How is the address space divided when using l3 switches at the access layer?

Question

Computer networks

I have always worked with l2 devices at the access level, there are no questions, we provide a fault-tolerant l2 domain (with loops and aggregation) and then we forward VLANs to the l3 device (router), on which we are already working with l3 traffic, we implement fault tolerance on the l3 perimeter through VRRP, inside l3 ECMP, metrics, dynamic routing. If you need to provide fault tolerance for a client connection, you can use a stack of switches and a cross ethernet channel.

But how to work when the l3 device is at the access level?
How to assign addresses to clients so that there are no problems with routing, throw a subnet by the number of ports and configure a firewall for each port (i.e. we throw 27 subnets on a 24 port switch) or divide by subnets, but then you get a lot of subnets.
Or give each client 30 subnets? But that's 24 thirtieth subnets per switch, i.e. 25 subnets per switch at once, i.e. five times more than is necessary for such a number of devices.
How to provide fault tolerance to the client, throw two links with different addresses in different subnets up to two l3 devices and configure metrics on the client?

Is there any decent guide on planning addresses with l3 access level, best practice, so as not to go through a rake?

l3 access is planned for servers.

Answer 1

It all depends on what you want and what equipment you have.
1. What kind of switches do you have?
2. What do you want to achieve by setting ip on switches, and not on routers?
3. Fault tolerance is provided not to the client, but to the switch by routing protocols. It is necessary to connect the switch with two other switches / routers. Metrics is not about fault tolerance.
4. If the IPs are gray, then you can at least /31 prescribe for each client if the equipment allows. If white, then it all depends on your Wishlist. You can, for example, throw everyone into one network, but then if you need to filter traffic on the switch for each client separately, then this will be problematic, because the switch is not a firewall. If you make an ACL for each client separately, then TCAM may overflow (it all depends on the filter itself and the piece of iron), if TCAM overflows, then the packets will go to the CPU and it may be bent. + If you register IP on a switch, then you will need to fence a more complex Control Plane Policy than for an L2 switch.
5. I have more questions than answers. First, decide for yourself why you need it. If there is a specific task, then describe it. If you want to make everything beautiful for servers, then see the design of topologies for data centers (VPC, VXLAN)

Answer 2

1 do not need to go in cycles that on L3 devices it is necessary to use all possible L3 functionality and only it.
as an option. on user devices, we divide users (if necessary or desired) into groups and divide them by VLAN. for example, you can separate users and printers, users and printers by department/floor. each VLAN has a separate range/broadcast domain. VLANs live only on access switches, then everything on L3 is dynamically routed. respectively on the backbone core, access is in stab. on the other hand, services + equipment are also divided into ranges that are also routable on the core.

Answer 3

How to share address space with l3 switches? Just like in the usual scheme with routers.
L3 switches are used to offload the already loaded processors of routers that perform the functions of firewalling, nating, some kind of controller, of course, a router, and much more. And what if a 16-core router is not enough? Buy even more expensive with even more cores. But as you know, money is not taken out of thin air, and buying a new piece of iron when it is still fresh, but "less productive" is irrational.
That is why there are l3 switches that remove the load from the router in inter-vlan routing.
On MikroTík switches, since RouterOS 7 version, hardware routing has appeared on some switches, i.e. on a switch chip.
Subtotal
Plan your network the same way you would with a router, but on switches.
You may have to use dynamic routing, as the scheme has become a little more complicated.
Good luck.