Η modularity του δικτύου είναι η πρακτική του σχεδιασμού δικτύων ως διασυνδεδεμένων, φτιαγμένων από σκοπό τμημάτων και όχι μονολιθικών δομών. Κάθε μονάδα εξυπηρετεί μια συγκεκριμένη λειτουργία, έχει καθορισμένα όρια, και συνδέεται με παρακείμενες ενότητες μέσω καλά καταληπτών διεπαφών. Αυτή η προσέγγιση μετατρέπει το σχεδιασμό του δικτύου από μια τέχνη σε μια επαναλαμβανόμενη μηχανική πειθαρχία.
Η δύναμη της modularity έγκειται στην ικανότητά της να δημιουργείπροβλέψιμα πρότυπααυτό μπορεί να εφαρμοστεί με συνέπεια σε ολόκληρο το αποτύπωμα υποδομής ενός οργανισμού—είτε αυτό καλύπτει δεκάδες χιλιάδες μικρές τοποθεσίες, χιλιάδες μεσαίες τοποθεσίες, ή εκατοντάδες μεγάλες επιχειρήσεις πανεπιστημιούπολη.
| Benefit | Small Sites | Medium Sites | Large Sites | |---------|-------------|--------------|-------------| |Απλοποιημένη Αντιμετώπιση προβλημάτων| Single engineer can understand entire topology | Teams can specialize by module | Clear escalation paths between module owners | |Προβλεπόμενη κλιμάκωση| Add modules as needed | Clone proven patterns | Extend without redesign | |Συνετή Ασφάλεια| Same policies everywhere | Uniform compliance posture | Auditable boundaries | |Επιχειρησιακή απόδοση| Template-based deployment | Automated provisioning | Standardized change management | |Έλεγχος κόστους| Right-size each module | Bulk purchasing by module type | Lifecycle management by tier |
Οι οργανισμοί σπάνια παραμένουν στατικοί. Ένα αρθρωτό σχέδιο πρέπει να περιλαμβάνει:
Χωρίς modularity, κάθε τοποθεσία γίνεται μια μοναδική νιφάδα χιονιού που απαιτεί προσαρμοσμένη τεκμηρίωση, εξειδικευμένη εκπαίδευση, και μια-off αντιμετώπιση προβλημάτων. Με modularity, ένας μηχανικός που καταλαβαίνει το μοτίβο μπορεί να λειτουργήσει αποτελεσματικά σε οποιαδήποτε τοποθεσία.
Το Internet Edge είναι όπου η οργάνωσή σας συναντά τον έξω κόσμο. Αυτό το άρθρωμα περιέχει:
@startuml Internet Edge Module
!define ICONURL https://raw.githubusercontent.com/Roemer/plantuml-office/master/office2014
skinparam backgroundColor #FEFEFE
skinparam handwritten false
nwdiag {
internet [shape = cloud, description = "Internet"];
network ISP_Transit {
address = "VLAN 10-12"
color = "#FFE4E1"
description = "ISP/MPLS Transit"
internet;
ISP_A [description = "ISP-A\nCircuit"];
ISP_B [description = "ISP-B\nCircuit"];
MPLS [description = "MPLS\nCircuit"];
}
network Edge_Router_Segment {
address = "VLAN 10,11,12"
color = "#E6E6FA"
description = "Edge Router Aggregation"
ISP_A;
ISP_B;
MPLS;
Edge_Router [description = "Edge Router\n(BGP Peering)"];
}
network FW_Outside {
address = "VLAN 100"
color = "#FFFACD"
description = "Firewall Outside"
Edge_Router;
FW_Primary [description = "Firewall\nPrimary"];
FW_Secondary [description = "Firewall\nSecondary"];
}
network FW_HA_Sync {
address = "VLAN 101"
color = "#F0FFF0"
description = "HA Sync Link"
FW_Primary;
FW_Secondary;
}
network FW_Inside {
address = "VLAN 102"
color = "#E0FFFF"
description = "To Internal Edge"
FW_Primary;
FW_Secondary;
}
}
@enduml
Βασικές αρχές σχεδιασμού:
Για τις μεσαίες και τις μεγάλες τοποθεσίες, το εσωτερικό άκρο παρέχει ένα στρώμα συγκέντρωσης για υπηρεσίες που απαιτούν ελεγχόμενη έκθεση ή χρησιμεύουν ως σημεία μετάβασης μεταξύ των ζωνών ασφαλείας.
