Chuyển mạch (Switching)Switching

Part of the Network Engineer Roadmap knowledge base.

Overview

Switching is the set of Layer 2 (Data Link) mechanisms that move Ethernet frames between hosts on the same local network as fast and as intelligently as possible. If routing (see ./07-routing.md) is about getting packets between networks based on IP addresses, switching is about getting frames within a network based on MAC addresses. It is the workhorse of every LAN, data center, and campus network — the layer where the vast majority of packets actually spend their time.

A modern switch does far more than blindly copy bits. It learns where every host lives (MAC address table), forwards frames only to the port that needs them (unicast filtering), carves one physical box into many isolated logical networks (VLANs), prevents self-inflicted meltdowns from cabling loops (Spanning Tree Protocol), bundles multiple physical links into one logical pipe for bandwidth and redundancy (EtherChannel/LACP), and — in the data center — stretches Layer 2 segments across a routed fabric so that virtual machines can move anywhere (VXLAN).

This note builds those ideas from the ground up with real Cisco IOS configuration you can type into a lab. The topics interlock:

• Physical devices and where switches sit in the taxonomy: ./04-network-devices.md
• Routing and inter-VLAN routing on Layer 3: ./07-routing.md
• Redundancy, first-hop redundancy (HSRP/VRRP), and HA: ./09-redundancy-and-high-availability.md
• Cloud and data-center overlays (VXLAN in depth): ./16-cloud-networking.md

Fundamentals

What Layer 2 switching actually does

An Ethernet switch is a multi-port bridge. Each port is its own collision domain (with full-duplex, collisions effectively disappear), and by default all ports share one broadcast domain — until you split them with VLANs. A switch makes forwarding decisions based on the 48-bit MAC (Media Access Control) address in the Ethernet frame header, never looking at the IP payload inside.

A MAC address is written as six hex octets, e.g. 00:1A:2B:3C:4D:5E. The first three octets are the OUI (Organizationally Unique Identifier) assigned to the vendor; the last three are assigned by the vendor to the individual NIC. The broadcast MAC is FF:FF:FF:FF:FF:FF.

Why switches replaced hubs

A hub is a Layer 1 repeater: it copies every incoming bit out of every other port. That makes the whole hub one giant collision domain running half-duplex CSMA/CD. As you add hosts, collisions rise, effective throughput collapses, and every host sees every other host’s traffic (a security and privacy problem).

A switch fixes all of this:

Because a switched, full-duplex port to a single host has no contention, CSMA/CD becomes irrelevant and throughput is deterministic. Hubs are obsolete; you will never deploy one today.

The three forwarding actions: learn, forward/flood, filter

Every frame a switch receives triggers one core process and one forwarding decision.

1. Learning. The switch reads the frame’s source MAC and records {source MAC → ingress port → VLAN} in its MAC address table (also called the CAM table). This is how the switch discovers where each host lives. Learning happens on every frame.
2. Forwarding decision based on the destination MAC:
   • Forward (filter) — if the destination MAC is known and maps to a different port, send the frame out that one port only. If it maps to the same port the frame arrived on, filter (drop) it — the destination is already on that segment.
   • Flood — if the destination MAC is unknown (not yet in the table), or is a broadcast (FF:FF:...) or multicast, send the frame out all ports in that VLAN except the one it came in on. This is “unknown-unicast flooding.” The reply then teaches the switch, so subsequent frames are unicast.

This learn/flood/filter cycle is the entire essence of transparent bridging (IEEE 802.1D). It is “transparent” because hosts have no idea a switch exists.

Store-and-forward vs cut-through

• Store-and-forward: the switch buffers the entire frame, verifies the FCS (Frame Check Sequence) CRC, then forwards. Drops corrupt/runt frames. Slightly higher latency; the default and standard on modern switches.
• Cut-through: the switch reads only the destination MAC (first 6 bytes after preamble) and starts forwarding immediately. Lower latency but forwards errored frames. Used in low-latency data-center and HFT gear. Variants: fast-forward and fragment-free (waits for first 64 bytes to catch collision fragments).

