What are some common network design patterns and how do you apply them?

The hierarchical model is a classic network design structured in layers—core, distribution, and access. In my experience, this model works well for large enterprise networks where scalability and performance are critical. The core handles high-speed switching, distribution manages routing and policy enforcement, and the access layer provides device connectivity. Implementing this model improves network manageability and troubleshooting efficiency by creating a clear structure where each layer has a specific role.

The hierarchical model is commonly used in campus networks. Depending on the size of the network, the number of buildings, and cabling, it may be enough to have a collapsed core design or even just a single layer. Traditionally, switches capable of L3 were more expensive, but almost all switches now do L3 to some degree. Port cost can be a factor as you consume ports on your core devices. You may run out of ports or decide that a distribution layer will save on total cost.

Segmentation and VLANs (Virtual Local Area Networks): Description: Divides a single physical network into multiple logical segments using VLAN tagging. Application: Enables isolation, security, and efficient use of network resources by logically separating different departments, functions, or security zones within an organization. VLANs are often employed in enterprise networks and service provider environments.

The hierarchical model still makes sense in many places. For example, in a factory environment, you typically have multiple network domains: the factory ICS/OT network, the building/facility/security ICS/OT network, the local factory data center network, and the local office network. Depending on SLAs and risk assessments, it may be advisable to add a distribution layer for each network domain. This approach ensures better traffic management, enhanced security, and improved fault isolation within each specific area of the factory's network infrastructure. ICS = Industrial Control Systems. OT = Operational Technology. SLA = Service Level Agreement.

Common network design patterns include hub-and-spoke, which centralizes traffic through a central hub for easier management; mesh, which offers high redundancy by connecting every device to every other device; and star, where devices connect to a central switch for simpler troubleshooting. Choosing the appropriate pattern depends on the network's needs for scalability, reliability, and manageability.

The leaf and spine topology is based on the work of Charles Clos (not CLOS). In this model, there are generally no connections within a layer (exceptions exist), but between layers. Commonly L3 is used in combination with a routing protocol to provide ECMP as the leaf has multiple paths via the spines. Compared to a traditional L2 design using the hierarchical model, there are no blocking links and no dependency on STP. This provides more throughput and better use of links.

A spine-leaf architecture is data center network topology that consists of two switching layers—a spine and leaf. The leaf layer consists of access switches that aggregate traffic from servers and connect directly into the spine or network core. Spine switches interconnect all leaf switches in a full-mesh topology.

Commonly used in data centers, the spine-leaf model ensures low latency and high throughput. All leaf nodes (access switches) connect to spine nodes (core switches) in a fully meshed manner, allowing any leaf to communicate with any other leaf through a single hop. I've found this model particularly effective when dealing with data-intensive applications, as it reduces bottlenecks and enhances load balancing. Applying this model improves horizontal scalability, which is essential for handling traffic in environments with fluctuating loads.

Spine Leaf model is better design but mostly seen in the DC, with technologies like VPC, VXLAN-EVPN, VNI these technologies are clubbed/mutually linked with leaf and spine architecture IN DC and DCI network. This help to overcome the limitations in traditional networking, caused by STP, scale-up or scale-down without further impact on existing infra, but compatible models of leaf and spines has to be chosen. Now most of the operations, configuration can be done through cisco ACI, make these technologies easier to use.

One of the benefits of spine/leaf is its alignment with modern application requirements such as microservices and containerization. These technologies often require heavy east/west traffic (where communication occurs between servers within the same data center). Spine/leaf is well-suited to handle this type of traffic efficiently, ensuring low latency and high throughput, which are critical for the performance of these applications. There are also super spines (RFC 7938) that can scale the spine/leaf architecture even further. Super spines act as an additional layer above the spine switches, interconnecting multiple spine layers to support very large-scale data center deployments.

