Campus and Branch LAN Design
Campus and Branch LAN Design
This domain tests access, distribution and core design with EX switches and Mist wireless: PoE, uplinks, VLANs, spanning tree, authentication and segmentation. The exam rewards designs that are simple, redundant and supportable.
Core rules
- Use a tiered or collapsed-core design. Virtual Chassis or MC-LAG provides device-level redundancy without complex STP.
- Calculate PoE from device class draw, not averages. Sum 802.3af/at/bt loads per switch, leave headroom for PSU failure, and verify PoE budget and UPS runtime.
- Plan uplink oversubscription from actual traffic. 1G access with 10G uplinks suits most offices; dense Wi-Fi 6 and camera estates may need 25G or 100G at the core.
- Segment user, voice, guest, IoT, camera and management traffic. Enable DHCP snooping, dynamic ARP inspection, MAC limiting and storm control at the edge.
- Use RSTP/MSTP with edge ports, BPDU guard and loop protection. For network access control, 802.1X on EX switches with Mist Access Assurance or JIMS, plus a guest portal and IoT profiling.
Worked example
A three-floor office has 600 users, 250 access points and 400 PoE cameras. Reasoning: cameras need 802.3bt and a dedicated VLAN, so the PoE budget is calculated per closet with 30 percent headroom and UPS sizing follows. EX access switches form a Virtual Chassis per floor, with 10G fiber to a redundant EX core. Users, voice, guest and IoT are separated; 802.1X protects user ports and profiling handles cameras. This meets power, redundancy and segmentation requirements without a flat Layer 2 domain.
Traps that cost marks
- Planning PoE from average draw and ignoring 802.3bt cameras.
- Flat VLANs across the whole campus.
- STP at the edge without BPDU guard or loop protection.
- 802.1X with no fallback or guest path.
- Ignoring uplink oversubscription for Wi-Fi 6.