Campus network reference architecture

A campus network typically separates access (endpoints/Wi-Fi), distribution or collapsed core (aggregation/policy), and a services/WAN edge. Overlay fabrics such as EVPN-VXLAN are optional and should be justified by scale and segmentation needs.

Key facts

Audience: network architects and implementation engineers
Goal: predictable segmentation, capacity and failure domains
Non-goal: vendor BOM or priced SKUs

Summary

Layered campus design with clear underlay vs overlay decisions.

Audience

Enterprise network designers evaluating campus refresh patterns.

Prerequisites

Inventory of buildings, closets and uplink capacities
Security zoning requirements (guest, OT, corporate)
Identity/NAC expectations if access control is in scope

Architecture

Access: wired edge and wireless termination
Distribution/core: aggregation, routing, policy enforcement points
Services edge: Internet, WAN, DC interconnect, shared services

Components

Switches/routers capable of the chosen underlay; optional EVPN-capable leaves if overlay is selected.

Workflow

Capture requirements and failure domains
Choose underlay (L2 collapsed vs L3 routed) before overlays
Map VLANs/VRFs or EVPN segments to security zones
Define verification tests before cutover

Configuration

Vendor CLI is out of scope here. Use platform docs after the logical design is approved.

Verification

Uplink utilization and ECMP balance checks
Inter-VLAN/VRF policy tests
Failover of dual-homed access uplinks

Troubleshooting

Start with underlay reachability and STP/ECMP state before blaming overlays.

Rollback

Keep a known-good underlay config checkpoint and dual-run critical VLANs during migration windows.

References

Related docs

Document revision: 2026.07