Network Security Architecture and Design
Design principles
Start from a segmented, least-privilege topology: separate management, user, guest, IoT, and server zones, and enforce policy at a consistent control point (controller, gateway, or fabric) rather than relying on VLAN sprawl. Know the difference between segmentation (isolating traffic) and enforcement (deciding whether traffic flows). Aruba designs commonly combine role-based access with centralized policy so the same intent applies wired and wireless.
Key concepts to name
- Defense in depth: edge, distribution, core, and data-center controls layered.
- Trust boundaries and where encryption terminates.
- Control plane vs. data plane separation (controller-based vs. gateway/fabric models).
- Redundancy: controller clustering, standby, and how failover affects policy continuity.
- Management-plane hardening: out-of-band management, ACLs, and restricted protocols.
Traps
Questions often test whether a design scales or whether it merely works. A design that puts every user VLAN trunked everywhere fails least-privilege even if access control is correct. Another trap: confusing high availability with load balancing - failover preserves service, it does not by itself improve throughput. Watch for wording that assumes wireless and wired policy are configured separately when the intent is unified.
Rule of thumb
If a design requires touching more than one policy source to add a new user type, it is probably not role-based enough. Design so a new role is a policy entry, not a topology change.