Chapter 2

Structuring and Modularizing the Network with Cisco Enterprise

Architecture

2.1. Introduction
This chapter introduces a modular hierarchical approach to network design, the Cisco Enterprise
Architecture. The chapter begins with a discussion of the hierarchical network structure. The next
section introduces network modularization and discusses the details of the Cisco Enterprise
Architecture. Following that are a detailed description of services within modular networks, and a
discussion of network management protocols and features.

2.2. Network Design Methodologies

As we have seen in chapter one large network design projects are normally divided into three
distinct steps, namely: Identifying the network requirements, Characterize the existing network,
and Designing the network topology and solutions.

Step 1. Identify the network requirements.

The network designer works closely with the customer to document the goals of the project.

Goals are usually separated into two categories:

 Business goals: Focus on how the network can make the business more successful
 Technical requirements: Focus on how the technology is implemented within the
network

Step 2: Characterizing the Existing Network

Information about current network and services is gathered and analyzed. It is necessary to
compare functionality of existing network with the defined goals of the new project. The designer
determines whether any existing equipment, infrastructure, and protocols can be reused, and what
new equipment and protocols are needed to complete the design.

1|Page
Step 3: Designing the Network Topology

A common strategy for network design is to take a top-down approach. In this approach, the
network applications and service requirements are identified, and then the network is designed to
support them. When the design is complete, a prototype or proof-of-concept test is performed. This
approach ensures that the new design functions as expected before it is implemented.

2.3. Determining the Scope of the Project

Also as we discuss in chapter 1 Common mistake made by network designers is failure to correctly
determine the scope of the network design project. While gathering requirements, the designer
identifies issues that affect the entire network and those that affect only specific portions. By
creating a topology, like Figure 2-1, the designer can isolate areas of concern and identify the scope
of the project. Failure to understand impact of a particular requirement often causes a project scope
to expand beyond the original estimate. This oversight can greatly increase cost and time required
to implement the new design.

Figure 2.1 Sample network topology

2|Page
Network Requirements that Impact the Entire Network: includes the following:

 Adding new network applications and making major changes to existing applications, such
as database or Domain Name System (DNS) structure changes.
 Improving the efficiency of network addressing or routing protocol changes
 Integrating new security measures
 Adding new network services, such as voice traffic, content networking, and storage
networking
 Relocating servers to a data center server farm.

Network Requirements that Impact a Portion of the Network: includes the following:

 Improving Internet connectivity and adding bandwidth

 Updating access layer LAN cabling
 Providing redundancy for key services
 Supporting wireless access in defined areas
 Upgrading WAN bandwidth

2.4. Hierarchical Network Design

In networking, a hierarchical design is used to group devices into multiple networks. The networks
are organized in a layered approach. The hierarchical design model has three basic layers

Core layer: Connects distribution layer devices

Distribution layer: Interconnects the smaller local networks
Access layer: Provides connectivity for network hosts and end devices

3|Page
 Figure 2.2 Hierarchical network design versus Flat network design

Benefit of dividing a flat network into smaller, more manageable hierarchical blocks is that local
traffic remains local. Only traffic destined for other networks is moved to a higher layer. As more
devices and applications are added to a flat network, response times degrade until the network
becomes unusable.

2.4.1. Investigating Core Layer Design Considerations

The Cisco 3 layer hierarchal model is composed of core, distribution, and access layers. Of the
three layers, core layer is responsible for transporting large amounts of data quickly and reliably.
The designer must ensure that the core layer is designed with fault tolerance, especially because
all users in the network can be affected by a failure. The ability to avoid unnecessary delays in
network traffic quickly becomes a top priority for the network designer.

4|Page
What Happens at the Core Layer?

The core layer is sometimes called the network backbone. Routers and switches at the core layer
provide high- speed connectivity. In an enterprise LAN, the core layer, shown in Figure 2-3, may
connect multiple buildings or multiple sites, and may provide connectivity to the server farm. The
core layer includes one or more links to the devices at the enterprise edge to support Internet,
VPNs, and WAN access.

