1.1 Enterprise Network Design Models & Hierarchical Campus Architecture

1.1 Enterprise Network Design Models & Hierarchical Campus Architecture

Before you start: this guide targets ENCOR 350-401 v1.2.

Cisco replaced the ENCOR blueprint on 19 March 2026. The last day to test on v1.1 was 18 March 2026, so every candidate now sits v1.2. The single biggest change is a removal: all wireless content is gone from ENCOR. The v1.1 topics covering WLAN design principles, AP modes and antennas, the AP discovery and join process, Layer 2 and Layer 3 roaming, WLAN troubleshooting, and wireless security (802.1X, WebAuth, PSK, EAPOL) moved to the new CCNP Wireless track and its own core exam, 350-101 WLCOR, which launched the same day. Cisco also removed the wireless concentration exams from CCNP Enterprise; the current concentration list is ENARSI 300-410, ENSDWI 300-415, ENSLD 300-420, ENAUTO 300-435, ENCC 300-440, and ENNA 300-445.

Other v1.2 changes reflected throughout this guide: domain 6 is renamed "Automation and Artificial Intelligence"; Cisco DNA Center is now Cisco Catalyst Center; vManage is now Cisco Catalyst SD-WAN Manager; policy-based routing was added as topic 3.2.d; multicast topic 3.3.d was expanded to name SSM, bidirectional PIM, and MSDP explicitly; and the QoS topic was simplified to "Interpret QoS configurations" (Chapter 2). The six domain weights are unchanged: Architecture 15%, Virtualization 10%, Infrastructure 30%, Network Assurance 10%, Security 20%, Automation and AI 15%. The exam remains 120 minutes.

If a study resource you are using still teaches CAPWAP or wireless roaming as ENCOR material, it is built against v1.1 and is out of date.

Modern enterprise networks must support high availability, deterministic traffic flows, seamless scalability, and simplified operational troubleshooting. To achieve these requirements, network architects avoid flat, unsegmented Layer 2 topologies and instead implement structured hierarchical models.

+-----------------------------------------------------------------------+
|                   CISCO ENTERPRISE ARCHITECTURE                       |
+-----------------------------------------------------------------------+
|  +------------------------+  +-------------------+  +---------------+ |
|  |   Enterprise Campus    |  |  Data Center &    |  |  Enterprise   | |
|  |  - Access Layer        |  |  Spine-Leaf Fabric|  |  Edge & WAN   | |
|  |  - Distribution Layer  |  |  - Spine Switches |  |  - Internet   | |
|  |  - Core Layer          |  |  - Leaf Switches  |  |  - SD-WAN     | |
|  +------------------------+  +-------------------+  +---------------+ |
+-----------------------------------------------------------------------+

---

1. Classical Hierarchical Campus Design (3-Tier Model)

The classical Cisco hierarchical campus design partitions the enterprise network into three distinct modular layers: Access, Distribution, and Core. Each layer performs specific, dedicated functions that isolate faults, aggregate traffic, and enforce security policies without impacting neighboring network tiers.

+-----------------------------------------------------------------------+
|                     3-TIER CAMPUS ARCHITECTURE                        |
+-----------------------------------------------------------------------+
|                                                                       |
|   +--------------------+             +--------------------+           |
|   |    Core Switch 1   |<===========>|    Core Switch 2   |  CORE     |
|   +--------------------+             +--------------------+  LAYER    |
|          //            \\           //            \\                  |
|         //              \\         //              \\                 |
|   +------------+      +------------+      +------------+              |
|   | Dist Switch|=====>| Dist Switch|      | Dist Switch|     DISTRIB  |
|   |    1A      |      |    1B      |      |    2A      |     LAYER    |
|   +------------+      +------------+      +------------+              |
|      /      \            /      \            /      \                 |
|  +----+    +----+    +----+    +----+    +----+    +----+             |
|  |Acc1|    |Acc2|    |Acc3|    |Acc4|    |Acc5|    |Acc6|    ACCESS   |
|  +----+    +----+    +----+    +----+    +----+    +----+    LAYER    |
+-----------------------------------------------------------------------+

Access Layer

The access layer serves as the network entry point for end devices, including workstations, IP phones, wireless access points (APs), printers, and IoT endpoints. Its primary mission is user connectivity and edge security enforcement.

