8 Integrated Network Design and Practice

How network components fit together

A working network depends on several layers fitting together: physical links carry Ethernet frames, switches place devices in the appropriate local network, and IP addressing and routing deliver packets to destinations. A hierarchical star is a common design for a small campus or office: access switches connect computers, printers, servers, and wireless access points; those switches connect to a core or Layer 3 switch; and a router or firewall connects toward the Internet.

Switching, routing, and access

A switch connects devices within a local area network (LAN) and forwards Ethernet frames using MAC addresses. A router connects different IP networks and forwards packets using IP addresses; a Layer 3 switch can also route between local networks. A firewall applies traffic rules, often at the LAN–Internet boundary.

A wireless access point (AP) connects Wi-Fi clients to the wired LAN. It is not necessarily a router: many APs bridge wireless clients onto a network connected through a switch.

Ethernet links and VLAN boundaries

Ethernet belongs to the IEEE 802.3 family and operates over media such as twisted-pair copper and fiber. Choose media and transceivers to match the required speed, distance, and equipment. Properly terminate and test cables, then check link indicators and negotiated speed before investigating IP settings. Fiber is often suitable for longer links or links between buildings; copper Ethernet is common for endpoint connections.

A VLAN divides a switched network into a separate Layer 2 broadcast domain. Devices in different VLANs generally need a router or Layer 3 switch to communicate. VLAN separation can organize users, servers, or IoT devices, but does not by itself provide a complete security policy.

IPv4 prefixes and subnet sizing

An IPv4 address has $32$ bits. CIDR notation places the network prefix length after a slash. For example, the prefix in 192.168.40.0/26 uses the first $26$ bits to identify the prefix, leaving $6$ bits for addresses within the block. The block therefore has $2^6=64$ total addresses. In a conventional LAN subnet, the first address is the network address and the last is the broadcast address, leaving $62$ usable host addresses.

Private IPv4 ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Address pools must not overlap with statically assigned addresses.

IPv6 addressing

IPv6 addresses have $128$ bits, and a typical LAN is assigned a /64. An interface may also have a link-local address, which is used only on its local link. IPv6 does not use an IPv4-style broadcast address.

The prefix 2001:db8::/32 is reserved for documentation and examples, not production addressing. In a real network, use prefixes assigned or generated for that deployment.

A two-VLAN addressing plan

The example plan assigns a staff VLAN and an IoT VLAN separate IPv4 subnets and IPv6 documentation prefixes:

• Staff: VLAN 10; IPv4 subnet 192.168.40.0/26; example gateway 192.168.40.1; IPv6 documentation prefix 2001:db8:40:10::/64.

• IoT: VLAN 20; IPv4 subnet 192.168.40.64/27; example gateway 192.168.40.65; IPv6 documentation prefix 2001:db8:40:20::/64.

For the staff subnet, hosts can use 192.168.40.1 through 192.168.40.62; 192.168.40.0 is the network address and 192.168.40.63 is the broadcast address. The /26 block has $62$ usable host addresses.

For the IoT subnet, hosts can use 192.168.40.65 through 192.168.40.94; 192.168.40.64 is the network address and 192.168.40.95 is the broadcast address. The /27 block has $30$ usable host addresses. These subnet sizes are sufficient for needs of $50$ staff addresses and $20$ IoT addresses, respectively.

The example IPv6 prefixes are documentation space, not production assignments. Keep VLAN boundaries consistent for IPv4 and IPv6, and configure and test routing and filtering for both protocols.

Troubleshooting from the link upward

When a device cannot reach a service, check the network in order rather than changing settings at random:

1. Physical link: Check power, cable seating, port status, Wi-Fi association, and link speed. Try a known-good cable or switch port.

2. Ethernet and VLAN: Confirm that the switch learned the device's MAC address on the expected port and that the port is assigned to the intended VLAN. A working link does not prove the VLAN is correct.

3. IP configuration: Check the address, prefix or subnet mask, and default gateway. Confirm that the host is in the subnet expected for its VLAN and that DHCP supplied valid settings.

4. Local reachability: Test the default gateway. If it does not respond, focus on host configuration, the VLAN, the switch-to-router link, or the gateway interface.

5. Routing and policy: If the gateway responds but a remote subnet does not, check routes, inter-VLAN routing, and firewall rules. Repeat these checks for IPv4 and IPv6; success on one protocol does not prove the other works.

6. Name and application: If an IP destination works but its hostname does not, investigate DNS. If both work but the application fails, check the service, port, and application-level policy.

Useful host-side checks include viewing interface configuration, checking the routing table, testing the gateway and destination with ping, and tracing the path with a traceroute utility. Interpret results carefully: a device or firewall may block diagnostic probes even when other traffic works.

Diagnosing cross-network and protocol failures

If a laptop has a valid address and can reach its gateway but cannot reach a server in another VLAN, check inter-VLAN routing, the destination route, and firewall rules between the VLANs. Also confirm the server's gateway and address plan.

If a service works over IPv4 but not IPv6, verify the host's IPv6 address and prefix, its IPv6 default route, the router's IPv6 interface and route, and IPv6-specific firewall policy. If a hostname is used, check DNS records as well; also verify that the service listens on IPv6. Working IPv4 does not prove IPv6 is configured correctly.