If you're running a flat network with unmanaged switches, you're essentially operating at Layer 2 (Data Link Layer) without any segmentation or advanced features. Unmanaged switches simply forward Ethernet frames based on MAC addresses without any configuration capabilities.

// Network traffic flow examples
// Layer 2 switching (MAC-based)
if (destinationMAC == switchMACTable[sourcePort]) {
    forwardFrame(destinationPort);
}

// Layer 3 switching (IP-based routing)
if (destinationIP != currentSubnet) {
    routePacket(vlanInterface, nextHop);
}

Layer 2 switches handle VLANs through 802.1Q tagging but can't route between VLANs. Layer 3 switches add IP routing capabilities while maintaining wire-speed switching performance.

• Inter-VLAN routing requirements
• Advanced QoS policies based on IP protocols
• Implementing ACLs at the network layer
• Dynamic routing protocols (OSPF, EIGRP)

For your case with ~100 users wanting VLANs and 802.1x, you could start with:

# Sample Cisco switch VLAN configuration (Layer 2)
vlan 10
 name Staff
vlan 20
 name Guests
interface range gig0/1-24
 switchport mode access
 switchport access vlan 10
 dot1x pae authenticator

Layer 3 switches typically have:

Start with a core Layer 3 switch and Layer 2 access switches. Here's a Python snippet to test your needs:

def needs_layer3(vlan_count, inter_vlan_traffic, security_needs):
    return (vlan_count > 3 and inter_vlan_traffic > 15% or 
           '802.1x' in security_needs and 'acl' in security_needs)

# For your case:
print(needs_layer3(2, 10, ['802.1x']))  # Likely returns False

When working with a flat network topology using unmanaged switches, you're essentially operating at Layer 2 (Data Link Layer) of the OSI model. This means all devices share the same broadcast domain, which can lead to:

• Unnecessary network congestion
• Limited security controls
• No traffic isolation between devices

Here's a technical breakdown of capabilities:

Here's a Cisco IOS configuration snippet for VLAN setup on a Layer 3 switch:

enable
configure terminal
vlan 10
 name Staff
vlan 20
 name Guests
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
interface vlan 20
 ip address 192.168.20.1 255.255.255.0
ip routing

For 802.1X configuration (using Cisco as example):

aaa new-model
aaa authentication dot1x default group radius
dot1x system-auth-control
interface GigabitEthernet0/1
 switchport mode access
 dot1x port-control auto

Consider a Layer 3 switch when:

• Your inter-VLAN traffic exceeds 20% of total bandwidth
• You need QoS policies between VLANs
• Your security policies require Layer 3 ACLs
• You're implementing advanced features like VRF-lite

For under 100 users, you might implement a hybrid approach:

1. Use Layer 2 switches at access layer
2. Deploy a single Layer 3 switch as core
3. Enable routing only where absolutely necessary

Key commands to verify your implementation:

show vlan brief        # Verify VLAN assignments
show ip route          # Check routing table (Layer 3)
show dot1x all         # Verify 802.1X status
show interfaces trunk  # Check trunk port configurations

Remember that Layer 3 switches typically cost 20-40% more than comparable Layer 2 switches. For your small network, you might start with a managed Layer 2 switch that supports 802.1X and VLANs, then upgrade to Layer 3 if inter-VLAN routing becomes necessary.