Key Concepts

VLANs (Virtual LANs) — IEEE 802.1Q

A VLAN is a logical broadcast domain created in software on a switch. Ports assigned to VLAN 10 behave as if they were plugged into a separate physical switch from ports in VLAN 20 — broadcasts, unknown unicast, and multicast stay inside the VLAN. To move traffic between VLANs you must route (Layer 3).

Benefits: segmentation (limit broadcast blast radius), security (isolate departments/roles), flexibility (group users logically regardless of physical location), and QoS/voice separation.

Access ports vs trunk ports

• Access port: belongs to exactly one VLAN, connects to an end host (PC, printer, server, AP). Frames on an access port are untagged — the host is unaware of VLANs.
• Trunk port: carries traffic for many VLANs between switches (or switch↔router). Frames are tagged with a VLAN ID so the far end knows which VLAN each frame belongs to.

802.1Q tagging and the native VLAN

IEEE 802.1Q inserts a 4-byte tag into the Ethernet frame between the source MAC and the EtherType. The key field is the VID (VLAN ID), a 12-bit value (1–4094; 0 and 4095 reserved). The tag also carries a 3-bit PCP (Priority Code Point) for 802.1p CoS.

| Dest MAC | Src MAC | 802.1Q Tag (4 bytes) | EtherType | Payload | FCS |
                        ├─ TPID 0x8100 (16b)
                        ├─ PCP (3b) | DEI (1b) | VID (12b)

The native VLAN is the one VLAN whose frames traverse a trunk untagged (default VLAN 1). If a frame arrives on a trunk without a tag, it is assumed to belong to the native VLAN. The native VLAN must match on both ends of a trunk or you get a VLAN mismatch (CDP will warn you). Security best practice: change the native VLAN away from 1 to an unused VLAN and never put user traffic on it — this mitigates VLAN-hopping (double-tagging) attacks.

Creating VLANs and access ports:

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)#  name ENGINEERING
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)#  name SALES
Switch(config-vlan)# exit

! Assign access ports
Switch(config)# interface range gigabitEthernet 0/1 - 12
Switch(config-if-range)#  switchport mode access
Switch(config-if-range)#  switchport access vlan 10
Switch(config-if-range)# exit

Switch(config)# interface range gigabitEthernet 0/13 - 24
Switch(config-if-range)#  switchport mode access
Switch(config-if-range)#  switchport access vlan 20

Configuring an 802.1Q trunk:

Switch(config)# interface gigabitEthernet 0/48
Switch(config-if)#  switchport trunk encapsulation dot1q   ! needed only on switches that also support ISL
Switch(config-if)#  switchport mode trunk
Switch(config-if)#  switchport trunk native vlan 999       ! move native VLAN off 1
Switch(config-if)#  switchport trunk allowed vlan 10,20,999 ! prune everything else
Switch(config-if)# end

Switch# show interfaces trunk
Switch# show vlan brief

DTP note: Cisco’s Dynamic Trunking Protocol can auto-negotiate trunks (switchport mode dynamic auto|desirable). For security and predictability, hard-code the mode (access or trunk) and disable negotiation with switchport nonegotiate on trunks.

Inter-VLAN routing

VLANs are isolated at Layer 2, so a router or Layer 3 switch must move traffic between them.

Option A — Router-on-a-stick (ROAS). One physical router link runs as an 802.1Q trunk with a subinterface per VLAN, each acting as that VLAN’s default gateway.

Router(config)# interface gigabitEthernet 0/0
Router(config-if)#  no shutdown
Router(config-if)# exit
Router(config)# interface gigabitEthernet 0/0.10
Router(config-subif)#  encapsulation dot1q 10
Router(config-subif)#  ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit
Router(config)# interface gigabitEthernet 0/0.20
Router(config-subif)#  encapsulation dot1q 20
Router(config-subif)#  ip address 192.168.20.1 255.255.255.0

Simple and cheap, but the single link is a bandwidth bottleneck and single point of failure. Fine for small sites.

Option B — SVI on a Layer 3 (multilayer) switch. A Switched Virtual Interface (SVI) is a virtual routed interface for a VLAN, living inside the switch’s own routing engine — no external router, wire-speed routing in ASICs. This is the standard for campus/data-center distribution layers.

