Access, Distribution, Core: Campus Network Layers Explained with Cisco Models

Campus Network Layers Explained: Access, Distribution and Core

A campus network isn't one big flat thing. It's built in layers, each doing a different job, and once you see the layers, a lot of things make sense at once, including why Cisco makes so many different switch models and which one belongs where. 

There are three layers: access, distribution and core. Learn what each does, and you can read a network design, size a purchase, and understand almost any Cisco switching conversation. This is that foundation, in plain terms. 

What Are the Layers of a Campus Network? 

Three of them, stacked. The access layer is where devices plug in. The distribution layer gathers the access switches together and routes between them. The core layer is the high-speed backbone that ties everything to the rest of the network (Cisco campus design guide). 

Think of it as a building. The access layer is the rooms where people work, the distribution layer is the corridors and stairwells connecting the rooms on each floor, and the core is the main lift shaft moving everything between floors and out of the building. Traffic flows up through the layers and back down. 

Not every network needs all three, as we'll see. But the three-layer model is the language campus networks are described in, so it's worth knowing whole. 

What Is the Access Layer? 

Where endpoints connect. The access layer is the switches your devices actually plug into: PCs, IP phones, wireless access points, cameras, and printers. Its job is to connect and power those devices, put them in the right VLAN, and apply the first line of security policy. 

This is also where Power over Ethernet lives, since access switches power the phones and access points, and where you increasingly need multi-gigabit ports for modern Wi-Fi. It's the busiest, most numerous layer, one access switch per wiring closet, often stacked. 

The Cisco models here are the Catalyst 9200 for budget access, the workhorse Catalyst 9300 for most enterprise access, and the modular Catalyst 9400 chassis for high-density access with plenty of PoE. 

What Is the Distribution Layer? 

The aggregation and routing layer. The distribution layer sits above the access switches and gathers their uplinks together. Its jobs are to route traffic between VLANs, apply policy, and provide redundancy so that no single failure takes a whole section of the network down. 

If the access layer is where devices connect, the distribution layer is where decisions get made, which traffic goes where, what's allowed, and how it stays resilient. It's the layer that keeps a large access estate organised and routed without pushing all that work up to the core. 

The Cisco models here are typically the fixed Catalyst 9500, and the Catalyst 9400 chassis can serve as distribution in some designs. 

What Is the Core Layer? 

The backbone. The core layer is the high-speed centre of the network, connecting the distribution blocks and to the data centre, the WAN and the internet. Its single job is to move large volumes of traffic fast and reliably, so it's kept simple and quick, no fancy policy, just speed and resilience. 

You don't plug endpoints into the core, and it doesn't power anything. It's fibre, high throughput, and built for uptime, because if the core stops, everything stops. 

The Cisco models here are the fixed Catalyst 9500 for a compact core and the modular Catalyst 9600 chassis for the largest campus cores. 

Campus Layers Mapped to Cisco Models 

Notice the 9500 appears twice, and the 9400 appears at two layers. That's normal: some switches suit more than one role, and the right layer depends on how you deploy them, which is why matching model to layer is a design decision, not a lookup. 

Two-Tier or Three-Tier: Do You Need All Three Layers? 

Not always. The full three-layer model suits large campuses with many buildings and thousands of users. Smaller networks collapse the core and distribution into a single layer, called a collapsed core or two-tier design, so you have just access and a combined core-distribution. 

The logic is simple. A separate core earns its place when there are enough distribution blocks and enough traffic to justify a dedicated backbone. A small office or single building rarely has that, so paying for a standalone core would be over-engineering. As a network grows, a two-tier design can expand into three tiers. 

So the honest answer to "do I need all three layers?" is: only if you're big enough to. Most small and mid-sized networks run two tiers, and that's the correct design for them, not a compromise. 

How Do the Layers Work Together? 

Follow a packet. A user's PC connects to an access switch, which places it in a VLAN and forwards its traffic up to the distribution layer. The distribution layer routes that traffic to another VLAN, or onward, and hands it to the core if it's leaving that part of the network. The core carries it at speed to wherever it's going: another building, the data centre, or out to the internet, and the reply travels back down the same layers. 

Each layer does its own job and trusts the others to do theirs. That separation is what makes a campus network scalable and manageable: you can grow or fix one layer without redesigning the whole thing. 

Where Does SD-Access Fit? 

On top. Cisco SD-Access is a modern overlay that runs across this physical hierarchy, adding identity-based, zero-trust segmentation without replacing the access, distribution and core layers underneath. The switches still do their layer jobs; SD-Access changes how policy and segmentation work over them. So the three-layer model remains the foundation even in a fabric design. 

Designing the Layers Right 

Understanding the layers is the start; sizing each one with the right Cisco models, and deciding between two and three tiers, is the design. Proactive Data Systems, a Cisco Preferred Partner with 35 years of experience and more than 1,500 customers, designs campus networks layer by layer, the right access, distribution and core for your size and growth. If you're planning or refreshing a network and want the layers sized correctly, send us your requirement and we'll map it out.