• Key Responsibilities:
  • Edge Security: Dynamic ARP Inspection (DAI), DHCP Snooping, IP Source Guard (IPSG), and 802.1X Port-Based Authentication.
  • VLAN Assignment & Segmentation: Segmenting broadcast domains into distinct functional and departmental VLANs.
  • Power over Ethernet (PoE): Providing inline power to endpoints via IEEE 802.3af (PoE, up to 15.4W), 802.3at (PoE+, up to 30W), and 802.3bt (UPOE/UPOE+, 60W to 90W).
  • Layer 2 Loop Prevention: Spanning Tree Protocol (STP) features such as PortFast, BPDU Guard, and Root Guard.
  • Initial QoS Classification & Marking: Setting Layer 2 Class of Service (CoS) 802.1p bits or Layer 3 Differentiated Services Code Point (DSCP) values at the untrusted boundary.

Distribution Layer

The distribution layer acts as the aggregation boundary between the access tier and the high-speed campus backbone. It terminates Layer 2 VLANs, hosts default gateway IP addresses, and enforces organizational traffic policies.

• Key Responsibilities:
  • Layer 2/Layer 3 Boundary: Serving as the default gateway for access-layer VLANs using First-Hop Redundancy Protocols (HSRP/VRRP) or routed access uplinks.
  • Policy Enforcement & Filtering: Applying Access Control Lists (ACLs), inter-VLAN routing inspection, and firewall policy boundaries.
  • Route Summarization & Aggregation: Summarizing subnets from access closets before advertising routes to the campus core, isolating routing flaps and reducing routing table sizes.
  • Quality of Service (QoS): Implementing priority queuing, weighted random early detection (WRED), and traffic policing.
  • Control Plane Security: Control Plane Policing (CoPP) and broadcast storm control.

Core Layer

The core layer (campus backbone) is designed for raw speed, high throughput, and maximum availability. Its primary objective is switching and routing aggregated traffic between distribution blocks, data center facilities, and the enterprise edge as quickly as possible.

• Key Responsibilities:
  • High-Speed Packet Transport: Utilizing low-latency, non-blocking 40G/100G/400G interfaces.
  • Zero Packet Manipulation: Policy enforcement, packet filtering (ACLs), deep packet inspection, and packet transformations are intentionally avoided in the core to eliminate CPU overhead and packet delay.
  • Fault Domain Isolation & Deterministic Convergence: Leveraging dynamic routing protocols (OSPF, EIGRP, IS-IS) with sub-second tuning (e.g., BFD, fast timers) to reroute around link or node failures instantaneously.

---

2. 2-Tier Collapsed Core Design

In small-to-medium enterprise campuses or branch office locations where building count and total port density do not justify a dedicated, standalone core infrastructure, architects deploy a 2-Tier Collapsed Core (also known as a Collapsed Backbone) topology.

+-----------------------------------------------------------------------+
|                   2-TIER COLLAPSED CORE TOPOLOGY                      |
+-----------------------------------------------------------------------+
|                                                                       |
|          +-----------------------------------------------+            |
|          |      Collapsed Core / Distribution Switch     |            |
|          |   - Inter-VLAN Routing & Gateway (HSRP/VRRP)  |            |
|          |   - Policy Enforcement (ACL / QoS / Security) |            |
|          |   - High-Speed Core Backbone Switching        |            |
|          +-----------------------------------------------+            |
|                      //                     \\                        |
|                     //                       \\                       |
|          +--------------------+    +--------------------+             |
|          | Access Switch 101  |    | Access Switch 102  |             |
|          | - Port Security    |    | - 802.1X & PoE+    |             |
|          +--------------------+    +--------------------+             |
+-----------------------------------------------------------------------+

• Core and Distribution Consolidation: The functions of the core and distribution layers are merged into a single redundant pair of multilayer switches (e.g., Cisco Catalyst 9500 or 9600 series).
• Economic & Operational Optimization: Reduces physical rack space, power consumption, cooling requirements, optical transceivers, and initial capital expenditures (CapEx).
• Trade-Offs: While cost-effective, a collapsed core limits horizontal scale. Expanding beyond a few thousand endpoints can exhaust hardware TCAM capacity and distribution port counts, necessitating migration to a 3-tier model.

