CCNP ENCOR Enterprise Network Design: Tier 2, Tier 3, and Fabric Capacity Planning for CCNP 350-401 ENCOR candidates and enterprise network engineers transitioning from implementation to design thinking

Austin Davies -

1. Why This Topic Matters for 350-401 ENCOR

ENCOR does not test campus design as a vocabulary exercise. It’s really testing whether you can take business needs, traffic behavior, resiliency expectations, and operational limits, then match all of that to the right architecture. In practice, that means knowing when a Tier 2 collapsed core is good enough, when a Tier 3 design actually makes sense, and when a fabric-based campus is the better call for segmentation and mobility.

The exam also likes to hide design choices inside failure scenarios. A question may really be about blast radius, FHRP placement, routed access, wireless aggregation, or underlay capacity even if it never directly asks, “Which campus model should you choose?” If you can connect architecture to traffic flow, convergence, and service reachability, you will read those questions much more accurately.

2. Campus Design Models in Cisco Enterprise Networks

Cisco campus design still centers on hierarchical roles: access, distribution, and core. The access layer connects endpoints. The distribution layer aggregates access, commonly hosts policy boundaries and default gateways in traditional designs, and often performs inter-VLAN routing. The core provides fast, predictable transport between distribution blocks and external campus services.

Those are roles, not fixed box counts. A Tier 2 campus collapses distribution and core into the same pair of devices. A Tier 3 campus separates them. A fabric campus still depends on underlay transport and distinct operational roles such as edge, control-plane, and border nodes.

For ENCOR, keep three models straight:

  • Traditional VLAN-based campus: usually access/distribution or access/distribution/core, with VLANs, trunks, STP, and FHRP.
  • Routed-access campus: Layer 3 uplinks from access to distribution, smaller STP scope, improved fault isolation, and less dependence on FHRP in the classic sense.
  • Fabric-based campus: underlay plus overlay, typically using Cisco SD-Access concepts for scalable segmentation and mobility.

3. Understanding Tier 2 Campus Design

Tier 2 means a collapsed core, not a Layer 2-only design. Access switches connect directly to a combined distribution/core pair. Those devices usually end up handling aggregation, inter-VLAN routing, FHRP, policy boundaries, and the backbone transport for the campus. The redundancy model really depends on the platform. Depending on the platform and the design, you might be dealing with two standalone switches, a StackWise Virtual pair, older VSS gear, or some other multi-chassis setup that’s meant to act like one logical system.

Tier 2 usually fits smaller campuses, single-building headquarters, or sites with moderate growth that still need solid resilience, but don’t really justify the extra cost and operational overhead of a separate core layer. The tradeoff is a larger failure domain. If the collapsed core pair is undersized or misdesigned, a single event can affect most of the site.

Implementation detail matters here. Dual-homed access switches are common. Access uplinks can be Layer 2 trunks bundled with EtherChannel, or they can be Layer 3 routed uplinks if you’re doing a more modern routed-access design. If you stick with Layer 2 uplinks, then STP design becomes absolutely critical. In Cisco campus environments, the common STP variants are PVST+, Rapid PVST+, or MST; classic 802.1D behavior is mostly legacy in modern campus design.

In a traditional Tier 2 design, I usually try to keep the active FHRP gateway and the STP root on the same switch for a given VLAN whenever possible. It just tends to make traffic flow more predictable. If HSRP active is on one device but the STP root is on the other, traffic may hairpin or become asymmetric. HSRP is the most common Cisco-focused FHRP. VRRP is an interoperable alternative. GLBP is still worth knowing for the exam, but you won’t see it as often in modern enterprise campuses. A lot of teams, honestly, just prefer straightforward gateway behavior. And more and more, they’ll move toward routed designs instead of trying to get clever with gateway load-balancing tricks.

Typical Tier 2 blueprint: two collapsed-core switches, access switches dual-homed upstream, HSRP on the SVIs, Rapid PVST+ or MST for loop prevention, LACP EtherChannels for uplinks, trunk allowed-VLAN lists kept tight, and DHCP relay configured on gateway SVIs if services are remote.

What ENCOR is likely to ask: when collapsed core is appropriate, why the blast radius is larger, how STP and FHRP interact, and why “Tier 2” does not mean “flat Layer 2 everywhere.”

4. Tier 3 Campus Design and Routed Access

Tier 3 is the classic access-distribution-core model. The distribution layer aggregates access blocks, commonly hosts policy boundaries and routing, and the core provides high-speed transport. Best practice is to keep the core free of unnecessary policy and packet manipulation so it stays fast and predictable.

