Three-tier campus design: Access, Distribution, Core
The three-tier model is the traditional enterprise campus architecture. The access layer is where end devices connect — desktops, phones, printers — through Layer 2 switches. The distribution layer aggregates access layer switches, enforces policy with ACLs, and routes between VLANs using Layer 3 switches. The core layer provides fast, redundant transport between distribution blocks and connects to the WAN and data center.
The key principle is that each layer has a specific function. Access layer switches don't route; they switch. Distribution switches don't connect to end users; they aggregate and route. Core switches move traffic as fast as possible with minimal processing — no ACLs, no NAT, just fast routing between distribution blocks.
Three-tier makes sense when a campus is large enough that a single distribution layer would become a bottleneck. Mid-size to large enterprise campuses with multiple buildings use this model. The redundancy built into each layer — dual links from access to distribution, dual links from distribution to core — ensures no single link failure takes down a segment.
Two-tier (collapsed core) design
In a two-tier or collapsed core design, the core and distribution layers are merged into a single layer. Access switches connect directly to distribution/core switches that also handle the inter-site or WAN connectivity. This removes one tier, reducing hardware cost and complexity.
Two-tier works for small to medium campuses where the traffic volume doesn't justify a dedicated core layer. The access layer still connects end users; the collapsed distribution/core layer handles routing, policy, and WAN connectivity. Most branch offices and small campuses use this model.
Spine-leaf topology for data centers
Spine-leaf is the dominant data center topology replacing traditional three-tier designs. Every leaf switch connects to every spine switch. No leaf connects directly to another leaf. No spine connects to another spine. This creates a predictable, uniform topology where any server can reach any other server in exactly two hops — one to the leaf, one to the spine, one back to the destination leaf.
The benefit is consistent latency and easy horizontal scaling. Adding capacity means adding a new leaf switch (connected to all spines) or a new spine switch (connected to all leaves). There's no traffic bottleneck at the core because all spine switches share load equally. This is why hyperscale data centers and cloud providers use spine-leaf almost exclusively.
For CCNA, understand the contrast: in a three-tier data center design, east-west traffic (server to server) travels up to the core and back down — three hops, unpredictable latency. In spine-leaf, east-west traffic is always exactly two hops.
WAN topologies: Hub-and-spoke, point-to-point, full mesh
WAN topologies describe how geographically distributed sites connect. A hub-and-spoke (or star) topology has a central hub site — usually headquarters — with spoke sites connecting to it. All inter-spoke traffic routes through the hub. Simple and cost-effective but creates a single point of failure at the hub.
A point-to-point topology connects two sites with a dedicated link. Predictable performance, easy to manage, but doesn't scale — N sites require N*(N-1)/2 links for full mesh. A full mesh gives every site a direct connection to every other site, maximizing redundancy and performance, but the link count becomes expensive at scale.
A partial mesh is the common compromise — key sites have direct links to multiple other sites; less critical sites use hub-and-spoke. Modern enterprises often replace dedicated WAN links with SD-WAN overlays over broadband internet.
SOHO and cloud network models
A Small Office/Home Office (SOHO) network is the simplest topology: a broadband router/modem connects to the ISP, a small switch or built-in switch ports connect wired devices, and a built-in wireless radio connects Wi-Fi clients. The router provides DHCP, NAT, and basic firewall. There is no dedicated distribution or core layer.
Cloud networking extends the on-premises topology into public cloud. A Virtual Private Cloud (VPC on AWS, VNet on Azure) acts like an on-premises network — you define subnets, route tables, and security groups. Site-to-site VPNs or dedicated connections (AWS Direct Connect, Azure ExpressRoute) bridge on-premises and cloud networks. Understanding this hybrid model is increasingly tested on CCNA.