Enterprise Network Architecture: Layers, Models, and Design Criteria

Learn how to design enterprise network architecture with layers, segmentation, redundancy, security, monitoring, infrastructure, and acceptance criteria.

Check it out!

Network architecture is the technical model that organizes how users, devices, applications, services, links, and security controls relate to one another. It defines infrastructure layers, domain boundaries, permitted flows, availability mechanisms, and how the network will be operated, monitored, and expanded.

In an enterprise network, the architecture must answer key questions before switches, routers, or vendors are selected: which applications are critical, who communicates with whom, what level of unavailability is acceptable, where traffic must be inspected, and what evidence will demonstrate that the solution meets the design.

This article explains how to design an enterprise network architecture that is scalable, available, secure, and manageable. Topologies such as star, ring, bus, mesh, and tree are subordinate architectural decisions and should be evaluated according to availability, expansion, failure domains, and operations.

What Is Network Architecture?

Network architecture is the logical and physical organization that transforms communication requirements into implementable infrastructure. It describes functions, layers, modules, interfaces, protocols, policies, supporting services, and performance criteria. It also establishes how the network will be documented, administered, protected, and validated.

A well-defined architecture makes it possible to understand the network without relying on isolated configuration files. The design should show where users, servers, cloud systems, industrial networks, internet access, branches, data centers, identity, monitoring, and security functions are located.

Architecture, Topology, and Network Design Are Not Synonyms

The topology represents how nodes and links are connected physically or logically. The architecture is broader: it defines the function of each part, boundaries, services, policies, and mechanisms used. The network design transforms those decisions into documents, specifications, diagrams, bills of quantities, and test criteria.

A network may have a physical star topology and a logical architecture segmented into dozens of VLANs and VRFs. It may also have redundant links and still remain vulnerable because both links follow the same physical path or depend on the same power source.

Logical Architecture and Physical Architecture

Logical architecture describes addressing, VLANs, VRFs, routing, zones, policies, services, and flows. Physical architecture describes equipment, interfaces, fiber, cables, racks, technical rooms, power supplies, and routes. Both need to be developed together.

Architecture Should Start with Requirements

The safest method is to start from business objectives and technical constraints, characterize the existing network and traffic flows, develop the logical design, and only then select technologies and equipment.

Applications, Users, and Communities of Interest

The survey should identify applications, users, devices, and data repositories. It is necessary to know who initiates each communication, where the destination is, which protocol is used, how much traffic is generated, and what impact occurs when the service becomes unavailable.

IP telephony, videoconferencing, video surveillance, access control, databases, backups, virtualization, Wi-Fi, SCADA, and cloud services have different traffic patterns. Some require low latency and low jitter; others demand high volume, multicast, synchronization, or continuous availability.

Technical Targets and Measurable Criteria

Requirements such as “fast network” or “high availability” need to be converted into capacity, maximum utilization, latency, loss, convergence time, availability, log retention, number of devices, and expansion horizon.

• Scalability: growth in users, endpoints, sites, and traffic.
• Availability: failure scenarios considered and recovery time.
• Performance: throughput, latency, jitter, loss, and queues.
• Security: identities, zones, flows, and logs.
• Manageability: monitoring, inventory, backup, and diagnostics.
• Adaptability: incorporation of new technologies.
• Cost: investment, licensing, operations, and lifecycle.

Characterization of the Existing Network

Enterprise projects rarely start from scratch. The assessment should reconstruct the current topology and identify equipment, versions, links, addressing, VLANs, routes, services, and dependencies. Utilization, errors, discards, CPU, memory, latency, and availability metrics help distinguish architectural limitations from configuration problems.

Hierarchical and Modular Models

Hierarchy divides a complex network into layers with clear functions. Modularity separates parts that can be designed, protected, operated, and expanded with less impact on the rest. These principles reduce unnecessary dependencies, simplify troubleshooting, and allow patterns to be replicated across buildings, plants, or branches.

Access Layer

The access layer connects users, phones, access points, cameras, controllers, sensors, local servers, and other devices. Functions such as access VLANs, 802.1X or MAB authentication, PoE, loop protection, QoS marking, and edge controls are applied there.

Sizing considers the number and type of ports, speed, uplinks, PoE power, stacking, environmental conditions, power-supply redundancy, and expansion capability. In industrial areas, temperature, vibration, DC power, and specific protocols also apply.