@startuml Internal Edge Module
skinparam backgroundColor #FEFEFE
nwdiag {
network From_Internet_Edge {
address = "VLAN 102"
color = "#E0FFFF"
description = "From Firewall Inside"
IntEdge_A [description = "Internal Edge\nSwitch A"];
IntEdge_B [description = "Internal Edge\nSwitch B"];
}
network MCLAG_Peer {
address = "Peer-Link"
color = "#DDA0DD"
description = "MCLAG/vPC Peer"
IntEdge_A;
IntEdge_B;
}
network WLC_Mgmt {
address = "VLAN 200 - 10.x.200.0/24"
color = "#FFE4B5"
description = "WLC Management"
IntEdge_A;
IntEdge_B;
WLC [description = "Wireless LAN\nController"];
}
network Proxy_Farm {
address = "VLAN 201 - 10.x.201.0/24"
color = "#FFDAB9"
description = "Proxy Services"
IntEdge_A;
IntEdge_B;
Proxy [description = "Web Proxy\nServers"];
}
network VPN_Services {
address = "VLAN 202 - 10.x.202.0/24"
color = "#E6E6FA"
description = "VPN Termination"
IntEdge_A;
IntEdge_B;
VPN [description = "VPN\nConcentrator"];
}
network Infrastructure {
address = "VLAN 204 - 10.x.204.0/24"
color = "#F0FFF0"
description = "Infrastructure Services"
IntEdge_A;
IntEdge_B;
DNS_DHCP [description = "DNS/DHCP\nServers"];
}
network To_Core {
address = "VLAN 205"
color = "#B0E0E6"
description = "Core Transit"
IntEdge_A;
IntEdge_B;
}
}
@enduml
Υπηρεσίες Τυπικά στο εσωτερικό άκρο:
Ο πυρήνας είναι η ραχοκοκαλιά υψηλής ταχύτητας που διασυνδέει όλες τις άλλες μονάδες. Θα πρέπει να βελτιστοποιηθεί για:
@startuml Core Module
skinparam backgroundColor #FEFEFE
nwdiag {
network From_Internal_Edge {
address = "L3 Routed"
color = "#B0E0E6"
description = "From Internal Edge"
Core_A [description = "Core Switch A\n100G Backbone"];
Core_B [description = "Core Switch B\n100G Backbone"];
}
network Core_Interconnect {
address = "100G+ ISL"
color = "#FFB6C1"
description = "High-Speed Interconnect\nOSPF/IS-IS/BGP"
Core_A;
Core_B;
}
network To_Distribution_1 {
address = "L3 P2P"
color = "#98FB98"
description = "Building A"
Core_A;
Core_B;
Dist_1 [description = "Distribution 1\n(L3 Adjacent)"];
}
network To_Distribution_2 {
address = "L3 P2P"
color = "#DDA0DD"
description = "Building B"
Core_A;
Core_B;
Dist_2 [description = "Distribution 2\n(MCLAG)"];
}
network To_Distribution_3 {
address = "L3 P2P"
color = "#FFDAB9"
description = "Building C"
Core_A;
Core_B;
Dist_3 [description = "Distribution 3\n(MCLAG)"];
}
network To_DC_Border {
address = "L3 Routed"
color = "#87CEEB"
description = "Datacenter"
Core_A;
Core_B;
Border_Leaf [description = "Border Leaf\n(DC Fabric)"];
}
}
@enduml
Βασικές αρχές σχεδιασμού:
Το στρώμα διανομής αθροίζει τους διακόπτες πρόσβασης και επιβάλλει την πολιτική. Εδώ είναι που οι επιλογές σχεδιασμού δικτύου έχουν την μεγαλύτερη παραλλαγή με βάση τις απαιτήσεις του ιστότοπου.
