Network Design and Topologies
Topology is a decision about failure, not a picture. The shapes below exist because each one trades cost against blast radius, convergence time and operational complexity.
The shapes
| Topology | Strength | Weakness | Where you still see it |
|---|---|---|---|
| Star | Simple, one hop, easy to reason about | Central device is a single point of failure | Access layer, home networks |
| Hierarchical (core/distribution/access) | Scales, predictable, policy at the edge | More devices, more config surface | Enterprise campus |
| Spine-leaf | Uniform latency, any-to-any, scales out | Needs routing everywhere (usually BGP or EVPN) | Data centres |
| Hub-and-spoke | Cheap, central policy | Backhaul latency, hub is a chokepoint | Branch offices, VPNs |
| Full mesh | Any path, fast failover | n(n−1)/2 links, admin nightmare | Small WAN cores, IXP fabrics |
| Ring | Survives one cut, cheap fibre | Convergence, capacity | Metro, industrial |
Why hierarchy is the default
Three tiers, each with one job:
- Access — port density, PoE, VLAN assignment, edge security. Cheap, many.
- Distribution — inter-VLAN routing, policy, summarisation, first hop redundancy.
- Core — fast, dumb, redundant. If the core does policy, it is doing too much.
Collapsed core (access + distribution merged) is right for most small and mid-size sites. Two devices, not six, and the failure modes stay legible.
Redundancy that actually fails over
Redundancy requires three things to line up; miss one and you have the cost without the benefit.
- Two paths — physically separate, ideally diverse fibre or different carriers.
- A protocol that notices — HSRP/VRRP for gateways, OSPF/BGP for paths, LACP for links.
- A test that proves it — pull the link on purpose, in business hours, with a timer running.
Most "redundant" networks fail test three. Two links from the same switch, two carriers entering the same conduit, two power supplies on one PDU: all redundant on the diagram.
Subnet and address plan as design
The IP plan is the design document people actually read.
| Rule | Why |
|---|---|
| Allocate by site, then by function | Summarisation works; new sites get clean blocks |
| Leave a gap between blocks | Room to grow without renumbering |
| One VLAN = one subnet | Clean broadcast domain, clean policy boundary |
Use /31 or /127 on point-to-points |
Two addresses, no waste |
| Reserve the first block for infrastructure | Loopbacks, management, VIPs |
| Document DNS/DHCP/VRRP per subnet | The next engineer needs the mapping, not the intent |
Overlapping RFC 1918 space between sites or with a partner is the most expensive mistake in this note to fix later, because it forces renumbering, which touches every firewall rule, ACL and DNS entry.
Bandwidth is not latency
A 10 Gbps link with 40 ms of RTT still cannot beat a 1 Gbps link with 1 ms for a chatty protocol. Design for the metric the application cares about:
- Bulk transfer — bandwidth and window size (bandwidth-delay product).
- Interactive — RTT dominates; put the service closer.
- Fan-out / many small calls — connection setup cost dominates; reuse connections (HTTP/2, keep-alive) or move to QUIC.
Where it goes wrong
- Designing for the diagram, not the failure. Every component needs a stated single-point-of-failure status. If nobody wrote it down, it is a single point of failure.
- Flat networks grown by accretion. Ten years of "just add a VLAN" produces 400 VLANs with no summarisation and an OSPF database nobody understands.
- Redundant links that loop. Without STP or a routing protocol, the second path is an outage waiting for a cable.
- Assuming the cloud is different. VPCs have the same design questions (subnets, routes, gateways, overlaps) with worse defaults for address planning, because a VPC CIDR is hard to change later.
- Skipping the address plan. Renumbering after the fact costs more than every other item in this note combined.
- MTU designed at 1,500 with tunnels. Overlays need headroom; decide the underlay MTU before the first VTEP.
Related Notes
- Addressing Subnetting CIDR — the arithmetic behind an IP plan
- Routing Fundamentals — how paths are chosen
- OSPF Fundamentals — convergence in a hierarchical design
- VPC Fundamentals — the same decisions in a cloud account
- Network Security Fundamentals — segmentation as a design goal