Home » Network Design Patterns: Three-Tier, Spine-Leaf, Campus, Branch และ Data Center
Network Design Patterns: Three-Tier, Spine-Leaf, Campus, Branch และ Data Center
Network Design Patterns: Three-Tier, Spine-Leaf, Campus, Branch และ Data Center
Network Design Patterns เป็นแนวทางมาตรฐานในการออกแบบ network ให้ scalable, resilient และ manageable Three-Tier (Core-Distribution-Access) เป็น classic campus design, Spine-Leaf เป็น modern data center fabric, Campus Design รวม wired + wireless + security สำหรับ office, Branch Design เชื่อม remote offices เข้า corporate network และ Data Center Design เน้น high-bandwidth + low-latency สำหรับ applications
Network ที่ออกแบบไม่ดีจะ มีปัญหาซ้ำซาก: bottlenecks, single points of failure, STP loops, ขยายยาก, troubleshoot ยาก Proper design patterns ที่พิสูจน์แล้วช่วยหลีกเลี่ยงปัญหาเหล่านี้ และทำให้ network พร้อมรองรับ growth ในอนาคต
Design Principles
| Principle |
รายละเอียด |
| Hierarchy |
แบ่ง network เป็น layers (core, distribution, access) — แต่ละ layer มีหน้าที่ชัดเจน |
| Modularity |
แบ่งเป็น modules (campus, data center, WAN, DMZ) — เปลี่ยน module หนึ่งไม่กระทบอีก module |
| Redundancy |
ไม่มี single point of failure (dual links, dual devices, dual paths) |
| Scalability |
เพิ่ม capacity ได้ง่ายโดยไม่ redesign (add switches, add links) |
| Resiliency |
Converge เร็วเมื่อมี failure (sub-second failover) |
| Security |
Defense in depth: segmentation, access control, encryption ทุก layer |
Three-Tier Architecture
| Layer |
Role |
Devices |
| Core |
High-speed backbone (packet forwarding, no policies) |
High-end routers/switches (Nexus 9K, Catalyst 9600) |
| Distribution |
Policy enforcement, routing, filtering, aggregation |
L3 switches (Catalyst 9400/9500, Arista 7280) |
| Access |
End-user connectivity (ports for devices, PoE, 802.1X) |
L2/L3 switches (Catalyst 9200/9300, Arista 720) |
Three-Tier Design Rules
| Rule |
รายละเอียด |
| Core = Fast forwarding |
No ACLs, no QoS marking, no unnecessary processing — just forward fast |
| Distribution = Policies |
Routing, ACLs, QoS, VLAN termination, summarization |
| Access = Connectivity |
Port security, 802.1X, PoE, VLAN assignment |
| L3 at Distribution |
Route between VLANs at distribution layer (not access) |
| Dual uplinks |
Every access switch → 2 distribution switches (redundancy) |
| Avoid VLAN spanning |
VLAN should not span multiple access switches (limit broadcast domain) |
Spine-Leaf Architecture
| Feature |
รายละเอียด |
| Spine |
Backbone switches — connect to every leaf (no direct spine-to-spine) |
| Leaf |
ToR (Top of Rack) switches — connect to servers + every spine |
| Full Mesh |
Every leaf connects to every spine → equal-cost paths → ECMP load balancing |
| Hop Count |
Maximum 2 hops (server → leaf → spine → leaf → server) — predictable latency |
| L3 Everywhere |
L3 routing (BGP/OSPF) between leaf and spine — no STP needed |
| Scale Out |
Add more spines (bandwidth) or more leafs (ports) — linear scaling |
| Overlay |
VXLAN overlay สำหรับ L2 extension across L3 fabric (EVPN-VXLAN) |
| Use Case |
Data center, cloud infrastructure |
Campus Design
| Block |
Components |
| Access Block |
Access switches + APs + phones + cameras (per floor/building) |
| Distribution Block |
Aggregation + routing + policies (per building/campus) |
| Core Block |
High-speed backbone connecting distribution blocks |
| Services Block |
Shared services: DHCP, DNS, NTP, authentication (RADIUS), monitoring |
| DMZ Block |
Internet edge: firewall, web servers, email, VPN concentrator |
| WAN Block |
WAN routers, SD-WAN, MPLS, internet connections |
| Wireless |
WLC (Wireless LAN Controller) + APs throughout campus |
Branch Design
| Size |
Design |
Devices |
| Small (< 25 users) |
Single switch + AP + SD-WAN/router (no distribution layer) |
Catalyst 9200 + Meraki AP + vEdge/Meraki MX |
| Medium (25-100 users) |
Collapsed core/distribution + access switches + APs |
Catalyst 9300 (stack) + APs + ISR/ASR |
| Large (100+ users) |
Mini three-tier (distribution + access) + local services |
Catalyst 9400/9500 + 9200/9300 + local DC |
Data Center Design
| Aspect |
Traditional |
Modern |
| Topology |
Three-tier (core/aggregation/access) |
Spine-leaf (CLOS fabric) |
| L2/L3 |
Large L2 domains + STP |
L3 fabric + VXLAN overlay (no STP) |
| Oversubscription |
20:1 at access, 4:1 at aggregation |
1:1 to 3:1 (non-blocking or low oversubscription) |
| East-West Traffic |
Hairpin through core (inefficient) |
Direct leaf-to-leaf via spine (2 hops) |
| Multi-tenancy |
VLANs |
EVPN-VXLAN (VNI per tenant) |
| Automation |
CLI/manual |
Ansible + Terraform + GitOps |
ทิ้งท้าย: Good Design = Scalable, Resilient, Manageable Network
Network Design Patterns Three-Tier: core (fast forwarding) + distribution (policies) + access (connectivity) — campus standard Spine-Leaf: full mesh, 2 hops max, L3 ECMP, VXLAN overlay — data center standard Campus: access + distribution + core + services + DMZ + WAN blocks Branch: small (single switch), medium (collapsed core), large (mini three-tier) Data Center: spine-leaf + EVPN-VXLAN + 1:1 oversubscription + automation Principles: hierarchy, modularity, redundancy, scalability, resiliency, security
อ่านเพิ่มเติมเกี่ยวกับ EVPN-VXLAN Data Center Fabric และ Network Redundancy HSRP VRRP ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
