Skip to main content

Network (LAN/WLAN)

Modern LAN/WLAN is built from a few key building blocks: cloud-based or on-prem management, policy-based access, switching, WLAN,... that together deliver secure, high-performance and manageable connectivity for users and devices

Categories​

Campus Networking​

  • Fabric technologies like Shortest Path Bridging MAC-in-MAC (SPBM, IEEE 802.1aq) create a single Ethernet fabric using an IS-IS control plane and backbone VLANs (B-VLANs), replacing legacy STP and many overlay protocols in the core while providing shortest-path forwarding and multi-tenancy
  • EVPN-VXLAN uses a Layer 3 IP underlay with an EVPN control plane and VXLAN data plane, decoupling logical L2/L3 topologies from the physical network and enabling scalable, standards-based campus fabrics common across campus and data center.

Network Management System (NPMS - Cloud platforms)​

  • Cloud-based NMS platforms provide centralized lifecycle management for wired and wireless devices: inventory, zero-touch provisioning, configuration templates, monitoring, and AIOps for campus fabrics
  • They typically treat the entire campus as a single managed fabric, unifying LAN, WLAN and often WAN/SD-WAN under one control and assurance plane

Policy-Based Networking​

  • Policy-based networking attaches role or policy attributes to users/devices at authentication (for example via NAC), then enforces those policies consistently across switches, APs, and gateways, often via an overlay fabric
  • Modern PBN designs use mechanisms like EVPN-VXLAN with policy tags or similar metadata to carry role information end-to-end, enabling micro-segmentation independent of VLANs

Switching​

  • L2 switching focuses on MAC learning, VLANs, STP-free fabrics, and PoE at the access layer; L3 switching adds routing (OSPF, BGP, VRFs), acting as default gateways and routing between segments in core/distribution
  • Stacking / "virtual chassis" aggregates multiple physical switches into a single logical system with a unified control plane, simplifying management and providing redundancy at access and distribution

WLAN​

  • Basic WLAN (SMB/SOHO) typically offers a few SSIDs on standalone APs or small controllers, pre-shared keys and limited RF optimization or identity-based policy
  • Enterprise-grade WLAN is controller- or cloud-managed, integrates tightly with 802.1X and policy, supports features like dynamic segmentation, deep packet inspection, traffic tunneling to gateways, and role-based firewalling across large deployments.
  • Enterprise WLAN doesn't stop at offering WiFi. New IoT technologies like Threat, Matter, UWB are also offered through the same access points. Some WiFi vendors focus really hard on indoor-location services.

Why is it so important​

Campus networking​

  • Fabric technologies remove L2 bottlenetcks and STP complexity by enabling active-active paths, faster convergence, and built-in multi-tenancy, which is critical as campus networks must support massive numbers of users and IoT endpoints
  • EVPN-VXLAN's separation of underlay and overlay lets you scale and re-segment without touching the physical topology, which reduces operational risk and accelerates change in digital-first organizations

Network Management System (Cloud)​

  • A modern NMS is the operational heart of the network: it reduces OPEX by centralizing configuration, monitoring and troubleshooting, and by enabling zero-touch provisioning and automated fabric deployment
  • Cloud-based management allows continuous feature delivery and AI-driven insights, improving SLA compliance and end-user experience with less on-premises infrastructure
  • Of course not all companies and verticals can use cloud-driven environments. Therefore NMS also exists in on-premise variants

Policy-Based Networking​

  • BPN translates business intent ("student vs guest vs OT device") into consistent enforcement at every port and SSID, closing the gap between security policy and actual traffic behavior
  • It is foundational for Zero Trust: enforcing least privilege, micro-segmentation and dynamic policy updates as user roles, device posture, or threats change.

Switching​

  • Robust L2/L3 switching underpins every service; if switching is fragile, all higher-layer services (voice, video, SaaS, OT) suffer in performance and availability
  • Stacking and modular L3 cores improve availability and simplify operations, directly impacting uptime guarantees and business continuity.

