Network Components and Their Roles

Learning objectives

By the end, you should be able to:

• Identify common network components and match them to their roles.
• Explain how routers, Layer 2 switches, and Layer 3 switches differ.
• Explain the roles of NGFW and IPS at a security boundary.
• Distinguish wireless access points from wireless LAN controllers.
• Distinguish clients that consume services from servers that provide them.
• Explain a simple topology and identify missing components.

Meet the components

Endpoints and servers

Endpoints include user PCs, phones, printers, and IoT devices. In our examples, PC-A, PC-B, and wireless client WL-1 consume services. A server provides services: web pages, email, files, DNS name resolution, or DHCP address assignment. SRV1 is our server. Servers can run on physical hardware, in virtual machines, or in containers. Identify the role by what the device does in the scenario.

Layer 2 switches

A Layer 2 switch, SW1, forwards frames within a local area network (LAN) using MAC addresses. Think of it as connecting local devices and directing frames toward the appropriate ports. Within the single LAN shown here, it does not separate broadcast domains or route packets to another IP network.

Routers

A router, R1, forwards packets between IP networks at Layer 3. It uses the destination IP address to select a path toward the destination network, like a post office selecting the next delivery point. Routers separate broadcast domains. Local MAC-based forwarding and between-network IP forwarding are different jobs.

Layer 3 switches

A Layer 3 switch, L3-SW1, combines Layer 2 switching with routing capability. It can connect devices locally and route between networks, including between VLANs when configured for that purpose. A plain Layer 2 switch does not gain routing capability just because another network is connected to it.

Wireless access points and controllers

An access point (AP), AP1, provides the radio connection and bridges wireless clients into the wired LAN. It is a way into the network, not an internet service by itself.

In a controller-based design, a wireless LAN controller (WLC), WLC1, centrally manages APs, wireless network names (SSIDs), security settings, and roaming. The AP connects wireless clients; the controller coordinates wireless management. A controller is not required in every wireless design.

Next-generation firewalls and intrusion prevention

A next-generation firewall (NGFW) inspects traffic and allows or blocks it according to policy, with application and identity awareness. An intrusion prevention system (IPS) inspects traffic inline and can drop traffic matching attack signatures or suspicious behavior. These functions may be combined in a security device such as FW1 at a meaningful boundary. Inspection does not replace the need for routing between networks.

Small-office topology walkthrough

This is an illustrative map of roles, not a required wiring design. A real office may combine functions or use fewer devices. The router and Layer 3 switch are both shown so you can recognize their capabilities.

1. Local access: PC-A and PC-B connect to SW1. WL-1 connects by radio to AP1, which connects into the wired LAN. WLC1 manages the AP; this management relationship does not mean every client packet must pass through the controller.
2. Between networks: R1 provides routing toward another network. L3-SW1 illustrates another device with both switching and routing capability.
3. Security boundary: FW1 inspects traffic with NGFW/IPS functions before it reaches services beyond that boundary.
4. Service: SRV1 supplies the requested service, such as a web page, to the client.

Trace PC-A requesting a service on a different network: SW1 handles local frame forwarding, a Layer 3 device handles forwarding between networks, FW1 applies security policy at the boundary, and SRV1 provides the service. If PC-A instead communicates with PC-B in the same LAN, that local exchange does not need a router to cross networks.

Try it with WL-1: which component first brings the wireless client into the LAN? AP1. Which component centrally manages the AP? WLC1.

Practice: identify a topology

Sketch two PCs connected to one switch, with that switch connected to one router: PC-A → SW1 → R1 → another IP network, and PC-B → SW1. Use paper or inspect the description below; no device configuration is needed.

• PC-A connects to SW1.
• PC-B connects to the same SW1.
• SW1 connects to R1; R1 would connect the LAN to another IP network.

Before reading the explanation, write your answers:

1. Which two devices are endpoints?
2. Which device provides Layer 2 connectivity, and what addresses does it use?
3. Which device would forward packets to another IP network?
4. Which components would you add for a local file service, wireless access, centralized AP management, and traffic inspection?

Exercise explanation

PC-A and PC-B are the endpoints. SW1 provides Layer 2 connectivity using MAC addresses. R1 provides Layer 3 forwarding between networks. A server could provide files; an AP could provide wireless access; a WLC could centrally manage APs in a controller-based design; and an NGFW/IPS could inspect traffic at a security boundary. None of those additional components is present in this exercise.

Knowledge check

Answer in your own words, then compare with the explanations.

1. A PC needs to reach another IP network. Is a Layer 2 switch alone sufficient? Why?
2. What capability does a Layer 3 switch add to Layer 2 switching?
3. Which device bridges wireless clients, and which manages AP settings centrally?
4. How do an NGFW and an IPS help protect traffic?
5. A device supplies DNS answers to clients. What role is it performing?

Answers and explanations

1. No. A Layer 2 switch forwards frames locally by MAC address. Reaching another IP network requires Layer 3 routing capability.
2. Routing between networks, alongside its local switching capability.
3. The AP bridges wireless clients into the LAN; the WLC centrally manages APs in a controller-based design.
4. An NGFW enforces traffic policy with application and identity awareness. An inline IPS can actively drop traffic matching attack signatures or suspicious behavior. These complement routing.
5. A server role: it provides a name-resolution service that clients consume.

If you missed a question, return to the component explanation and describe its job using one verb: consume, provide, switch, route, bridge, manage, or inspect.