Figure 2.3 Core layer

Implementing core layer reduces complexity of network, making it easier to manage and
troubleshoot.

5|Page
[Link]. Goals of the Core Layer

The core layer design enables the efficient, high-speed transfer of data between one section of the
network and another. The primary design goals at the core layer are as follows:

 Provide 100% uptime.

 Maximize throughput.
 Facilitate network growth.

[Link]. Core Layer Technologies

Technologies used at the core layer include the following:

 Routers or multilayer switches that combine routing and switching in the same device
 Redundancy and load balancing
 High-speed and aggregate links
 Routing protocols that scale well and converge quickly, such as EIGRP and OSPF Protocol

Redundant Links

Implementing redundant links at the core layer ensures that network devices can find alternate
paths to send data in the event of a failure. When Layer 3 devices are placed at the core layer, these
redundant links can be used for load balancing in addition to providing backup. In a flat, Layer 2
network design, STP disables redundant links unless a primary link fails. This STP behavior
prevents load balancing over redundant links.

Mesh Topology

Most core layers are wired in either full-mesh or partial-mesh topology. Although full-mesh
topologies provide the benefit of fully redundant network, they can be difficult to wire and manage
and are more costly. For larger installations, a modified partial-mesh topology is used, which is
each device is connected to at least two others, creating sufficient redundancy without the
complexity of a full mesh.

6|Page
[Link]. Network Traffic Prioritization

Failures at core layer can potentially affect all users of the network. Therefore, network designer
has to incorporate features to the design to minimize or eliminate the effects of a core layer failure.
The users on a network do not want to wait to complete their daily tasks because of a lack of care
in the design.

Preventing Failures

The network designer must strive to provide a network that is resistant to failures and that can
recover quickly in the event of a failure. Core routers and switches can contain: dual power
supplies and fans, modular chassis- based design, additional management modules.

Redundant components increase the cost, but they are usually well worth the investment. Core
layer devices should have hot-swappable (install/remove components without to turn off the device
power) components whenever possible. Using these components reduces repair time and
disruption to network services. Larger enterprises often install generators and large uninterruptible
power supply (UPS) devices. These devices prevent minor power outages from causing large-scale
network failures.

Reducing Human Error

Human errors contribute to network failures. Unfortunately, the addition of redundant links and
equipment cannot eliminate these factors. Many network failures are the result of poorly planned,
untested updates or additions of new equipment. Never make a configuration change on a
production network without first testing it in a lab environment.

Failures at the core layer cause widespread outages. It is critical to have written policies and
procedures in place to govern how changes are approved, tested, installed, and documented. Plan
a back-out strategy to return the network to its previous state in case changes are not successful.

2.4.2. Investigating Distribution Layer Design Considerations

The next layer of the Cisco hierarchical model is the distribution layer. This layer is associated
with routing, filtering, and is the communication point between the core layer and the access layer.

7|Page
A network designer must create a distribution layer design that complements the needs of the other
two layers.

What Happens at the Distribution Layer?

The distribution layer represents a routing boundary between the access layer and the core layer.
It also serves as a connection point between remote sites and the core layer.

Distribution Layer Routing

The access layer is commonly built using Layer 2 switching technology. The distribution layer
(see Figure 2-3) is built using Layer 3 devices. Routers or multilayer switches, located at the
distribution layer, provide many functions critical for meeting the goals of network design,
including the following:

 Filtering and managing traffic flows

 Enforcing access control policies
 Summarizing routes before advertising the routes to the Core
 Isolating the core from access layer failures or disruptions
 Routing between access layer VLANs

Distribution layer devices also used to manage queues and prioritize traffic before transmission
through campus core.

Trunk

Trunk links are often configured between access and distribution layer networking devices. Trunks
are used to carry traffic that belongs to multiple VLANs between devices over the same link. The
network designer considers overall VLAN strategy and network traffic patterns when designing
the trunk links.

Redundant Links

When redundant links exist between devices in the distribution layer, the devices can be configured
to load balance the traffic across the links. Load balancing is another option that increases the
bandwidth available for applications.