The real advantage is modularity. Each building or access block can connect to a distribution pair, and those distribution blocks connect to the core over routed links. That reduces dependence on spanning tree in the backbone, improves convergence, and limits failure domains.

A modern design variation you should know for ENCOR is routed access. Instead of extending Layer 2 all the way from access up into distribution, the access uplinks are simply Layer 3 links. That keeps the STP domain contained at the access layer, which is a big deal, and it usually improves fault isolation too. In a lot of cases, it also means you don’t need the classic distribution-layer FHRP setup for user VLANs because the gateway can live right on the access switch. You see this more and more in campus designs where convergence and operational clarity matter a lot.

OSPF is the IGP you’ll hear about most often in ENCOR campus scenarios. EIGRP is still exam-relevant, and you’ll absolutely run into it in legacy or Cisco-heavy environments, but it shows up less often in greenfield multi-vendor campus networks. IS-IS isn’t all that common in traditional campus routing, but it’s important to recognize it in SD-Access underlays.

In a Tier 3 OSPF design, common practices include passive interfaces on user-facing links, clean area boundaries, route summarization at distribution where the addressing plan supports it, and default route injection toward access where appropriate. Route summarization really only gives you value if the subnet plan was clean enough to begin with. If the addressing is messy, summarization turns into more of a headache than a help.

Example summarization logic: if Building A uses 10.10.0.0/22 and Building B uses 10.10.4.0/22, each distribution block can advertise a summary instead of many individual /24s. That keeps the core routing table smaller and convergence cleaner.

What ENCOR is likely to ask: why routed core links improve convergence, how distribution blocks improve fault isolation, when routed access is preferable, and why three-tier is not automatically better unless scale and growth justify it.

5. Cisco SD-Access and Fabric-Based Campus Design

Fabric-based campus design is aimed at a different set of problems: scalable segmentation, mobility, and automation. In Cisco SD-Access, the underlay is IP transport, commonly built with IS-IS in Cisco reference designs. The overlay uses VXLAN for data-plane encapsulation. The control plane uses LISP to map endpoint identity to location. Automation and orchestration are typically handled by Cisco Catalyst Center (formerly DNA Center).

The major fabric roles are:

  • Edge node: where endpoints attach to the fabric.
  • Control-plane node: maintains endpoint ID-to-locator mappings through LISP.
  • Border node: connects the fabric to external networks such as WAN, internet, data center, or traditional campus areas.
  • Fusion role: often used where policy translation, service insertion, or integration with non-fabric domains is required.

SD-Access also changes segmentation. Instead of relying only on VLANs and ACLs, you can use Virtual Networks for macro-segmentation and Scalable Group Tags (SGTs) with group-based policy for finer policy control. Anycast gateway behavior helps preserve a consistent gateway experience across the fabric.

Fabric is powerful, but not magic. Underlay design still matters. Border nodes can become choke points. Control-plane scale must match endpoint growth. VXLAN does add encapsulation overhead, and that’s something you can’t just hand-wave away. And if orchestration, policy intent, or external integration isn’t right, the campus can fail in ways that are a lot more annoying to troubleshoot than a straightforward VLAN and STP design.

Wireless note: fabric can integrate wired and wireless policy more cleanly, but AP density, WLC placement, roaming behavior, and edge-node capacity still have to be engineered.

What ENCOR is likely to ask: underlay versus overlay, LISP versus VXLAN roles, edge/control-plane/border functions, and why fabric is usually chosen for segmentation, mobility, and automation rather than just because it is newer.

6. Tier 2 vs Tier 3 vs Fabric: Picking the Right Campus Model

Architecture comparison:

  • Tier 2: Best fit for a small to medium campus with limited buildings. Main strength is simplicity and lower cost. Main risk is a broader failure domain. Segmentation usually leans on VLANs, ACLs, and maybe a limited amount of VRF-Lite if the design really needs it.
  • Tier 3: Best fit for a multi-building, growth-heavy campus. Its biggest strength is modularity and cleaner fault isolation. The tradeoff is higher cost and a fair bit more operational complexity. Segmentation commonly uses VLANs, ACLs, VRF-Lite, and stronger policy boundaries that are easier to control at scale.
  • Fabric: Best fit when segmentation, mobility, and automation are priorities. Its main strength is scalable policy and a much more consistent operational model. Main risk is higher design abstraction and dependency on correct orchestration. Segmentation typically uses Virtual Networks, Scalable Group Tags, and group-based policy.