Architectural Comparison: 3-Tier vs. 2-Tier Collapsed Core

---

3. Data Center & Modern Fabric Architecture: 2-Tier Spine-Leaf

Traditional 3-tier campus designs were engineered for asymmetric North-South traffic patterns (client-to-server and client-to-internet). In modern data centers and software-defined enterprise fabrics (such as Cisco SD-Access and Cisco ACI), distributed applications, server virtualization, and microservice architectures generate predominantly East-West traffic (server-to-server and controller-to-node).

To eliminate the bottlenecks, spanning-tree blocked links, and variable multi-hop latency of classical topologies, modern data centers implement a 2-tier Spine-Leaf architecture based on a Clos network topology.

+-----------------------------------------------------------------------+
|                   2-TIER SPINE-LEAF FABRIC (CLOS)                     |
+-----------------------------------------------------------------------+
|                                                                       |
|            +------------------+    +------------------+               |
|            |  Spine Switch 1  |    |  Spine Switch 2  |  SPINE        |
|            +------------------+    +------------------+  LAYER        |
|                /    |    \              /    |    \                   |
|               /     |     \            /     |     \                  |
|              /      |      \          /      |      \                 |
|        +-------+ +-------+ +-------++-------+ +-------+ +-------+     |
|        |Leaf 1 | |Leaf 2 | |Leaf 3 ||Leaf 4 | |Leaf 5 | |Leaf 6 |     |
|        +-------+ +-------+ +-------++-------+ +-------+ +-------+     |
|            |         |         |        |         |         |         |
|         [Server]  [Server]  [Storage][Server]  [Server]  [Storage]    |
+-----------------------------------------------------------------------+

Spine-Leaf Architectural Rules

1. Full Mesh Interconnection: Every leaf switch connects to every spine switch in the fabric.
2. No Leaf-to-Leaf Links: Leaf switches never connect directly to other leaf switches.
3. No Spine-to-Spine Links: Spine switches never connect directly to other spine switches.
4. Consistent Hop Count & Latency: Any endpoint attached to one leaf switch is exactly two hops away from any endpoint attached to any other leaf switch (Leaf $\to$ Spine $\to$ Leaf), guaranteeing deterministic latency.
5. Layer 3 Underlay with ECMP: All inter-switch links operate as routed Point-to-Point Layer 3 interfaces running dynamic routing protocols (typically eBGP or IS-IS). Equal-Cost Multi-Pathing (ECMP) load-balances traffic across all available spines simultaneously, eliminating spanning tree blocked links and achieving 100% link bandwidth utilization.

4. High Availability (HA) & Fault Tolerance Design

High availability in enterprise campus networks combines physical hardware redundancy, link aggregation, stateful supervisor failover, and sub-second control plane convergence.

Supervisor Engine Redundancy Modes

Modular chassis switches (such as the Cisco Catalyst 9400 and 9600 series) accommodate dual supervisor engines (Active and Standby). The synchronization behavior between supervisors determines recovery time during hardware or software faults:

• Route Processor Redundancy (RPR):
  • The standby supervisor is partially initialized but does not load the startup configuration or maintain routing state.
  • Upon active supervisor failure, the standby supervisor must reset the line cards and load the operating system completely.
  • Failover Time: 2 to 4 minutes; all existing data plane traffic is dropped.
• Route Processor Redundancy Plus (RPR+):
  • The standby supervisor is fully booted and the startup configuration is parsed.
  • Line cards are not reset upon failover, but internal data plane tables must be rebuilt.
  • Failover Time: 30 to 60 seconds; active sessions are dropped.
• Stateful Switchover (SSO):
  • The standby supervisor is fully initialized, synchronized with the active supervisor's running configuration, and mirrors Layer 2 protocol states (STP, 802.1Q, LACP, MAC address tables) in real time.
  • Failover Time: Sub-second Layer 2 switchover (<200 ms). Layer 2 links stay up without renegotiation.
• Non-Stop Forwarding (NSF) / Graceful Restart (GR):
  • Works in tandem with SSO to preserve Layer 3 data forwarding.
  • When an active supervisor fails, the Cisco Express Forwarding (CEF) hardware forwarding table on the line cards continues forwarding user traffic without interruption.
  • Meanwhile, the newly active supervisor restarts routing protocol neighbor relationships (BGP, OSPF, EIGRP, IS-IS) without tearing down neighboring routing adjacencies or flushing routing tables.

