Home » Campus Network Design: Three-Tier, Collapsed Core, SD-Access, Wireless Design และ High Availability
Campus Network Design: Three-Tier, Collapsed Core, SD-Access, Wireless Design และ High Availability
Campus Network Design: Three-Tier, Collapsed Core, SD-Access, Wireless Design และ High Availability
Campus Network Design เป็นพื้นฐานของ enterprise networking Three-Tier (Core-Distribution-Access) เป็น traditional design ที่ใช้กันมานาน, Collapsed Core รวม Core และ Distribution เข้าด้วยกันสำหรับ smaller campuses, SD-Access เป็น modern fabric-based approach, Wireless Design วางแผน WiFi coverage และ capacity และ High Availability ออกแบบให้ network ไม่ล่ม
Campus network ที่ออกแบบไม่ดี ส่งผลกระทบต่อทุกคนในองค์กร: WiFi ช้า/หลุด, application ใช้ไม่ได้, VoIP quality ต่ำ, security holes ที่ attacker exploit ได้ง่าย Cisco estimates ว่า 60% ของ network problems เกิดจาก poor design ไม่ใช่ hardware failure การลงทุนเวลาออกแบบ network ที่ดีตั้งแต่แรกประหยัดเงินและเวลามหาศาลในระยะยาว
Three-Tier Architecture
| Layer |
Function |
Equipment |
| Access Layer |
Connect end devices (PCs, phones, APs, printers) → port security, VLAN assignment, PoE |
Catalyst 9200/9300, Meraki MS |
| Distribution Layer |
Policy enforcement, inter-VLAN routing, ACLs, summarization, redundancy |
Catalyst 9400/9500, Nexus 9300 |
| Core Layer |
High-speed transit, connect distribution blocks, WAN edge, data center → no policy processing |
Catalyst 9600, Nexus 9500 |
Collapsed Core
| Feature |
Three-Tier |
Collapsed Core |
| Layers |
Access + Distribution + Core (3 tiers) |
Access + Distribution/Core combined (2 tiers) |
| Size |
Large campus (1,000+ users, multiple buildings) |
Small-medium campus (< 500 users, 1-2 buildings) |
| Cost |
Higher (more switches, more links) |
Lower (fewer devices) |
| Scalability |
Better (add distribution blocks) |
Limited (must migrate to 3-tier when growing) |
| Redundancy |
Full redundancy at every layer |
Redundancy at collapsed core (dual switches) |
SD-Access (Software-Defined Access)
| Feature |
รายละเอียด |
| คืออะไร |
Cisco’s campus fabric: VXLAN overlay + LISP control plane + CTS (TrustSec) policy |
| DNA Center |
Controller: design, provision, policy, assurance — single pane of glass |
| Fabric |
VXLAN overlay over physical underlay → macro/micro-segmentation via SGT |
| Control Plane |
LISP: host tracking (MAC, IP → location mapping) — replaces traditional flooding |
| Policy |
ISE + SGT → identity-based policy → “who can talk to whom” regardless of location |
| Wireless |
Fabric-enabled APs → wireless traffic enters fabric at AP (no controller hairpin) |
| Benefit |
Zero-touch provisioning, consistent policy wired+wireless, automated segmentation |
Wireless Design
| Aspect |
Consideration |
Best Practice |
| Coverage |
Every area has signal ≥ -67 dBm (data), -65 dBm (voice) |
Site survey (predictive + active), AP placement every 15-20m |
| Capacity |
Users per AP: 25-30 (typical), channels: 1/6/11 (2.4GHz), 36-165 (5GHz) |
High-density: more APs lower power, WiFi 6/6E for capacity |
| Roaming |
Seamless handoff between APs (< 150ms for voice) |
802.11r (fast BSS transition), 802.11k/v (neighbor reports) |
| Security |
WPA3-Enterprise, 802.1X, RADIUS |
Separate SSIDs: Corporate (802.1X), Guest (captive portal), IoT |
| Controller |
Centralized (WLC) vs cloud-managed (Meraki) |
Centralized for large campus, cloud for distributed sites |
| WiFi 6/6E/7 |
OFDMA, MU-MIMO, BSS Coloring, 6GHz band |
Deploy WiFi 6E/7 for new installations — future-proof |
High Availability
| Technique |
Layer |
How |
| Redundant Links |
L1/L2 |
Dual uplinks from access to distribution → EtherChannel/LAG |
| FHRP (HSRP/VRRP) |
L3 |
Virtual gateway: active + standby router → failover in seconds |
| Stacking (StackWise) |
L2/L3 |
Multiple physical switches act as one logical switch → MEC (Multi-Chassis EtherChannel) |
| VSS/StackWise Virtual |
L3 |
Two chassis act as one → eliminates STP, active-active forwarding |
| NSF/SSO/GR |
L3 |
Non-Stop Forwarding during supervisor failover → sub-second convergence |
| Dual WAN |
WAN |
Primary + backup ISP → BGP or floating static routes for failover |
| UPS + Generator |
Power |
Dual power supplies, UPS for bridge, generator for extended outage |
Design Best Practices
| Practice |
Detail |
| Modular Design |
Design in blocks (access block, distribution block) → add blocks to scale |
| Hierarchical |
Clear layer separation → each layer has defined function → easier troubleshooting |
| Deterministic |
Predictable traffic paths → know exactly how traffic flows → easier to optimize |
| VLAN Pruning |
Limit VLANs to access layer → don’t extend L2 across distribution → reduce broadcast domain |
| Routing at Distribution |
L3 boundary at distribution → inter-VLAN routing → summarize to core |
| Documentation |
Network diagrams (L1, L2, L3), IP scheme, VLAN table, port mapping → update regularly |
ทิ้งท้าย: Good Design = Reliable, Scalable, Secure Network
Campus Network Design Three-Tier: access (connect devices) + distribution (policy/routing) + core (high-speed transit) — large campus Collapsed Core: access + combined dist/core — small-medium campus (< 500 users) SD-Access: VXLAN fabric + LISP + SGT + DNA Center — modern, identity-based, automated Wireless: site survey, -67dBm coverage, WiFi 6/6E, 802.11r roaming, WPA3-Enterprise HA: redundant links, FHRP (HSRP/VRRP), stacking, VSS, NSF/SSO, dual WAN, dual power Best Practices: modular blocks, hierarchical layers, routing at distribution, VLAN pruning, documentation Key: invest time in design upfront → saves 10x in troubleshooting and redesign later
อ่านเพิ่มเติมเกี่ยวกับ Network Segmentation Micro-Segmentation Zero Trust และ Wireless Security WPA3 802.1X RADIUS ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
