Architecture · Topic 1 of 5
Enterprise Network Design Models
Compare two tier, three tier, fabric and cloud designs for the enterprise network, and learn which layer does what and when each model fits best.
- 5 min
- Includes a diagram
- The three tier model has access, distribution and core layers.
- Access connects endpoints. Distribution aggregates and applies policy. Core moves traffic quickly.
- A two tier design collapses the core and distribution layers into one.
What it is
An enterprise network design model is a repeatable layout that tells you which devices go where and what each one does.
A good model keeps a network easy to grow, easy to troubleshoot and predictable when something fails. Cisco describes the classic campus in layers, and newer designs add a fabric or move services into the cloud. The exam expects you to recognise each model, name its layers and say when it fits.
How it works
Each model trades size, cost and complexity against each other.
Three tier design
The three tier model has access, distribution and core layers. The layers split the work so each switch has a clear job.
| Layer | Main job | Typical features |
|---|---|---|
| Access | Connects endpoints | Port security, VLANs, PoE, first hop security |
| Distribution | Aggregates access switches and applies policy | Inter VLAN routing, ACLs, summarisation, FHRP |
| Core | Moves traffic between distribution blocks as fast as possible | High speed links, routing, little or no policy |
Each access switch connects to two distribution switches for redundancy. Each distribution switch connects to two core switches. The distribution layer is also the border of the Layer 2 domain in a routed design, so VLANs stay small.
Two tier design (collapsed core)
A two tier design merges the core and distribution layers into one. It is also called a collapsed core.
The access layer connects to a pair of collapsed core switches that do both jobs. This costs less and has fewer devices to manage.
It suits a small or medium site, such as a single building or a small campus. A very large campus may outgrow it, because every access block has to home on the same pair of switches.
Fabric design
A fabric is a network built from an underlay and an overlay. The underlay is a simple routed network that moves packets between fabric nodes. The overlay is a virtual network that rides on top and carries the user traffic.
The data centre often uses a spine and leaf layout. Every leaf connects to every spine, and endpoints connect only to leaf switches. Any two leaf switches are the same distance apart, so latency is predictable and bandwidth grows by adding spines.
In the campus, Cisco SD-Access is a fabric design. It adds automation and policy on top of the underlay and overlay idea. It has its own page in this chapter.
Cloud design
A cloud design places some applications or services outside the enterprise buildings. Two ideas matter here.
- Service models: infrastructure as a service gives you virtual machines and networks. Platform as a service gives you a runtime for your code. Software as a service gives you a finished application.
- Deployment models: a private cloud serves one organisation. A public cloud is shared among many customers. A hybrid cloud joins private and public parts.
Branch sites then need a reliable way to reach those services. Many enterprises use an SD-WAN overlay, a direct connection to the cloud provider, or VPN tunnels over the internet. Traffic that once flowed through the head office may now go straight from the branch to the cloud.
Choosing a model
| Model | Best fit | Watch out for |
|---|---|---|
| Two tier | Small and medium sites | Limited scale |
| Three tier | Large campus with several buildings | More devices and cost |
| Fabric | Data centre, or campus needing automation and segmentation | Needs planning of underlay and overlay |
| Cloud | Services that must scale or be reached from anywhere | Dependence on WAN and provider |
Design principles that apply to every model
Several ideas repeat in every model.
- Hierarchy: layers keep each device simple and its job clear.
- Modularity: a building or block can be added or changed without redesigning the whole network.
- Resilience: devices and links are paired so one failure does not stop traffic.
- Predictable paths: a regular layout means traffic takes the same number of hops each time.
What to remember for the exam
Seven facts cover most questions on this topic.
- The three tier model has access, distribution and core layers.
- Access connects endpoints. Distribution aggregates and applies policy. Core moves traffic quickly.
- A two tier design collapses the core and distribution layers into one.
- Two tier suits small and medium sites. Three tier suits large campuses.
- A fabric has an underlay (routed transport) and an overlay (virtual networks).
- Spine and leaf is a common data centre fabric. Every leaf connects to every spine.
- Cloud models are described as IaaS, PaaS and SaaS, and as private, public or hybrid.
When a question mentions a small campus with cost in mind, think collapsed core. When it mentions a large campus with many buildings, think three tier.
Common mistakes
These four mistakes appear often.
Putting heavy policy in the core. The core should be fast and simple, so policy belongs in distribution or access.
Thinking a collapsed core removes a layer of function. The functions of distribution and core still exist. They are only combined on the same switches.
Mixing up underlay and overlay. The underlay is the physical routed network. The overlay is the virtual network built on it.
Treating cloud as only a data centre replacement. Cloud design also changes how branches connect and where traffic goes.
Do not describe fabric as a replacement for redundancy. A fabric still needs paired devices and multiple links.
Check yourself
Work through these three questions.
Which layer connects endpoints to the network in the three tier model?
The access layer connects endpoints such as PCs, phones and access points.
What is a collapsed core design?
It is a two tier design in which the core and distribution layers are combined on the same pair of switches.
What are the two parts of a fabric?
A fabric has an underlay, which is the routed transport, and an overlay, which carries the virtual networks.
Topic 1 of 5 in Architecture
Test yourself on Architecture
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.