Campus Core After a Merger

Put a router in the tenant space and two stacked PoE access switches behind it. The router is the Layer 3 edge: a routed /30 or /31 link goes over the single fiber pair to the campus core, and all leased-building VLANs (users, voice, local server) terminate on that router. This places the Layer 2/Layer 3 boundary at the tenant router, so VLAN 10, its broadcasts, and its STP domain never cross the fiber. That matters because the current flat VLAN has already caused two outages and a 1 Gb/s link carrying 300 users plus 80 phones has no spare capacity for a broadcast storm. Voice QoS is easier with a single shaped uplink: trust DSCP from the phones, place voice in the priority queue, shape the parent to about 900 Mb/s, and reserve bandwidth for call signaling. The design is not fully redundant: one fiber pair and one router mean the leased building is isolated by a fiber cut or router failure. If the lease requires five-nines, add LTE or a second fiber path; otherwise document the single point of failure. A core switch failure can still be survived because the router reaches the core through the remaining core peer link.

Do not extend VLAN 10. A Layer 2 extension would make the leased building part of the same broadcast and STP domain as 1,400 existing users and 48 access switches. One fiber pair cannot provide a redundant L2 topology, so STP would block one path or, worse, create a loop during maintenance. Broadcast storms from the campus would reach the tenant, and tenant broadcasts would reach the campus. The 1-second HSRP hello also becomes dangerous across a single link because a transient fiber event can cause both sides to believe they are active. The cheaper alternative is not L2 extension but local routing: the new router owns the leased-building subnets, runs OSPF or static routing to the core, and filters traffic to only the file server, DNS, NTP, and voice call control. If a legacy application truly requires L2 adjacency, use a point-to-point VXLAN tunnel only for that one VLAN and document it as technical debt, not as the general design.

First risk: HSRP with a 1-second hello and no interface tracking can produce a dual-active gateway if the active core switch loses its uplink while its HSRP interface stays up. Hosts keep sending to a gateway that cannot route. Mitigate with HSRP interface tracking, a preempt delay, and BFD or object tracking on the core uplinks; this costs configuration effort, not hardware. Second risk: the flat VLAN 10 makes STP root placement and broadcast containment ineffective. An access-switch root or an unintended BPDU can shift the topology and cause outages. Mitigate with explicit STP root primary/secondary on the core pair, root guard on access-facing ports, BPDU guard and storm control on edge ports, and a phased VLAN plan for users, voice, servers, and management. The new leased router can route between its local VLANs, which also gives a template for segmenting the main campus without replacing the core.