Page Nav

HIDE

Grid

GRID_STYLE

Network Infrastructure Explained: Devices, Cabling and a Small Office Design

July 21, 2021

Network infrastructure is all the hardware, cabling and basic services that let devices talk to each other. In this post I will explain each...

Network infrastructure is all the hardware, cabling and basic services that let devices talk to each other. In this post I will explain each component in plain terms, then put them together into a real small-office design of the kind I deploy for 30 to 60 users in Kathmandu, complete with an IP plan, a core switch configuration and a Packet Tracer topology you can build yourself.

What network infrastructure includes

Networking means connecting two or more devices so they can share information and resources. To do that you need four groups of things:

  • Network devices that move traffic: routers, switches, firewalls and wireless access points.
  • End devices that create and use traffic: PCs, laptops, phones, printers, IP cameras and servers.
  • Transmission media: the copper cables, fiber and radio links the signals travel on, plus connectors such as RJ45 and LC.
  • Protocols and services: the TCP/IP protocol suite, plus services like DHCP, DNS and directory authentication.

Supporting items matter just as much: racks, patch panels, UPS units and labeling. A network with perfect configuration still fails if the switch loses power every time the grid flickers.

Basic network infrastructure components

Network devices

DeviceOSI layerWhat it doesWhere you see it
ONT / modem1-2Converts the ISP's fiber (GPON) or other access signal to EthernetThe box your ISP installs where the fiber enters
Router3Forwards packets between different IP networks using a routing table; usually does NAT at the internet edgeISP edge, branch offices
Firewall3-7Allows or blocks traffic based on rules and connection state; modern ones also inspect applications and run VPNsBetween the LAN and the internet
Layer 2 switch2Forwards frames inside a network using a MAC address table; supports VLANsAccess switches near users
Layer 3 (multilayer) switch2-3A switch that can also route between VLANs at high speedCore switch
Wireless access point1-2Bridges Wi-Fi clients onto the wired LANCeilings and walls
Hub1Repeats every bit out every port; one shared collision domainObsolete; replaced by switches
Server7 (services)Provides services such as DHCP, DNS, file sharing and authenticationServer rack or cupboard

Note that routers, switches and hubs are devices, not transmission media; that is a common mix-up.

Cabling and transmission media

Copper twisted pair

Unshielded twisted pair (UTP) with RJ45 connectors is what runs to almost every desk. The key limit to remember is 100 meters per channel (90 m of permanent cable plus up to 10 m of patch cords), defined by the ANSI/TIA-568 cabling standard.

  • Cat5e: 1 Gbps up to 100 m. Fine for existing installs.
  • Cat6: 1 Gbps up to 100 m, and 10 Gbps up to about 55 m. The common choice for new offices.
  • Cat6a: 10 Gbps up to 100 m. Worth it for runs to Wi-Fi 6/7 access points and between switches.

Use the same wiring scheme on both ends, either T568A or T568B (T568B is what most installers in Nepal use). Modern switches support Auto-MDIX, so you rarely need crossover cables any more.

Fiber

Fiber is used for longer runs, links between floors or buildings, and anywhere electrical interference or lightning is a concern. Multimode fiber (OM3, OM4) suits runs within a building, up to a few hundred meters at 10 Gbps. Single-mode fiber (OS2) reaches kilometers and is what ISPs use. Small form-factor pluggable (SFP) modules plug into switches, and LC is the usual connector.

Wireless

Wi-Fi uses radio in the 2.4, 5 and 6 GHz bands. Walls, especially the thick brick and concrete common in Kathmandu buildings, weaken the signal a lot, so plan for one access point per room cluster rather than one powerful AP for the whole floor.

Power and environment

Use Power over Ethernet (PoE, IEEE 802.3af/at/bt) switches to power APs, IP phones and cameras over the data cable. Put the core switch, firewall, ISP equipment and server on a UPS, and make sure the rack is properly grounded.

Small office design

Here is the scenario: a 40-person office on two floors. It needs staff wired and wireless access, a separate guest Wi-Fi, one on-site server for DHCP, DNS and file sharing, and a firewall between the office and the internet.

Design decisions

  • Collapsed core. One Layer 3 core switch does inter-VLAN routing for the whole office. A separate distribution layer is unnecessary at this size.
  • One access switch per floor, each connected to the core by a trunk.
  • VLANs separate staff, guests, servers and switch management.
  • Firewall at the edge does NAT and controls what enters and leaves. The ISP router is placed in bridge mode if the ISP allows it, or else the firewall sits behind it (double NAT).
  • Central DHCP on the server, with the core switch relaying requests from each VLAN.

