched media LANs; VLANs may be used to segment the switched LANs. Each LAN or VLAN is a single broadcast domain.
The access layer aggregates end-user switched 10/100 ports and provides Fast Ethernet, Fast EtherChannel, and Gigabit Ethernet uplinks to the distribution layer to satisfy connectivity requirements and reduce the size of the broadcast domains. You can deploy multiple VLANs, each with its own IP subnet and its own instance of Spanning Tree Protocol (STP) providing alternative paths in case of failure. In this case, Layer 2 trunking (typically using the Institute for Electrical and Electronic Engineers [IEEE] 802.1Q trunking protocol) is used between the access layer switches and the distribution layer switches, with per-VLAN STP on each uplink for load balancing and redundancy, and with a distribution layer multilayer switch providing the inter-VLAN communication for the access layer.
NOTE Chapter 4 discusses STP further.
KEY POINT
A recommended best practice is to implement one VLAN—thus supporting one IP subnet—per access switch and to connect the access switches to the distribution switches with Layer 3 links rather than with trunks.
NOTE In small networks, the access layer is often collapsed into the distribution layer; in other words, one device might handle all functions of the access and distribution layers.
KEY POINT
Using the Rapid Spanning Tree Protocol (RSTP) is a recommended best practice in the enterprise. RSTP is an evolution of the IEEE 802.1d STP standard and provides faster spanning-tree convergence after a topology change.
When RSTP cannot be implemented, Cisco IOS STP features such as UplinkFast, PortFast, and BackboneFast can be used to provide equivalent convergence improvements. These features are described as follows:
■ UplinkFast: Enables faster failover on an access layer switch on which dual uplinks connect to the distribution layer. The failover time is reduced by unblocking the blocked uplink port on a switch immediately after root port failure, thereby transitioning it to the forwarding state immediately, without transitioning the port through the listening and learning states.
■ BackboneFast: If a link fails on the way to the root switch but is not directly connected to the local switch, BackboneFast reduces the convergence time from 50 seconds to between 20 and 30 seconds.
■ PortFast: Enables switch ports connected to nonswitch devices (such as workstations) to immediately enter the spanning-tree forwarding state, thereby bypassing the listening and learning states, when they come up. Ports connected only to an end-user device do not have bridging loops, so it is safe to go directly to the forwarding state, significantly reducing the time it takes before the port is usable.
NOTE Chapter 4 discusses other STP features.
Using Multilayer Switching in the Access Layer
The most common design for remote users is to use multilayer switches or routers. A multilayer switch, or router, is the boundary for broadcast domains and is necessary for communicating between broadcast domains (including VLANs). Access routers provide access to remote office environments using various wide-area technologies combined with multilayer features, such as route propagation, packet filtering, authentication, security, Quality of Service (QoS), and so on. These technologies allow the network to be optimized to satisfy a particular user's needs. In a dialup connection environment, dial-on-demand routing (DDR) and static routing can be used to control costs.
Access Layer Example
Figure 3-3 illustrates a sample network in which the campus access layer aggregates end users and provides uplinks to the distribution layer. The access layer switches are dual-attached to the distribution layer switches for high availability.
Figure 3-3 Access Layer Connectivity in a Campus LAN
Figure 3-3 Access Layer Connectivity in a Campus LAN
-To Core
-To Core
The access layer can support convergence, high availability, security, QoS, and IP multicast. Some services found at the access layer include establishing a QoS trust boundary, broadcast suppression, and Internet Group Management Protocol (IGMP) snooping.
Continue reading here: Distribution Layer Functionality
Was this article helpful?