Layer 2 vs Layer 3 Networks: Who Controls the Routing, and Why It Decides What You Buy

Every private connectivity quote an enterprise receives — Metro Ethernet, IEPL, MPLS IP VPN, managed SD-WAN — is ultimately one of two things. The debate over Layer 2 vs Layer 3 networks sounds like an OSI-model classroom exercise, but it settles a very practical question: who runs the routing. A Layer 2 service delivers your Ethernet frames between sites and stays out of your IP design entirely. A Layer 3 service takes your packets and routes them, which means the provider participates in — or fully manages — decisions your own network team would otherwise make.

That single difference drives almost everything buyers care about: how much control you keep, how easily the network scales, where the troubleshooting boundary sits, what the service costs at high bandwidth, and what happens when you add the eleventh site. This guide explains both service families, compares them dimension by dimension, and sets out how the choice plays out for enterprises buying connectivity in Singapore in 2026.

What Layer 2 and Layer 3 mean in a network service

The layer numbers come from the OSI reference model. Layer 2, the data link layer, moves frames within a network segment using MAC addresses — Ethernet is the dominant example. Layer 3, the network layer, moves packets between networks using IP addresses and routing protocols. Inside your own LAN the distinction is about switch and router behaviour, which our LAN vs WAN primer covers. When you buy a wide-area service, the same distinction describes something commercial: the layer at which the provider hands the service to you.

Buy at Layer 2 and the provider gives you what behaves like a very long Ethernet cable — or a shared Ethernet segment — between your locations. Buy at Layer 3 and the provider gives you a routed IP network. Below both sits Layer 1, where the provider sells raw transport such as dark fibre or wavelengths and everything above the light path is your problem; our companion piece on Layer 1 vs Layer 2 point-to-point circuits covers that boundary in detail.

One caution on terminology before going further: the layer label describes the service handoff, not the provider's internal transport. Most carriers deliver both families over the same IP/MPLS or optical core. An "MPLS network" can therefore sell you a Layer 2 product (a pseudowire or VPLS instance) or a Layer 3 product (an IP VPN) — which is why "is MPLS Layer 2 or Layer 3?" has no one-word answer.

How Layer 2 services work

A Layer 2 service forwards your Ethernet frames based on MAC addresses and VLAN tags, without inspecting or acting on the IP packets inside them. The MEF (the industry body now operating as Mplify) standardised the service types nearly all carriers use, defined in its specification MEF 6.3:

Locally these are sold as Metro Ethernet or Carrier Ethernet, at speeds from 10 Mbps to 10 Gbps and beyond. Regionally and internationally the same idea becomes IEPL (International Ethernet Private Line) — dedicated Ethernet over the carrier's fibre and submarine capacity, which has largely displaced the older TDM-based IPLC for new orders. Under the hood, providers build these services as pseudowires and VPLS instances over MPLS, and increasingly as EVPN (Ethernet VPN, RFC 7432), which uses BGP to distribute MAC reachability and fixes VPLS's scaling and multihoming weaknesses. The encapsulation mechanics — VLANs, VXLAN, overlays — are covered in our network virtualisation explainer.

The defining property is what the provider does not do. Your routers at each end run OSPF or BGP with each other across the circuit, exactly as if a long cable joined them. You keep full control of IP addressing, routing policy, QoS marking and failover behaviour, and the service is protocol-agnostic — it will carry non-IP traffic that a routed service cannot. The trade is responsibility: broadcast domains, spanning-tree or link-aggregation design, routing convergence and redundancy are all yours to engineer. At the extreme end of the control spectrum sits dark fibre, where you light the glass yourself and even the Ethernet layer is your equipment.

How Layer 3 services work

A Layer 3 service routes IP packets on your behalf. The canonical product is the MPLS IP VPN, standardised as BGP/MPLS IP VPNs in RFC 4364. Your customer edge (CE) router at each site peers with the provider edge (PE) router — usually over BGP, sometimes static routes — and hands over your prefixes. The provider keeps each customer's routes in a separate VRF (virtual routing and forwarding instance), so thousands of enterprises share one backbone without seeing each other's traffic, and every one of your sites can reach every other without you building a mesh of circuits.