Distribution Layer

The distribution layer aggregates access switches and centralizes policies. It can delimit Layer 2 domains, route between VLANs, apply ACLs, summarize routes, implement gateway redundancy, and control access to the core or central services.

A well-defined distribution layer avoids indiscriminate VLAN extension and reduces failure scope. It also creates predictable points for inspection, QoS, filtering, observability, and transition between network areas.

Core Layer

The core interconnects high-importance modules such as distribution, data center, WAN, internet edge, and management environments. Its main function is to transport traffic predictably, with high availability and low latency. Excessively complex policies in the core can increase dependencies and make convergence more difficult.

Collapsed Core

In small and medium-sized networks, distribution and core can be combined into a collapsed-core layer. This simplification reduces equipment and cost, provided capacity, redundancy, and growth are analyzed. The mistake is adopting the simplified model without planning for when the environment will exceed its limits.

Functional Modules

In addition to layers, the architecture can be organized into modules: campus, data center, internet edge, WAN, branches, remote access, wireless networks, management, security, shared services, and OT environments. Each module has its own requirements and boundaries but must be validated as part of the whole.

Cisco Reference Models Applied to Network Architecture

Architecture models popularized by Cisco help organize enterprise and industrial networks into layers and modules with defined responsibilities. The objective is not to tie the architecture to a brand, but to use an established reference to reduce coupling, limit failure domains, facilitate expansion, and make security and operations part of the design.

Principle	Application in the architecture	Related content
Hierarchical model	Separation among access, distribution, and core with clear functions and boundaries.	Layers detailed in this article.
Modular architecture	Division by campus, data center, WAN, internet edge, security, and industrial environments.	Functional modules and hybrid architectures.
Collapsed core	Combination of distribution and core when scale and criticality allow it.	Specific section on collapsed core.
Failure domains	Limiting the impact of faults, changes, loops, and outages.	Availability and redundancy.
Redundancy	Links, devices, power sources, uplinks, and alternative paths with planned convergence.	Spanning Tree and LACP and EtherChannel.
Segmentation	VLANs, VRFs, zones, ACLs, and policies between communities of interest.	Logical Network.
Access control	Identity, 802.1X, NAC, AAA, and dynamic authorization.	Cisco ISE.
Secure operations	Hardening, protected management, telemetry, SNMPv3, logs, and standardization.	Cisco Switch Hardening.
Industrial architecture	IT/OT segmentation, environmental requirements, redundancy, and asset visibility.	Cisco Industrial Switch and Cisco Cyber Vision.

The selection of Cisco or equivalent technologies should occur after requirements, modules, boundaries, capacity, availability, and policies have been defined. The Network Design transforms these decisions into diagrams, specifications, matrices, lists, configuration standards, and acceptance criteria.

Boundaries between Layer 2 and Layer 3

One of the most relevant decisions is determining where Layer 2 switching ends and Layer 3 routing begins. Large Layer 2 domains simplify some device movement but increase broadcast scope, spanning-tree dependency, and failure impact. Smaller Layer 3 boundaries favor containment, convergence, and more predictable policies.

Architecture decision	Technical implication	Design criterion
Extended Layer 2	Expands the broadcast domain and dependence on loop-prevention mechanisms.	Use only when there is a clear functional requirement for L2-domain continuity.
Gateway at distribution	Centralizes inter-VLAN routing and policies at a predictable boundary.	Suitable when access remains predominantly Layer 2 and distribution concentrates control.
Routing at access	Reduces Layer 2 domains and moves the L3 boundary closer to endpoints.	Evaluate scale, convergence, operations, mobility, and access-switch capabilities.
VLAN by function	Organizes local domains and facilitates association among addressing, policy, and responsibility.	Define purpose, gateway, subnet, scope, and authorized communication for each VLAN.
Path redundancy	Provides continuity after a failure provided paths are truly independent.	Validate physical topology, convergence, and remaining capacity under contingency.

Broadcast Domains and VLAN Extension

Each VLAN constitutes a broadcast domain. The architecture should define its purpose, scope, gateway, subnet, policy, and owner. Extending a VLAN across many switches, buildings, or sites increases complexity and may allow a local fault to have broad impact.

Routing at Access or Distribution

In some designs, access uplinks are Layer 2 and routing occurs at distribution. In others, access switches participate in routing. The choice depends on scale, convergence, operations, device capabilities, mobility requirements, and security model.

