University Campus Network

Section 01

The Story That Explains a Campus Network

📖 Real World Analogy

A University Is a Small City — And Every City Needs Roads

Picture a small city. Two hostels where 2,000 students sleep and stream video. One library where quiet research demands rock-steady bandwidth. Two academic blocks where 5,000 laptops, projectors, lab machines and IoT sensors all try to reach the internet at 9 a.m. on Monday.

You cannot let every device talk to every other device on one giant flat cable — that is like a city with one road. Traffic jams, no traffic lights, no privacy, and the moment one truck breaks down the whole city stops. A campus network is the traffic-light system, the highways, the toll booths, and the security perimeter — all wrapped into one design.

In this tutorial you will build that city from the ISP handoff at the border all the way down to a laptop plugged into a wall port in Hostel 2, Room 214.

🌐

What You Will Design

A production-grade campus network for a mid-sized university with 2 hostels, 1 library and 2 academic blocks. You will place every firewall, NAT boundary, DMZ server, core switch, distribution switch, access point, and end device — and hand every subnet a proper CIDR block.

Section 02

The Complete Campus Topology — Animated

Below is the full end-to-end topology. Watch the coloured packets travel from the ISP cloud at the top, cross the firewall, get their addresses translated at NAT, and fan out through the core switch to every building on campus. The DMZ hangs off a dedicated firewall leg — never mixed with internal traffic.

Fig 1 · Full University Campus Topology

Golden squares are packets. Dashed animated lines show live traffic flow direction. Every subnet lives in its own VLAN, and every VLAN meets at the core switch.

🔑

The Three-Tier Design

The topology follows the classic Cisco three-tier hierarchy: access layer (APs, edge switches inside each building), distribution layer (per-building L3 switches), and core layer (one campus-wide core switch that links every building to the security edge). This is not academic theory — every real university runs some variant of this.

Section 03

Every Component, Explained

☁️

ISP

Internet Service Provider

Delivers a WAN circuit (typically fibre, 1–10 Gbps) to the campus edge. Hands over one small public IP block via a /30 point-to-point link. Everything upstream of the firewall is the ISP's problem.

🛡️

Firewall

Stateful + IDS/IPS

The border guard. Inspects every packet against ACLs, drops anything unexpected, and tracks connection state. Also hosts the university's DMZ leg and enforces zone-to-zone rules (LAN → DMZ → WAN).

🔄

NAT Router

Address Translation

Rewrites the source address of outbound packets from 10.x.x.x to the single public IP, and remembers the mapping so replies come back to the right internal host. Uses PAT (port overload) so 10,000 students share 1 public IP.

🌐

DMZ

De-Militarised Zone

A separate network for servers the outside world must reach — web, mail, DNS, portal. If a DMZ host is compromised, the attacker is still trapped there and cannot pivot to internal networks because firewall rules forbid DMZ → LAN.

📡

Core Switch

Layer-3 Backbone

The single high-throughput switch every building fibre lands on. Performs inter-VLAN routing, runs OSPF/EIGRP to the edge, and forwards packets at line rate. Redundant power & supervisor cards; the campus dies if this dies.

🔢

Access Switch

Layer-2 Edge

Sits inside each building. 24 or 48 gigabit ports feed wall jacks and access points. Trunks a single fibre uplink back to the core. Supports PoE so APs and phones need no separate power supply.

📶

Access Point (AP)

Wi-Fi 6 / 802.11ax

Broadcasts SSIDs (e.g. Uni-Student, Uni-Staff), authenticates users via WPA3-Enterprise / 802.1X, and tags client traffic into the correct VLAN. Managed centrally by a WLAN controller.

💻

Laptop & PC

End Hosts

Get a DHCP-assigned address from their VLAN's pool. Traffic hits the access switch, gets tagged, travels up to distribution, then to core, then to the edge — and back. Every hop is invisible to the student.

🌐

Distribution Switch

Building Aggregator

In larger buildings (library, academic blocks) a distribution switch sits between the access switches and the core. Aggregates uplinks, terminates VLANs at Layer 3, and simplifies the core.

