Hierarchical Network Design Models

From Messy to Modular: The Need for Hierarchy

Imagine a network that grew "organically" over time. New switches are added wherever a port is needed, servers are plugged into the nearest available switch, and connections are made based on convenience. This might work for a very small setup, but as the network grows, it quickly becomes chaotic, difficult to troubleshoot, and impossible to scale efficiently.

The hierarchical network model was developed to solve this problem by providing a structured, modular framework. To understand this transition from a chaotic to a structured approach, let's watch a short segment from a video by KishSquared.

As the video explains, a hierarchical design brings order and predictability. This approach is built on four key principles:

• Hierarchy: A layered structure that clarifies the role of each device.
• Modularity: Allows you to replicate design elements as the network grows, simplifying scaling.
• Resiliency: Isolates faults to smaller domains, improving overall network availability.
• Flexibility: Enables intelligent use of network resources, like load sharing across redundant paths.

The Three-Tier Hierarchical Model

The most common implementation of this design is the three-tier model, which segments the campus network into three distinct layers: Access, Distribution, and Core.

Each layer has a specific set of functions and responsibilities. Let's break them down one by one.

1. The Access Layer: The Network Edge

The access layer is where end-user devices connect to the network. This includes PCs, IP phones, printers, security cameras, and wireless access points. Because it's the first point of entry into the network, it's one of the most feature-rich layers.

Primary Functions & Services:

• End-Device Connectivity: Provides Layer 2 switched connectivity to endpoints.
• VLAN Assignment: Assigns devices to specific VLANs, segmenting the network into different broadcast domains.
• Power over Ethernet (PoE): Delivers power to devices like IP phones and wireless APs.
• Quality of Service (QoS): Classifies and marks traffic to ensure that critical applications (like voice and video) receive the appropriate priority. The trust boundary is typically set here.
• Security: Implements crucial edge security features like port security, DHCP snooping, and 802.1X for access control.

To get a more detailed look at the services and considerations at this layer, please watch this segment.

2. The Distribution Layer: The Policy Workhorse

The distribution layer serves as the crucial middle ground between the access layer and the core. Its primary role is to aggregate traffic from the access layer switches and enforce network policies. This is where most of the "thinking" happens.

Primary Functions & Services:

• Aggregation: Acts as an aggregation point for all access layer switches in a building or area.
• Layer 2 / Layer 3 Boundary: This is typically where the Layer 2 broadcast domains from the access layer are terminated and routed. Switched Virtual Interfaces (SVIs) are configured here to enable inter-VLAN routing.
• Policy Enforcement: Implements access control lists (ACLs) to filter traffic and enforce security policies.
• Redundancy and Load Balancing: Provides redundant connections to both the access and core layers. It runs First-Hop Redundancy Protocols (FHRPs) like HSRP or VRRP to provide a resilient default gateway for end devices.
• Route Summarization: Summarizes routing information from the access layer before advertising it to the core, which helps reduce the size of routing tables in the core.

This layer truly is the workhorse of the campus network, as it combines high-speed forwarding with intelligent policy control.

3. The Core Layer: The High-Speed Backbone

The core layer is the backbone of the network. Its sole purpose is to provide fast, reliable, and low-latency transport between distribution layer blocks.

Primary Functions & Services:

• High-Speed Transport: Switches packets between distribution blocks as quickly as possible. This is purely a Layer 3 function.
• Scalability & Availability: Provides a highly available and scalable backbone. As more distribution blocks are added (e.g., for new buildings), they simply connect to the core.

The guiding principle for the core layer is simplicity. It should not perform any complex packet manipulation like applying ACLs, QoS policing, or inter-VLAN routing. Its job is to switch, and switch fast.

For a deeper, authoritative explanation of each layer's role, please read the following sections from the Cisco Campus LAN Design Guide.

Use Cases: When to Use a Two-Tier vs. Three-Tier Design

The three-tier model is the gold standard for large, multi-building enterprise campuses. However, not every network requires a dedicated core layer. This leads to the two most common use cases:

1. Three-Tier Design (Large Campus)

• Use Case: Large enterprise networks spanning multiple buildings. When you have three or more distribution blocks, a dedicated core layer significantly simplifies connectivity and improves scalability compared to a full mesh of distribution switches.
• Benefit: The core provides a predictable, high-performance path between all parts of the campus.

2. Two-Tier or "Collapsed Core" Design (Small/Medium Campus)

• Use Case: Smaller networks, such as a single building or a large branch office.
• Architecture: The core and distribution layer functions are combined, or "collapsed," into a single layer of switches. These switches handle both policy enforcement (distribution) and high-speed backbone switching (core).
• Benefit: This design reduces cost and complexity by requiring fewer devices, while still maintaining the key benefits of a hierarchical structure.

The choice between a two-tier and three-tier model is primarily driven by the scale of the network and future growth expectations.

For more information on the collapsed core model, refer to this Cisco document for small enterprise design.

A Key Design Choice: Layer 2 vs. Layer 3 Access

One of the most critical decisions in campus design is where to place the boundary between Layer 2 (switching) and Layer 3 (routing).

1. Layer 2 Access (Traditional Multi-layer Design)

• VLANs extend from the access layer to the distribution layer.
• The L2/L3 boundary is at the distribution switches, where SVIs act as default gateways.
• Pros: Allows VLANs to span multiple access closets, providing flexibility for applications that require Layer 2 adjacency.
• Cons: Relies heavily on Spanning Tree Protocol (STP) to prevent loops, which results in blocked (unused) uplinks and potentially slower convergence. Large broadcast domains can also be a concern.

2. Layer 3 Access (Routed Access Design)

• The L2/L3 boundary is moved down to the access layer switches.
• The links between access and distribution switches are routed (Layer 3) point-to-point links.
• Pros: Eliminates the need for STP on uplinks, allowing all links to be used (e.g., with Equal-Cost Multi-Path, ECMP). This leads to faster convergence and smaller, contained broadcast domains.
• Cons: Limits flexibility, as a single VLAN cannot span across multiple switches. This requires more careful IP address planning.

This decision involves significant trade-offs between flexibility and performance/simplicity. Modern network designs are increasingly favoring the routed access model due to its stability and scalability.

The video below gives a good summary of this important design debate.

Conclusion

In this lesson, we have laid the groundwork for understanding modern enterprise network architecture.

Key Takeaways:

• A hierarchical network design provides a scalable, resilient, and manageable foundation by dividing the network into Access, Distribution, and Core layers.
• Each layer has a distinct function: the Access layer provides user and device connectivity, the Distribution layer implements policy and aggregation, and the Core layer ensures high-speed transport.
• The design can be adapted based on scale. A three-tier model is ideal for large campuses, while a two-tier (collapsed core) model is a cost-effective solution for smaller sites.
• A fundamental design choice is whether to use a Layer 2 access model (which relies on STP) or a Layer 3 access model (which uses routing to the edge for faster convergence and full link utilization).

Preview of the Next Lesson:
The hierarchical model is a powerful and enduring concept. In our next lesson, we will see how modern fabric architectures, such as Cisco's SD-Access, build upon these principles. We'll compare the traditional three-tier design to these newer approaches that use an underlay/overlay model to provide even greater automation, segmentation, and flexibility.