Hello! Welcome back to your CCNP ENCOR course.
In our last two lessons, we established a strong foundation by analyzing the traditional three-tier hierarchical model and then comparing it directly with Cisco's modern fabric architecture, SD-Access. We focused on the specific components and operational planes of these campus designs.
Today, we will broaden our perspective. The goal of this lesson is to learn how to apply the principles of the Cisco Enterprise Architecture framework to network design scenarios. This means moving beyond just the campus and learning to view the entire enterprise network as a set of interconnected, functional modules. We will explore how to make strategic design decisions within this framework, bridging the gap between architectural theory and the practical challenges you'd face as a solutions engineer.
The Big Picture: The Cisco Enterprise Architecture Model
A well-designed network is modular. Just as in software engineering, breaking a complex system into smaller, well-defined modules makes it easier to design, scale, and troubleshoot. The Cisco Enterprise Architecture formalizes this by dividing the network into distinct functional areas.
Each module in this diagram represents a functional block with specific roles and design considerations. To get a comprehensive overview of these modules, let's watch a video that introduces this framework.
ENCOR Section 1 - Examining Cisco Enterprise Network Architecture
The 'ENCOR Section 1 - Examining Cisco Enterprise Network Architecture' video provides an excellent introduction to this modular framework. It will walk you through the purpose of each block shown in the diagram above.
Please watch from the beginning to 07:02. As you watch, focus on the primary role of each of the following modules: Enterprise Campus: The local network where users and devices connect. Enterprise Edge: The gateway to the outside world, which is often subdivided into the Internet Edge, WAN Edge, and remote access components. Service Provider Edge: The block representing connectivity from various service providers (Internet, WAN, etc.). Remote Locations: Including branches and teleworkers.
As the video explains, this modular approach allows you to select the right technologies and designs for each specific area of the network while ensuring they all integrate into a cohesive whole. Now, let's see how to apply design principles within these modules, starting with the campus.
Applying Principles to the Campus Module
In the previous lessons, you've already seen the two dominant design choices for the campus: the traditional hierarchical model and the SD-Access fabric. Applying architectural principles means knowing when and why to choose one over the other.
A fabric-based SD-Access design is the strategic direction for modern, large-scale enterprise networks due to its automation, security, and flexibility benefits. However, the traditional hierarchical model remains a valid and practical choice in many scenarios, such as:
- Smaller networks where the complexity of a fabric isn't justified.
- Organizations with tight budget constraints.
- Networks with a highly static user base and predictable traffic patterns.
When opting for a hierarchical design, you still face critical design decisions.
Campus Design Decision 1: Do You Need a Core Layer?
The three-tier model includes access, distribution, and core layers. But for smaller networks, it's common to merge the core and distribution functions into a single layer. This is called a collapsed core design.
The decision to implement a dedicated core layer is primarily a question of scalability.
As you can see, without a core, every new distribution block must connect to every other existing distribution block. This leads to an exponential increase in cabling and routing complexity. A core layer simplifies this by providing a centralized, high-speed backbone, ensuring that growth is linear and manageable.
Rule of Thumb: If you have more than two or three distribution blocks (e.g., multiple large buildings in a campus), a dedicated core layer is highly recommended to ensure scalability and stable performance.
Campus Design Decision 2: Layer 2 or Layer 3 Access?
This is one of the most fundamental design choices in a hierarchical campus. It dictates where the boundary between Layer 2 (switching) and Layer 3 (routing) lies.
To understand the trade-offs, let's consult a definitive Cisco design guide.
Campus LAN and Wireless LAN Solution Design Guide - Cisco
The 'Campus LAN and Wireless LAN Solution Design Guide' is a Cisco Validated Design (CVD) document that provides authoritative guidance. We will focus on the section that compares different design options.
Please read the section titled 'Design Options: Campus Wired LAN'. Focus specifically on the subsections for 'Layer 2 access with traditional multilayer campus design' and 'Layer 3 routed access campus design'. Pay close attention to the pros and cons of each.
Let's summarize the key characteristics of each design:
| Characteristic | Layer 2 Access (Switched) | Layer 3 Access (Routed) |
|---|---|---|
| L2/L3 Boundary | Distribution Layer | Access Layer |
| VLANs | Can span across multiple access switches. | Confined to a single access switch. |
| Key Challenge | Requires Spanning Tree Protocol (STP) to prevent loops, leading to blocked links and complex failover tuning. | Requires more detailed IP subnet planning. Cannot easily support applications that need L2 adjacency between wiring closets. |
| Key Benefit | Flexible; allows a single VLAN (e.g., a voice VLAN) to exist everywhere. | Highly stable and predictable. Uses all uplinks (ECMP), converges quickly, and is simpler to troubleshoot with L3 tools (ping, traceroute). |
The Routed Access (Layer 3) design is the modern best practice for hierarchical networks because it offers superior stability and convergence. The limitations on L2 adjacency that once drove engineers to use L2 access designs are now better solved by an overlay technology like SD-Access.