Section 04

The IP Addressing Plan (CIDR)

Every zone gets a dedicated CIDR block — no overlaps, no ambiguity. This is the single most important design document in a campus network; a bad plan now means a painful renumbering later. All private ranges come from RFC 1918 (10.0.0.0/8 · 172.16.0.0/12 · 192.168.0.0/16).

Zone	CIDR Block	Usable Hosts	Gateway	VLAN	Purpose
WAN link to ISP	203.0.113.0/30	2	203.0.113.1	—	Public point-to-point
Public NAT pool	203.0.113.4/30	1 (PAT)	203.0.113.5	—	Outbound overload
DMZ	172.16.1.0/28	14	172.16.1.1	100	Web / Mail / DNS servers
Core & Mgmt	10.0.0.0/24	254	10.0.0.1	1	Switch/router mgmt loopbacks
Hostel 1	10.10.1.0/24	254	10.10.1.1	10	Student residents block A
Hostel 2	10.10.2.0/24	254	10.10.2.1	20	Student residents block B
Library	10.20.1.0/24	254	10.20.1.1	30	OPAC, study PCs, staff
Academic Block 1	10.30.1.0/24	254	10.30.1.1	40	CS / EEE labs & classrooms
Academic Block 2	10.30.2.0/24	254	10.30.2.1	50	Mech / Civil labs & classrooms
Guest Wi-Fi	10.100.0.0/22	1022	10.100.0.1	200	Isolated internet-only SSID
IoT / CCTV	10.200.0.0/24	254	10.200.0.1	210	Cameras, door locks, sensors

📈

Why /24 for buildings and /28 for the DMZ?

A /24 gives 254 usable hosts — plenty for a hostel with ~200 rooms. A /28 gives only 14 usable hosts — exactly what a DMZ needs, since exposed servers should be few and audited. Small subnets shrink the blast radius when things go wrong.

Section 05

The Security Edge — ISP → Firewall → NAT

Before any student packet touches the campus core, it passes through three ordered checkpoints. Below is the animated life of one HTTPS request leaving a laptop.

Fig 2 · Edge Pipeline (outbound)

The same packet travels left to right — but is rewritten and inspected at each stop.

🏪 Packet Life · Outbound HTTPS Request

Laptop 10.10.1.42 opens TCP to 142.250.72.14:443. SYN packet leaves with a private source address.

Access switch tags the frame with VLAN 10 and forwards toward the core.

Core switch routes to the default gateway (the firewall interface on the inside zone).

Firewall consults its ruleset — Inside → Outside on TCP 443 allowed — creates a state entry, hands off to the NAT engine.

NAT rewrites source to 203.0.113.5:4001, records the mapping.

Packet leaves via the ISP uplink. Google's SYN-ACK returns to 203.0.113.5:4001, NAT reverses the mapping, firewall matches the state entry, packet arrives back at the laptop.

Section 06

The DMZ — Where Public Services Live

The DMZ (De-Militarised Zone) is a purpose-built third leg of the firewall. It hosts servers the outside world must reach — but they must never be able to reach the internal network back. This asymmetry is enforced by firewall rules, not by trust.

Fig 3 · DMZ Segmentation · 172.16.1.0/28

Internet → DMZ and LAN → DMZ are allowed. Nothing flows in the reverse direction unless an internal host initiated the connection first.

Source Zone	Destination Zone	Ports	Rule
Outside (Internet)	DMZ	80, 443, 25, 53	ALLOW
Outside	Inside (LAN)	ANY	DENY
Inside	DMZ	80, 443, 22 (admin)	ALLOW
Inside	Outside	Most TCP/UDP	ALLOW (+ NAT)
DMZ	Inside	ANY	DENY
DMZ	Outside	53, 80, 443 (updates)	LIMITED

Section 07

Inside a Hostel — Access Layer Detail

Zoom into Hostel 1. A single fibre uplink lands in the ground-floor IT closet on a stack of access switches. Each floor gets its own switch and 2–3 ceiling-mounted APs. Wall ports feed desktop machines in study rooms.

Fig 4 · Hostel 1 Interior · 10.10.1.0/24

Ceiling APs (blue) and wall PCs (amber) all trunk back to one stackable access switch. One fibre carries every VLAN up to the core.

🔌

Why Stack the Access Switches?

