Enterprise network domains: campus, WAN, data centre, cloud and edge as one architecture
In short: An enterprise network is not one network but several domains: campus access for people, the WAN for linking sites, the data centre and cloud for applications, the edge for devices, and remote access for people outside the office. Each has different traffic and design rules, and a good architecture applies one set of identity-based policies across all of them.
Why think in domains?
Ten years ago many organisations could draw their network as one building with a server room. Today the same organisation has offices, home workers, cloud platforms, software as a service (SaaS) applications and hundreds of connected devices. Trying to design all of that as one thing is overwhelming. Architects split it into domains: parts of the network that share a purpose, a traffic pattern and a set of design rules. You then design each domain well and define clear hand-off points between them.
What each domain is for
| Domain | Main job | Typical design concerns |
|---|---|---|
| Campus access | Connect people and devices in a building | Port density, PoE, Wi-Fi coverage, VLANs, network access control |
| Branch and WAN | Join sites to each other and to the internet | Link cost, resilience, SD-WAN, VPNs, quality of service |
| Data centre | Host servers, storage and internal applications | East-west bandwidth, spine-leaf fabrics, low latency, redundancy |
| Cloud | Run workloads on a provider's platform | Virtual networks, routing to on-premises, cloud firewalls, cost of data transfer |
| Edge and IoT | Connect cameras, sensors and machines | Isolation, limited device security, local processing |
| Remote users | Give staff access from anywhere | Identity, device health, zero trust network access (ZTNA) |
Each domain has its own detailed notes: see campus and data centre architectures, SD-WAN and cloud networking basics.
Hand-off points between domains
The places where domains meet are where most design mistakes and security gaps appear. Write down, for every boundary, which device owns it, how routes are exchanged and where traffic is inspected.
- Campus to WAN: the branch edge router or SD-WAN device. It decides which traffic goes to head office, which goes to the cloud and which goes straight to the internet.
- WAN to data centre: a pair of WAN aggregation routers and a firewall. Plan for every branch failing over to the second data centre at once.
- On-premises to cloud: a site-to-site VPN or a private connection into a cloud hub network. Agree an IP plan first so cloud ranges never overlap with office ranges.
- Edge devices to everything else: a dedicated segment with a firewall in front, because cameras and sensors often can't run security software.
One policy across every domain
The biggest change in enterprise architecture is that policy now follows identity rather than location. In an older design a user on the office LAN was trusted and a user at home was not. Now the same rule should apply wherever the person sits: "finance staff on a managed laptop may reach the finance system". Controllers and cloud management platforms help by pushing one policy to campus switches, SD-WAN edges and cloud firewalls together. This is the idea behind zero trust and intent-based networking.
Tip: keep one shared IP address plan and one naming standard for all domains. Overlapping private ranges between offices and cloud networks are one of the most common, and most painful, problems to fix later.
Real-world example: a growing college
A fictional college with two campuses ran each site as its own network, with separate firewalls and rules written by different contractors. When it moved its student records system to a cloud platform and let staff work from home, nobody could say who could reach what. The IT team mapped the network into the six domains, documented every hand-off point and found three overlapping 10.0.0.0/16 ranges. They renumbered one campus, put both campuses on SD-WAN with direct internet breakout, built a single cloud hub network, and moved remote staff from a full-tunnel VPN to ZTNA. Access rules were rewritten once, by role, and applied in every domain.
Practice
Name three domains of a typical enterprise network and the main job of each.
Why are the boundaries between domains so important to document?
What does it mean for policy to follow identity?
Key takeaways
- An enterprise network is a set of domains with different purposes and design rules.
- Common domains: campus access, branch and WAN, data centre, cloud, edge and remote users.
- Document every hand-off point: who owns it, how routes are exchanged and where traffic is inspected.
- Use one IP plan and naming standard across all domains to avoid overlaps.
- Modern designs apply one identity-based policy across every domain.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.