Spanning Tree as Protection, Not Improvised Design

STP, RSTP, and MSTP prevent loops in switched networks but do not replace intentional architecture. Root selection, priorities, instances, edge ports, and protection mechanisms need to be defined. The article on Spanning Tree — STP, RSTP, and MSTP examines loop prevention, root election, and convergence in greater depth.

Segmentation and Security Architecture

Segmentation should not be added after the network is complete. It needs to be part of the architecture and reflect functions, criticality, exposure, and authorized flows. VLANs isolate Layer 2 domains but do not by themselves constitute a complete security policy.

VLANs, VRFs, Zones, and Conduits

VLANs separate local domains; VRFs create independent routing tables; firewalls and ACLs control traffic between zones. In industrial environments, the zones-and-conduits concept helps group assets with similar requirements and control communications between areas.

The flow matrix should indicate source, destination, service, direction, justification, and owner. This documentation allows firewalls, ACLs, and access policies to be configured according to actual need instead of allowing entire networks for convenience.

Identity and Network Access Control

Modern architectures relate connectivity to identity. Solutions such as Cisco ISE, RADIUS, TACACS+, 802.1X, MAB, and certificates make it possible to authenticate users and devices, assign policies, and control equipment administration.

Management Plane

Administrative interfaces, SSH, SNMP, APIs, consoles, backups, and management platforms need their own architecture. The management plane may use a dedicated network, management VRF, bastion host, centralized authentication, and access restricted to administrative workstations.

Hardening and Defense in Depth

Switch hardening should follow each device’s function. Unnecessary services, insecure protocols, default accounts, broad administrative access, and missing logs increase the attack surface. The baseline needs to be tested and maintained throughout the lifecycle.

Addressing, Routing, and Network Services

Addressing and routing should reflect organizational and geographic hierarchy. Improvised plans hinder summarization, expansion, troubleshooting, and access control. The architecture needs to reserve address ranges, establish allocation criteria, and account for IPv4, IPv6, management networks, services, users, systems, and temporary environments.

Subnets and Summarization

Subnets should be sized with appropriate margin and grouped so routes can be summarized. Summarization reduces tables, updates, and propagation of instability, but depends on contiguous allocation and advance planning. The article on IPv4 Subnetting examines sizing, block division, and criteria for expanding the addressing plan in greater depth.

Static and Dynamic Routing

Static routes are appropriate when the environment is simple and predictable. Dynamic protocols become useful when there are redundant paths, multiple sites, and a need for automatic convergence. The decision should consider scale, recovery time, team expertise, and administrative boundaries. In internal networks, OSPF makes it possible to structure link-state routing domains; when autonomous systems, multiple providers, or peering policies come into play, BGP becomes the architectural reference.

DNS, DHCP, NTP, and Shared Services

Name, addressing, time synchronization, and authentication services are network dependencies. The architecture needs to define location, redundancy, forwarding, access, logs, and contingency. NTP synchronization is especially important for correlating events, investigating incidents, and validating operational sequences.

Availability and Redundancy

Redundancy should eliminate relevant single points of failure, not merely duplicate equipment. Two switches powered by the same circuit, two fibers in the same duct, or two carrier links sharing the same physical route may appear resilient without providing true independence.

Failure Domains

The design should map which users, applications, and areas are affected by the failure of each component. Well-defined layers and modules contain the impact. Flat and excessively interdependent architectures tend to enlarge the failure domain.

Device, Link, and Power Redundancy

Availability may require paired equipment, dual uplinks, redundant power supplies, physically diverse routes, UPS systems, generator sets, and carrier contingency. The adopted level should be proportional to criticality and the cost of downtime.

Convergence and Capacity during Failures

It is not enough for an alternate path to exist. It is necessary to know how long the network takes to use it and whether its capacity can support the remaining traffic. Failover tests should verify loss, reconvergence, sessions, routes, gateways, aggregations, and application behavior.

Link Aggregation

LACP and link aggregation combine physical interfaces into a logical link, increasing capacity and tolerance to port or cable failures. Distribution is not necessarily uniform and depends on the hashing algorithm. The article on LACP, Link Aggregation, and EtherChannel examines architecture criteria, capacity, compatibility, hashing, and testing in greater depth.

