Hospital campus access refresh with PoE, 802.1X, and multicast imaging
Rivergate Hospital is refreshing a four-building campus with 3,000 users and about 2,500 PoE endpoints: 1,100 access points, 900 IP cameras, 300 badge readers, and 200 clinical carts. Clinical VLANs are flat across buildings; biomedical devices are on the same VLAN as nurse workstations because the vendor refuses 802.1X. Access closets have 1 Gbps switches with 10 Gbps uplinks, and some closets have only two power circuits. The hospital wants 802.1X for staff, MAB for legacy devices, microsegmentation for biomedical, and PoE budget visibility. A new EHR rollout will add multicast imaging traffic between buildings. The oldest closets have Cat5e cabling limited to 1 Gbps; newer buildings have Cat6A. The hospital operates 24x7 and cannot take clinical wings down during business hours. The CIO asks whether to use a collapsed core or spine-leaf and whether to keep spanning tree.
1. Recommend a campus architecture (collapsed core vs spine-leaf, Layer 2 vs EVPN-VXLAN) and justify it against the stated constraints.
Read the worked answer
For 3,000 users and 2,500 PoE endpoints, a collapsed core per building pair is sufficient if each building stays under about 1,000 access ports. A full spine-leaf fabric is justified only if the hospital needs a single large L2/L3 domain, dense 100G, or automated microsegmentation across all buildings. The stated constraints point to a middle path: a redundant collapsed core with 100G uplinks, MC-LAG to access switches, and EVPN-VXLAN used selectively for the biomedical microsegment and the stretched clinical VLANs.
Do not keep spanning tree as the primary loop-prevention mechanism. Dual-home access switches to the core with MC-LAG or EVPN multihoming. That gives active-active uplinks, faster convergence, and no blocked ports. Keep STP as a fallback only at the edge.
For multicast EHR imaging, enable PIM-SM in the underlay or use EVPN multicast with assisted replication; test the imaging flow before cutover. A flat clinical VLAN across four buildings is a failure-domain and broadcast problem, so move to per-building VLANs with a routed core and extend only the VLANs that truly require L2 stretch.
The oldest Cat5e closets limit access to 1 Gbps, so do not promise 2.5G/5G to those endpoints. Plan the refresh by closet, starting with power-constrained closets and clinical wings that can be cut over in scheduled maintenance windows.
2. How do you handle 802.1X for staff, MAB for legacy devices, and biomedical devices that cannot authenticate? Include failure behavior and PoE planning.
Read the worked answer
Use 802.1X with EAP-TLS for staff workstations and clinical carts. Put staff in a role-based VLAN or group policy after authentication. Use MAB with profiling for printers, cameras, and badge readers, but restrict MAB to known MAC ranges and place unknown devices in a quarantine VLAN.
Biomedical devices that cannot run an 802.1X supplicant should go on a dedicated biomedical VLAN with MAB plus a static ACL that permits only the biomedical server and required vendor support endpoints. Do not put them on the nurse workstation VLAN just because the vendor refuses 802.1X; that is the segmentation gap. If the vendor requires a flat network, isolate the biomedical segment behind a firewall or use group-based policy on the switch to enforce allow-lists without changing the device IP.
Failure behavior matters in a hospital. Configure a critical VLAN for staff and clinical carts so an authentication failure does not remove life-critical connectivity; use a restricted critical VLAN, not full production access. For biomedical, fail closed by default but test vendor support paths. MAB failures should land in quarantine with help-desk visibility.
PoE planning: inventory 802.3af/at/bt per device, calculate per-closet simultaneous load, and reserve headroom for AP bursts and camera heaters. Some closets have only two power circuits, so use PoE budget alarms and per-port priority; put critical clinical devices on UPS-backed switches. Do not assume 1,100 APs at maximum power will fit existing closet power.