Topology

Internet ISP router 1941 ASA 5506-X Firewall + PAT Core (3560) Layer 3, ip routing Server ACC-SW1 2960, .99.11 ACC-SW2 2960, .99.12 Staff PCs AP1 Staff Staff PCs AP2 Guest G0/0 .1 G1/1 outside .2 203.0.113.0/30 G1/2 inside .1 Fa0/24 .2 10.0.0.0/30 Fa0/10 192.168.30.10 VLAN 30 Gi0/1 Gi0/2 Gi0/1 Gi0/1 802.1Q trunk 802.1Q trunk VLAN 10 VLAN 10 VLAN 10 VLAN 20 VLAN 10 STAFF 192.168.10.0/24 VLAN 20 GUEST 192.168.20.0/24 VLAN 30 SERVERS 192.168.30.0/24 VLAN 99 MGMT 192.168.99.0/24 Gateways: Core SVIs, .1 in each VLAN
Figure: Small office design with firewall edge, collapsed Layer 3 core, two access switches and VLANs 10, 20, 30 and 99.

In Packet Tracer, use a 1941 router for the ISP, an ASA 5506-X for the firewall, a 3560-24PS as the core, two 2960-24TT switches as access switches, two AccessPoint-PT devices, and a Server-PT. Cable it like this: ISP G0/0 to ASA G1/1 (outside), ASA G1/2 (inside) to Core Fa0/24, Core Gi0/1 to ACC-SW1 Gi0/1, Core Gi0/2 to ACC-SW2 Gi0/1, and the server to Core Fa0/10. An AccessPoint-PT broadcasts a single SSID, so in the lab AP1 is the staff AP (VLAN 10) and AP2 is the guest AP (VLAN 20); on real equipment each floor would get one AP carrying both SSIDs over a trunk.

IP plan

The 203.0.113.0/24 range is reserved for documentation (RFC 5737); replace it with the public IP your ISP gives you. The internal ranges are private addresses from RFC 1918.

VLAN / linkPurposeSubnetGatewayKey addresses
ISP linkISP router to firewall outside203.0.113.0/30203.0.113.1 (ISP)Firewall outside 203.0.113.2
TransitFirewall inside to core switch10.0.0.0/3010.0.0.1 (firewall)Core Fa0/24 10.0.0.2
VLAN 10 STAFFStaff PCs, staff Wi-Fi, printers192.168.10.0/24192.168.10.1Printer 192.168.10.20; DHCP .51-.254
VLAN 20 GUESTGuest Wi-Fi, internet only192.168.20.0/24192.168.20.1DHCP .51-.254
VLAN 30 SERVERSOn-site server192.168.30.0/24192.168.30.1Server 192.168.30.10 (static)
VLAN 99 MGMTSwitch and AP management192.168.99.0/24192.168.99.1ACC-SW1 .11, ACC-SW2 .12

Core switch configuration

Core(config)# ip routing
Core(config)# vlan 10
Core(config-vlan)# name STAFF
Core(config-vlan)# vlan 20
Core(config-vlan)# name GUEST
Core(config-vlan)# vlan 30
Core(config-vlan)# name SERVERS
Core(config-vlan)# vlan 99
Core(config-vlan)# name MGMT
Core(config-vlan)# exit
Core(config)# interface vlan 10
Core(config-if)# ip address 192.168.10.1 255.255.255.0
Core(config-if)# ip helper-address 192.168.30.10
Core(config-if)# interface vlan 20
Core(config-if)# ip address 192.168.20.1 255.255.255.0
Core(config-if)# ip helper-address 192.168.30.10
Core(config-if)# interface vlan 30
Core(config-if)# ip address 192.168.30.1 255.255.255.0
Core(config-if)# interface vlan 99
Core(config-if)# ip address 192.168.99.1 255.255.255.0
Core(config-if)# exit
Core(config)# interface range gigabitEthernet 0/1 - 2
Core(config-if-range)# switchport trunk encapsulation dot1q
Core(config-if-range)# switchport mode trunk
Core(config-if-range)# exit
Core(config)# interface fastEthernet 0/10
Core(config-if)# switchport mode access
Core(config-if)# switchport access vlan 30
Core(config-if)# exit
Core(config)# interface fastEthernet 0/24
Core(config-if)# no switchport
Core(config-if)# ip address 10.0.0.2 255.255.255.252
Core(config-if)# exit
Core(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1
  • ip routing turns the 3560 into a router; without it the SVIs exist but nothing is routed between VLANs.
  • interface vlan 10 creates an SVI, the default gateway for that VLAN.
  • ip helper-address 192.168.30.10 forwards DHCP broadcasts from clients in VLANs 10 and 20 to the server as unicast, so one server can serve every VLAN.
  • switchport trunk encapsulation dot1q is required on the 3560 before it will accept switchport mode trunk.
  • no switchport turns Fa0/24 into a routed port for the link to the firewall.
  • The static default route sends all internet-bound traffic to the firewall.

On each 2960 access switch, create the same VLANs, set Gi0/1 to switchport mode trunk, put user ports and the staff AP port in VLAN 10, put the guest AP port in VLAN 20, and give interface vlan 99 its management IP with ip default-gateway 192.168.99.1. On the ASA, name the interfaces (inside and outside), add a route for 192.168.0.0/16 back via 10.0.0.2, add a default route to 203.0.113.1, configure PAT so internal users share the outside address, and enable ICMP inspection (inspect icmp under class inspection_default in the global policy) so ping replies from the internet are allowed back in. On the server, set the static address 192.168.30.10/24 with gateway 192.168.30.1, then under Services > DHCP create one pool per client VLAN with the matching gateway:

Pool nameDefault gatewayDNS serverStart IP addressSubnet maskMaximum users
STAFF192.168.10.1192.168.30.10192.168.10.51255.255.255.0204
GUEST192.168.20.1192.168.30.10192.168.20.51255.255.255.0204

Make sure the DHCP service is set to On and click Add for each pool. A start address of .51 with 204 users hands out .51 to .254, matching the IP plan.

