Lesson 62 · Network design

Campus network design

How the switches in one building fit together. Follow a three-tier campus network from the desk to the server room: access switches where people plug in, a distribution pair that routes and applies the rules, and a core that moves traffic fast. Then see how double uplinks, a bundled peer link and a shared VRRP gateway keep it running when a switch dies, and why small sites collapse the core.

10 min12 steps5 questionsBeginner

Fig 62 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01Which layer of a campus network is where users' laptops, phones and access points plug in?

Access switches sit closest to the people: one port per desk, VLAN membership and Power over Ethernet happen here.

02Where are routing between VLANs and policies like "guests may not reach the servers" usually applied?

The distribution layer holds the VLAN gateways and the access lists. The core is kept free of filters so it stays simple and fast.

03A laptop's default gateway is 192.168.10.1, shared by Dist 1 (Active) and Dist 2 (Backup) with VRRP. Dist 1 loses power. What happens?

VRRP (RFC 9568) shares one virtual IP and MAC between the pair. When the Backup hears no advertisements for about 3.6 s, it takes over; the laptop changes nothing.

04A Wi-Fi access point is fixed to the ceiling, far from any power socket. How does it usually get power?

With Power over Ethernet (IEEE 802.3) the access switch first looks for a 25 kΩ signature on the device, then sends about 48 volts down the same cable that carries the data.

05What is a collapsed core?

A single building with a few access switches does not need a separate core. The distribution pair also does the core's job: two tiers instead of three.

Key terms

Glossary

Access layer: The switches people and devices plug into: one port per desk, VLAN membership, Power over Ethernet.
Distribution layer: The switches that join the access switches together, route between VLANs and apply policy such as access lists.
Core layer: The fast centre of the network that carries traffic between distribution blocks, the server room and the internet, with no filtering.
Collapsed core: A two-tier design for smaller sites, where one redundant pair of switches does both the distribution and the core jobs.
PoE: Power over Ethernet (IEEE 802.3): the switch sends power down the same cable as the data, for access points, phones and cameras.
Uplink: The cable from an access switch up to the next layer. Campus designs give every access switch two, one to each distribution switch.
VRRP: Virtual Router Redundancy Protocol (RFC 9568): two routers share one virtual gateway address; the Active one answers, the Backup takes over if it fails.
Wireless LAN controller: A central box that manages many Wi-Fi access points over CAPWAP tunnels: their network names, channels and security settings.

Fine print

Notes and sources

Three-tier and collapsed-core designs are common practice from vendor campus design guides, not a standard; the jobs of each layer are the usual split.
VRRP version 3 is RFC 9568, which replaced RFC 5798 and renamed the "Master" router "Active". Advertisements go to 224.0.0.18; the IPv4 virtual MAC is 00:00:5e:00:01 followed by the VRID.
Dist 2 takes over after Active_Down_Interval: 3 × the 1 s advertisement interval plus a skew of (256 - priority)/256 s, 3.609 s at priority 100. Preemption is on by default, so Dist 1 takes the role back when it returns.
PoE power figures are per IEEE 802.3 clauses 33 and 145: the switch-port figure is higher than what reaches the device because some is lost in the cable.
Addresses are private (RFC 1918) and MACs come from the documentation range 00:00:5e:00:53:xx (RFC 9542, which replaced RFC 7042); 00:00:5e:00:01:0a is the real VRRP virtual MAC for VRID 10.

Quiz Unlocks after the last step.