Campus Design & Network Segmentation

Short answer: access, distribution, and core are network roles, not a requirement to buy three tiers of switches. Segmentation separates traffic domains; ACLs, firewalls, and endpoint controls enforce who can communicate. A resilient design accounts for shared dependencies, available capacity after failure, and operational simplicity.

Read VLANs and trunks, inter-VLAN routing, and firewalls and ACLs.

A railway interchange with controlled routes

At a railway interchange, platforms connect passengers to a local concourse, concourses connect to the wider station, and main lines connect stations. Staff-only doors and ticket gates decide who may enter particular areas. Access switches are the platforms, distribution is the local gathering point, and the core connects those gathering points. VLAN labels are area labels; a locked and monitored door is an enforcement rule. A sign saying "staff only" is not a lock.

Three roles, not always three physical tiers

A campus network connects devices within a site, from one office to several nearby buildings. The term isn't limited to universities. The physical size and availability requirements determine how these roles are implemented.

A smaller site may combine distribution and core in a collapsed core. A larger campus with multiple buildings may benefit from a separate core. At a small station, one concourse does both jobs. Select the design from port/fiber distances, traffic paths, recovery targets, and the team's ability to operate it, not a diagram that insists every site needs three layers.

Decide where Layer 2 ends

With Layer 2 access, VLANs travel over 802.1Q trunks toward distribution-layer SVIs. Redundant paths need a deliberate loop-prevention or supported multichassis design. RSTP can block a redundant path; LACP combines compatible links to one logical partner. Two independent switches aren't automatically one LACP partner just because both have an uplink cable.

With routed access, the access switch can host gateways and use routed uplinks, often with OSPF and equal-cost paths. This limits how far Layer 2 faults spread, but requires appropriate hardware, addressing, routing operations, and a plan for services that expect Layer 2 adjacency. Extending a VLAN across every building is not free, and routing everywhere is not automatically simpler for every team.

The railway equivalent is deciding which movements remain inside a local concourse and which cross a station boundary. Keep broadcast domains and failure domains intentional. Overlay fabrics and distributed anycast gateways add other options, but are not prerequisites for a sound small-campus design.

Segments need explicit enforcement

A VLAN is a Layer 2 broadcast domain. A subnet is a Layer 3 addressing boundary. A VRF provides a separate routing table. None of those labels alone defines the complete access policy. When a Layer 3 switch has routes between two VLANs, it may route freely unless an ACL, firewall, or equivalent policy prevents it. Two devices in the same VLAN may communicate without crossing the gateway at all.

At the station, passenger, staff, and maintenance areas need different entrances and authorization checks. In the network, write the required communications first, then place enforcement on every relevant path. Apply equivalent intent to IPv4 and IPv6. A policy that blocks internal IPv4 destinations but ignores IPv6 is incomplete.

Worked policy: a modest office

Consider users in VLAN 20 (10.20.0.0/24), guests in VLAN 30 (10.30.0.0/24), IoT in VLAN 40 (10.40.0.0/24), and management in VLAN 99 (10.99.0.0/24). These are illustrative assignments, not sizing recommendations. This matrix expresses policy intent, not deployable ACL syntax:

A user at 10.20.0.42 accessing an IoT controller at 10.40.0.10:443 crosses a routing boundary where policy can allow that specific flow. A guest at 10.30.0.42 attempting the same destination should be denied. An IoT peer in the same VLAN may never cross that routed rule, so intra-segment isolation requires separate controls such as port/client isolation, host policy, or smaller segments.

Don't build an "internet-only" rule by merely permitting 0.0.0.0/0: that prefix includes internal destinations too. Define internal address space, IPv6 policy, exception ordering, and routing context correctly. A stateful firewall tracks return traffic; a stateless ACL generally needs explicit consideration of both directions.

Keep the necessary services reachable

A ticket gate that blocks staff from the signaling room can halt the station. Likewise, allow required infrastructure paths deliberately. A DHCPv4 relay forwards requests toward the server and identifies the client subnet using giaddr; the relay/server path is not the same as a direct client unicast. DNS commonly uses UDP and TCP 53, NTP commonly uses UDP 123, and enterprise admission may depend on EAP/RADIUS and certificate services.

Route and filter the return path too. Document where DHCP scopes, DNS resolvers, authentication services, firewalls, and management access live. Include safe out-of-band recovery where the availability target requires it. Segmentation is not a substitute for patching, authenticated administration, or application authorization, and it doesn't by itself implement zero trust.

Redundancy is about independent failure paths

Two train lines that pass through the same blocked tunnel are not independent escape routes. Similarly, a switch stack or multichassis pair can simplify operations but still share software, control links, or a maintenance event. Check the expected traffic against surviving capacity, not the sum of all healthy links.

Related topics

Continue with gateway redundancy, spanning-tree choices, LACP, and physical and power constraints.

Sources

• Cisco Campus LAN and Wireless LAN design guide: vendor-specific architectures and tradeoffs.
• RFC 2131: DHCP, including relay behavior.
• NIST SP 800-207: Zero Trust Architecture: identity and resource access beyond network location.