That any-to-any property is the product. Adding a site means ordering one access circuit; the provider integrates it into the VPN, advertises its routes to your other locations, and typically bundles QoS classes, managed redundancy and an end-to-end SLA — the provider controls the whole path, so it can commit to latency, jitter and packet-loss targets. What an SLA does and does not promise is a topic of its own, covered in our network SLA explainer. The cost of the convenience is ceded control: the provider constrains your addressing and routing design, the service carries IP only, and moving a large routed estate between providers is a project, not an order form.

The newer arrival in the Layer 3 family is SD-WAN, which builds encrypted tunnels over whatever underlay circuits a site has — dedicated internet access, broadband, 5G, or a private Ethernet circuit — and steers each application over the best current path. Strictly it is an overlay rather than a carrier service, but commercially it competes head-on with MPLS IP VPN for the branch WAN, usually paired with cloud-delivered security as SASE.

Layer 2 vs Layer 3: the comparison that matters

Two honest qualifications. First, performance: both families can deliver low latency and jitter when properly engineered — the physics of the fibre path matters more than the layer. Layer 2 earns its low-latency reputation on point-to-point links because there are simply fewer routing hops and less provider machinery in the path. Second, cost: headline pricing favours Layer 2 at high bandwidths, but total cost of ownership includes the network engineers who design and operate what the provider no longer does. A Layer 2 WAN run by a two-person IT team is not cheaper than a managed IP VPN.

Choosing between Layer 2 and Layer 3

The decision usually resolves quickly once framed as a handful of questions:

• Control vs simplicity. If you need custom routing policy, your own address plan, or non-IP protocols, Layer 2. If you want the WAN to be someone else's job, Layer 3.
• Site count and shape. A few high-capacity links between offices and data centres favours Layer 2. Tens of branches needing any-to-any reachability favours Layer 3 or SD-WAN.
• In-house skills. Layer 2 assumes a team fluent in BGP/OSPF design, failover and capacity planning. Be honest about bench depth — it is the deciding factor more often than technology.
• Latency sensitivity. Trading systems, storage replication and GPU-cluster interconnect push toward engineered Layer 2 paths, or below them to dark fibre and wavelengths.
• Security and compliance. Both families are private by construction but neither encrypts by default. Encryption is additive at either layer — MACsec (IEEE 802.1AE) on Ethernet links, IPsec over routed paths — so treat "private network" claims as segregation, not secrecy.
• Exit costs. A Layer 2 circuit is easy to replace like-for-like. Re-homing a provider-managed Layer 3 VPN means migrating routing design, QoS policy and sometimes addressing.

Hybrid designs: why most enterprises buy both

Presenting Layer 2 vs Layer 3 as an either/or is the survey answer, not the design answer. The pattern that dominates real enterprise networks pairs them: Layer 2 for the core — data centre interconnect, headquarters-to-DC, cloud on-ramp back-ends — where bandwidth is high, latency matters and control pays for itself; and Layer 3 or SD-WAN for the branch estate, where site count is high and per-site simplicity wins. A second common pattern buys Layer 2 as the underlay and runs the enterprise's own Layer 3 network over it — effectively renting the cable and owning the brain.

This is also how the migration away from MPLS actually happens in practice. Few enterprises rip out an IP VPN in one change window; they move branches onto SD-WAN over dedicated internet access while retaining private transport — increasingly Ethernet rather than MPLS — for the sites and workloads that justify it. A fuller map of how the products fit together is in our enterprise connectivity buyer's guide.

Sourcing Layer 2 or Layer 3 connectivity in Singapore?

Browse telecom operators, network integrators and managed service providers who design and deliver Metro Ethernet, IEPL, IP VPN and SD-WAN for Singapore enterprises.