WLAN​

  • Wireless is the default access medium in modern campuses; poor WLAN translates immediately into lost productivity, poor customer experience, and support costs
  • Enterprise-grade WLAN enables dense, secure, and predictable connectivity for latency-sensitive apps, collaboration suites, and IoT/OT sensors, which wired access alone cannot achieve at scale.

Positioning​

Campus networking​

  • Ideal for medium-to-large enterprises, education, healthcare, and multi-building campuses that need scalable L2/L3 connectivity, fast convergence, and multi-tenant segmentation
  • Also fits organizations looking for a consistent architecture between campuses and data centers to simplify operations and hybrid-cloud connectivity

Network Management System​

  • Targets organizations wanting centralized, lean IT: distributed reatil, multi-site enterprises, managed service providers, and campuses without large on-site network teams
  • Particularly attractive when you want uniform policy and config across many small sites, plus AIOps for proactive troubleshooting

Policy-Based Networking​

  • Best suited for security-sensitive environments (finance, healthcare, government, education, industrial OT) where role-based or device-based segmentation is required for compliance and risk reduction.
  • Also valuable in environments with many dynamic or unmanaged endpoints (BYOD, contractors, IoT) where static VLAN models break down

Switching​

  • L2 access switches with PoE target office floors, classrooms, clinics, and branch sites where endpoints are primarily edge devices (PCs, phones, cameras, APs)
  • L3 aggregation/core switches address central campuses or data-center adjacent roles where routing, high-speed uplinks, and redundancy for many access blocks are needed

WLAN​

  • Basic WLAN fits very small offices, pop-up locations, or cost-sensitive SMBs with simple security needs and low client density
  • Enterprise WLAN targets dense user environments (campuses, arenas, hospitals, factories, universities) that need identity-based security, roaming, voice over Wi-Fi and deep integration with wired and security layers.

Best Practices​

Campus networking​

  • Design the underlay (for EVPN-VXLAN) or backbone (for SPBM) as a simple, highly available IP/Ethernet fabric with redundant links and equal-cost paths; keep it free of unnecessary complexity and services
  • Use a consistent fabric architecture (Clos/IP-fabric or ring/mesh) across campus sites, standardize on a small set of building blocks, and auomate service instantiation through templates to avoid per-box CLI

Network Management System​

  • Threat the NMS as a critical service: integrate with identity stores and ticketing, control admin access via RBAC, and enforce config baselines and compliance checks
  • Use the NMS for full lifecycle: design templates, staged rollouts, change windows, and post-change validation using telemetry and user-experience metrics

Policy-Based Networking​

  • Start with a clear role model (e.g. employees, students, guest, IoT types, OT devices) and map to policies in simple, auditable terms before touching device configs
  • Use dynamic, identity-based classification (802.1X, device profiling) instead of static VLANs, and validate policies with test users and simulated traffic before broad rollout

Switching​

  • Follow a layered or modular design: access, aggregation/distribution, core; keep L2 domains as small as practical and aggregate routing in the core/fabric
  • Standardize port roles, QoS, and security templates (port-security, storm control, DHCP snooping) and use stacking for edge resiliency while avoiding overly large, fragile stacks

WLAN​

  • Perform site surveys (predictive and on-site), especially in high-density or RF-challenging environments, and plan for capacity, not just coverage
  • Limit the number of SSIDs, use 5GHz/6GHz where possible, enable fast roaming, and align WLAN roles/SSIDs with the same policy model used on the wired side for consistency

Integration with other layers​

With NAC/Identity​

  • NAC (with 802.1X, RADIUS, profiling) is the authoritative source of identity, role, and sometimes posture; switches and APs consume these attributes to apply policy and, in fabric networks, tag traffic appropriately

With firewalls and security services​

  • Policy-aware campus fabrics can steer traffic to next-gen firewalls or service chains (IPS, SWG, DLP) based on role or application, not just IP/VLAN, enabling more granular inspection and logging
  • East-west segmentation in the campus fabric reduces the load on perimeter firewalls by enforcing many decisions directly at the edge or distribution, leaving firewalls to focus on north-south and cross-domain traffic