Describe characteristics of network topology architectures

Topology describes how devices are connected. A physical topology is the actual cabling; a logical topology is how data flows. An architecture is a proven design pattern for building a network of a given size and purpose. The CCNA expects you to recognize six architectures and to explain why each is structured the way it is.

Enterprise campus designs are built from tiers (also called layers, but not in the OSI sense). Cisco’s classic names for the tiers are:

• Access layer: the switches endpoints plug into. Many ports, PoE, port security, VLAN assignment. Every wall jack in an office leads to an access switch.
• Distribution layer: aggregates the access switches, usually one pair per building or floor. Routes between VLANs, applies policy (ACLs, QoS), and provides redundancy. Typically Layer 3 switches.
• Core layer: the high-speed backbone that connects distribution layers and the data center, WAN, and Internet edge. Its only job is to forward as fast as possible; policy is kept out of the core.

1.2.a Two-tier

A two-tier design, also called a collapsed core, merges the core and distribution functions into one layer. Access switches connect directly to a pair of distribution/core switches, which route between VLANs and connect to the WAN, the Internet firewall, and the servers.

Characteristics:

• Used in small to medium campuses, typically a single building or a few buildings close together, where a dedicated core would add cost with no benefit.
• Each access switch has redundant uplinks to both collapsed-core switches, so the loss of one core switch or one uplink does not isolate any users.
• Fewer devices, lower cost, simpler to manage than three-tier.
• Limited scalability: adding many more access switches or buildings eventually requires a full core.

1.2.b Three-tier

A three-tier design keeps the access, distribution, and core layers separate. It is used in large campuses with multiple buildings, where each building has its own distribution pair and all distribution pairs connect through a central core.

Characteristics:

• Scalability: a new building means a new distribution pair connected to the core; nothing else changes.
• Reduced cabling: without a core, every distribution pair would need links to every other distribution pair (a full mesh), which grows quickly. With a core, each distribution pair needs only links to the core switches.
• Fault isolation: a problem in one building’s distribution layer does not affect others.
• Core is Layer 3, fast, and policy-free. Routing protocols and redundant links provide multiple paths and quick convergence.

A useful rule: the distribution layer marks the boundary between Layer 2 (access, VLANs, spanning tree) and Layer 3 (routing). The core and the links between distribution and core are almost always routed links.

1.2.c Spine-leaf

Campus networks carry mostly north-south traffic (client to server, user to Internet). Data centers carry mostly east-west traffic (server to server: web tier to application tier to database, virtual machines migrating, storage replication). The three-tier design handles east-west traffic poorly because two servers on different access switches may be many hops apart and share oversubscribed uplinks. The spine-leaf architecture (a form of Clos network) was created to solve this and is the standard modern data center topology. Cisco ACI uses it.

The rules of spine-leaf are strict:

• Leaf switches are the access layer of the data center: servers, storage, firewalls, and routers to the outside world all connect to leaves.
• Spine switches form the backbone. Every leaf connects to every spine.
• Leaves never connect to other leaves, and spines never connect to other spines.
• Every link between leaf and spine is a routed (Layer 3) link, and traffic is load-balanced across all spines using equal-cost multipath (ECMP).

The result is a predictable, low-latency fabric: any server can reach any other server in exactly the same number of hops (leaf to spine to leaf), latency is consistent, bandwidth grows by adding spines, and port capacity grows by adding leaves. Spanning tree is unnecessary because there are no Layer 2 loops.

1.2.d WAN

A WAN (Wide Area Network) connects sites that are geographically separated (different cities or countries) using links leased from a service provider, because an organization cannot run its own cable across a city. The router at each site that faces the WAN is the CE (customer edge) router; the provider’s router it connects to is the PE (provider edge) router. Common WAN technologies:

• Leased line: a dedicated point-to-point circuit (T1/E1 historically, fiber today) between two sites. Simple, private, expensive, uses serial or Ethernet interfaces, and traditionally the PPP or HDLC Layer 2 protocol.
• MPLS VPN: the provider’s shared MPLS network carries each customer’s traffic in a private VPN. Supports any-to-any connectivity between many sites (Layer 3 MPLS VPN, where the provider routes for you) or Layer 2 point-to-point services.
• Metro Ethernet: Ethernet handoff from the provider within a metropolitan area, giving the customer a familiar Ethernet interface for point-to-point (E-Line) or multipoint (E-LAN) service.
• Internet VPN: each site buys ordinary Internet access and encrypts site-to-site traffic with IPsec tunnels (Domain 5). Cheapest, ubiquitous, but with no bandwidth or latency guarantee.
• SD-WAN: an overlay that uses a controller to manage multiple underlying transports (MPLS, broadband, LTE/5G) at once, steering each application over the best path and encrypting all traffic. Cisco Catalyst SD-WAN (formerly Viptela) is the flagship.

WAN topologies are described as point-to-point (two sites), hub-and-spoke (branches connect only to headquarters), full mesh (every site to every site), or partial mesh.

1.2.e Small office/home office (SOHO)

A SOHO network serves a home or a very small office with a handful of users. Its defining characteristic is that a single integrated device performs every role: it is a router (with a default route to the ISP), a NAT gateway, a DHCP server, a DNS forwarder, a stateful firewall, a four- or eight-port Ethernet switch, and a wireless access point. The WAN side is broadband: cable, DSL, fiber (PON), or 4G/5G cellular. There is no redundancy and no tiering. Larger organizations often manage many SOHO sites (for teleworkers) with small ISR routers or Meraki devices that build VPN tunnels back to headquarters.

1.2.f On-premises and cloud

On-premises (on-prem) means the organization owns and operates the equipment in its own building or data center: it buys the servers, switches, and storage, supplies the power and cooling, and staffs the operations. Cloud means consuming computing resources as a service from a provider such as AWS, Microsoft Azure, or Google Cloud, paying for what is used and scaling up or down on demand.

Cloud services are categorized by how much the provider manages:

Cloud deployment models include public cloud (shared provider infrastructure), private cloud (cloud-style automation on infrastructure dedicated to one organization, possibly on-prem), hybrid cloud (a mix, with workloads moving between them), and multicloud (more than one public provider). Colocation means placing your own equipment in a third party’s data center.

Networking implications matter for the exam. Connecting to the cloud is done over the Internet (with IPsec VPN), or over a private connection from a provider (AWS Direct Connect, Azure ExpressRoute), often reached through an intercloud exchange or a colocation facility. Virtual routers (Cisco Catalyst 8000V) and virtual firewalls can run inside the cloud provider’s network so that the cloud looks like just another site in your WAN.