Layer 2 or Layer 3: which switch does the site actually need?

Layer 3 is not simply the better switch. It is a different job, and buying it when you do not need it moves your routing to the wrong box.

The question comes up on nearly every multi-VLAN quote. The honest answer is that Layer 3 is not an upgrade — it is a decision about where routing happens, and that decision has consequences for troubleshooting long after the install.

What the distinction actually is

A Layer 2 switch forwards on MAC addresses inside a broadcast domain. Put VLANs on it and traffic between those VLANs has to leave the switch, reach a router or firewall, and come back. That is the classic router-on-a-stick, and the uplink carries every cross-VLAN packet twice.

A Layer 3 switch routes between its own VLANs in hardware. Cross-VLAN traffic never leaves the box, which is why it matters.

When Layer 3 earns its price

Buy it when significant traffic crosses VLANs inside the building: cameras on one VLAN writing to an NVR on another, workstations hitting a local file server, VoIP phones reaching an on-premise PBX. A 16-camera deployment writing to a local NVR will saturate a gigabit uplink doing that trip twice. Routing it in the switch keeps it off the uplink entirely.

When it does not

A site where VLANs exist to separate guest Wi-Fi from staff, and nearly all traffic is heading to the internet anyway, does not need it. That traffic has to reach the gateway regardless. You would be paying for silicon to route traffic that is leaving the building.

The part people forget

Once the switch routes, the switch holds routing state — and whoever troubleshoots the site in two years needs to know that. Access lists, DHCP relay and inter-VLAN policy now live in two places instead of one. If the site is supported by someone who only ever looks at the firewall, a Layer 3 switch can make the network harder to reason about, not easier.

Decide where routing should live, then buy the switch that matches. Not the other way round.