Capacity, Traffic, and Quality of Service

Capacity should be calculated from flows, not merely from the nominal sum of ports. Uplinks aggregate traffic from many devices, and peaks may occur simultaneously. Backups, cameras, updates, replication, and cloud applications can generate bursts that do not appear in daily averages. Characterizing network traffic helps identify sources, destinations, communication patterns, simultaneity, and critical periods; in existing networks, NetFlow can provide additional evidence about conversations and volumes.

Oversubscription

Oversubscription is the relationship between the potential capacity of access ports and uplink capacity. It may be acceptable when users do not transmit simultaneously, but it needs to be documented. Video, storage, virtualization, and automation environments may require more conservative ratios.

Latency, Jitter, and Loss

Interactive applications, voice, video, and control depend on predictable delay. Architecture affects hop count, queues, paths, inspections, and capacity. High utilization increases queueing nonlinearly, making design margins and QoS relevant.

QoS and Classification

QoS does not create bandwidth, but it allows traffic to be classified, marked, queued, and prioritized according to criticality. The policy needs to be end-to-end and consistent across access, distribution, core, and WAN. Untrusted markings should be validated or reclassified at the edge.

Multicast

Video, discovery, automation, and some critical systems use multicast. IGMP Snooping, querier functions, multicast routing, and domain boundaries need to be considered. Treating multicast as broadcast can generate excessive traffic and unpredictable behavior.

Monitoring, Observability, and Management

The ability to operate the network should be designed from the outset. Monitoring added later may encounter unsupported devices, inconsistent addressing, missing logs, and lack of secure access. The management architecture needs to define what will be monitored, through which protocol, at what interval, and with what retention.

SNMPv3, Telemetry, Syslog, and Flows

SNMPv3 allows collection of states and counters with authentication and privacy. Syslog records events; NetFlow or equivalent technologies characterize conversations; telemetry provides time series with greater granularity. Each source answers different questions and should be integrated into the operational process. The article on Network Monitoring organizes metrics and observability, while Network Management broadens the view to faults, configuration, accounting, performance, and security through the FCAPS model.

In-Band and Out-of-Band Management

In in-band management, administrative access uses the production network itself. In out-of-band management, it uses independent or dedicated infrastructure. OOB increases diagnostic resilience but requires specific cost, protection, and design. Hybrid solutions are common.

Source of Truth and Living Documentation

Inventory, IPAM, VLANs, racks, circuits, interfaces, and cables should have a reliable source of truth. Tools such as NetBox help relate physical and logical infrastructure, but they require an update process. An outdated platform merely centralizes inconsistencies.

Physical Infrastructure Supporting the Architecture

The logical architecture depends on network infrastructure capable of supporting capacity, distance, power, environment, and expansion. Structured cabling, fiber, racks, pathways, spaces, power, and equipotential bonding need to be coordinated with the logical design.

Horizontal Cabling and Backbone

Horizontal cabling connects work areas and devices to distributors. The backbone interconnects rooms, floors, buildings, and areas. Fiber counts, performance classes, distances, connectors, spare capacity, routes, and physical independence should support the growth horizon.

Racks and Technical Rooms

Layout, occupancy, heat dissipation, access, organization, identification, and electrical capacity affect maintainability. Concentrating equipment without evaluating space, heat, weight, or cable access can make expansion impractical and increase operational risk.

PoE and Power

Cameras, phones, access points, and controllers may depend on Power over Ethernet. The design should calculate per-port power, total power budget, losses, simultaneity, redundancy, and UPS autonomy. The number of PoE ports does not mean there is capacity to power all of them at maximum power.

Grounding, Equipotential Bonding, and Environment

Racks, metallic pathways, shields, and equipment need to be integrated with the equipotential-bonding measures provided for telecommunications. Temperature, humidity, dust, vibration, electromagnetic interference, and surge exposure also influence selection and installation.

Enterprise, Industrial, and Hybrid Architectures

Enterprise Campus

Campus networks connect users, Wi-Fi, voice, video, and building systems across one or more buildings. They typically use access, distribution, and core or collapsed-core layers, with an optical backbone, segmentation, authentication, and centralized management.

Data Center and Central Services

Data centers have high density, east-west traffic, virtualization, storage, automation, and strict availability requirements. The architecture should consider redundancy, failure domains, load balancing, security between applications, and integration with campus, cloud, and disaster recovery.