+-----------------------------------------------------------------------+
|             SUPERVISOR STATEFUL SWITCHOVER & NSF OPERATION            |
+-----------------------------------------------------------------------+
|                                                                       |
|  +------------------------+             +--------------------------+  |
|  |   Active Supervisor    |             |    Standby Supervisor    |  |
|  |  - Control Plane (OSPF)|             |  - Warm Control Plane    |  |
|  |  - Dynamic RIB / ARP   |====SYNC====>|  - Synced L2 MAC / STP   |  |
|  +------------------------+ (Real-time) +--------------------------+  |
|              |                                        |               |
|   [ACTIVE CRASHES!]                               [BECOMES ACTIVE]    |
|              |                                        |               |
|  +-----------------------------------------------------------------+  |
|  |               Hardware Data Plane (Line Cards / CEF)            |  |
|  |   - FIB and Adjacency tables continue forwarding uninterrupted  |  |
|  |   - No packet loss during control plane restart (NSF/SSO)       |  |
|  +-----------------------------------------------------------------+  |
+-----------------------------------------------------------------------+

Supervisor Redundancy Configuration & Verification

! Configure SSO redundancy mode on a modular Cisco Catalyst switch
Switch(config)# redundancy
Switch(config-red)# mode sso

! Verify redundancy state and synchronization
Switch# show redundancy
Redundant System Information :
------------------------------
       Available system uptime = 42 weeks, 3 days, 14 hours
Switch uptime in current state = 42 weeks, 3 days, 14 hours
                Operating Mode = Stateful Switchover (SSO)
                Current System = Dual Supervisor

Redundancy State Information :
------------------------------
            Active Slot = Slot 3 (ACTIVE)
           Standby Slot = Slot 4 (STANDBY HOT)
             Image Type = Dual IOS-XE Enterprise
                 Config = In Sync

---

5. Quantitative Reliability Metrics: MTBF, MTTR, and Availability

Enterprise Service Level Agreements (SLAs) define network uptime mathematically. Designing resilient architectures requires evaluating hardware reliability and operational recovery metrics.

+-----------------------------------------------------------------------+
|                 TIMELINE OF SYSTEM AVAILABILITY METRICS               |
+-----------------------------------------------------------------------+
|                                                                       |
|   |<--------------------------- MTBF ---------------------------->|   |
|   |                                                               |   |
|---+======================================+------------------------+---|
|   |           Normal Operation           |  Failure & Repair (MTTR)|   |
|   |                                      |                        |   |
|   ^                                      ^                        ^   |
| Device                               Device                   Service |
| Online                              Fails                    Restored |
+-----------------------------------------------------------------------+

Mathematical Definitions

1. Mean Time Between Failures (MTBF): $\text{MTBF} = \frac{\text{Total Operational Operating Hours}}{\text{Total Number of Natural Hardware Failures}}$

   • Represents the statistical reliability rating (measured in hours) provided by hardware manufacturers indicating expected operating duration before a hardware component suffers an intrinsic failure.

2. Mean Time to Repair / Resolve (MTTR): $\text{MTTR} = \frac{\text{Total Corrective Maintenance Downtime}}{\text{Total Number of Corrective Repair Actions}}$

   • Represents the average duration required to detect a failure, dispatch replacement parts, reconfigure software, and restore the service to operational status.

3. System Availability Percentage ($A$): $A = \frac{\text{MTBF}}{\text{MTBF} + \text{MTTR}} \times 100\%$

The "Nines" of Availability and Permitted Downtime

Architectural Takeaway: MTBF is governed by hardware physical components (e.g., capacitors, power supplies, silicon ASICs), whereas MTTR is governed by architectural design choices (redundant paths, rapid protocol convergence, SSO/NSF, automated failover). Reducing MTTR from hours to sub-seconds using automated HA architectures is the most effective engineering path to achieving "Five Nines" ($99.999%$) enterprise uptime.