Campus Refresh: Routed Access vs. Layer 2 Access with 1,200 Users
Your employer runs a three-building campus with 1,200 users and about 1,900 access ports. Each building has a pair of Catalyst 9300 distribution switches and 16 wiring closets; every closet has 2×10G uplinks, one to each distribution switch. All access ports are currently Layer 2, with building-wide VLANs, RSTP, and HSRP on the distribution pair. After any uplink flap, users see 20–40 seconds of outage, and last month a broadcast storm in one closet saturated both 10G links. You must add 400 IP cameras and 120 badge readers, keep them out of user VLANs, and meet a 99.9% availability target without buying new switches. The campus core runs OSPF area 0 and the data center advertises a default route. Management wants the smallest possible blast radius and sub-second convergence.
1. Recommend either retaining Layer 2 access with HSRP or moving to routed access links. Justify the choice against the stated convergence, blast-radius, and IoT requirements.
Read the worked answer
Recommend routed access: keep server-facing and endpoint ports as Layer 2, but convert each closet uplink to a routed /31 or /30 and run OSPF with the distribution pair. The key reasoning is failure domain. Today RSTP blocks one uplink, HSRP makes both distribution switches share one first-hop subnet, and a storm in one closet can consume campus-wide links. With routed uplinks, each closet is its own OSPF stub or totally stubby area, both 10G links can forward simultaneously as equal-cost paths, and BFD gives sub-second failure detection. A closet flap no longer causes a campus-wide RSTP topology change. The IoT requirement is met by placing cameras and badge readers in local VLANs per closet, with DHCP relay and ACLs enforced at distribution; do not stretch those VLANs building-wide. The cost is more subnets, so require IPAM and templates. HSRP disappears from access, which reduces first-hop complexity. Keep the core and distribution in OSPF area 0, and make access areas stubby so they receive only a default route.
2. The camera vendor insists all 400 cameras use one subnet because its management server discovers them by broadcast. How do you satisfy this without reintroducing a campus-wide Layer 2 domain?
Read the worked answer
Do not create one camera VLAN across all buildings; that reintroduces the broadcast and failure domain you are removing. First challenge the requirement: most discovery tools can use a seed list, DNS, or directed probes. If the application truly sends UDP broadcast, configure the camera SVI as the relay point and use ip helper-address with the specific UDP port, so broadcasts are forwarded only to the management server rather than flooded campus-wide. Keep one camera subnet per closet or per building, with DHCP relay and an ACL that permits only camera-to-server management traffic and blocks camera-to-camera and camera-to-user traffic. If the vendor cannot support relayed discovery, place a small local discovery proxy or management server instance in each building. As a last resort, use a dedicated VXLAN segment for cameras, but that adds overlay complexity and is not justified for 400 devices. The judgement is to preserve segmentation and contain broadcast, not to satisfy the vendor by flattening the network.
3. Outline a migration sequence that avoids a campus-wide outage.
Read the worked answer
Use a pilot, then waves. First, pre-build the routed uplink on one closet in parallel with the existing Layer 2 path, using new point-to-point addressing and OSPF stub configuration. Move a few noncritical ports, verify OSPF adjacency, BFD, ECMP, DHCP relay, QoS, and return traffic. Keep the old Layer 2 path configured but shut down as rollback. Next, migrate one building during a maintenance window: convert closets in pairs, validate that the distribution switch remains below safe CPU and adjacency limits, and confirm that the default route from the data center is still preferred. Then repeat per building. Pre-stage configurations with templates and variable data for closet ID, subnets, and camera VLANs. Do not remove HSRP or the old VLANs until the routed path has run cleanly through a business cycle. For IoT, migrate cameras after user ports so that any DHCP or ACL issue is isolated. Define rollback triggers, such as adjacency flaps or voice quality degradation, before the window starts.