Σε αυτό το σχεδιασμό, τα στρώματα διανομής και πρόσβασης είναιL3 δίπλα—κάθε διακόπτης πρόσβασης έχει το δικό του υποδίκτυο IP και διαδρομές απευθείας προς τη διανομή.
@startuml Distribution Variation 1 - L3 Adjacent
skinparam backgroundColor #FEFEFE
nwdiag {
network From_Core {
address = "L3 ECMP"
color = "#B0E0E6"
description = "From Core Layer"
Dist_A [description = "Distribution A\n(L3 Router)"];
Dist_B [description = "Distribution B\n(L3 Router)"];
}
network Dist_iBGP {
address = "iBGP Peering"
color = "#DDA0DD"
description = "ECMP/iBGP"
Dist_A;
Dist_B;
}
network P2P_Access_1 {
address = "10.x.2.0/30"
color = "#98FB98"
description = "L3 Point-to-Point"
Dist_A;
Dist_B;
Access_1 [description = "Access SW-1\n(L3 Gateway)"];
}
network P2P_Access_2 {
address = "10.x.2.8/30"
color = "#FFE4B5"
description = "L3 Point-to-Point"
Dist_A;
Dist_B;
Access_2 [description = "Access SW-2\n(L3 Gateway)"];
}
network P2P_Access_3 {
address = "10.x.2.16/30"
color = "#FFDAB9"
description = "L3 Point-to-Point"
Dist_A;
Dist_B;
Access_3 [description = "Access SW-3\n(L3 Gateway)"];
}
network User_VLAN_1 {
address = "10.x.32.0/24"
color = "#F0FFF0"
description = "Users - SW1"
Access_1;
Laptop_1 [description = "Laptops"];
Phone_1 [description = "Phones"];
}
network User_VLAN_2 {
address = "10.x.33.0/24"
color = "#FFF0F5"
description = "Users - SW2"
Access_2;
Laptop_2 [description = "Laptops"];
Camera_2 [description = "Cameras"];
}
network User_VLAN_3 {
address = "10.x.34.0/24"
color = "#F5FFFA"
description = "Users - SW3"
Access_3;
Laptop_3 [description = "Workstations"];
Camera_3 [description = "Cameras"];
}
}
@enduml
Παράδειγμα κατανομής υποδικτύων:
| Link | Subnet | |------|--------| Διανομή στον πυρήνα 10.x.1.0/30, 10.x.1.4/30 | Dist-A to Access-1 | 10.x.2.0/30 | | Dist-B to Access-1 | 10.x.2.4/30 | | Access-1 User VLAN | 10.x.32.0/24 | | Access-2 User VLAN | 10.x.33.0/24 |
Οφέλη:
Προτάσεις:
Αυτό το σχέδιο χρησιμοποιείΣυγκέντρωση δεσμού πολλαπλών κλιμάκων (MCLAG)σε διανομή μεΟμόλογα ΛΑΚΕστους διακόπτες πρόσβασης που μεταφέρουν κορμούς VLAN.
Ορολογία Προμηθευτή: Η Cisco αποκαλεί αυτό το vPC (Virtual Port Channel), η Arista χρησιμοποιεί το MLAG, η Juniper χρησιμοποιεί το MC-LAG, και η HPE/Aruba χρησιμοποιεί το VSX. Η λειτουργική συμπεριφορά είναι παρόμοια σε όλους τους πωλητές.
