Designing a secure corporate network: scalability, redundancy, hierarchy and device selection

What a network design should document

Network design turns requirements into a plan before anything is built, aiming to meet communication needs at the lowest reasonable cost. A complete design shows:

• a clear map (diagram) of the network;
• the cabling structure and layout;
• the number, type and location of every device;
• the IP addressing plan;
• the security architecture and processes.

Designing for growth and resilience

• Scalability: use modular or stackable equipment, a hierarchical design, and a hierarchical IPv4/IPv6 addressing plan so new parts slot in easily. Routers or multilayer switches limit broadcasts and filter unwanted traffic.
• Redundancy: duplicate critical devices and links so there is no single point of failure. Redundant switch links create loops, so Spanning Tree Protocol (STP) blocks spare paths until they are needed.
• Bandwidth: EtherChannel bundles several physical links into one logical link to remove bottlenecks between switches, with load balancing across the members.
• Wireless access: extends the access layer flexibly with access points.
• Routing: large networks use dynamic protocols such as OSPF (open standard, link state, fast convergence; multi-area designs need backbone Area 0) or Cisco's EIGRP.

The hierarchical layers and their security roles

Smaller networks often combine core and distribution into a two-tier collapsed core.

Selecting the right devices

• Switches: categories include campus LAN, cloud-managed, data-centre, service-provider and virtual switches. Compare fixed vs modular, stackable or not, rack units, port density (ports per switch), forwarding rate (how much traffic it can process), PoE for phones, cameras and APs, and multilayer (routing) capability for the distribution and core.
• Routers: branch, network-edge and service-provider routers. They connect sites and the internet, contain broadcasts, apply ACLs and find alternate paths. Check interface types and modularity.
• Security appliances: firewalls (often with routing and analytics), dedicated IPS, VPN gateways, anti-malware, and web and email security appliances.

Segmenting with subnets

ARP and DHCP rely on broadcasts, and switches flood broadcasts to every port. A large broadcast domain slows the network and every device. Dividing it into smaller subnets (by borrowing host bits) reduces traffic and lets administrators apply security policy about which subnets may communicate. Subnetting is easiest at the octet boundaries /8, /16 and /24; see IPv4 addressing and the VLSM planner.

Real-world example: a small accounting firm

A fictional accounting firm with 60 staff had grown from one office to three floors, adding switches wherever ports ran out. All devices sat in one flat network, so a single infected laptop could reach the file server, the printers and the CCTV recorder. The firm hired a consultant who documented the existing setup, then rebuilt it into an access and collapsed core design: two core switches linked with an EtherChannel, each floor's access switch connected to both. Staff, servers, printers, voice and CCTV were each given their own subnet and VLAN, with access lists between them. The new switches were chosen with PoE for the phones and cameras and spare ports for growth.