L3Switch(config)# ip routing                  ! enable Layer 3 forwarding
L3Switch(config)# interface vlan 10
L3Switch(config-if)#  ip address 192.168.10.1 255.255.255.0
L3Switch(config-if)#  no shutdown
L3Switch(config-if)# exit
L3Switch(config)# interface vlan 20
L3Switch(config-if)#  ip address 192.168.20.1 255.255.255.0
L3Switch(config-if)#  no shutdown

You can also turn a physical switch port into a pure routed (non-switched) port with no switchport and give it an IP directly — useful for switch-to-router or switch-to-switch L3 uplinks. See ./07-routing.md for how routing decisions are then made.

Voice VLAN

IP phones typically have a built-in 3-port switch: uplink to the network switch, a port to the PC, and the phone itself. The voice VLAN feature lets a single access port carry PC data (untagged, in the access/data VLAN) and phone traffic (tagged, in the voice VLAN) simultaneously, so voice gets its own broadcast domain and QoS.

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)#  switchport mode access
Switch(config-if)#  switchport access vlan 10      ! data VLAN for the PC
Switch(config-if)#  switchport voice vlan 110      ! tagged voice VLAN for the phone
Switch(config-if)#  mls qos trust cos              ! trust CoS marking from the phone

Spanning Tree Protocol (STP) — IEEE 802.1D / 802.1w

Redundant links between switches are essential for availability — but Ethernet has no TTL field. A single physical loop will circulate broadcast frames forever, each switch flooding them out every port, doubling the traffic on every pass. Within seconds a broadcast storm saturates every link, MAC tables thrash as the same source MAC appears on multiple ports, and the whole LAN melts down. STP exists to give you redundant physical topology while guaranteeing a loop-free logical topology.

STP (802.1D) builds a loop-free tree by electing one root bridge and then blocking every redundant path, leaving exactly one active path to the root from every switch.

Root bridge election and BPDUs

Switches exchange BPDUs (Bridge Protocol Data Units) — multicast frames to 01:80:C2:00:00:00 — to build the tree. Each switch has a Bridge ID (BID) = Bridge Priority (2 bytes, default 32768) + MAC address. In PVST+, the priority also embeds the VLAN ID (the “extended system ID”), so priority values increment in steps of 4096.

• The switch with the lowest BID becomes the root bridge. Ties break on lowest MAC. Because the default priority is identical everywhere, the oldest switch (lowest MAC) often wins by accident — always set the root manually.
• Every other switch computes its lowest-cost path to the root using cumulative path cost (per-link cost by speed).

Default IEEE 802.1D-2004 (long/short) path costs:

Port roles and states

Roles:

• Root Port (RP) — the one port on each non-root switch with the lowest cost toward the root. Forwards.
• Designated Port (DP) — the one forwarding port per segment (all ports on the root bridge are DPs). Forwards.
• Non-Designated / Blocking (Alternate/Backup in RSTP) — everything else. Blocks user data to break the loop; still listens to BPDUs.

States (classic 802.1D): Blocking → Listening → Learning → Forwarding, with a 20 s max-age and two 15 s forward-delay timers, so converging after a topology change takes ~30–50 seconds. That slowness is why RSTP exists.

RSTP (802.1w) and PVST+

• RSTP (802.1w) is the rapid version: it converges in well under a second on point-to-point links by using explicit proposal/agreement handshakes instead of timers. It renames states to Discarding / Learning / Forwarding and adds Alternate (backup root port) and Backup port roles. RSTP is backward-compatible with 802.1D. Always prefer it.
• PVST+ / Rapid-PVST+ are Cisco’s per-VLAN variants: one independent spanning-tree instance per VLAN, so you can load-balance by making different switches the root for different VLANs. Rapid-PVST+ (802.1w per VLAN) is the modern Cisco default of choice.
• MST (802.1s) maps many VLANs to a few instances, so you get per-VLAN flexibility without thousands of instances in large environments.