A stack of three 48-port switches looks like a single 144-port logical switch — one management IP, one config, one MAC table. Uplink redundancy is automatic: if the master switch fails, the next member takes over in under a second.

Section 08

Library & Academic Blocks — Distribution Layer

The library and academic blocks are bigger than a hostel. They need a distribution switch to aggregate multiple access switches inside the building, plus dedicated APs for lecture halls and quiet reading rooms.

📚

Library · 10.20.1.0/24

VLAN 30 · 254 hosts

1 distribution switch, 4 access switches (24-port), 8 APs across 3 floors. Feeds ~60 OPAC terminals, ~40 staff PCs and ~200 concurrent Wi-Fi users. Traffic to the digital-journals proxy stays local via caching.

🏫

Academic 1 · 10.30.1.0/24

VLAN 40 · 254 hosts

Computer Science and Electrical labs. 2 distribution switches, 12 access switches, 24 APs. Lab PCs get static reservations from DHCP so lecturers can reach any machine by hostname.

🏭

Academic 2 · 10.30.2.0/24

VLAN 50 · 254 hosts

Mechanical and Civil labs. Same shape as Academic 1. IoT sensors in the workshops trunk into a separate VLAN 210 (10.200.0.0/24) so a compromised sensor cannot see student traffic.

Fig 5 · Distribution Layer · Academic Block 1

One distribution switch aggregates four access switches. Each access switch feeds two APs plus wall ports for lab PCs.

Section 09

Complete Packet Journey — Student to Google

Now trace a single packet all the way from a student's laptop in Hostel 2 to google.com. This is what the network does 40 million times a day.

Laptop associates & gets DHCP lease

Laptop connects to SSID Uni-Student, authenticates via 802.1X, and the AP tags its traffic into VLAN 20. DHCP hands it 10.10.2.87 /24, gateway 10.10.2.1, DNS 172.16.1.4.

DNS resolves google.com

Browser asks the internal DNS resolver in the DMZ. If the record is cached, an answer returns in <1 ms; otherwise the resolver recurses out through NAT to root/TLD servers.

TCP SYN toward 142.250.72.14:443

Frame leaves the laptop on VLAN 20, hops through the hostel access switch to the core switch, which routes it toward the firewall.

Firewall inspects & stores state

Rule inside → outside on tcp/443 matches. A state entry is added: 10.10.2.87:56221 ↔ 142.250.72.14:443. Packet forwarded to NAT.

NAT translates (PAT)

Source rewritten to 203.0.113.5:11024. Mapping stored in the NAT table with a 30-minute idle timer.

Packet leaves via ISP uplink

Ethernet frame becomes IP-over-fibre and rides the ISP's aggregation network to Google's edge.

SYN-ACK returns, reversed

Reply arrives at 203.0.113.5:11024. NAT reverses to 10.10.2.87:56221. Firewall matches existing state, allows through. Core switch delivers to Hostel 2. AP hands to laptop. Handshake completes in ~40 ms.

Section 10

Sample Router / Switch Configuration

Core switch — inter-VLAN routing (Cisco IOS)

vlan 10  name HOSTEL_1
vlan 20  name HOSTEL_2
vlan 30  name LIBRARY
vlan 40  name ACADEMIC_1
vlan 50  name ACADEMIC_2
vlan 100 name DMZ
vlan 200 name GUEST
vlan 210 name IOT_CCTV

! One SVI per VLAN — the core is the default gateway
interface Vlan10
 ip address 10.10.1.1 255.255.255.0
 ip helper-address 10.0.0.10   ! DHCP relay
!
interface Vlan20
 ip address 10.10.2.1 255.255.255.0
 ip helper-address 10.0.0.10
!
interface Vlan30
 ip address 10.20.1.1 255.255.255.0
 ip helper-address 10.0.0.10
!
! Trunk uplink to firewall
interface TenGigabitEthernet1/0/48
 description Uplink to Firewall
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50,100,200,210

! Default route out via firewall inside IP
ip route 0.0.0.0 0.0.0.0 10.0.0.254

Edge router — NAT overload (PAT)

interface GigabitEthernet0/0
 description WAN — ISP handoff
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
!
interface GigabitEthernet0/1
 description Inside to Firewall
 ip address 10.0.0.253 255.255.255.0
 ip nat inside
!
access-list 10 permit 10.0.0.0 0.255.255.255

