NetOps Toolkit

Reference

Network Architecture

Three-tier (Core/Distribution/Access) and Spine-Leaf network design reference

Three-Tier Hierarchical Model (Campus / Enterprise)

The Cisco three-tier hierarchical model divides a campus or enterprise network into three distinct layers — Core, Distribution, and Access — each with a specific role. This separation makes the network easier to design, manage, troubleshoot, and scale.

Layer 3 — CoreBackbone

The high-speed backbone. Provides fast, reliable transport between Distribution blocks. No policy, no filtering here — just raw forwarding speed.

Devices: High-capacity L3 switches, routers
Topology: Full-mesh or dual-node redundant
Speed: 10G / 40G / 100G links typical
Avoid: Routing filters, ACLs, QoS marking
Layer 2/3 — Distribution (Aggregation)Policy Point

The brains of the network. Aggregates Access switches, enforces policy, provides inter-VLAN routing, and is the boundary between L2 (Access) and L3 (Core).

Devices: Multilayer switches (L3)
Topology: Redundant pair, uplinks to Core
Functions: ACLs, QoS, route summarization
Also: Inter-VLAN routing, HSRP/VRRP gateway
Layer 1/2 — AccessEdge / User

Where end devices connect. Provides port-level security, VLAN assignment, PoE, and QoS marking at the edge. Primarily L2 switching.

Devices: L2 switches, WAPs, PoE switches
Connects: PCs, phones, printers, APs
Security: Port security, 802.1X, DHCP Snooping
Features: PoE, BPDU Guard, storm control

Three-Tier Diagram

          +------------------------------------------+
          |          CORE LAYER (L3)                 |
          |  [Core-SW1] ============ [Core-SW2]      |  <-- Full-mesh, 10G/40G/100G
          +--------+-----------------------+---------+
                   |                       |
     +-------------+-------+     +---------+---------------+
     |  DISTRIBUTION (L3)  |     |  DISTRIBUTION (L3)      |
     |  [Dist-SW1]         |     |       [Dist-SW3]         |  <-- ACLs, QoS, HSRP
     |  [Dist-SW2]         |     |       [Dist-SW4]         |      Inter-VLAN routing
     +--+-----+------+-----+     +------+-----+------+-----+
        |     |      |                  |     |      |
     [Acc1] [Acc2] [Acc3]          [Acc4] [Acc5] [Acc6]
      ACCESS LAYER (L2)              ACCESS LAYER (L2)
      PCs, Phones, APs               PCs, Phones, APs
A Two-Tier (collapsed core) design merges Core + Distribution into one layer — common in smaller campuses or single-building deployments where a separate Core adds unnecessary complexity.