Branches, WAN, and Internet Edge

Branches may connect through private networks, the internet, VPN, or SD-WAN. The architecture defines carrier redundancy, routing, prioritization, local internet access, security, and operation when the central connection becomes unavailable.

Industrial Networks and OT

OT environments connect PLCs, IEDs, RTUs, HMIs, SCADA, historians, and engineering workstations. The architecture needs to consider industrial protocols, availability, determinism, synchronization, rugged equipment, segmentation, and restricted change windows. The industrial networks hub examines these interfaces in greater depth.

Integration among IT, OT, and Cloud

Convergence does not mean eliminating boundaries. Integrations should use zones, DMZ, proxies, gateways, APIs, and explicitly authorized flows. Cloud services need to be incorporated into availability, identity, logging, latency, and continuity requirements.

Network Migration and Modernization

A target architecture is only useful when there is a safe path to reach it. The migration plan should consider compatibility, licenses, transceivers, addressing, dependencies, maintenance windows, communications, rollback, and go/no-go criteria.

Wave-Based Deployment

Dividing migration by building, site, layer, or service reduces risk and allows lessons learned to be incorporated. Each wave should have prerequisites, owners, a runbook, validation, and contingency measures.

Coexistence with Legacy Systems

Legacy equipment and applications may require temporary VLANs, specific protocols, gateways, or compensating controls. These exceptions need to be documented, assigned an owner, and have a plan for elimination or review.

Staging and Pre-Validation

Configurations, versions, templates, authentication, routing, and integrations can be prepared in staging. Pre-testing reduces maintenance-window duration and identifies incompatibilities before production is affected.

Documentation and Acceptance Criteria

Documentation should make it possible to procure, implement, test, operate, and modify the network. Conceptual diagrams are important but need to be complemented by sufficient information for execution and validation. The article on Network Diagrams details how to separate and relate logical, physical, and architectural views.

Acceptance criterion	Expected evidence	Failure the test seeks to reveal
Segmentation	VLANs, gateways, routes, and policies consistent with the communication matrix.	Unauthorized communication, incorrect isolation, or undocumented dependency.
Redundancy	Controlled failure test of a link, device, or gateway with recovery records.	Single point of failure, excessive reconvergence time, or insufficient alternate path.
Capacity	Measurements of throughput, utilization, queues, and behavior under the peak condition defined in the design.	Undersized uplink, inappropriate oversubscription, or architectural bottleneck.
Observability	Collection of states, events, logs, metrics, and flows according to the management plan.	Assets without visibility, diagnostic gaps, or insufficient retention.
Documentation	Diagrams, addressing, ports, circuits, configurations, and as-built documentation consistent with the implementation.	Divergence among design, configuration, and the actual network condition.

Architecture and Design Deliverables

• design basis and criteria;
• inventory and assessment of the existing condition;
• matrix of applications, users, flows, and criticality;
• conceptual, logical, and physical architecture;
• campus, data center, WAN, internet-edge, and management diagrams;
• addressing, VLAN, VRF, and routing plan;
• matrix of zones, flows, and controls;
• sizing of links, uplinks, PoE, and infrastructure;
• technical specifications, lists, and quantities;
• migration, contingency, and rollback plan;
• FAT, SAT, and commissioning procedures;
• requirements for as-built documentation.

Functional, Performance, and Failure Testing

Tests should verify connectivity, VLANs, routing, redundancy, convergence, authentication, policies, QoS, multicast, monitoring, logs, and supporting services. Throughput, latency, jitter, loss, and behavior under peak load should be assessed when relevant. Failures of links, equipment, power sources, gateways, and services need to be simulated in a controlled manner.

As-Built Documentation and Change Management

The as-built documentation should reflect what was actually implemented. Diagrams, addresses, ports, fibers, configurations, versions, licenses, and exceptions need to be updated. Without a change-management process, documentation quickly loses value.

Common Network-Architecture Errors

• selecting equipment before defining requirements and flows;
• confusing logical redundancy with physical independence;
• extending VLANs unnecessarily across many switches or sites;
• maintaining large Layer 2 domains for convenience;
• failing to control spanning-tree root and protection mechanisms;
• sizing uplinks only by the nominal number of ports;
• ignoring backup, video, replication, and multicast traffic;
• treating security and monitoring as afterthoughts;
• applying the same policy to users, servers, cameras, and OT;
• failing to plan PoE power, UPS systems, racks, and backbone routes;
• implementing without a migration and rollback plan;
• accepting the network based only on ping tests;
• failing to update documentation after changes.

