Skip to main content

Campus Networking

Network Campus Networking

Campus Networking - Overview​

A campus network is the wired (and wireless) network that connects people and devices in classrooms, labs, hospitals, warehouses, and similar "on-site" environments. It links:

  • User devices (laptops, phones, tablets)
  • Building systems (cameras, access contorl, HVAC, lighting)
  • Operational technology and IoT (sensors, robots, medical devices, production lines)
  • Local services (printers, local apps) and uplinks to data centers and the internet

Historically, campus networks were built with a layered design:

  • Access: Switches in closets where devices plug in
  • Distribution: Aggregation switches per building or area
  • Core: Central backbone in the main data room

Connectivity and redundancy were managed with VLANs (virtual LANs) and spanning tree (a loop-avoidance protocol). This worked for many years, but it is fragile and operationally heavy at today's scale.

Modern campus networking shifts from this "box-by-box" model to a fabric-based model:

  • The physical network (switches, links) forms a simple, resilient IP underlay
  • On top of that underlay, an overlay fabric creates virtual networks (segments) for different users, devices and services
  • The fabric is controlled by a control-plane protocol that automatically distributes reachability information (who/what is connected where)

Two major campus fabric approaches in use today are:

  • BGP EVPN VXLAN: An IP-based fabric where:
    • VXLAN encapsulates user traffic in tunnels
    • BGP EVPN distributes information about devices, IP addresses, and segments
  • SPBM (Shortest Path Bridging MAC-in-MAC): An Ethernet-based fabric where
    • A single link-state protocol calculates shortest paths
    • Services (virtual networks) are defined and carried end-to-end over a MAC-in-MAC encapsulation

Both approaches eliminate spanning tree in the core and distribution layers, provide virtualization and segmentation, and greatly improve automation and resilience. They differ in how they achieve it and what trade-offs they make

Why is it so important?​

Campus Networking has moved from "IT plubming" to a strategic business platform. Several trends explain why

Business and User Expectations​

People now expect:

  • High-quality WiFi and wired connectivity everywhere on site
  • Seamless movement (roaming) without losing access when they move buildings or floors
  • Instant onboarding of new employees, devices and services
  • Consistent experience whether accessing local resources or cloud/SaaS

A well-designed campus network makes these expectations routine rather than exceptional. A poorly designed one turns every minor IT change into a project and every outage into a business incident

Security and Zero Trust​

Organizations must assume that threats can come from inside as well as outside. That means:

  • Not putting "everything in one big flat network"
  • Isolating guests from staff, staff from critical systems, IT from operational technology
  • Quickly containing incidents (e.g. infected laptop, compromised camera)

Campus fabrics allow segmentation as a first-class concept:

  • Different user groups and device types live in their own virtual networks (segments)
  • Policies can be tied to identity and role, not just physical location
  • The fabric can carry these segments end-to-end across the campus, maintaining isolation without manual VLAN gymnastics

This is a foundational building block for any Zero Trust security model at campus scale

Explosion of Connected Devices (IoT and OT)​

There is massive growth in non-traditional devices:

  • Cameras, door controllers, point-of-sale, sensors
  • Medical devices, lab instruments
  • Manufacturing robots, PLCs, autonomous vehicles

Many of these:

  • Are hard or impossible to patch
  • Run outdated operating systems
  • Have poort built-in security

The campus network must compensate. Fabric-based approaches let you:

  • Put such devices in tightly controlled segments
  • Limit where they can talk (for instance, only to a specific server)
  • Monitor and, if needed, quickly isolate them

Operational Efficiency and Agility​

Traditional campus networks require:

  • Manually creating and extending VLANs
  • Tuning spanning tree
  • Managing complex, inconsistent switch configs

This makes moves, adds, and changes slow and error-prone. Fabrics:

  • Move complexity to the fabric core and its control plane
  • Greatly simplify the edge (access switch and AP) configuration
  • Lend themselves to central management, templates and automation

The result: faster rollout of projects, fewer outages caused by human error, and lower operational cost

Positioning - Where do these fabrics fit?​

This section treats campus fabric concepts as "solutions" and looks at where they are a good fit: which environments, which customers, and what low-hanging fruit

Key Market Segments​

Large Enterprise Campuses​

  • Multi-building, often multi-site
  • Thousands to tens of thousands of users/devices
  • Multiple departments with different security and compliance needs
  • Often require differentiated networks for corporate, guest, contractors, partners, and OT