Test your understanding!
A university campus has three main buildings, each with its own wiring closets. The IT team is refreshing the network with a limited budget, making a full SD-Access deployment unfeasible for now. Their primary goal is to create a highly stable, fast-converging network. A legacy application requires that a specific VLAN for lab equipment be available in all three buildings.
Based on these requirements, what design would you propose, and what are the key trade-offs?
Show answer
This scenario presents conflicting requirements, which is common in network design.
- Proposed Architecture: A three-tier hierarchical design with a dedicated core layer. Given the three buildings (implying three distribution blocks), a core layer is necessary for scalability.
- Access Layer Design: The primary goal is stability and fast convergence, which strongly suggests a Layer 3 Routed Access design. However, the requirement for a stretched VLAN for lab equipment conflicts with this.
- The Trade-off and Solution:
- Option A (Recommended): Implement a Layer 3 Routed Access design for 99% of the network to gain the stability and performance benefits. For the single legacy application, use an overlay technology (like VXLAN with manual configuration or even a simple GRE tunnel) to stretch just that one L2 domain where needed. This contains the complexity to a small part of the network.
- Option B (Compromise): Implement a Layer 2 Access design. This meets the legacy requirement easily but sacrifices overall network stability and performance due to reliance on STP. This would not be the best practice.
The best answer involves explaining this trade-off to the stakeholders and recommending Option A, which aligns with modern design principles while providing a tactical solution for the legacy constraint.
Applying Principles to the WAN Edge
Now let's shift our focus from the campus to the Enterprise Edge, specifically how we connect to remote sites. Traditionally, this was done using private WAN circuits like MPLS. However, the rise of cloud applications has exposed the limitations of this model. Backhauling all internet-bound traffic from a branch office to a central data center for security inspection adds latency and consumes expensive WAN bandwidth.
This is where Software-Defined WAN (SD-WAN) comes in. It applies the same underlay/overlay principles we saw in SD-Access to the wide area network.
REPLAY: CCNP Enterprise LIVE Webcast
This clip from Kevin Wallace provides a clear explanation of what SD-WAN is, the problems it solves, and the components of Cisco's Viptela-based solution.
Please watch from 03:37 to 14:42. Focus on how SD-WAN provides: Transport Independence: The ability to use any combination of connections (MPLS, internet, LTE). Intelligent Path Control: Automatically steering traffic over the best path based on application policies. Direct Internet Access (DIA): Allowing branch offices to send cloud traffic directly to the internet securely, avoiding the backhaul problem.
Applying architectural principles at the WAN edge means choosing the right transport solution. For an organization with many branches and significant cloud usage, an SD-WAN architecture offers clear advantages over a traditional MPLS-only design by improving performance, reducing cost, and simplifying management.
The Unifying Element: Automation and Assurance
A recurring theme in modern Cisco architecture is the move from manual, device-by-device management to a centralized, controller-based model. Your background with REST APIs and automation makes you well-positioned to understand the power of this shift. The central brain for the Enterprise Network is Cisco DNA Center.
While we introduced DNA Center as the controller for SD-Access, its role is much broader. It serves as the management and assurance platform for the entire enterprise network—campus, branch, and WAN.
Campus LAN and Wireless LAN Solution Design Guide - Cisco
Let's return to the Cisco design guide to see an official breakdown of DNA Center's functions.
Read the section 'Cisco DNA Center'. Note the four major workflow areas it manages: Design, Policy, Provision, and Assurance. This shows how it provides a single interface for the entire network lifecycle.
By providing a single point of control and a rich set of APIs, DNA Center allows you to apply consistent design and policy across all the modules of your enterprise architecture, fulfilling the promise of true intent-based networking.
Conclusion
In this lesson, we elevated our view from individual technologies to the overarching framework that guides enterprise network design. You learned how to apply architectural principles to make strategic decisions in different parts of the network.
Key Takeaways:
- The Cisco Enterprise Architecture uses a modular approach (Campus, Edge, Remote Sites) to build scalable and manageable networks.
- Applying design principles involves making choices within each module based on technical and business requirements.
- In the Campus, key decisions include whether to use a collapsed or dedicated core, and whether to build a Layer 2 or Layer 3 access network. A routed access design is the modern best practice for hierarchical networks.
- At the WAN Edge, SD-WAN provides a flexible and intelligent overlay architecture that is superior to traditional WAN designs for cloud-centric organizations.
- Cisco DNA Center is the unifying management platform that automates workflows and applies consistent policy across the entire enterprise architecture.
Preview of the Next Lesson:
A core principle in all these designs is high availability. In our next lesson, we will dive deep into this topic and analyze high availability design concepts including redundancy, fault tolerance, and stateful switchover (SSO). We will explore the specific technologies that make the resilient designs we discussed today a reality.