8|Page
[Link]. Distribution Layer Topology

Distribution layer networks are usually wired in partial-mesh topology. When distribution layer
devices are located in the same wiring closet or data center, they are interconnected using gigabit
links. When devices are separated by longer distances, fiber cable is used. Switches that support
multiple high-speed fiber connections can be expensive, so careful planning is necessary to ensure
that enough fiber ports are available to provide desired bandwidth and redundancy.

[Link]. Limiting the Scope of Network Failure

Failure domain defines portion of the network affected when either a device or network application
fails.

Limiting the Size of Failure Domains

Because failures at the core layer of a network have a large impact, the network designer often
concentrates on efforts to prevent failures. These efforts can greatly increase the cost to implement
the network. In the hierarchical design model, it is easiest and usually least expensive to control
the size of failure domain in distribution layer. In distribution layer, network errors can be
contained to a smaller area, thus affecting fewer users. When using Layer 3 devices at the
distribution layer, every router functions as a gateway for a limited number of access layer users.
Figure 2-4 shows the manner in which redundant cabling and devices can be configured to limit
the effects of a link or device failure.

Figure 2.4 Protection against single device failures

9|Page
Switch Block Deployment

Routers, or multilayer switches, are usually deployed in pairs, with access layer switches evenly
divided between them. This configuration is referred to as a building or departmental switch block.
Each switch block acts independently of the others. As a result, failure of single device does not
cause the network to go down. Even the failure of an entire switch block does not impact a
significant number of end users.

[Link]. Traffic Filtering at the Distribution Layer

Access control lists (ACL) are a tool used at distribution layer to limit access and to prevent
unwanted traffic from entering core network. It is a list of conditions used to test network traffic
that attempts to travel through a router interface. ACL statements identify which packets to accept
or which to deny.

Filtering Network Traffic

To filter network traffic, the router examines each packet and then either forwards or discards it,
based on the conditions specified in the ACL. There are different types of ACLs for different
purposes. Standard ACLs filter traffic based on source address. Extended ACLs filter based on
multiple criteria, including Source address, Destination address, Protocols, Port numbers, and
Complex ACLs are based on Standard and extended ACLs. With Cisco IOS Software, it is possible
to configure three complex ACL features:

 Dynamic ACL: Requires user to use telnet to connect to the router and authenticate. Once
authenticated, traffic from the user is permitted. Dynamic ACLs are sometimes referred to
as “lock and key” because the user is required to log in to obtain access.
 Reflexive ACL: Allows outbound traffic and limits inbound traffic to only responses to
those permitted requests.
 Time-based ACL: Permits and denies specified traffic based on the time of day or day of
the week.

10 | P a g e
Placing ACLs

Traffic that travels into an interface is filtered by inbound ACL, whereas outgoing traffic filtered
by the outbound ACL. The network designer must decide where to place ACLs within the network
to achieve the desired results. It is important to remember the following rules for designing and
applying ACLs:

 There can be one ACL per protocol per direction per interface.
 Standard ACLs should be applied closest to the destination.
 Extended ACLs should be applied closest to the source.
 Inbound or outbound interface should be referenced as if looking at port from inside the
router
 Statements are processed sequentially from the top of the list to the bottom until a match
is found.

If no match is found, the packet is denied and discarded.

 There is an implicit “deny any” at the end of all ACLs. It does not appear in configuration
listing.
 The network administrator should configure ACL entries in an order that filters from
specific to general.

Specific hosts should be denied first, and groups or general filters should come last.
The match condition is examined first. “Permit” or “deny” is examined only if the match is
true.

 Never work with an ACL that is actively applied.

 Use text editor to create comments that outline the logic, and then fill the statements that
perform the logic.
 The default behavior is that new lines are always added to the end of the ACL. A no access-
list x command removes the whole list.
 An IP access control list sends an ICMP host unreachable message to the sender of the
rejected packet and discards the packet in the bit bucket.

11 | P a g e
 o ACL should be removed carefully. Removing an access list immediately stops
filtering process.
o Outbound filters do not affect traffic that originates from the local router.

By following these simple rules, an administrator can ensure the proper functioning of an ACL.

