1.1.a High-level enterprise network design such as 2-tier, 3-tier, fabric, and cloud

What this objective means

You need to compare 2-tier, 3-tier, fabric, and cloud designs without turning the answer into vendor marketing. The useful question is: where are the boundaries?

Boundaries are where routing starts, where policy is enforced, where a failure stops spreading, and where operations teams can prove what happened.

2-tier campus

A 2-tier design has an access layer and a collapsed core/distribution layer. Cisco also calls this the two-tier hierarchical model: distribution and core functions are combined into one tier.

Northbound:
  WAN / SD-WAN edge
  Data center

Collapsed core/distribution:
  Core/dist 1 · L3 · FHRP · policy
  Core/dist 2 · L3 · FHRP · policy

Access layer:
  Access switches · L2 · VLANs · port security

Endpoints:
  Users · IP phones · printers · servers · Wi‑Fi APs

The two collapsed switches peer with each other (L2 for FHRP VLANs, or L3 routed links) while access dual-homes upward. Northbound services sit above the collapsed block—literally north on the diagram.

Use it when the site is small enough that a separate core adds cost without clarity. It is easier to operate, easier to cable, and usually easier to troubleshoot. The weakness is concentration: the collapsed layer does many jobs—routing, policy, aggregation, and WAN or data center handoff.

3-tier campus

A 3-tier design separates access, distribution, and core. The distribution layer aggregates access, provides default gateways, enforces policy, and summarizes routes toward the core. The core is a high-speed backbone that should stay simple.

Northbound:
  WAN / SD-WAN edge
  Data center · shared services

Core layer:
  Core switch 1 · backbone
  Core switch 2 · backbone

Distribution layer:
  Distribution 1 · gateways · policy · summarization
  Distribution 2 · gateways · policy · summarization

Access layer:
  Access switches · L2 · VLANs · port security

Endpoints:
  Users · IP phones · printers · servers · Wi‑Fi APs

Distribution switches always interconnect (L2 trunk for FHRP/SVIs, or routed point-to-point). Access dual-homes to both; distribution dual-homes to both core switches. Traffic flows up to northbound services at the top.

Use it when you need scale, cleaner summarization, or multiple buildings and distribution blocks. The core should forward quickly and avoid unnecessary features. The distribution layer aggregates access, provides gateways, and enforces policy.

Fabric campus

A fabric design separates the physical underlay from the logical overlay. Endpoint identity, segmentation, and mobility matter more than VLAN geography. SD-Access and modern campus fabrics use a routed underlay (often spine-leaf) plus an overlay such as VXLAN with a control plane (LISP, BGP EVPN).

IP underlay · north:
  Spine 1
  Spine 2

Fabric edge:
  Leaf / VTEP A
  Leaf / VTEP B

Endpoints:
  Host A
  Host B

This is useful when identity, segmentation, and mobility matter more than VLAN location. A fabric is not magic. If the underlay has loss, MTU problems, bad routing, or weak telemetry, the overlay inherits those problems.

Cloud-connected enterprise

Cloud designs extend the enterprise into provider networks. You may use IPsec, private circuits, SD-WAN, cloud routers, security service edge, or direct interconnects. The design goal is the same: deterministic routing, known inspection points, segmentation, and proof.

Cloud · northbound:
  Cloud router · TGW · virtual WAN edge
  VPC / VNet workloads
  Security groups · cloud-native policy

On-premises campus:
  Firewall / NGFW inspection zone
  Campus users and applications

Mini-lab: classify the design

Draw four versions of the same branch and campus network. For each version, answer these questions.

• Where is the default gateway?
• Where is route summarization possible?
• What link or device failure causes user-visible impact?
• Where would you apply security policy?
• Which command proves the forwarding path?

Use these verification commands in a real or simulated campus.

show cdp neighbors detail
show interfaces status
show interfaces trunk
show ip route
show ip cef exact-route 10.10.10.50 10.20.20.50
traceroute 10.20.20.50 source 10.10.10.1

What to remember for the exam

Do not answer design questions with one universal winner. 2-tier wins simplicity. 3-tier wins scale and modularity. Fabric wins policy and mobility. Cloud wins elasticity and reach, but forces you to be precise about routing, identity, and failure ownership.