Final Considerations

Enterprise network architecture is a design discipline, not a generic drawing or equipment list. It begins with objectives, applications, flows, and constraints; organizes infrastructure into layers and modules; defines boundaries, segmentation, availability, capacity, management, and security; and ends with documentation, testing, and acceptance criteria.

Technical References

[1] OPPENHEIMER, Priscilla. Top-Down Network Design. 3rd ed. Indianapolis: Cisco Press, 2011.

[2] ABNT. ABNT NBR 14565:2019 — Structured cabling for commercial buildings.

[3] ISO; IEC. ISO/IEC 11801-1:2017 — Information technology — Generic cabling for customer premises — Part 1: General requirements. Available at: https://www.iso.org/standard/66182.html.

[4] IEEE. IEEE 802.3 — Ethernet. Available at: https://standards.ieee.org/ieee/802.3/10422/.

[5] IEEE. IEEE 802.1Q-2022 — Bridges and Bridged Networks. Available at: https://standards.ieee.org/ieee/802.1Q/10323/.

[6] CENTER FOR INTERNET SECURITY. CIS Critical Security Controls v8.1. Available at: https://www.cisecurity.org/controls/v8-1.

[7] CISA; NSA. Network Infrastructure Security Guidance. 2022. Available at: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a.

[8] IEC. IEC 62443 series — Security for industrial automation and control systems. Available at: https://www.iec.ch/cyber-security/industrial-cyber-security.

Frequently Asked Questions

What Is Network Architecture?

Network architecture is the model that organizes layers, modules, services, flows, policies, protocols, equipment, and infrastructure to meet communication, security, availability, and operational requirements.

What Is the Difference between Network Architecture and Topology?

Topology represents how nodes and links connect physically or logically. Architecture is broader and defines functions, layers, boundaries, services, security, management, and capacity.

What Are the Layers of an Enterprise Network Architecture?

The hierarchical model uses access, distribution, and core. In smaller networks, distribution and core may be combined in a collapsed-core layer.

Is a VLAN Enough to Segment a Network Securely?

No. A VLAN separates Layer 2 domains, but security requires policies between zones, controlled routing, ACLs or firewalls, identity, hardening, and monitoring.

What Documents Should Be Included in a Network-Architecture Design?

Design criteria, logical and physical diagrams, addressing, VLANs, routing, flow matrix, sizing calculations, specifications, migration plan, and test procedures.

How Should a Network Architecture Be Validated?

Validation should demonstrate connectivity, routing, segmentation, redundancy, convergence, authentication, performance, monitoring, logging, and recovery.

Complementary Technical Materials

Related Services

• Logical Network and Corporate Network Design — architecture, segmentation, redundancy, addressing, and design criteria.
• Engineering Technical Due Diligence — As-Is survey, inventory, constraints, risks, and modernization baseline.
• Technical Testing and Verification — validation of performance, contingency, and measurable acceptance criteria.
• Commissioning — verification of implemented architecture, documentation, and handover evidence.

Main Content on the Topic

• Complete Guide to Network Architecture — hub for the architecture, topology, design, and infrastructure cluster.
• Network Design — stages, requirements, documentation, implementation, and validation criteria.
• Network Diagram — logical, physical, and architectural views applied to technical documentation.
• Network Topology — criteria for star, ring, mesh, tree, and other interconnection forms.
• Logical Network — VLANs, segmentation, addressing, and flow organization.

Related Technical Content

• IPv4 Subnetting — subnet sizing and organization.
• OSPF — areas, LSAs, costs, convergence, and design criteria.
• BGP — ASN, peering, and policies between autonomous systems.
• Network Traffic — flows, load, broadcast, multicast, and capacity.
• NetFlow — flow telemetry for traffic characterization.
• Network Monitoring — metrics, availability, performance, and observability.
• Network Management — FCAPS, configuration, performance, and operational security.
• Spanning Tree — loop prevention and convergence in Layer 2.
• LACP and EtherChannel — link aggregation, capacity, and redundancy.
• Whitepaper: NetBox as a Source of Truth — IPAM, DCIM, inventory, and living network documentation.