[Link]. Routing Protocols at the Distribution Layer

Another important function that occurs at distribution layer is route summarization, also called
route aggregation or supernetting. Route summarization has several advantages for the network,
such as the following:

 One route in routing table that represents many other routes, creating smaller routing tables
 Less routing update traffic on the network
 Lower overhead on the router

Summarization can be performed manually or automatically, depending on which routing

protocols are used in the network. Classless routing protocols such as RIPv2, EIGRP, OSPF, and
Intermediate System-to- Intermediate System (IS-IS) Protocol support route summarization based
on subnet addresses on any boundary. Classful routing protocols such as RIPv1 automatically.

Summarize routes on the classful network boundary, but do not support summarization on any
other boundaries.

2.4.3. Investigating Access Layer Design Considerations

Access layer is used to control user access to internetwork resources. The network designer has to
facilitate the traffic generated from access layer as it is bound for other segments or other layers
within the network. Without an appropriate design, access layer could quickly become in undated
with traffic, resulting in less-than- acceptable performance for the end users.

12 | P a g e
What Happens at the Access Layer?

Access layer, Figure below represents edge of the network where end devices connect. Access
layer services and devices reside inside each campus building, each remote site and server farm,
and at enterprise edge.

[Link]. Access Layer Physical Considerations

The access layer of the campus infrastructure uses Layer 2 switching technology to provide access
into the network. The access can be either through a permanent wired infrastructure or through
wireless APs. Ethernet over copper wiring poses distance limitations. Therefore, one of the
primary concerns when designing access layer of campus infrastructure is the physical location of
the equipment.

Wiring closet

Wiring closets can be actual closets or small telecommunication rooms that act as the termination
point for infrastructure cabling within buildings or within floors of a building. The placement and
physical size of the wiring closets depends on network size and expansion plans. The wiring closet
equipment provides power to end devices such as IP phones and wireless access points. Many
access layer switches have Power-over- Ethernet (PoE) functionality. Unlike a typical wiring
closet, inside a server farm or data center the access layer. Devices are typically redundant
multilayer switches that combine the functionality of both routing and switching. Multilayer
switches can provide firewall and intrusion protection features and Layer 3 functions.

[Link]. The Impact of Converged Networking at the Access Layer

The modern computer network consists of more than just PCs and printers connecting to the access
layer. Many different devices, as shown in Figure 2.5, can connect to an IP network, including IP
telephones, video cameras, and video conferencing systems.

13 | P a g e
 Figure 2.5 Access Layer Connections
All these services can be converged onto a single physical access layer infrastructure. However,
the logical network design to support them becomes more complex because of considerations such
as quality of service (QoS), traffic segregation, and filtering. These new types of end devices, and
the associated applications and services, change the requirements for scalability, availability,
security, and manageability at access layer.

The Need for Availability at the Access Layer In early networks, high availability was usually
present only at the network core, enterprise edge, and data center networks. With IP telephony,
there is now an expectation that every individual telephone should be available 100 percent of the
time. Redundant components and failover strategies can be implemented at the access layer to
improve reliability and increase availability for the end devices.

Access Layer Management

Access layer management is crucial because of the following:

 The increase in the number and types of devices connecting at the access layer
 The introduction of wireless access points into the LAN

14 | P a g e
Designing for Manageability

In addition to providing basic connectivity at access layer, the designer needs to consider the
following:

 Naming structures
 VLAN architecture
 Traffic patterns
 Prioritization strategies

Following good design principles improves the manageability and ongoing support of the
network by:

 Ensuring that the network does not become too complex

 Allowing easy troubleshooting when a problem occurs
 Making it easier to add new features and services in the future

[Link]. Network Topologies at the Access Layer:

Most recent Ethernet networks use a star topology, in which each end device has a direct
connection to a single central networking device. This single networking device is usually a Layer
2 or multilayer switch. A star topology in the access layer typically has no redundancy from
individual end devices to the switch. For many businesses, the cost of additional wiring to create
redundancy is usually too high. However, if costs are not a factor, the network can be configured
as a full-mesh topology to ensure redundancy.

15 | P a g e