M2- LAN Architecture Design

Hierarchical Models, Switching, VLAN Segmentation

​

Justin David Pineda CISSP, CISM

Version 1

Mar 2026

Motivation

• Flat networks allow rapid attack spread (lateral movement)
• LAN design directly impacts security, performance, scalability
• Poor segmentation = higher breach impact
• LAN = first line of defense inside organization

Learning Objectives

• Explain hierarchical LAN design
• Differentiate Layer 2 vs Layer 3 switching
• Design VLAN segmentation strategies
• Analyze trade-offs in real environments

What is LAN Architecture Design?

• Structured design of connectivity within local networks
• Focus: performance, scalability, security, manageability
• Not just wiring – controls how traffic flows and is restricted

Flat Network Problem

• Single broadcast domain
• All devices can communicate freely
• High risk of malware spread
• Difficult troubleshooting and monitoring

Hierarchical Model Overview

Divides network into layers for efficiency

• Access – user/device connectivity
• Distribution – policy enforcement
• Core – high-speed backbone

Access Layer

• Connects end devices (PCs, printers, phones)
• Implements VLAN assignment
• Enforces port security
• Entry point of users into network

Distribution Layer

• Aggregates access switches
• Implements routing between VLANs
• Applies ACLs and policies
• Controls traffic flow

Core Layer

• High-speed backbone
• Optimized for performance and availability
• Minimal filtering to reduce latency
• Ensures network stability

Why Hierarchical Design?

• Improves scalability
• Simplifies troubleshooting
• Isolates failures
• Supports policy enforcement

Switching Fundamentals

• Switch forwards frames using MAC address
• Builds MAC address table dynamically
• Forwards traffic intelligently vs hubs

Layer 2 Switching

• Operates using MAC addresses
• Works within same VLAN
• Fast but no routing capability
• Limited segmentation

Layer 3 Switching

• Uses IP addresses
• Routes between VLANs
• Combines speed of switching + routing
• Essential for segmentation

Switching Modes

• Store-and-forward: checks errors before forwarding
• Cut-through: forwards immediately (faster)
• Trade-off between reliability and speed

What is VLAN?

• Logical segmentation of network
• Devices grouped regardless of location
• Multiple networks within same switch

Why VLAN?

• Improves security via isolation
• Reduces broadcast traffic
• Organizes network logically
• Supports policy enforcement

VLAN Example

• HR VLAN
• Finance VLAN
• IT VLAN
• Guest VLAN

Each isolated unless explicitly allowed

Inter-VLAN Communication

• Requires Layer 3 device
• Controlled communication between VLANs
• Enables policy enforcement

VLAN Security Impact

• Limits lateral movement
• Contains breaches
• Improves monitoring visibility
• Supports compliance

Design Considerations

• Number of users
• Traffic patterns
• Security requirements
• Scalability and growth

Real-World Scenario

• University network segmentation
• Students vs Faculty vs Admin separation
• Prevents unauthorized access
• Improves control and monitoring

Summary

• Hierarchical design structures network
• Switching enables efficient communication
• VLAN enables segmentation
• Design impacts both performance and security

Knowledge Check 1

A mid-sized company uses a flat network where all departments (HR, Finance, IT) are in the same subnet.

​

Question:

• Would you prioritize VLAN segmentation immediately, or address other controls first (e.g., endpoint security, monitoring)?
• Justify your decision based on risk and business impact.

Knowledge Check 2

An organization wants to simplify costs by removing the distribution layer and connecting access switches directly to the core.

​

Question:

• Is this a reasonable design decision?
• Under what conditions could this work—and when would it become a risk?

Knowledge Check 3

A university is planning VLANs per department but IT suggests instead grouping by function (e.g., admin systems, student systems, public access).

​

Question:

• Which segmentation strategy is more effective?
• Defend your approach in terms of security, scalability, and manageability.

Knowledge Check 4

A company is using only Layer 2 switches, but is experiencing performance bottlenecks and limited control between departments.

​

Question:

• Would introducing Layer 3 switching significantly improve the situation?
• Explain what problems it solves—and what it does NOT solve.

Knowledge Check 5

A ransomware attack spreads across multiple departments within minutes.

Post-incident analysis shows:

• No VLAN segmentation
• No internal access control

​

Question:

• Which design failure had the greatest impact, and what would be your top 2 architectural fixes?

Knowledge Check 6

An organization minimizes VLANs to reduce complexity and improve performance.

​

Question:

• Do you agree that fewer VLANs = better design?
• Discuss the trade-off between performance, manageability, and security.

Key Takeaways

• LAN design is a security control
• Segmentation is critical
• Structured design enables scalability
• Always consider trade-offs

Exercise 2: Spanning Tree Evolution

By the end of this activity, students will be able to:

• Analyze modern LAN and data center architectures
• Explain design trade-offs in real-world environments
• Apply concepts to organizational scenarios
• Communicate technical decisions at a managerial level

​

Student Presentation Requirements

Duration: 8–10 minutes presentation

Q&A: 3–5 minutes

Format: PowerPoint (executive-level, not overly technical)

Delivery: By partner presentation

Topic Assignment

Group A – STP Evolution

• Spanning Tree Protocol (STP)
• Rapid STP (RSTP)
• Multiple STP (MSTP)
• Limitations of STP in modern networks

Topic Assignment

Group B – Campus Network Design

• Traditional campus hierarchical model
• Modern campus (SDN, segmentation, NAC)
• Wireless integration in campus LAN
• Security considerations in campus networks

Topic Assignment

Group C – Leaf-Spine Architecture

• Leaf-spine fundamentals
• East-west traffic optimization
• Comparison vs traditional 3-tier architecture
• Use cases (data centers, cloud environments)