# Network Design and Topologies

Topology is a decision about failure, not a picture. The shapes below exist because each one trades cost against blast radius, convergence time and operational complexity.

## The shapes

| Topology | Strength | Weakness | Where you still see it |
|---|---|---|---|
| **Star** | Simple, one hop, easy to reason about | Central device is a single point of failure | Access layer, home networks |
| **Hierarchical (core/distribution/access)** | Scales, predictable, policy at the edge | More devices, more config surface | Enterprise campus |
| **Spine-leaf** | Uniform latency, any-to-any, scales out | Needs routing everywhere (usually BGP or EVPN) | Data centres |
| **Hub-and-spoke** | Cheap, central policy | Backhaul latency, hub is a chokepoint | Branch offices, VPNs |
| **Full mesh** | Any path, fast failover | n(n−1)/2 links, admin nightmare | Small WAN cores, IXP fabrics |
| **Ring** | Survives one cut, cheap fibre | Convergence, capacity | Metro, industrial |

## Why hierarchy is the default

Three tiers, each with one job:

- **Access** — port density, PoE, VLAN assignment, edge security. Cheap, many.
- **Distribution** — inter-VLAN routing, policy, summarisation, first hop redundancy.
- **Core** — fast, dumb, redundant. If the core does policy, it is doing too much.

Collapsed core (access + distribution merged) is right for most small and mid-size sites. Two devices, not six, and the failure modes stay legible.

## Redundancy that actually fails over

Redundancy requires three things to line up; miss one and you have the cost without the benefit.

1. **Two paths** — physically separate, ideally diverse fibre or different carriers.
2. **A protocol that notices** — HSRP/VRRP for gateways, OSPF/BGP for paths, LACP for links.
3. **A test that proves it** — pull the link on purpose, in business hours, with a timer running.

Most "redundant" networks fail test three. Two links from the same switch, two carriers entering the same conduit, two power supplies on one PDU: all redundant on the diagram.

## Subnet and address plan as design

The IP plan is the design document people actually read.

| Rule | Why |
|---|---|
| Allocate by site, then by function | Summarisation works; new sites get clean blocks |
| Leave a gap between blocks | Room to grow without renumbering |
| One VLAN = one subnet | Clean broadcast domain, clean policy boundary |
| Use `/31` or `/127` on point-to-points | Two addresses, no waste |
| Reserve the first block for infrastructure | Loopbacks, management, VIPs |
| Document DNS/DHCP/VRRP per subnet | The next engineer needs the mapping, not the intent |

Overlapping RFC 1918 space between sites or with a partner is the most expensive mistake in this note to fix later, because it forces renumbering, which touches every firewall rule, ACL and DNS entry.

## Bandwidth is not latency

A 10 Gbps link with 40 ms of RTT still cannot beat a 1 Gbps link with 1 ms for a chatty protocol. Design for the metric the application cares about:

- **Bulk transfer** — bandwidth and window size (bandwidth-delay product).
- **Interactive** — RTT dominates; put the service closer.
- **Fan-out / many small calls** — connection setup cost dominates; reuse connections (HTTP/2, keep-alive) or move to QUIC.

## Where it goes wrong

- **Designing for the diagram, not the failure.** Every component needs a stated single-point-of-failure status. If nobody wrote it down, it is a single point of failure.
- **Flat networks grown by accretion.** Ten years of "just add a VLAN" produces 400 VLANs with no summarisation and an OSPF database nobody understands.
- **Redundant links that loop.** Without STP or a routing protocol, the second path is an outage waiting for a cable.
- **Assuming the cloud is different.** VPCs have the same design questions (subnets, routes, gateways, overlaps) with worse defaults for address planning, because a VPC CIDR is hard to change later.
- **Skipping the address plan.** Renumbering after the fact costs more than every other item in this note combined.
- **MTU designed at 1,500 with tunnels.** Overlays need headroom; decide the underlay MTU before the first VTEP.

## Teaching hook

**The road-network analogy.** Access roads are local streets, distribution is the arterial ring, core is the motorway. You do not put traffic lights on the motorway, and you do not route cross-country traffic through a residential street.

Exercise: give learners a one-line requirement ("200 staff, two floors, one internet link, one cloud app") and ask for a diagram, an IP plan, and the two things that would take the site down. The gap between their first diagram and their third is the lesson.

## Related Notes

- [[Foundations/Addressing-Subnetting-CIDR.md]] — the arithmetic behind an IP plan
- [[Routing/Routing-Fundamentals.md]] — how paths are chosen
- [[Routing/OSPF-Fundamentals.md]] — convergence in a hierarchical design
- [[Cloud-Modern-Networking/VPC-Fundamentals.md]] — the same decisions in a cloud account
- [[Security/Network-Security-Fundamentals.md]] — segmentation as a design goal