! Use the rapid, per-VLAN variant everywhere
Switch(config)# spanning-tree mode rapid-pvst

! Deterministically set the root for each VLAN (load-balancing)
Switch(config)# spanning-tree vlan 10 root primary       ! sets priority to 24576
Switch(config)# spanning-tree vlan 20 root secondary     ! sets priority to 28672
! (equivalent explicit form: spanning-tree vlan 10 priority 24576)

Switch# show spanning-tree vlan 10
Switch# show spanning-tree root

STP protections (edge hardening)

! Best practice: enable PortFast + BPDU Guard on all access ports at once
Switch(config)# spanning-tree portfast default
Switch(config)# spanning-tree portfast bpduguard default

! Per-port (host/edge port)
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)#  spanning-tree portfast
Switch(config-if)#  spanning-tree bpduguard enable

! Protect toward a downstream switch that must never be root
Switch(config)# interface gigabitEthernet 0/48
Switch(config-if)#  spanning-tree guard root

! Recover err-disabled ports automatically after 5 minutes
Switch(config)# errdisable recovery cause bpduguard
Switch(config)# errdisable recovery interval 300

MAC address table: aging, and security

The MAC (CAM) table is finite (thousands to hundreds of thousands of entries). Entries are removed after an aging timer (default 300 s / 5 minutes on Cisco) of no traffic from that MAC, so the table stays current as hosts move.

Switch# show mac address-table
Switch# show mac address-table dynamic vlan 10
Switch(config)# mac address-table aging-time 300
Switch(config)# mac address-table static 0000.1111.2222 vlan 10 interface gi0/5

MAC flooding attack and port security

A MAC flooding attack (e.g. via macof) sends a torrent of frames with random bogus source MACs. The CAM table fills up; when full, the switch can no longer learn legitimate MACs and floods all unknown-unicast frames out every port — effectively turning the switch into a hub so the attacker can sniff everyone’s traffic (CAM overflow / fail-open).

Port security is the countermeasure: cap how many MACs a port may learn, and choose what happens on violation.

Switch(config)# interface gigabitEthernet 0/5
Switch(config-if)#  switchport mode access
Switch(config-if)#  switchport port-security
Switch(config-if)#  switchport port-security maximum 2
Switch(config-if)#  switchport port-security mac-address sticky   ! learn & save current MACs
Switch(config-if)#  switchport port-security violation restrict   ! shutdown | restrict | protect
Switch(config-if)# end

Switch# show port-security
Switch# show port-security address

Violation modes: protect (silently drop extra MACs), restrict (drop + log/SNMP + counter), shutdown (err-disable the port — the default and most secure).

Link aggregation / EtherChannel — IEEE 802.3ad (LACP)

Link aggregation bundles 2–8 parallel physical links into one logical link (an EtherChannel / Port-Channel) for two wins: more bandwidth (aggregate throughput) and redundancy (if one member fails, traffic shifts to the survivors with no STP reconvergence — STP sees the bundle as one link, so no member is blocked). Traffic is spread across members by a hashing algorithm (on src/dst MAC, IP, or L4 port) so any single flow stays on one member (avoids reordering).

Negotiation protocols:

• LACP (IEEE 802.3ad) — the open standard. Modes: active (initiates) / passive (only responds). At least one side must be active.
• PAgP — Cisco-proprietary. Modes: desirable / auto.
• on — static, no negotiation (both ends must be on; risky if misconfigured).

Both ends must agree on speed, duplex, allowed VLANs, and trunk/access mode, or the bundle won’t form.

! LACP Layer 2 trunk EtherChannel across two links
Switch(config)# interface range gigabitEthernet 0/1 - 2
Switch(config-if-range)#  switchport mode trunk
Switch(config-if-range)#  switchport trunk allowed vlan 10,20
Switch(config-if-range)#  channel-group 1 mode active         ! LACP active
Switch(config-if-range)# exit

! Configure the logical Port-Channel interface once; members inherit it
Switch(config)# interface port-channel 1
Switch(config-if)#  switchport mode trunk
Switch(config-if)#  switchport trunk allowed vlan 10,20
Switch(config-if)# exit

! Tune the load-balancing hash (global)
Switch(config)# port-channel load-balance src-dst-ip

Switch# show etherchannel summary
Switch# show lacp neighbor

A Layer 3 EtherChannel (routed uplink) adds no switchport + an IP on the Port-Channel:

Switch(config)# interface port-channel 2
Switch(config-if)#  no switchport
Switch(config-if)#  ip address 10.0.0.1 255.255.255.252

MLAG / vPC / StackWise: Vendors let a Port-Channel span two physical switches (Cisco vPC on Nexus, StackWise/VSS on Catalyst; MLAG generically) so a downstream device dual-homes to two chassis with one logical bundle — full switch redundancy with no blocked links. See ./09-redundancy-and-high-availability.md.

