Owner: Network Architecture · Review Cycle: Annual
This page documents the enterprise network architecture — the logical and physical design that governs how all sites, data centres, and cloud environments are connected. Changes to the core architecture require an Architecture Decision Record (ADR) and sign-off from the Network Domain Architect and CISO.
| Layer | Device | Model | Redundancy |
|---|---|---|---|
| Internet Edge | Firewall | Palo Alto PA-5450 | Active/Passive pair |
| Core / Border | Router | Cisco Catalyst 9500-48Y4C | VSS pair |
| DC Spine | Switch | Cisco Nexus 9364C | vPC pair |
| DC Leaf | Switch | Cisco Nexus 9300-FX | vPC pair per rack row |
| OOB Management | Switch | Cisco Catalyst 9200 | Per-row, separate OOB fabric |
Mirrors DC1 at 70% capacity. Active-Passive for Tier 1 workloads; Active-Active for select stateless services.
| Layer | Device | Model |
|---|---|---|
| Distribution | Cisco Catalyst 9300X-48HX | StackWise pair per building |
| Access | Cisco Catalyst 9200L-48P | Per floor |
| Wireless | Cisco Meraki MR57 | Per zone (see Wireless page) |
VLANs are the primary segmentation boundary within the campus. Traffic between VLANs is enforced via ACL on the distribution layer and NSX-T micro-segmentation within the DC.
| VLAN ID | Name | Subnet | Zone |
|---|---|---|---|
| 10 | CORP-STAFF | 10.10.10.0/22 | Internal trusted |
| 20 | CORP-MGMT | 10.10.20.0/24 | IT management |
| 30 | VOIP | 10.10.30.0/24 | QoS tagged |
| 40 | PRINTERS | 10.10.40.0/24 | Restricted egress |
| 50 | GUEST-WIFI | 10.10.50.0/23 | Internet breakout only |
| 60 | IOT-DEVICES | 10.10.60.0/24 | Isolated, no corp access |
| 100 | SERVERS-PROD | 10.0.10.0/22 | DC1 production servers |
| 110 | SERVERS-MGMT | 10.0.20.0/24 | DC1 OOB management |
| 200 | DMZ-EXTERNAL | 10.0.100.0/28 | Internet-facing services |
┌──────────────────────────────┐
│ ISP A (AS 1234) │
│ Primary Internet Transit │
└──────────────┬───────────────┘
│ eBGP
┌──────────────▼───────────────┐
│ Internet Edge (PA-5450) │
│ AS 65001 │
└──────────────┬───────────────┘
│
┌──────────────▼───────────────┐
│ Core Router (C9500) │
│ iBGP Route Reflector │
└──────┬───────────────┬───────┘
│ │
┌──────────▼──┐ ┌──────▼──────────┐
│ DC Spine │ │ AWS DX Gateway │
│ (Nexus) │ │ (Direct Connect)│
└─────────────┘ └──────────────────┘
| DSCP | Class | Traffic Type | Bandwidth |
|---|---|---|---|
| EF (46) | Voice | VoIP RTP | 15% |
| AF41 (34) | Video | Video conferencing | 20% |
| AF31 (26) | Critical Data | ERP, finance apps | 25% |
| AF21 (18) | Business Data | General corporate | 25% |
| BE (0) | Best Effort | Internet, guest | 15% |
UNTRUST (Internet)
│
│ [Palo Alto — Internet Edge]
│
TRUST-DMZ (Reverse proxies, VPN)
│
│ [Palo Alto — Internal Segmentation Firewall]
│
TRUST-CORE (Corporate LAN, DC servers)
│
│ [NSX-T DFW — Micro-segmentation]
│
TRUST-APP (Application tier east-west)
All network changes follow the ITIL Change Management process:
| Change Type | Approval | Lead Time |
|---|---|---|
| Standard (pre-approved) | None — CAB pre-approved | Immediate |
| Normal Minor | Network Lead | 5 business days |
| Normal Major | CAB | 10 business days |
| Emergency | On-call Network Architect | Immediate, post-review |
https://netbox.internalhttps://panorama.internal