- 2074 Bhadra · 12 marks
Redundant network design for insurance company
Short answer
Use two stacked L3 core switches with LACP port-channels to access switches, RSTP as safety net, and HSRP/VRRP plus BGP on dual routers to two ISPs. Deploy CAT6 UTP for horizontal runs, fibre for risers and core links, PoE access switches per department, and dual-homed servers.
Design the redundant/loop free network for 3 stories XYZ insurance company having 5 departments including Internet department. Internet department contain server farm with servers like DNS, DHCP, Email, FTP, insurance application server and webserver. The main internet routers which will be connected to multiple upstream provider. Beside Internet department, other 4 departments have 20 computers each. Propose appropriate equipment (L1, L2 and L3) and physical wires for the network design.
Assumptions
- Building: ground floor (Internet department with server farm and main distribution room), 1st floor (Underwriting and Claims), 2nd floor (Accounts and Customer Service).
- 4 departments x 20 PCs = 80 PCs. Each department also has 1 AP, 1 network printer.
- Floors are 3.5 m high; the longest horizontal cable is under 90 m.
- Two ISPs (ISP-A, ISP-B) deliver fibre links to the ground floor.
- Redundancy means no single device or link failure stops service, and loops are prevented by design (link aggregation to a stacked core, with RSTP as protection).
Redundant, loop-free design
ISP-A ISP-B
| |
[Router R1]--------------[Router R2]
| \ / |
| [FW-1]=HA link=[FW-2]|
+------+ +------+
| |
[Core-1]==LACP==[Core-2] stacked L3
/ | \ / | \
/ | +------+ | \
Floor2 / | | Floor1 | \ Server
[SW-D3]-+ [SW-D4]-+ [SW-D1]-+[SW-D2] farm
Acct,CS (each access switch dual-homed [SF-1]
to both cores by LACP) [SF-2]
How the loops are avoided:
- Core-1 and Core-2 form a stack/virtual chassis so they act as one logical switch.
- Every access switch connects to both cores with two uplinks in one LACP port-channel. To the access switch this is one link, so there is no L2 loop.
- RSTP stays enabled with the core as root bridge as a safety net, with BPDU guard on access ports.
- Routers use HSRP/VRRP for the gateway and BGP to the two upstream providers (or default routes with tracking).
- Servers are dual-homed with NIC teaming to SF-1 and SF-2.
Equipment by layer
| Layer | Equipment | Qty | Role |
|---|---|---|---|
| L1 | CAT6 UTP, 305 m boxes | 13 | 90 drops x 40 m average + 10% wastage = 3,960 m |
| L1 | Single-mode fibre patch cords, LC-LC | 12 | Core to access and router links |
| L1 | OM3 multimode 6-core riser, 60 m | 1 | Between floors |
| L1 | Patch panels 24-port CAT6 | 4 | 90 drops (96 ports) |
| L1 | CAT6 patch cords 2 m and 1 m | 90 + 90 | User side and panel side |
| L1 | Faceplates (single port) | 90 | 80 PCs + 4 APs + 4 printers + 2 spare |
| L1 | SFP+ 10G modules | 16 | Uplinks |
| L2 | 24-port PoE access switch, 2 x SFP+ | 4 | One per department (20 PCs + AP + printer) |
| L2 | 24-port server switch | 2 | Server farm, dual-homed |
| L3 | L3 core switch, 24 x GE + 4 x SFP+ | 2 | Stacked; routing between VLANs |
| L3 | Edge router with BGP | 2 | Two ISPs |
| L3 | Firewall (HA pair) | 2 | NAT, DMZ, ACL |
| Other | Wireless AP | 4 | Staff and guest SSID |
| Other | Servers: DNS, DHCP, Email, FTP, Application, Web | 6 | In server farm |
| Other | UPS 3 kVA online, 42U rack | 2, 2 | Power and cabinets |
Physical wires: CAT6 UTP for horizontal runs (up to 90 m, 1 Gbps) and server links; single-mode or multimode fibre for core-to-access and router links; fibre from ISPs. Server-farm links use short CAT6 or DAC cables.
IP plan (10.30.0.0/16)
| Segment | Subnet | Usable |
|---|---|---|
| Underwriting (20 PCs) | 10.30.10.0/27 | 30 |
| Claims | 10.30.20.0/27 | 30 |
| Accounts | 10.30.30.0/27 | 30 |
| Customer Service | 10.30.40.0/27 | 30 |
| DMZ (Web, Email, FTP) | 10.30.100.0/27 | 30 |
| Internal servers (DNS, DHCP, App) | 10.30.101.0/27 | 30 |
| Management | 10.30.99.0/27 | 30 |
| Router/core links | 10.30.250.0/30 x n | 2 each |
| ISP-A / ISP-B links | Provider supplied /30 | 2 each |
The DHCP server in the internal segment serves all department VLANs through DHCP relay (ip helper-address on each VLAN gateway). Public servers (web, email, FTP) sit in the DMZ; the insurance application and DNS are internal and reached through the firewall. Failure of one core, router, firewall or ISP leaves the network working.
✓ Answer checked by Claude Opus 5.5 (high effort)
Related questions
- Redundant network for IOE Pulchowk campus · Internet and Intranet, chapter 5
- Redundant hierarchical network design for bank · Internet and Intranet, chapter 5
- Medium network design issues and proxy servers · Internet and Intranet, chapter 5
- Client/server architecture and FTP operation · Internet and Intranet, chapter 3
- Internet vs Intranet and DNS need · Internet and Intranet, chapter 1
- Email server and its protocols · Computer Networks and Security, chapter 6 · asked 3×
- Internet vs WWW; client-server paradigm · Web Technology, chapter 1