Verification

Core# show ip route
(codes omitted)
Gateway of last resort is 10.0.0.1 to network 0.0.0.0

     10.0.0.0/30 is subnetted, 1 subnets
C       10.0.0.0 is directly connected, FastEthernet0/24
C    192.168.10.0/24 is directly connected, Vlan10
C    192.168.20.0/24 is directly connected, Vlan20
C    192.168.30.0/24 is directly connected, Vlan30
C    192.168.99.0/24 is directly connected, Vlan99
S*   0.0.0.0/0 [1/0] via 10.0.0.1

You should see one connected route per VLAN and the static default route. Then, from a staff PC set to DHCP, check that it received a 192.168.10.x address with gateway 192.168.10.1, ping the server at 192.168.30.10, and ping the ISP router at 203.0.113.1.

C:\>ipconfig

FastEthernet0 Connection:(default port)

   Connection-specific DNS Suffix..: 
   Link-local IPv6 Address.........: FE80::20A:F3FF:FE4C:1B02
   IPv6 Address....................: ::
   IPv4 Address....................: 192.168.10.51
   Subnet Mask.....................: 255.255.255.0
   Default Gateway.................: ::
                                     192.168.10.1

C:\>ping 192.168.30.10

Pinging 192.168.30.10 with 32 bytes of data:

Reply from 192.168.30.10: bytes=32 time<1ms TTL=127
Reply from 192.168.30.10: bytes=32 time<1ms TTL=127
Reply from 192.168.30.10: bytes=32 time<1ms TTL=127
Reply from 192.168.30.10: bytes=32 time<1ms TTL=127

Ping statistics for 192.168.30.10:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

C:\>ping 203.0.113.1

Pinging 203.0.113.1 with 32 bytes of data:

Reply from 203.0.113.1: bytes=32 time=1ms TTL=254
Reply from 203.0.113.1: bytes=32 time<1ms TTL=254
Reply from 203.0.113.1: bytes=32 time<1ms TTL=254
Reply from 203.0.113.1: bytes=32 time<1ms TTL=254

Ping statistics for 203.0.113.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Security note for the guest VLAN

As configured, the core switch routes between all VLANs, so guests could reach the server. In production, add an ACL on interface vlan 20 that denies traffic to the 192.168.0.0/16 internal ranges (while still permitting DHCP and DNS if the server provides them) and permits everything else toward the internet, or terminate the guest VLAN directly on the firewall.

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Common mistakes

  • Forgetting ip routing on the core, so PCs can reach their gateway but not other VLANs.
  • SVI stays down. An SVI only comes up if the VLAN exists and at least one port in it (or a trunk carrying it) is up.
  • No route back on the firewall. Internet pings fail because the ASA does not know 192.168.x networks are behind 10.0.0.2.
  • No ICMP inspection on the ASA. Traffic goes out, but ping replies are dropped at the outside interface, so it looks like the internet is unreachable.
  • DHCP pool gateway mismatch. Each pool's default gateway must match that VLAN's SVI, or clients get an address but cannot leave their subnet.
  • No UPS on the core. One power cut takes the whole office offline and can corrupt configs.

Summary

  • Infrastructure = devices + end devices + media + protocols, supported by power, racks and labeling.
  • Copper UTP is limited to 100 m; use fiber for longer or inter-floor links.
  • A small office works well with a collapsed core: firewall at the edge, one Layer 3 core switch, access switches per floor, VLANs and central DHCP.

Related tutorials

  • Configuring Static VLANs on a Cisco Switch (Packet Tracer Lab)
  • Trunking and 802.1Q on Cisco Switches: Configs and Common Errors
  • DHCP Server on a Cisco Router plus DHCP Relay (ip helper-address)
  • NAT and PAT on Cisco Routers: Lab for Home and Office Networks
  • Standard vs Extended ACLs on Cisco Routers: Lab with Examples
  • Setting Up a Home Network in Nepal: ISP Router, Wi-Fi and a Separate Network for Smart Devices

Sources

  • ANSI/TIA-568 Commercial Building Telecommunications Cabling Standard
  • IEEE 802.3 (Ethernet and PoE amendments 802.3af, 802.3at, 802.3bt)
  • RFC 1918, Address Allocation for Private Internets: https://www.rfc-editor.org/rfc/rfc1918
  • RFC 5737, IPv4 Address Blocks Reserved for Documentation: https://www.rfc-editor.org/rfc/rfc5737
  • Cisco IOS Configuration Guide – VLANs and Inter-VLAN Routing
  • Cisco IOS IP Addressing Configuration Guide – DHCP Relay (ip helper-address)

Related Posts

No comments

Subscribe to: Post Comments (Atom)