Fabric campus architectures shine here because they:

  • Provide scalable segmentation
  • Simplify connecting many buildings
  • Enable centralized operations and automation

Education (Universities, Colleges, Secondary schools)​

  • High user mobility (students, staff, visitors) across large areas
  • High density of devices
  • Mix of wired and wireless, labs, dorms, guest networks

Fabrics help:

  • Provide a consistent user experience across the campus
  • Isolate research networks, student networks, and administrative systems
  • Onboard and offboard large user populations efficiently

Healthcare (Hospitals, Clinic, Labs)​

  • Highly critical uptime and patient safety
  • Strong regulation and privacy requirements
  • Many specialized medical and building systems

Fabric advantages:

  • High availability and fast recovery from failures
  • Strong isolation of medical devices, guest access, and admin systems
  • Ability to grow and reorganize without constant re-cabling or major redesign

Manufacturing, Logistics and Industrial Campuses​

  • Mix of IT and OT networks
  • Harsh environments and specialized devices
  • Need to connect production lines, warehouses and offices

Fabrics enable:

  • Strong speration of OT from the corporate IT network
  • Controlled communication paths between them
  • Simplified extension of the network as production grows or shifts

Government, Finance, and Other High-Regulation Sectors​

  • Segregation of confidential networks
  • Auditability and predictable behavior of the network
  • Often geographically distributed sites

Fabric benefits:

  • Clear, policy-based segmentation
  • Easy to document and audit segments and paths
  • Good support for multi-site architectures with consistent policies

Conceptual​

Both BGP EVPN VXLAN and SPBM are fabric technologies, but their natural "fit" differs slightly

BGP EVPN VXLAN: IP Centric, Multi-Environment alignment​

Conceptually better aligned with:

  • Organizations that also want a modern fabric in the data center or WAN
  • Environments where network teams are comfortable with IP routing and BGP

Strengths:

  • Strong multi-tenancy and segmentation model
  • Easy to interconnect campus fabrics with data center fabrics using the same technology family
  • Rich feature set driven by broad industry adoption

Typical sweet spots:

  • Large enterprises, universities, and regulated industries with skilled network teams
  • Projects that explicitly aim to harmonize data center and campus designs

SPBM: Ethernet-Centric, Simplicity of a Single Control Plane​

Conceptually better aligned with:

  • Organizations that want fabric simplicity delivered by one protocol
  • Campus environments that historically used Ethernet-based backbones and care a lot about deterministic operation and multicast

Strengths:

  • Single control plane for unicast and multicast, with very predictable behavior
  • Edge-focused learning (the core does not need to track individual user devices)
  • Clear service constructs (virtual networks expressed as service identifiers)

Typical sweet spots:

  • Large campuses focusing on simple, stable L2/L3 virtualization
  • Environments with heavy multicast or broadcast requirements (e.g. IP vide, financial markets, control systems) where deterministic shortest-path forwarding is key

Specifics​

This section goes one layer deeper in how modern campus fabrics work

Traditional campus vs Fabric Campus​

Traditional Campus​

  • VLANs extended across switches to group devices
  • Spanning tree blocks some links to avoid loops (so not all links are used)
  • Routing typically happens at distribution/core for inter-VLAN traffic
  • Any change (new VLAN, new building segment) may require
    • Touching multiple switches
    • Risking loops or misconfigurations

Fabric Campus​

  • Underlay: All core/distribution switches form a simple, fully routed IP or Ethernet mesh, using equal-cost multipath (ECMP) to use all links
  • Overlay: Virtual networks (segments) are created logically and carried through the fabric
    • By tunnels (e.g. VXLAN over IP), or
    • By encapsulation (e.g. MAC-in-MAC with SPBM)
  • The edge (access switches, wireless) simply attaches endpoints to the correct virtual network, and the fabric takes care of transporting that traffic across the campus

The benefit is conceptual: think of the fabric as a "virtual wiring system" that can create and move "virtual cables" (segments) anywhere in the campus without redoing physical cabling or low-level configurations

Common Fabric Design Concepts​

Regardless of the protocol (BGP EVPN VXLAN or SPBM), campus fabrics share several core ideas

Underlay vs Overlay​

  • Underlay:
    • The real, physical network of switches and links
    • Runs basic routing or bridging to enable full connectivity between fabric nodes
    • Designed for resilience, high bandwidth, and simplicity
  • Overlay:
    • Virtual netorks that ride on top of the underlay
    • Isolated from each other, like separate "virtual private roads" over a common highway system
    • Provide user-facing services (employee LAN, guest network, IoT network etc)

