Campus Fabric for a Hospital with a Small Network Team
A 420-bed hospital has 2,400 access ports across 60 switches in three buildings, 12 core/distribution switches, and 800 PoE devices including cameras and Wi-Fi 6E access points. The four-person network team inherited a Cisco estate with SmartNet renewing in five months. A spanning-tree loop caused a 40-minute outage last year. Clinical IoT devices must be segmented without adding firewall ports at every closet. The CIO wants 'one fabric' and has asked for Aruba. The CFO will approve only if the three-year TCO is below Cisco renewal plus a planned refresh. The hospital cannot accept a cloud-only management model unless data residency and break-glass access are proven. A pilot in one building is acceptable. The network team has no EVPN experience.
1. Design the Aruba switching and segmentation approach. State clearly what should be fabric and what should not.
Read the worked answer
Design for the requirement, not the slogan:
- Access: Aruba CX 6300/6400 series with PoE for cameras and Wi-Fi 6E APs, sized for 2,400 ports and 800 PoE devices with power budget headroom.
- Core: CX 8360 pairs in VSX at each building or a collapsed core, with 10/25 GbE uplinks. Use EVPN-VXLAN fabric only if the three buildings need a common overlay or if moves/adds/changes justify it; for 60 switches, VSX plus dynamic segmentation may be enough.
- Segmentation: Aruba Dynamic Segmentation with role-based policies for clinical IoT, cameras, guest, and medical devices. Use ClearPass for device profiling and enforcement. Avoid adding firewall ports in every closet; enforce at the access layer and core.
- Management: Aruba Central only if data residency and break-glass access are proven; otherwise use on-prem management with a documented cloud exit. The fabric is a tool, not the goal. The goal is segmentation, loop prevention, and a small team that can operate it.
2. How do you address the outage risk and the team's lack of EVPN experience?
Read the worked answer
Treat the 40-minute loop as a design and process failure, not a reason to buy the biggest fabric. Mitigate:
- VSX at core/distribution and loop protection at access; standardize STP/MST or eliminate loops by design.
- Configuration backup and automated compliance checks; a tested rollback plan.
- A one-building pilot with success criteria: zero unplanned outages, segmentation tests pass, and mean time to change improves.
- Training for four people and a break-glass runbook.
- Keep Cisco and Aruba in parallel during migration; do not cut over clinical systems in one weekend. If the team cannot operate EVPN-VXLAN, do not sell it. A simpler VSX design with dynamic segmentation is lower risk and still meets the clinical IoT requirement. The TCO must include training and dual-running, not just hardware.
3. Handle the 'Cisco installed base is safer' objection and explain how you would prove the TCO case.
Read the worked answer
Do not attack Cisco's installed base; attack the renewal-plus-refresh cost and the operational risk. Build a three-year comparison:
- Cisco: SmartNet renewal plus planned refresh, licensing, power, and the cost of the last outage.
- Aruba: hardware, support, Central/on-prem management, training, migration labor, and dual-running.
- Normalize for ports, PoE, Wi-Fi 6E, and segmentation; include 15-20% contingency. Then propose a phased pilot in one building and a decision gate. If Aruba is not below Cisco renewal plus refresh, say so. The competitive differentiator is not 'one fabric'; it is lower operational complexity for a four-person team, open standards, and a migration path that protects clinical uptime. Handle the 'Cisco is safer' objection with a reference visit and a failure-mode test, not a feature sheet.