Network hierarchy and topologies
In one line
Structured layering bounds failure domains, scales the control plane, and localizes policy - it is the foundation every other L3 decision sits on.
Layers and their purpose
- Access - host/edge connectivity and the policy edge (QoS marking, NAC, first-hop security).
- Distribution - aggregation and the routing/policy boundary: where you summarize,
redistribute, set policy, and terminate L2 domains.
- Core - fast, simple, highly available transport; no policy, no feature drag.
- Collapsed core (two-tier) for smaller sites; spine-leaf / CLOS for east-west-heavy
data centres; hub-and-spoke vs partial/full mesh for WAN (cost vs path optimality).
When does a dedicated core pay for itself?
The core question is arithmetic, not aesthetics. Without a core, distribution blocks full-mesh each other: block n adds 4(n-1) links (dual switches on both sides), so a 4th block already means ~12 new links, ~24 in total, and each distribution switch carries the whole IGP adjacency fan-out (8+ neighbours and climbing). With a dedicated core, every new block costs a constant 4 uplinks and adjacency counts stay bounded (~3 per distribution switch) - link growth drops from O(n^2) to O(n). The crossover sits around three distribution blocks: below it a collapsed core is cheaper and simpler; at or above it the dedicated core buys constant-cost growth, fewer peers to reconverge, and easy bandwidth upgrades. Keep the core itself technology-independent and policy-free so the arithmetic stays true as blocks are added.
The sizing grammar - blocks and ratios
Campus capacity planning has a standard grammar worth quoting in numbers. The unit is the ~1,000-endpoint building block: a redundant distribution pair aggregating about twenty 48-port access switches, each access switch dual-homed with one uplink to each distribution node - need 5,000 endpoints, plan five blocks. The soft ratios that keep the block honest: access-to-distribution oversubscription <= 20:1 and distribution-to-core <= 4:1 - the AI-fabric 1:1 discipline does not belong here, and gold-plating a campus toward it is spend without a requirement. The scale arithmetic follows the aggregation: the distribution pair learns the sum of everything below it - twenty access blocks of 1-2K MACs each lands 20-40K MAC entries and a comparable ARP/ND burden at the distribution SVIs, with IPv6 multiplying it (a host holds 3+ ND entries - link-local plus globals) - and the same summing applies to AAA sessions (every host one session, IP phones two: voice plus data). Size the distribution tier's tables and the authenticator's session capacity to the sum, not to one closet.
Access-layer design model: Layer 2 vs routed access vs fabric
A campus design's biggest single decision is where the Layer 3 boundary sits at the edge, because it dictates whether you live with STP and FHRP at all. In a Layer 2 access design the access switches are L2 and the distribution is the routing boundary, so VLANs/subnets span the distribution, STP controls loops, and FHRP (Layer 2 fault isolation and resiliency) provides the default gateway - familiar and flexible, but convergence is bounded by STP/FHRP and the L2 domain is the blast radius. In a routed access design L3 goes all the way to the access switch: there is no STP and no FHRP, convergence is fast and deterministic via the IGP/ECMP (Fast convergence techniques), and failure domains are smallest - the trade is that a subnet cannot stretch beyond a single access switch. SD-Access fabric (Overlays and BGP EVPN) is the third model: a routed underlay with a VXLAN overlay that decouples addressing from location, so you regain L2-like mobility and gain SGT policy - at the cost of a controller, a LISP map system, and more moving parts. Pick L2 access for simple/legacy needs, routed access for stability and fast convergence without L2 stretch, and the fabric when policy-based segmentation and endpoint mobility at scale justify the complexity.
Comparison
Topology hiding
Summarization at boundaries, OSPF stub/NSSA areas, IS-IS L1/L2, and route filtering keep flooding/SPF scope small and hide internal structure from other domains - smaller blast radius, less churn, less exposure.
Fault isolation and resiliency (3.6)
- Fate sharing is the enemy: redundant paths that share a conduit, linecard, power feed, or
SRLG fail together. Design diverse paths, not just duplicated ones.
- Redundancy is a cost/availability tradeoff: N+1 vs full 2N; more redundancy = more cost
and more state to converge.
Core plane architectures (how many failure planes?)
