Your campus is one big layer-2 domain: every VLAN trunked from every access switch back to a central pair, spanning tree deciding the paths, and a single loop or a single core taking the whole site down. Routed access fixes that — each access switch becomes layer 3 and routes to the core — but the gateway for every subnet has to move from the core to the edge while people are using it. Here is how to do that one subnet at a time.
In layer-2 access, access switches are dumb: every VLAN is trunked up to a central router or core pair that holds all the gateways, and spanning tree picks which trunk forwards and which blocks. It is simple, but the whole campus is one broadcast domain and one spanning-tree instance — a loop anywhere, or a core failure, affects everything, and half your uplinks sit idle in blocking.
In routed access, each access switch is layer 3: it holds the gateways for its own subnets and routes to the core over a routing protocol, so there is no site-wide spanning-tree domain, every uplink is active (ECMP), and a fault is contained to one switch. The migration moves each subnet’s gateway from the core to the edge — which is a default-gateway change for its hosts — so it is done one subnet at a time, with the old gateway kept alive until the new one is proven.
01
Before: everything trunks to the core, spanning tree blocks a leg. After: each access switch routes, every uplink is active, the failure domain is one switch.
02
Build the routed underlay first, then move each subnet’s gateway to the edge one at a time — the old gateway stays as a backup until the new one is proven.
| Step | Do | Rollback |
|---|---|---|
| 1 · Underlay | Add point-to-point routed links (or a routed uplink VLAN) from each access switch to the core; bring up OSPF, verify adjacency — carries no user traffic yet. | Shut the routed links. |
| 2 · Pick a pilot subnet | Choose one low-risk VLAN that lives mostly on one access switch. | — |
| 3 · Move the gateway | Create the SVI/gateway on the access switch; keep the core’s gateway as a secondary (lower priority) during the cut. Redistribute the subnet into OSPF. | Remove the edge SVI; core GW resumes. |
| 4 · Verify | Hosts reach their new local gateway and route to the core; failover to the retained core GW still works. | — |
| 5 · Retire the core GW | Remove the subnet’s gateway and its trunk from the core; the VLAN no longer spans the campus. | Re-add the core SVI + trunk. |
| 6 · Repeat + shrink STP | Move the next subnet. As VLANs stop spanning switches, the spanning-tree domain shrinks to nothing. | Per-subnet, as above. |
Moving a subnet’s gateway from the core to the access switch changes which device answers for the .1. If you just delete the core SVI and create the edge one, there is a gap. Keep both gateways live during the cut — an FHRP (VRRP/HSRP) virtual gateway that you move, or the core SVI left as a lower-priority backup — so hosts never lose their default gateway. Only remove the core’s copy once the edge gateway is proven. And watch the VLAN that spans two switches: it cannot be fully routed-access until it lives on one.
03
| Before you start | Why |
|---|---|
| Map which VLAN lives on which switch | Subnets confined to one switch migrate cleanly; spanned ones need planning. |
| OSPF adjacency proven before any gateway moves | The underlay must route before you depend on it. |
| Keep the old gateway as backup during each cut | No host should lose its default gateway for a second. |
| Pilot a low-risk subnet first | Validate the pattern where a mistake is cheap. |
Takeaways
Routed access shrinks the failure domain so a mistake stays on one switch. I migrate a live campus from L2 to L3 access one subnet at a time, moving each gateway to the edge without an outage.
Book a Discovery Call →