! PAT — all internal hosts share one public IP
ip nat inside source list 10 interface GigabitEthernet0/0 overload

! Static NAT for DMZ web server (port forward)
ip nat inside source static tcp 172.16.1.2 443 interface GigabitEthernet0/0 443

OUTPUT — show ip nat translations

Pro Inside global Inside local Outside local Outside global tcp 203.0.113.2:11024 10.10.2.87:56221 142.250.72.14:443 142.250.72.14:443 tcp 203.0.113.2:11025 10.10.1.42:52411 93.184.216.34:443 93.184.216.34:443 tcp 203.0.113.2:443 172.16.1.2:443 --- --- Total number of translations: 3

Section 11

Security Zones & Trust Model

🔴

Untrusted — Outside

The public internet. Assume hostile. Everything inbound is denied by default; only explicit port-forwards to DMZ hosts are permitted.

trust-level: 0

🟠

Semi-Trusted — DMZ

Servers exposed to the internet. Trusted enough to accept incoming public traffic, but never trusted enough to initiate connections into the LAN.

trust-level: 50

🟢

Trusted — Inside LAN

Hostel, library, academic block, staff. All device traffic goes through firewall & NAT to reach the internet. Full inter-VLAN routing at the core with ACLs.

trust-level: 100

🟠

Isolated — Guest Wi-Fi

Internet only — no route to any 10.x subnet. Rate-limited, captive-portal login. Sits on VLAN 200 (10.100.0.0/22).

trust-level: 20

📡

Isolated — IoT / CCTV

Cameras, HVAC, door locks. Cannot see student or staff subnets. Only reaches its own VMS server on VLAN 210 (10.200.0.0/24).

trust-level: 10

🔑

Management Plane

Switch/router SSH, WLAN controller GUI, monitoring servers. Locked to a jump-host on 10.0.0.0/24, MFA required.

trust-level: 200

Section 12

Common Failures & Where to Look

Symptom	Likely Cause	Where to Look
One hostel offline	Building fibre cut / access switch dead	Core switch port stats · light levels on SFP
All buildings slow	NAT table exhausted / firewall CPU pinned	`show ip nat statistics`, `show processes cpu`
Wi-Fi drops room-to-room	Roaming misconfig / co-channel interference	WLC RSSI heatmap · DFS logs
DMZ site works internally, not externally	Static NAT / port-forward missing	Edge router `show ip nat translations`
DHCP fails on one VLAN only	Missing `ip helper-address` on the SVI	Core switch VLAN interface config
Random slowness on Monday 09:00	Broadcast storm / STP topology change	Access switch `show spanning-tree`
Guest cannot open captive portal	DNS-hijack rule broken or expired cert	WLC captive portal · DNS logs

⚠️

The Broadcast-Storm Trap

If a student plugs both ends of a patch cable into two wall ports, they can create a Layer-2 loop that broadcasts frames forever, saturating the switch and taking a whole building offline. Always enable bpduguard, storm-control broadcast, and portfast on access ports.

Section 13

Golden Rules

🏆 Campus Network Design — Non-Negotiable Rules

Never put user devices on the same VLAN as servers or management interfaces. One infected laptop should never see the switch CLI.

Give every building its own /24 at minimum — even if you have only 30 devices today. Renumbering later is agony.

The DMZ must never initiate connections into the internal LAN. Enforce this with an explicit deny firewall rule, not by trusting the servers.

Trunk uplinks between access, distribution and core must carry only the VLANs they actually need. Use switchport trunk allowed vlan explicitly — never all.

Put guest Wi-Fi on a separate routed VLAN with no inter-VLAN reachability. Rate-limit it. Force captive-portal login. Log everything.

Redundancy at the core is not optional. Dual power supplies, dual supervisors, dual fibre paths to at least one building — and an HSRP/VRRP pair for the default gateway.

Monitor NAT-table utilisation. A university with 10,000 devices behind PAT can exhaust the port pool during exam registration — watch it, don't discover it.

Document the IP plan — who owns which /24, which VLAN maps to which SSID, which port belongs to which building. When it breaks at 2 a.m. the diagram is what saves you, not memory.