When inter-VLAN traffic is heavy enough that sending it to a router and back is wasteful - or when the number of VLANs makes a router-on-a-stick fragile.

On a Layer 2 design, every packet crossing between VLANs travels up the uplink to the firewall and back down again. Both directions consume the same link. On a busy network with servers and clients in different VLANs, that can be most of the traffic.

A Layer 3 switch routes it internally at full speed, so the uplink carries only traffic that genuinely leaves.

The second driver is resilience. A pair of Layer 3 switches with first-hop redundancy provides gateways that survive one switch failing; a single router doing all inter-VLAN routing does not.

The threshold is a judgement, but a useful test is to measure the firewall's internal interface. If a large share of the traffic crossing it has an internal source and an internal destination, that traffic wants to be routed in a switch.

Yes - and that is the consequence people most often miss.

Once the Layer 3 switch holds the gateway for each VLAN, traffic between those VLANs is routed inside the switch. It never reaches the firewall, so no firewall rule applies to it, and it does not appear in the firewall's logs.

On a network where VLANs were created to separate trust levels, that quietly removes the enforcement point.

There are two sound responses. Either express the controls as access lists on the Layer 3 switch, accepting that they are stateless and less expressive than firewall rules; or keep the sensitive VLANs' gateways on the firewall while routing the routine ones in the switch.

The second is common and works well: routine internal traffic is routed for speed, and anything crossing a trust boundary still goes through inspection.

Decide this deliberately at design time. It is regularly discovered afterwards, during an audit.

Two switches presenting a single gateway address, so devices keep working when one fails.

Every device has a default gateway configured or handed to it by DHCP. If that address lives on one switch and the switch fails, everything in the VLAN loses its route out - regardless of how redundant the cabling is.

Protocols such as VRRP, and the vendor equivalents HSRP and GLBP, let two switches share a virtual address and MAC. One is active, the other standby, and failover happens in a few seconds without any device knowing.

The design point is to align it with the rest of the topology. The active gateway should be on the same switch that spanning tree considers root, otherwise traffic crosses between the pair unnecessarily.

Some platforms go further with an active-active arrangement or by stacking the pair so they behave as one device - which removes the question but concentrates the risk in a single control plane.

Static routes for a simple site, OSPF for anything with several routed segments, BGP only where an external relationship demands it.

Static routing is entirely adequate for a single site with one route out. It is predictable and there is nothing to converge. The weakness is that it does not react - a failed path stays configured until somebody changes it.

OSPF is the usual choice for a campus with multiple routed switches. It discovers routes automatically, converges quickly on failure, and scales with areas. It needs a design - area layout, addressing that summarises cleanly - but then largely looks after itself.

BGP appears where the network peers with something outside its control: multiple internet providers, a service provider connection, or a large data centre fabric.

Buy the protocol you need. Licence tiers on Layer 3 switches frequently separate basic static and RIP from full OSPF and BGP, and the difference is discovered late.

The links between edge switches and the core are routed rather than switched, so spanning tree stops at the edge and VLANs do not span the campus.

In a traditional design, VLANs extend from the edge through to the aggregation layer over trunk links, and spanning tree manages the resulting loops. It works, but the failure domain is large and convergence depends on spanning tree.

In a routed access design each edge switch routes locally, its uplinks are routed point-to-point links, and a routing protocol handles failover. Convergence is faster and more predictable, broadcast domains are small and contained, and a fault at one edge switch cannot affect another.

The cost is address planning - each edge switch needs its own subnets - and the loss of VLANs that span the building, which matters for some wireless designs and for anything relying on Layer 2 adjacency.

It suits large campuses. For a single building it is usually more structure than the problem needs.

In hardware on any switch worth calling Layer 3 - and confirming that is worth doing, because the exceptions are painful.

A proper Layer 3 switch routes in its forwarding silicon at the same rate it switches, so routed and switched traffic perform identically. The processor handles only protocol messages and management.

Some lower-cost devices advertise Layer 3 while routing in the main processor. Throughput then collapses to a fraction of line rate under load, and the fault presents as unexplained slowness that appears only when the link is busy.

The things to check are the routing throughput figure, the hardware routing table size - measured in entries - and whether access lists are enforced in hardware, since software-enforced lists carry the same penalty.

Table size matters where the network has many subnets or receives external routes. When the hardware table overflows, the excess is handled in software and performance falls off a cliff for those destinations only, which is confusing to diagnose.

Where traffic naturally aggregates and where policy needs to change - usually the aggregation layer in a campus, the core in a small site.

Too low, and every edge switch becomes a router with its own subnets, its own routing configuration and its own documentation burden. That is right for a large campus and excessive for one building.

Too high, and inter-VLAN traffic travels further than it needs to and the boundary device becomes a bottleneck.

The practical rule is to put it at the point where several edge switches converge and where you would want a failure to be contained. In a typical building that is a pair of Layer 3 switches at the main cabinet, with Layer 2 access switches in the floor cabinets trunking up to them.

Keep the boundary consistent. Networks that acquired Layer 3 capability in different places over time - a gateway here, a firewall interface there - are the ones where nobody can say with confidence how a given packet reaches its destination.