Browse telecommunication providers

Where the Layer 2 vs Layer 3 market stands in 2026

The market data tells a consistent story: the classic managed Layer 3 product is in structural decline, while its replacements grow on both sides of it. TeleGeography's WAN market forecast puts global WAN connectivity revenue roughly flat — about US$442 billion in 2025 easing to US$433 billion by 2030 — but the mix shifts sharply underneath. MPLS falls from nearly 30 per cent of that revenue to just over 13 per cent (roughly US$130 billion down to US$57 billion), while dedicated internet access grows from about US$99 billion to US$142 billion and SD-WAN nearly doubles from US$23 billion to US$42 billion. The same firm's WAN Manager Survey tracked MPLS at 82 per cent of surveyed enterprise sites in 2018 falling to 41 per cent by 2023.

Three sentiment points sit behind those numbers. First, the money leaving MPLS is not leaving private connectivity: high-bandwidth Ethernet and optical services keep growing as data centre interconnect and AI workloads pull traffic east-west between facilities. Second, the security perimeter has followed the WAN into the cloud — Dell'Oro put SASE revenue up 21 per cent year on year to over US$3 billion in the first quarter of 2026 — which reinforces internet-plus-overlay designs at the branch. Third, on the Layer 2 side, EVPN has become the default way carriers and data centre operators build Ethernet services, quietly modernising the family without changing what the customer buys.

Layer 2 and Layer 3 connectivity in Singapore

Singapore's market offers unusually deep choice at both layers. On the Layer 2 side, Metro Ethernet is available island-wide from Singtel, StarHub, M1, SPTel and ViewQwest, with speeds into the tens of gigabits and sub-millisecond metro latency achievable on engineered paths. For regional reach, IEPL is the workhorse: StarHub sells circuits from 2 Mbps to 1 Gbps across the region, and SPTel advertises IEPL reach to more than 150 countries through consortium and partner capacity. The city-state's submarine cable density is what makes those international Ethernet products competitive, and the SG–Johor corridor has become a distinct low-latency market of its own as data centre capacity spreads across the border.

The same operators all sell Layer 3: MPLS IP VPN remains widely available (particularly for international WANs), and every major provider now leads with managed SD-WAN and SASE bundles instead. Two local notes for buyers. Competitive tension stayed intact in 2026 — the proposed Simba–M1 consolidation collapsed in June 2026, leaving four mobile network operators plus strong enterprise specialists competing for business connectivity. And resilience needs to be specified physically, not just contractually: ask for path diversity across different cable landing stations, exchanges and building entry points, because two "diverse" circuits that share a duct fail together regardless of which layer you bought them at. Our internet connectivity buyer's guide covers the procurement checklist in depth.

Future outlook

The layer boundary itself is stable — frames below, packets above — but the products around it keep moving. Expect continued migration of branch WANs to SD-WAN and SASE over internet underlays, with MPLS IP VPN persisting longest in regulated, multi-country deployments. Expect Layer 2 to keep gravitating toward higher speeds: 100 Gbps Ethernet services are routine for DC interconnect, 400 Gbps is spreading, and AI-driven east-west traffic is pulling demand down the ladder toward wavelengths and dark fibre. Automation is the other axis: carriers are exposing bandwidth-on-demand and API-driven ordering for Ethernet services, shortening what used to be a procurement cycle into a portal action. For how the control-plane side of this evolves, see our explainer on software defined networking.

The buying advice, though, has not changed in a decade and is unlikely to change in the next one: decide who should run your routing — you or your provider — and let that answer, not the acronym on the datasheet, pick the layer.

Frequently asked questions

Sources and further reading

• MEF 6.3 — Subscriber Ethernet Services Definitions (MEF, now Mplify)
• TeleGeography — WAN Market Size: 2025–2030 Forecast
• TeleGeography — WAN Configurations Are Shifting (WAN Manager Survey)
• IETF RFC 4364 — BGP/MPLS IP Virtual Private Networks
• IETF RFC 7432 — BGP MPLS-Based Ethernet VPN (EVPN)
• Dell'Oro Group — SASE 1Q 2026 revenue climbs 21 per cent to over US$3B
• StarHub Business — International Ethernet Private Line (IEPL)
• SPTel — Metro Ethernet in Singapore
• Nikkei Asia — Failed Simba–M1 deal sends Singapore telecom consolidation to square one
• IMDA — Digital Connectivity Blueprint