Control Plane vs Data Plane​

  • Control plane:
    • The "brain": protocols that decide
      • How devices and segments are reachable
      • Which path to use between any two points
    • Example BGP EVPN (for EVPN/VXLAN), IS-IS SPB (for SBPM)
  • Data plane:
    • The "muscle": how packets are actually forwarded along those paths
    • Uses encapsulation formats (VXLAN headers, MAC-in-MAC) to carry virtual network information

Roles in the Fabric​

Typical roles (in concept):

  • Fabric edge:
    • Where users, devices, and wireless APs connect
    • Classifies traffic into segments and hands it to the fabric
  • Fabric core / transit nodes:
    • Move encapsulated traffic across the campus
    • Do not need to know individual end devices, only fabric-level identifiers
  • Fabric border / gateway
    • Connects the fabric to external networks (data centers, internet, legacy networks)
    • Translates between the fabric's internal representation and the outside world

Segmentation and VRFs​

Segmentation can be done at multiple layers

  • Layer 2 (broadcast domains):
    • Equivalent to separate LANs that do not see each other's broadcasts
  • Layer 3 (VRF - Virtual Routing and Forwarding):
    • Each VRF is like a completely separate routing table
    • Two VRFs can use the same IP ranges without conflict because they are isolated

Campus fabrics can combine these concepts, providing multiple virtual networks with their own IP spaces and policies across the same physical infrastructure

BGP EVPN VXLAN-based Campus Fabric​

This approach is IP-centric and is often used when aligning campus and data center designs

Core Elements​

  • Underlay IP Network:
    • All switches participating in the fabric run IP routing
    • Each link is used actively (no blocked links as in spanning tree)
    • A simple interior routing protocol (eg IS-IS or OSPF) and ECMP ensure efficient traffic paths
  • VXLAN Encapsulation:
    • When traffic from a user or device enters the fabric, it is wrapped in a VXLAN header
    • The VXLAN header contains a VNI (VXLAN Network Identifier) that represents the virtual network/segment
    • VXLAN tunnels exist between fabric nodes (particularly edges and gateways)
  • BGP EVPN Control Plane
    • BGP, extended with EVPN (Ethernet VPN), distributes information about
      • Which MAC address and IP addresses are reachable where
      • Which VNIs (segments) exist and where
      • Which nodes share the role of default gateway for a given subnet (anycast gateway)
    • This avoids flooding the network with broadcasts; information is shared "intelligently" via the control plane

Key Capabilities​

  • Distributed, Anycast Gateway:
    • Multiple fabric edge devices can share the same IP/MAC address as the default gateway for a subnet
    • Users see a local gateway wherever they connect, improving efficiency and mobility
  • Multi-Homing and Redundancy:
    • Endpoints or access devices can be connected redundantly to multiple fabric nodes
    • BGP EVPN can coordinate active-active or active-standby behavior to avoid duplicate traffic
  • Advanced Multi-Tenancy:
    • Different business units, services, or customers can have their own isolated VNIs and VRFs
    • The same fabric can securely support many logical networks

Conceptual Strengths​

  • Very flexible and scalable for large, complex environments
  • Common "language" with data center fabrics and some WAN architectures
  • Highly suitable for organizations that want a unified approach across multiple domains (campus, DC, WAN)

SPBM-Based Campus Fabric​

SPBM (Shortest Path Bridging MAC) is Ethernet-centric, extending the traditional Ethernet concept with better scalability and control

Core Elements​

  • Single Link-State Protocol in the Fabric:
    • SPBM uses a single protocol to understand the entire topology
    • It computes shortest paths through the network (hence the name)
    • All fabric devices have a synchronized view of the topology
  • MAC-in-MAC encapsulation
    • User traffic is encapsulated inside a backbone MAC header as it crosses the fabric
    • The core of the network sees only backbone MAC addresses, not individual user devices
    • This reduces learning overhead in the core and confines end-device complexity to the edges
  • Service Identifiers (I-SIDs):
    • Each virtual network/service is identified by an I-SID (service identifier)
    • An I-SID can represent
      • A Layer 2 service (like a virtual LAN)
      • A Layer 3 service (virtual routing instance)
    • Traffic belonging to different services is carried separately across the same physical links