Decision anchor:

  • Small + simple + budget-sensitive: Tier 2
  • Multi-building + modular growth + fault isolation: Tier 3
  • Segmentation + mobility + automation: Fabric

Then validate capacity and failure-state behavior for all three. Architecture choice never removes the need for sizing and testing.

7. Capacity Planning Fundamentals and Practice

Capacity planning is not just interface speed. It covers traffic patterns, failure state, hardware scale, PoE, control-plane load, and service dependencies. A 10G uplink can still be the wrong answer if wireless bursts, east-west traffic, or failover events push beyond what the surviving path can actually carry.

A workflow I’ve found useful is:

  • Step 1: inventory users, endpoints, applications, and growth forecast
  • Step 2: calculate port density and PoE demand
  • Step 3: size uplinks and estimate oversubscription
  • Step 4: validate hardware scale: MAC, ARP/ND, route, FIB, TCAM, CPU, buffers
  • Step 5: model single-link and single-node failure states
  • Step 6: verify service reachability for DHCP, DNS, AAA, ISE, NTP, telemetry

Core formulas:

Oversubscription ratio = total potential downstream bandwidth / total upstream bandwidth

Failover capacity check = surviving path capacity >= peak required traffic

Growth-adjusted demand = current demand × growth factor

Oversubscription based on line rates is only a theoretical maximum. Real design should use measured concurrency, application mix, and peak-hour behavior.

Example 1: Oversubscription math

Say you’ve got three access switches, and each one has 48 x 1G user ports plus 2 x 10G uplinks bundled into an LACP port-channel. That gives you 144 Gbps of total downstream potential. Your total upstream bandwidth is 60 Gbps.

Oversubscription = 144 / 60 = 2.4:1

That might be perfectly acceptable for general office users, but it may not hold up so well in dense wireless, VDI, or video-heavy areas.

Example 2: failover-state validation

A building uses a routed ECMP design with two active 10G uplinks carrying 12 Gbps aggregate during peak periods. If one uplink fails, the surviving capacity is 10 Gbps.

10 Gbps >= 12 Gbps? No.

The design is fine in steady state but not in failure state.

PoE matters too. A 48-port switch can absolutely have enough ports and still not have enough power budget. If 24 APs draw 20W each and 24 phones draw 7W each, you’re at 648W total draw. That can blow past some switch PoE budgets faster than people expect, especially if you need power redundancy or you know AP refreshes are coming later.

Wireless planning caveat: AP-count times average throughput is only a rough estimate. Real wireless capacity depends on client concurrency, channel width, PHY rates versus actual throughput, roaming behavior, SSID design, and whether traffic is centrally switched or locally switched.

QoS and buffers: bandwidth alone is not enough. Voice, video, and wireless bursts are sensitive to queue drops and buffer exhaustion. Trust boundaries, DSCP preservation, uplink queue design, and drop monitoring matter at access uplinks, distribution aggregation points, and fabric borders.

8. Security, Segmentation, and Services by Architecture

Security design changes with the architecture. In Tier 2 and Tier 3 traditional campuses, segmentation commonly uses VLANs, ACLs, and sometimes VRF-Lite. In fabric, segmentation can scale more cleanly with VNs and SGT-based policy.

Traditional Layer 2-heavy designs expose a bigger Layer 2 attack surface. That means controls such as 802.1X, MAB, DHCP snooping, Dynamic ARP Inspection, IP Source Guard, PortFast, BPDU Guard, Root Guard, and Loop Guard become especially important. And the management plane matters just as much. SSH, AAA through TACACS+/RADIUS, SNMPv3, logging, NTP, PKI, and control-plane policing all need to be part of the design discussion.

Fabric definitely improves scalable segmentation, but it also makes you more dependent on correct controller intent, clean policy definitions, and solid integration with identity and access control services. If policy is wrong in a fabric, the mistake can scale quickly.

Services must be reachable during failures. DHCP relay placement, DNS pathing, AAA reachability, network access control dependencies, WLC connectivity, and telemetry collectors all need to be tested in normal and degraded states. A campus can have redundant links and still fail users if authentication or address assignment breaks.

Dual-stack awareness is also exam-relevant. IPv6 brings its own set of concerns too, like ND and RA scaling, MLD awareness in some environments, and FHRP options such as HSRP for IPv6 or VRRPv3. Keeping policy consistent across IPv4 and IPv6 is just part of good design, plain and simple.

