Enterprise LAN and Campus Design
This domain examines campus topology, the Layer 2/Layer 3 boundary, loop prevention, first-hop redundancy, wired/wireless convergence and edge security - and the trade-offs between them.
Where to terminate Layer 2
The central campus decision is how far VLANs stretch. Layer 2 access with first-hop redundancy (HSRP, VRRP, GLBP) keeps VLAN extension simple for wireless roaming and legacy appliances, but blocks half the uplinks to spanning tree and bounds the failure domain. Routed access (Layer 3 to the wiring closet) removes STP blocking, enables ECMP, converges faster with BFD, and shrinks broadcast domains - at the cost of per-closet subnets and more careful IP planning. Many designs split the difference: routed links to closets, but wireless client VLANs terminated on the distribution pair so mobility is preserved.
Hierarchy and loop prevention
Access/distribution/core, or a collapsed core in smaller sites. Place the STP root deliberately at the distribution layer, use rapid-PVST+ or MST for scale, and enable BPDU Guard, BPDU Filter and Loop Guard on access ports. Where switches support stacking, VSS or vPC/MLAG, dual-homed servers and access switches can use both uplinks actively.
Edge considerations
PoE budget per switch and per UPS must be summed for phones, APs and cameras, including inrush. The QoS trust boundary belongs at the phone or access point, not at the uplink. DHCP snooping, Dynamic ARP Inspection and IP Source Guard protect against rogue servers. Deploy 802.1X with EAP-TLS, MAB fallback for devices without supplicants, and downloadable ACLs or Security Group Tags for enforcement.
Worked example
A building has 48 access switches, two distribution switches and a requirement for ≤ 200 ms convergence on voice. A Layer 2 design using RSTP with default timers plus HSRP at 1 s hellos can take several seconds to fail over. A routed-access design with OSPF, BFD and equal-cost paths converges in well under a second and uses both uplinks. Choose routed access, keep two wireless VLANs terminated on the distribution pair with a mobility tunnel to preserve roaming, and place the QoS trust boundary on the access switch port where the IP phone attaches.
Traps that cost marks
- Assuming rapid spanning tree is fast without checking timer tuning and topology depth.
- Extending a single VLAN across the whole campus, creating one broadcast and failure domain.
- Ignoring PoE and UPS sizing, then discovering phones reboot during a power event.
- Trusting DSCP markings from PCs instead of re-marking at the access edge.
- Forgetting DHCP relay and option 82 when designing per-closet subnets.