Description: A central “hub” device connects to multiple “spoke” devices in a star topology, centralizing management and simplifying remote site connections. Use Cases: Suitable for wide area networks (WANs) or branch-office networks. Application: Hub: Install in the central location with strong processing power, responsible for managing traffic to and from spokes. Spokes: Connect branch offices or remote sites to the hub, facilitating centralized control. Best Practices: Ensure high redundancy at the hub for reliability, use VPNs to secure remote connections, and monitor bandwidth to avoid bottlenecks.

Hub and spoke topologies are commonly used in WANs. Many organizations have centralized traffic flows where there generally isn't any traffic between branches, only towards DC, HQ, and towards the internet. The hub and spoke topology is simpler than a full mesh and also makes it easier to insert for example inspection devices into traffic flows.

The Hub-and-Spoke model is a common architecture used in networking and security infrastructure. It organizes the network into a central hub connected to multiple peripheral nodes (spokes). This model is designed to simplify management, optimize traffic flow, and improve security. Advantages: Centralized Management,Reduced Complexity,Cost-Effective,Simplified Monitoring. Disadvantages: Single Point of Failure,Potential Bottleneck,Latency,Scalability Challenges in Hub. Use Cases in Network Infrastructure: Enterprise WANs Cloud Connectivity VPN Architectures

When designing a VPN/WAN with a hub/spoke model, consider incorporating spoke-to-spoke (direct) communication opportunities. Similar to peer-to-peer networks or DNS, the hub can act as a lookup/broker, enabling spokes to communicate directly. While direct spoke-to-spoke communication might not be necessary for typical office locations that primarily interact with centralized or internet services, it becomes crucial when services need to be accessed between sites. Enabling efficient spoke-to-spoke communication can enhance performance and reduce latency for inter-site service access.

In a mesh model, each node connects directly to multiple other nodes, creating multiple paths for data transmission. While more costly to implement, this model provides high redundancy and fault tolerance, which are essential in mission-critical applications like telecommunications. I've applied mesh networks in scenarios where constant uptime is critical, as this model’s redundancy supports reliable failover in the event of a link failure.

With my background in IIoT advanced engineering product development, I've seen firsthand how mesh networks play a crucial role in maintaining reliable and resilient communication. In environments where downtime is unacceptable, such as industrial automation or IIoT systems, mesh networks ensure that each node connects to multiple others, providing redundancy. If one node fails, data can be rerouted through alternative paths, minimizing disruptions. This scalability and fault tolerance make mesh networks ideal for critical applications where constant, real-time communication between devices is essential for operational efficiency and safety.

While the mesh model offers high availability and resilience, it's essential to evaluate the complexity and cost implications, especially for large-scale networks. Full mesh networks can be resource-intensive and challenging to manage due to the numerous connections required. Additionally, the mesh model might give a false sense of security. There’s an expectation that all sites and devices are communicating with each other on all links at all times, but a bug or a minor routing mistake can potentially take out the entire WAN or site. Ensure that mesh is the only viable alternative when assessing requirements, available resources (money, people), and the time needed to implement and operate.

Combining elements of the models above, hybrid models are tailored to meet specific network needs. This adaptable approach enables businesses to benefit from various design strengths, such as the scalability of a hierarchical model combined with the reliability of a mesh network. For complex networks, I’ve found the hybrid model offers flexibility to accommodate diverse requirements across different departments or business units. For example, a core-mesh for data centers combined with hub-and-spoke for branches balances resilience with cost-effectiveness.

The hybrid model is an ideal approach for network design, emphasizing domain separation and modular design. By breaking down the infrastructure into distinct domains, you can tailor each domain’s design to best meet specific KPIs, SLAs, resources (money, people), interoperability, integration, and technical requirements. For example, the hierarchical model can be used for the campus, the spine-leaf model for the data center, the hub-and-spoke model for the WAN, and the mesh model for backbone/core. This method leverages the strengths of each design pattern, providing a customized, efficient, and effective solution for the diverse needs of the entire network infrastructure. KPI = Key Performance Indicators. SLA = Service Level Agreements.