When a scenario asks you to replace or re-architect the core, the option set is really about how many independent failure planes the core has - and who runs them. A single-plane core (one control+data plane, typically a partial mesh grown to fit traffic) is the self-run default: links sit exactly where optimal routing wants them and end-to-end services/virtualization are easy, but all resiliency lives inside one domain - and unplanned growth breeds a spaghetti core. A dual-plane core runs two fully independent, simpler cores in parallel: resiliency means switching traffic to the other plane, failure domains barely overlap, and - the underrated win - services can be staged one plane at a time, so a bad rollout never touches both. The price is operating two of everything, and a double failure still bites. A multiplanar core keeps the parallel planes but joins them with shunt links at a few meet points: simpler to operate, and the shunts add a (higher-cost) alternate path - but the planes become only semi-independent, because the shunts couple the control planes. Outsourcing the core to a provider L3VPN buys a contractual SLA with minimal in-house effort, at the price of routing/TE control and end-to-end virtualization (WAN transport architecture selection carries the procurement side of this axis).
Map the drivers: IP-only + many sites + cost-first + small team -> provider L3VPN; L2 interconnect, traffic engineering, or per-BU virtual networks -> self-deployed MPLS on a single or multiplanar core; extreme availability or the need to roll out changes without ever risking the whole core -> dual-plane (or multiplanar). And weigh the operational metric that climbs with every added plane and protocol: the mean time between mistakes (MTBM) - more parallel complexity means more chances that the operator, not the fibre, causes the next outage. The multicast twin of dual-plane thinking is Live-Live (Multicast routing design - PIM, RP, MSDP).
Why it matters for design
The hierarchy decides where summarization happens, where failure domains end, and where policy lives. Get it right and aggregation, convergence, and security all fall into place.
A complementary cut to layered, topological decomposition is functional: Places In the Network (PINs) - campus, branch, WAN, data center, Internet edge - each a module defined by its role, free to use a different design paradigm and security posture (a hub-and-spoke retail WAN beside a Clos data center is not inconsistency; it is per-PIN fit). PINs also give scenario answers a clean structure: state the paradigm and policy per place, then design the seams between them.
IPv6 / dual-stack note
Hierarchy is address-family agnostic; plan v6 addressing to summarize at the same boundaries.
Related
- Route aggregation and summarization
- IGP selection - OSPF vs IS-IS vs EIGRP
- Fast convergence techniques
Spaced repetition
In the access/distribution/core model, which layer is the routing and policy boundary (summarization, redistribution, policy)?
The distribution layer.
Two redundant paths that share a conduit, linecard, or power feed are an example of [...] (they fail together).
Two redundant paths that share a conduit, linecard, or power feed are an example of fate sharing (they fail together).
The core layer should carry [...] - it is optimized purely for fast, resilient transport.
The core layer should carry no policy / features - it is optimized purely for fast, resilient transport.
What does choosing routed access (L3 to the access switch) eliminate, and what does it cost?
It eliminates STP and FHRP and gives fast IGP/ECMP convergence with the smallest failure domains; the cost is that a subnet/VLAN can no longer stretch beyond a single access switch.
Why does an SD-Access fabric give L2-like mobility without spanning VLANs?
A VXLAN overlay on a routed underlay decouples the endpoint's address (EID) from its location (RLOC), so endpoints move and keep their subnet while the underlay stays purely routed - at the cost of a controller and LISP map system.
A dual-plane core buys two things a multiplanar (shunt-linked) core cannot fully deliver - what are they?
Truly independent failure domains (no control-plane coupling through shunt links) and service rollout staged one plane at a time; the price is operating two of everything.
Around how many distribution blocks does a dedicated core pay off, and what is the mechanism?
~Three. Full-meshed distributions grow links O(n^2) (block n adds 4(n-1) links) with ballooning IGP adjacencies; a core makes each new block a constant 4 uplinks with bounded peering.
What is the campus sizing grammar?
A ~1,000-endpoint building block (redundant distro pair + ~20 dual-homed 48-port access switches), access-to-distro <=20:1 and distro-to-core <=4:1 soft oversubscription - and the distribution learns the sum of everything below it (20-40K MACs/ARP, 3+ ND entries per v6 host, AAA sessions with phones counting twice).
Sources
- Cisco Live BRKENS-2500 (S. Wargo, J. Matela), Advanced Campus Network Design (2026 deck, user-supplied PDF; all 197 pages passed 2026-07-26) - 1K-endpoint block, 20:1/4:1 soft ratios, distribution scale-summing arithmetic.
- Cisco Live BRKCRS-2031 (Cisco Plus Canada 2012): Multilayer Campus Architectures and Design Principles - core-layer justification: full-mesh link and adjacency growth vs dedicated core
- Cisco Press, Optimal Routing Design; Designing for Cisco Network Service Architectures (ARCH).