← Interview Prep

Office Network Architecture

How to design and explain an enterprise / campus network at a whiteboard: the three-tier model, L2/L3 design, wireless, the WAN edge, and the security and redundancy that hold it together.

An office (campus) network connects users, phones, printers, wireless access points, and IoT to each other, to on-prem servers, and to the Internet — reliably, securely, and with predictable performance. The canonical way to reason about it is the hierarchical (three-tier) model, which splits the network into layers with distinct jobs so that each can scale and fail independently.

Three layers, three jobs: access connects endpoints and enforces policy at the port; distribution aggregates access switches, does inter-VLAN routing and policy; core is a high-speed, low-policy backbone that just moves packets between distribution blocks. Small sites collapse distribution and core into one layer.

The three-tier hierarchical model

Cisco's classic access / distribution / core model keeps failure domains small and the topology easy to reason about. Each access-to-distribution and distribution-to-core connection is redundant, and routing usually starts at the distribution layer.

                      INTERNET / WAN
                           │
                    ┌──────┴──────┐
                    │  Edge / FW  │      Internet edge: routers, firewall, DMZ, VPN
                    └──────┬──────┘
              ╔════════════╪════════════╗
              ║          CORE           ║   L3 backbone — fast, redundant, no policy
              ║   ┌─────┐     ┌─────┐   ║
              ║   │Core1│═════│Core2│   ║
              ║   └──┬──┘     └──┬──┘   ║
              ╚══════╪═══════════╪══════╝
                     │  ╲     ╱  │           full-mesh L3 uplinks
              ╔══════╪═══╳═══════╪══════╗
              ║  DISTRIBUTION (per block) ║  inter-VLAN routing, HSRP/VRRP, summarize
              ║  ┌────┐         ┌────┐   ║
              ║  │Dst1│═════════│Dst2│   ║   MLAG / stack pair
              ║  └─┬──┘         └──┬─┘   ║
              ╚════╪══════╤════════╪═════╝
                   │      │        │
              ╔════╪══════╪════════╪═════╗
              ║       ACCESS LAYER       ║  user ports, PoE, VLANs, 802.1X
              ║  ┌────┐ ┌────┐ ┌────┐    ║
              ║  │ SW │ │ SW │ │ SW │    ║
              ║  └─┬──┘ └─┬──┘ └─┬──┘    ║
              ╚════╪══════╪══════╪═══════╝
                   │      │      │
                 [PC]  [Phone] [AP] [IoT]   endpoints

Collapsed core (two-tier)

For a small or single-building site, a dedicated core is overkill. You collapse the core into the distribution layer: a pair of L3 distribution/core switches (usually MLAG/stacked) do both aggregation and backbone duties, with access switches dual-homed to them. This is the most common real-world office design.

• Add a real core when you have multiple distribution blocks / buildings, when the number of distribution switches makes a full mesh unwieldy, or when you need a clean point to interconnect blocks without re-cabling everything.
• Rule of thumb: 1 building = collapsed core; a campus of several buildings = three-tier.

Modern alternative: spine-leaf / SD-Access

Newer campus designs borrow the data-center spine-leaf (Clos) fabric: every leaf (access) connects to every spine, giving uniform, non-blocking, ECMP-load-balanced paths and eliminating STP-blocked links. Cisco SD-Access (and similar EVPN/VXLAN fabrics) overlays this with a VXLAN data plane, a LISP/BGP control plane, and centralized policy (group-based segmentation via SGTs) managed from a controller (DNA Center). The tradeoff is added complexity and controller dependence in exchange for consistent policy and easy segmentation.

Access layer

The access layer is where endpoints plug in and where most of the security policy lives, because it is closest to the (untrusted) user. Access switches are typically 24–48 port, PoE-capable, with 1G copper to the desk and 10/25G fiber uplinks to distribution.

• PoE / PoE+ / PoE++: power delivered over the data cable for IP phones, wireless APs, and cameras. 802.3af (PoE, 15.4 W), 802.3at (PoE+, 30 W), 802.3bt (PoE++, 60/90 W). Budget the switch's total PoE wattage against the sum of connected devices.
• VLANs segment the access layer by function so broadcast domains and policy are separated: typically data, voice, guest, and IoT VLANs (see table).
• Access ports vs trunks: an access port carries a single (untagged) VLAN to an endpoint; a trunk carries many VLANs tagged with 802.1Q between switches. An IP phone port is a hybrid: an untagged data VLAN for the PC behind the phone plus a tagged voice VLAN.

Access-port hardening

Because users control what plugs into an access port, harden every one of them:

Layer 2 design & loop prevention

Ethernet has no TTL, so a single loop melts the network with a broadcast storm. The access/distribution boundary is therefore all about loop-free redundancy.

• STP / RSTP / MSTP: Spanning Tree blocks redundant links to leave one loop-free tree, then re-converges on failure. 802.1D STP is slow (~30–50 s); RSTP (802.1w) converges in seconds; MSTP (802.1s) maps many VLANs onto a few spanning-tree instances for scalability. Use Root Guard and BPDU Guard to protect the root and the edge.
• EtherChannel / LACP: bundle multiple physical links into one logical link (802.3ad/LACP). STP sees one link, so no port is blocked, and you get the aggregate bandwidth with sub-second failover if a member dies.
• MLAG / stacking / VSS / vPC: make a pair of distribution switches appear as one logical switch so an access switch can EtherChannel uplinks to both at once. This removes the STP-blocked link entirely — both uplinks forward — while surviving the loss of either distribution switch. This is the preferred modern L2 topology.
• First-hop redundancy (FHRP): endpoints have one default gateway, so the gateway itself must be redundant. A virtual IP/MAC floats between two routers/SVIs (see table).
• SVIs & inter-VLAN routing: a Switch Virtual Interface is a logical L3 interface for a VLAN on a multilayer switch; it is the default gateway for that subnet and routes between VLANs at wire speed ("router-on-a-stick" is the older, slower single-trunk alternative).