Key Capabilities​

  • Shortest Path Forwarding without Spanning Tree:
    • The fabric can use all available links
    • No blocked links for loop prevention; the control plane computes loop-free paths
  • Strong Multicast and Broadcast Handling:
    • SPBM's control plane naturally supports efficient multicast distribution
    • Useful for IP video, real-time feeds, or other one-to-many applications
  • Edge-Centric Learning:
    • Edge devices learn end-host MAC addresses
    • The core focuses on backbone MACs and service identifiers, not every individual device
    • This makes the backbone more scalable and stable

Conceptual Strenths​

  • Very deterministic behavior: one protocol, one control plane
  • Particularly attractive where multicast and Ethernet-like services are important
  • Operationally appealing to teams that value a straightforward, predictable transport fabric with clear service constructs

Operational and Design Considerations​

Regardless of the chosen fabric protocol, several operational concepts are similar

Automation and Orchestration​

Fabric-based designs are naturally suited to central management and automation:

  • Policies and segments are defined and appliad across the campus
  • Common patterns:
    • Role-based policies: "HR staff", "contractors", "IoT camera" instead of "VLAN 123 on switch A"
    • Templates and profiles for access switches, wireless APs, and uplinks
  • Over time, this reduces manual configuration and speeds up:
    • New building onboarding
    • Office reorganization
    • Integration of new applications or services

Migration Strategies​

Moving from a legacy campus to a fabric is typically done stepwise:

  • Start in the core/distribution:
    • Introduce the fabric in the center of the network
    • Connect existing access switches or buildings as "clients" to the fabric
  • Gradually extend the fabric to the edge:
    • As access switches are replaced or reconfigured, they become full fabric edge nodes
    • Wireless integration follows suit, attaching SSIDs directly to fabric segments
  • Migrate segments:
    • Move important segments (e.g. guest, corporate, OT) into the fabric overlay
    • Decommision old spanning-tree domains and VLAN extensions as segments migrate

This staged approach reduces risk and allows coexistence with legacy environments during the transition

Security and Policy​

Fabrics enhance security by making segmentation and policy more natural:

  • User or device identity (from a directory, authentication server, or profiling engine - NAC) can determine:
    • Which virtual network they join
    • Which policies apply
  • Different paths and firewall policies can apply to each segment
  • Incidents can be handled by
    • Quickly isolating affected segments
    • Redirecting traffic through security inspection points
    • Monitoring specific segments more intensively

The fabric becomes a powerful enforcer of a "no implicit trust" security posture across the physical campus

Conclusion​

Campus networking is no longer just about plugging things in; it is about delivering secure, predictable, and flexible connectivity across a rapidly changing environment of people, devices, and applications

Traditional designs built on VLANs and spanning tree struggle with today's requirements for:

  • Large-scale segmentation
  • Zero Trust security
  • Mobility and wireless density
  • IoT and OT integration
  • Operational agility and automation

Campus fabric architectures address these challenges by:

  • Separating the simple, resilient underlay from a flexible, segmented overlay
  • Using powerful control planes (such as BGP EVPN or SPBM) to automatically distribute reachability and segment information
  • Enabling clean, scalable virtual networks that can be extended anywhere in the campus without manual rework

Conceptually BGP EVPN VXLAN offers an IP-centric, feature-rich and highly flexible fabric that aligns naturlaly with data center and WAN designs and supports extensive multi-tenancy and advanced capabilities. SPBM offers an Ethernet-centric, single-control-plane fabric with strong multicast behavior and deterministic shortest-path forwarding, appealing for organizations that value simplicity, predictability and strong L2/L3 service constructs

From a business perspective, campus fabric are particularly compelling for:

  • Large and complex campuses
  • Environments with strong security and compliance demands
  • Sectors with many specialized or sensitive devices (healthcare, manufacturing, government, education)

The "low-hanging fruit" lies in using fabrics to:

  • Replace unstable, spanning-tree-heavy backbones
  • Implement clear segmentation between users, guests, partners and critical systems
  • Build new or expanded campuses on a foundation that is ready for both current and future demands

For non-technical stakeholders, the key takeaway is simple: a campus fabric turns the physical network into a flexible, secure platform, where business changes (new buildings, new teams, new applications, new security rules) can be implemented quickly and safely, without constant low-level re-engineering.

The choice between different fabric technologies then becomes a strategic design decision, guided by existing skills, surrounding environments (data center, WAN), and specific operational priorities.