VXLAN — Layer 2 overlay over Layer 3

Classic VLANs have a hard ceiling of 4094 IDs (the 12-bit 802.1Q field) and cannot stretch a broadcast domain across a routed core — a real problem for multi-tenant clouds and for live VM migration across data-center pods.

VXLAN (Virtual Extensible LAN, RFC 7348) solves both. It is a MAC-in-UDP overlay: an original Ethernet frame is encapsulated inside a UDP packet (dest port 4789) and routed across any IP (Layer 3) underlay. Key terms:

• VNI (VXLAN Network Identifier) — a 24-bit segment ID giving ~16 million logical networks (vs 4094 VLANs).
• VTEP (VXLAN Tunnel Endpoint) — the device (a physical switch or a hypervisor vSwitch) that encapsulates/decapsulates VXLAN traffic and maps local VLANs/ports to VNIs.

The payoff: any two hosts in the same VNI appear to be on the same L2 segment even though the packets are routed between racks and pods over a scalable, loop-free, ECMP-load-balanced Layer 3 spine-leaf fabric. Control-plane MAC/IP learning is typically done with BGP EVPN rather than flood-and-learn. VXLAN is the foundation of modern data-center and cloud networking; it is covered in depth in ./16-cloud-networking.md.

Summary of key Layer 2 technologies

Best Practices

• Design VLANs intentionally. One IP subnet per VLAN. Keep broadcast domains reasonably small; document VLAN IDs and purposes. Never leave hosts in the default VLAN 1.
• Harden trunks. Hard-set switchport mode access or switchport mode trunk (disable DTP with switchport nonegotiate). Prune allowed VLANs to only what’s needed. Change the native VLAN off 1 to an unused VLAN and never carry data on it — this defeats double-tagging VLAN-hopping.
• Always run Rapid-PVST+ (or RSTP/MST), never classic 802.1D. Sub-second convergence beats 30–50 s.
• Set the root bridge manually (spanning-tree vlan X root primary/secondary) at the distribution/core — never let it be decided by an accidental low MAC. Place the root where your traffic naturally aggregates.
• Enable PortFast + BPDU Guard on every access port (spanning-tree portfast default + bpduguard default). Use Root Guard facing downstream switches and Loop Guard on non-designated ports. Configure errdisable recovery so a transient event auto-recovers.
• Turn on port security on access ports (sticky MAC, sensible maximum, restrict or shutdown on violation) to stop CAM-table flooding and rogue devices.
• Use LACP (mode active), not static on, so misconfigurations fail safe instead of forming a broken bundle or a loop. Match speed/duplex/VLAN config on all members. Bundle at least two links across redundant hardware where possible.
• Route where you can, switch where you must. Use L3 switches with SVIs for inter-VLAN routing at scale; reserve router-on-a-stick for small sites. Keep Layer 2 domains contained and push routing (and ECMP) toward the edge.
• Prefer a routed leaf-spine fabric with VXLAN/EVPN for data centers instead of stretching giant STP domains — it scales, load-balances across all links, and confines failure domains.
• Disable unused ports (shutdown) and put them in an unused VLAN; enable DHCP snooping and Dynamic ARP Inspection for defense in depth on user VLANs.

References

• IEEE 802.1Q — Bridges and Bridged Networks (VLANs)
• IEEE 802.1D — MAC Bridges (Spanning Tree)
• IEEE 802.1w / 802.1D-2004 — Rapid Spanning Tree
• IEEE 802.3ad / 802.1AX — Link Aggregation
• RFC 7348 — Virtual eXtensible Local Area Network (VXLAN)
• Cisco — Configuring VLANs and Trunks (Catalyst)
• Cisco — Understanding and Configuring Spanning Tree Protocol (STP)
• Cisco — Understanding EtherChannel / Link Aggregation