Layer 3 design: routing & addressing

Pushing routing down to the distribution layer (a routed access or routed-distribution design) shrinks L2 domains, kills large STP topologies, and speeds convergence with an IGP instead of spanning tree.

• Where routing happens: SVIs / L3 interfaces at distribution (or core) route between VLANs and toward the WAN. The core is pure L3, load-balancing across equal-cost paths (ECMP).
• Internal IGP: run OSPF (open, link-state, area-based) or EIGRP (Cisco, fast, easy summarization) inside the campus. Design areas / boundaries so each distribution block is a summarization point.
• Summarization: aggregate each block's subnets into one prefix advertised upward. This shrinks routing tables and, crucially, contains flapping — a link bouncing inside a block doesn't ripple across the whole campus.
• Default route toward the edge: the campus IGP carries internal routes; a default route (0.0.0.0/0) is originated at the Internet edge and flooded inward so everything unknown heads to the firewall/edge routers.
• DHCP relay (ip helper-address): clients broadcast DHCP DISCOVER, which routers don't forward; the SVI relays it as unicast to a central DHCP server, inserting the subnet (giaddr) so the server picks the right scope.

Sample addressing plan

Keep it structured and summarizable — e.g. a /16 per site, a /24 per VLAN, third octet encoding building/floor:

Wireless

Wi-Fi is now the primary access medium in most offices. Two architectures dominate:

• Controller-based (WLC + APs): lightweight APs tunnel traffic (CAPWAP) to a central Wireless LAN Controller that handles RF management, roaming, and policy. The WLC connects to distribution/core; APs are PoE-powered access-layer devices on a trunk (mgmt VLAN + client VLANs).
• Cloud-managed (Meraki, Mist, Aruba Central): APs are managed from a cloud dashboard with no on-prem controller; data is usually bridged locally at the AP.
• SSID-to-VLAN mapping: each SSID maps to a VLAN/policy — e.g. Corp (802.1X/WPA2/3- Enterprise → data VLAN), Guest (captive portal → guest VLAN, Internet-only), IoT (PSK → IoT VLAN).
• Roaming: fast-roaming standards (802.11r/k/v) let clients move between APs without re-authenticating or dropping calls; the WLC coordinates the handoff and RF/channel plan.
• Guest portal: a captive portal (on the WLC or a dedicated guest anchor / NAC) handles click-through or sponsored login and keeps guests isolated from internal subnets.

WAN & Internet edge

The edge is where the campus meets the outside world — the Internet, other sites, and remote users. It is the natural place to concentrate security controls.

• Dual ISP: two providers (ideally with diverse last-mile) for redundancy and, optionally, load sharing. Terminate on two edge routers to avoid a single point of failure.
• Routing to the Internet: small sites use a static default route per ISP with failover (SLA/IP-tracking); larger or multi-homed sites run BGP with the providers (using provider-independent space and an ASN) for real multihoming and path control.
• NAT / PAT: translate the internal RFC 1918 space to public addresses; PAT (overload) shares one public IP across many hosts by port.
• Firewall: a stateful next-gen firewall enforces policy between zones (inside / outside / DMZ) and adds IPS, URL/app filtering, and TLS inspection.
• DMZ: a separate zone for Internet-facing services (web, mail relay, reverse proxy) so a compromise there can't reach the internal LAN directly.
• VPN: remote-access VPN (SSL/IPsec, or modern ZTNA) for teleworkers, and site-to-site IPsec tunnels to branches/partners.
• SD-WAN (modern option): an overlay across multiple transports (MPLS, broadband, LTE/5G) with centralized policy, application-aware path selection, and built-in encryption — increasingly replaces traditional per-site edge routers plus separate VPN.

Security & core services

• Segmentation: VLANs plus L3 ACLs (or micro-/group-based segmentation with SGTs) keep users, voice, IoT, guests, and servers apart so lateral movement is contained. Least-privilege between segments.
• ACLs & firewall zones: filter inter-VLAN and edge traffic; treat internal segments as zones with explicit allow rules (e.g. IoT may reach only its cloud, never the data VLAN).
• Guest isolation: guest VLAN routes straight to the Internet, blocked from all internal prefixes; client isolation stops guest-to-guest traffic.
• 802.1X / NAC: identity- and posture-based access at the port and the SSID, with dynamic VLAN/ACL assignment.
• DHCP / DNS / NTP: centralized, redundant infrastructure services. NTP matters more than people expect — accurate time is required for logs, certificates, and Kerberos/802.1X.
• QoS: classify and mark at the access edge (voice → EF/DSCP 46, video → AF41), trust markings upstream, and queue so voice/video stay smooth under congestion. Voice needs low latency (<150 ms one-way), low jitter, and low loss.

Redundancy & operations

• Dual everything at the core/distribution: paired devices, dual power supplies, dual uplinks. Access switches are typically single but dual-homed to two distribution switches.
• Failure domains: keep them small — an access-switch failure should affect one closet, not a building. Summarization and per-block L3 boundaries contain faults and route churn.
• Convergence: prefer L3 + IGP or MLAG over large STP domains for fast, predictable failover; tune FHRP and BFD for sub-second detection where needed.
• Monitoring & management: SNMP/streaming telemetry, syslog to a central collector, NetFlow/IPFIX for traffic visibility, out-of-band management network, config backup and version control, and NTP-synced timestamps across every device.
• Change & standardization: templated configs per role (access/distribution/core), so closets are interchangeable and reviewable.