Campus and Branch Network Design
Domain 2 - Campus and Branch Network Design tests your choice of topology, where the Layer 2/Layer 3 boundary sits, first-hop redundancy, wireless and PoE sizing, and fabric (SD-Access) design.
Topology and the L2/L3 boundary
Classic design is access-distribution-core. Three valid patterns exist: Layer 2 access with SVIs on the distribution pair; routed access, where the uplink is a /31 and the access switch is the gateway; and SD-Access, an IS-IS underlay with a LISP/VXLAN overlay. Distribution pairs use VSS, StackWise Virtual, or vPC, with HSRP/VRRP for the virtual gateway. Align the STP root and the HSRP active on the same chassis so traffic never hairpins.
Spanning tree
Keep Layer 2 domains small, run RSTP or MST, set the root bridge manually, and prefer Layer 3 links between distribution and core.
Wireless and power
Size the WLC for AP count and clients, deploy HA (SSO), and plan capacity by active clients per radio - roughly 30-50 in high-density areas - with 5 GHz preference, 20/40 MHz channels, and RRM/DCA enabled. Roaming across subnets needs mobility groups. PoE is a hard design constraint: 802.3af 15.4 W, 802.3at 30 W, 802.3bt 60/90 W per port - count APs, phones, and cameras against the switch's PoE budget, not its port count.
SD-Access
Underlay IS-IS, edge and border nodes, control-plane node, virtual networks, and SGT-based segmentation. A fusion router handles shared services and DHCP/DNS leakage between VNs.
Worked example
A 1,200-seat building: 60 APs at 30 W and 300 phones at 15.4 W. Per floor (20 APs, 100 phones) the PoE load is 600 W + 1,540 W = 2,140 W. A pair of 48-port PoE+ switches with 1,440 W budget each gives 2,880 W usable - sufficient with headroom. Each floor pair runs VSS, offers an HSRP virtual gateway, and the distribution advertises a single /20 summary to the core.
Traps
- One flat VLAN spanning the whole building, then trying to fix it with STP tuning.
- HSRP active and STP root on different switches.
- Sizing PoE from AP count alone and forgetting powered endpoints.
- Placing the WLC behind a WAN link, forcing APs to join over latency.