9. High Availability, Validation, and Troubleshooting: What Actually Breaks

High availability in campus design has multiple layers:

  • Gateway availability: FHRP such as HSRP or VRRP
  • Path redundancy: dual uplinks, EtherChannel, routed ECMP
  • Control-plane resilience: SSO, NSF, and NSR where supported
  • Stateful session preservation: usually a firewall or service-cluster function, not something FHRP itself provides

Quick distinctions matter. SSO provides supervisor switchover continuity. NSF helps preserve forwarding while a routing process restarts. NSR maintains routing protocol state without neighbor reset on supported platforms and protocols. Support varies by platform, feature set, and protocol, so I’d never assume universal behavior.

A good way to troubleshoot is by symptom:

  • Intermittent gateway reachability or odd latency: check FHRP/STP misalignment or asymmetric forwarding.
  • Broad impact after one distribution failure: check collapsed-core blast radius and failover capacity.
  • Congestion after maintenance: check surviving uplinks, queue drops, and whether the design was only sized for average load.
  • Wireless complaints in dense areas: check AP uplink speed, PoE class, WLC traffic path, and aggregation bottlenecks.
  • Fabric users reach local resources but not external services: check border-node capacity, fusion integration, and policy/export path.

Useful verification commands (platform support varies):

show etherchannel summary show spanning-tree show spanning-tree vlan X show standby brief show standby show ip route show ip ospf neighbor show processes cpu sorted show mac address-table count

Hardware-capacity and queue diagnostics are platform-specific, so use the relevant platform command set and compare findings to official scale guidance for the deployed hardware and software.

10. Compact Design Scenarios for ENCOR

Scenario A: Tier 2 fit
One main building, 500 users, moderate wireless, limited staff, cost-sensitive, mostly SaaS and internet traffic. Best fit: Tier 2 collapsed core, with dual-homed access, HSRP, Rapid PVST+ or MST, and careful failover-state sizing.

Scenario B: Tier 3 fit
Six buildings, heavy east-west traffic, growth expected, experienced operations team, need for route summarization and fault isolation. Best fit: Tier 3, likely with routed distribution-to-core links and possibly routed access.

Scenario C: Fabric fit
High mobility, contractors, IoT, guest access, compliance-driven segmentation, and a desire for automation. Best fit: fabric-based campus, with underlay/overlay planning, border capacity validation, and policy integration through centralized orchestration and identity services.

11. ENCOR Exam Traps, Drills, and Rapid Review

Common exam traps:

  • Tier 2 means Layer 2-only. False.
  • Three-tier is always best practice. False.
  • Fabric removes the need for underlay design. False.
  • FHRP provides stateful session failover. False.
  • Oversubscription ratios alone determine design quality. False.

Mini drills:

  • If the campus is small, staff is lean, and cost matters most, think Tier 2.
  • If the campus is multi-building and growth requires modularity, think Tier 3.
  • If segmentation and mobility are dominant requirements, think Fabric.
  • If a failover path cannot carry peak traffic, the design is not truly resilient.
  • If the active HSRP gateway and STP root are misaligned, expect suboptimal traffic flow.
  • LISP = endpoint mapping, VXLAN = overlay encapsulation, Border = external connectivity, Edge = endpoint attachment.

Final rapid review:

  • Tier 2 = simplicity
  • Tier 3 = modular scale
  • Fabric = segmentation and automation
  • Routed access reduces STP scope
  • OSPF is the most common ENCOR campus IGP
  • EIGRP is still exam-relevant but less common in greenfield design
  • SD-Access underlay commonly uses IS-IS
  • SD-Access overlay uses VXLAN
  • SD-Access control plane uses LISP
  • Capacity planning must include failure state
  • PoE budget can be a limiting factor before port count is
  • Wireless throughput estimates are rough unless tied to real client behavior
  • Services like DHCP, DNS, AAA, identity services, and wireless controllers must be validated during failover

12. Final Takeaways

The right campus architecture is the one that fits the business and survives real operating conditions. Tier 2 is often right for smaller, simpler campuses. Tier 3 is right when modularity, growth, and fault isolation matter. Fabric is right when segmentation, mobility, and automation are first-class requirements.

For ENCOR, think like a designer: choose the model, place the gateway and policy boundaries deliberately, size the uplinks and hardware correctly, secure the access edge, and always ask what happens when a link, node, or service fails. That is the design mindset the exam is looking for.