Core (Backbone) Switch Installation

What is a core switch and where does it sit in the network?

A core switch is the central switch that aggregates traffic from the access switches and routes between VLANs. User PCs, IP phones and access points plug into the access layer; those switches connect to the core over fibre or copper uplinks; and the servers, the firewall and the internet edge usually connect to the core as well.

Cisco’s campus LAN design guide describes this as three layers: access, distribution and core. In small and mid-sized networks the distribution and core roles are merged into the same devices, which is known as a collapsed core. On campuses with several buildings or many distribution points, a separate core layer cuts down the number of links and the overall complexity.

In practice we ask one question: if the core stops, what stops with it? If the answer is “everything”, the core should not be a single device, and every access switch should reach it over at least two paths.

Which backbone design suits an office, a factory or a campus?

In a single building with a few floors, a collapsed core built from two switches is usually enough. Take a 150-person office over five floors: two 48-port access switches on each floor and two core switches in the comms room. Each floor switch has two fibre uplinks, one to each core switch. When one core switch is down for maintenance, traffic flows through the other and users never notice.

Factories are a different picture. Shop-floor switches can sit hundreds of metres from the server room, in dust and heat. Here the priorities are single-mode fibre, industrial access switches, and VLANs and routing rules that keep the production network (PLCs, SCADA, cameras) apart from the office network. On a campus, the main design questions are the fibre routes between buildings and a distribution point in each one.

Public-sector technical specifications in Türkiye often include a “core switch” clause. It sets measurable criteria such as port count and type, uplink speed, redundant power supplies, Layer 3 routing protocols and stacking support. Writing those criteria to match the existing cabling and access switches avoids unpleasant surprises once the hardware arrives.

Stacking or MLAG: how do you build redundancy into the core?

There are two common ways to make the core redundant: stack the switches, or run two independent switches with multi-chassis link aggregation (MLAG). Either way, the access switch’s two uplinks are bundled into one logical link (an LACP port-channel) split across both core switches, and both links carry traffic at the same time.

A stack is managed as one device, with a single configuration and a shared operating system. That makes it easy to run, but a software upgrade can hit the whole stack at once. With MLAG each switch keeps its own control plane, so you can upgrade one while the other carries on; the trade-off is that two separate configurations have to be kept consistent. StackWise Virtual, used on Cisco’s larger Catalyst models, turns two switches into one logical device and presents the pair to spanning tree as a single bridge.

The right choice depends on the hardware model, your maintenance windows and how your team likes to work. A plant that cannot find an overnight maintenance window is better off with switches that can be upgraded independently. In an office with a small IT team, a stack run from a single configuration is often easier to follow.

How do you plan Layer 3 switching and inter-VLAN routing?

The core switch should do the inter-VLAN routing itself. Each VLAN gets an SVI (switched virtual interface) and the default gateway lives on the core, so traffic between, say, finance and production is routed inside the switch instead of hairpinning through the firewall. Which VLAN may reach which is then controlled with access control lists (ACLs), or by deliberately sending that traffic through the firewall.

A typical plan puts users, servers, voice, cameras, guest Wi-Fi and management in separate VLANs. Guest and camera traffic goes to the firewall without ever touching the internal network. The addressing plan leaves room for growth from day one, so adding a floor or a branch does not mean redrawing everything.

Where there are several distribution points, a dynamic routing protocol such as OSPF between the core and distribution switches moves traffic to the other path on its own when a link fails. In a single-building office, static routing is usually enough.

What should you check on uplinks and fibre links?

Uplink speed is sized to the traffic aggregated on the access switches. With 1 Gbit user ports on the floor switches, a 10 Gbit uplink per floor is a common choice today; if server and storage traffic is heavy, the links between the core and the servers may need more.

On the fibre side, the transceiver type (SFP/SFP+), whether the fibre is multimode or single-mode, and the distance all have to match. Ordering optics without knowing the type and test status of the fibre already in the building is one of the most common mistakes. If the fibre backbone has to be re-run, that work is planned as part of structured cabling.

What do you get at the end of a core switch installation?

At handover you have a working network plus documentation that someone else can pick up and understand. Port mappings, the VLAN list, the IP plan and a topology diagram are all part of the deliverable. If the hardware is going into a server room, rack layout and power connections are planned at the same time.

On Cisco networks, the access layer is finished off with the security settings described on our Cisco switch configuration page. Before any work starts, we review the existing network free of charge and confirm the scope in a written quote.

What you receive

• Inventory of the existing network and topology diagrams (before and after)
• Core, distribution and access layer design, with the stacking or MLAG decision and the reasoning behind it
• VLAN and IP addressing plan, plus inter-VLAN routing rules
• Redundant uplinks, LACP port-channels and spanning tree settings
• Management access (SSH, dedicated management VLAN), SNMP and log forwarding
• Configuration backups and a port mapping table
• Failover test: one core switch and one uplink shut down to prove the design

How we work

1. 1

   Discovery

   We review the existing switches, cabling, fibre type and traffic, on site or remotely, and list every single point of failure.

2. 2

   Design

   We put the layer structure, redundancy method, VLAN and IP plan in writing and sign them off with you.

3. 3

   Staging

   We pre-configure the hardware on the bench, align software versions and test the optics.

4. 4

   Cutover

   We migrate floor by floor out of hours, checking user, phone and server access after every step.

5. 5

   Testing and documentation

   We run the failure scenarios, back up the configurations and hand over all the documentation.

Frequently asked questions