Merger Network: Hierarchy, Overlap, and Convergence
Northwind Components, formed from a merger, runs a flat network: a single OSPF area 0 across headquarters (2,400 users), two data centers, and 14 branch offices. The acquired company still uses 10.0.0.0/8 addresses that overlap Northwind's 10.10.0.0/16. Access switches are Layer 2 with 1,500 endpoints in one VLAN; Spanning Tree converges in 45 seconds after a fiber cut, and broadcast storms have twice saturated the core. The core is two Catalyst 9500s with 40G links but no redundancy at the access distribution layer. The board requires 99.99% availability, PCI segmentation for the payment team (60 servers), and room for 30% growth in five years. There are four network engineers, no automation team, and a change window only on Sundays. The CIO wants a target design before the next budget cycle.
1. Recommend a hierarchical design and define failure domains. Which layers need redundancy first, and what would you explicitly not change in phase 1?
Read the worked answer
Treat availability as a core/distribution property first. At HQ, keep a routed core (two C9500s) and add a distribution pair per building; dual-home each access stack with LACP to both distribution switches, and run an FHRP at distribution. That removes the current single-homed distribution and limits a closet failure to one floor rather than a building. Do not put user VLANs on the core. I would not start with a full SD-Access fabric: 99.99% is about eliminating single points in the core and distribution, not about overlay. Phase 1: redundant distribution, dual uplinks, routing at distribution, and a redundant OSPF area 0. Leave access switch replacement for phase 2. A single access switch is an accepted edge failure if the business signs off; a 99.99% target for the core does not require dual access switches in every closet. Measure by MTTR and single points, not by product count.
2. Build an addressing and summarization plan: resolve the 10.0.0.0/8 overlap, allocate per-site blocks, and summarize at area boundaries.
Read the worked answer
First resolve the overlap: 10.0.0.0/8 cannot coexist with 10.10.0.0/16 in one routing domain. Renumber acquired sites into 10.20.0.0/14, or if renumbering is impossible, use NAT at the merger boundary and keep it out of the core. Allocate HQ 10.10.0.0/16 (subnets /24 per floor), DC1 10.11.0.0/16, DC2 10.12.0.0/16, and branches 10.20.0.0/16 through 10.23.0.0/16. Summaries: 10.10.0.0/15 for HQ plus DC1; 10.12.0.0/16 for DC2; 10.20.0.0/14 for all branches. Keep /24 per closet for growth and summarization. Use /31 on point-to-point links from a separate 10.255.0.0/16. Do not summarize across a boundary unless the ABR has all components; otherwise you create black holes. Document the plan in IPAM and reserve /24s for out-of-band.
3. Would you keep a single OSPF area? Explain how to reduce SPF scope and speed failure detection without creating unnecessary areas.
Read the worked answer
A single area is not the root cause of 45-second convergence; STP is. Fix STP first: rapid PVST+, PortFast, BPDU Guard, root guard, and LACP. Then area design: keep HQ and DCs in area 0, put each branch in a stub or NSSA area only if the branch has multiple routers; a single-router branch can stay in area 0 and be summarized at the ABR. Too many areas add complexity without benefit. Use point-to-point links, BFD for sub-second failure detection, OSPF fast hellos only on links that need it, LSA throttling, and prefix suppression on transit links. Summarize at ABRs to shrink the LSDB and SPF. For 99.99%, redundant paths plus BFD and fast convergence matter more than area count.