@startuml Distribution Variation 2 - MCLAG
skinparam backgroundColor #FEFEFE
nwdiag {
network From_Core {
address = "L3 Routed Uplinks"
color = "#B0E0E6"
description = "From Core Layer"
Dist_A [description = "Distribution A\n(MCLAG Member)"];
Dist_B [description = "Distribution B\n(MCLAG Member)"];
}
network MCLAG_Peer_Link {
address = "Peer-Link"
color = "#FFB6C1"
description = "MCLAG/vPC Peer-Link"
Dist_A;
Dist_B;
}
network LACP_To_Access {
address = "Po1 - LACP Trunk"
color = "#DDA0DD"
description = "VLANs 100,110,120 Trunked"
Dist_A;
Dist_B;
Access_1 [description = "Access SW-1\n(L2 Switch)"];
}
network Data_VLAN {
address = "VLAN 100 - 10.x.32.0/24"
color = "#98FB98"
description = "Data VLAN"
Access_1;
Laptops [description = "Laptops\nWorkstations"];
}
network Voice_VLAN {
address = "VLAN 110 - 10.x.64.0/24"
color = "#FFE4B5"
description = "Voice VLAN"
Access_1;
Phones [description = "IP Phones"];
}
network Security_VLAN {
address = "VLAN 120 - 10.x.96.0/24"
color = "#FFDAB9"
description = "Security VLAN"
Access_1;
Cameras [description = "Cameras\nBadge Readers"];
}
}
@enduml
SVI Τοποθέτηση (VRRP VIP στο ζεύγος διανομής):
Configuration προφυλακτήρα VLAN:
| Port-Channel | VLANs | Destination | |--------------|-------|-------------| | Po1 (MCLAG) | 100,110,120 | Access-1 | | Po2 (MCLAG) | 100,110,120,130 | Access-2 | | Po3 (MCLAG) | 100,110 | Access-3 | | Native VLAN | 999 (unused) | — |
Οφέλη MCLAG:
Προτάσεις:
Σε περιβάλλοντα datacenter, το στρώμα διανομής γίνεται τοΦύλλο περιγράμματοςσύνδεση της σπονδυλικής στήλης/φύλλου με το υπόλοιπο δίκτυο επιχειρήσεων.
@startuml Distribution Variation 3 - Border Leaf Datacenter
skinparam backgroundColor #FEFEFE
nwdiag {
network Enterprise_Core {
address = "L3 Routed (eBGP/OSPF)"
color = "#B0E0E6"
description = "From Enterprise Core"
Border_A [description = "Border Leaf A\nVXLAN Gateway"];
Border_B [description = "Border Leaf B\nVXLAN Gateway"];
}
network Border_EVPN {
address = "VXLAN EVPN"
color = "#DDA0DD"
description = "EVPN Type-5 Routes"
Border_A;
Border_B;
Spine_1 [description = "Spine 1"];
Spine_2 [description = "Spine 2"];
}
network Spine_Fabric {
address = "eBGP Underlay"
color = "#FFB6C1"
description = "Spine Layer"
Spine_1;
Spine_2;
}
network Leaf_Tier_1 {
address = "VTEP"
color = "#98FB98"
description = "Compute Rack 1"
Spine_1;
Spine_2;
Leaf_1 [description = "Leaf 1"];
Leaf_2 [description = "Leaf 2"];
}
network Leaf_Tier_2 {
address = "VTEP"
color = "#FFE4B5"
description = "Storage/Services"
Spine_1;
Spine_2;
Leaf_3 [description = "Leaf 3"];
Leaf_4 [description = "Leaf 4"];
}
network Server_Rack_1 {
address = "VNI 10001"
color = "#F0FFF0"
description = "Compute Servers"
Leaf_1;
Leaf_2;
Servers_1 [description = "Rack Servers\nVMs/Containers"];
}
network Storage_Network {
address = "VNI 10002"
color = "#FFDAB9"
description = "Storage Arrays"
Leaf_3;
Storage [description = "SAN/NAS\nStorage"];
}
network Voice_Services {
address = "VNI 10003"
color = "#E6E6FA"
description = "UC Systems"
Leaf_4;
PBX [description = "PBX/UC\nSystems"];
}
}
@enduml
Λεπτομέρειες υφάσματος datacenter:
| Component | Function | |-----------|----------| |Υπόστρωμα| eBGP (ASN per switch) or OSPF | |Επικάλυψη| VXLAN with EVPN control plane | |Φύλλο περιγράμματος| VXLAN-to-VLAN gateway, External routes, Inter-VRF routing | |Φορτία εργασίας φύλλων| Compute, Storage, Voice/UC, Infrastructure |
Οφέλη:
Προτάσεις:
Το στρώμα Access είναι το σημείο σύνδεσης των τελικών συσκευών. Ανεξάρτητα από την τοπολογία διανομής, οι διακόπτες πρόσβασης παρέχουν:
@startuml Access Layer Module
skinparam backgroundColor #FEFEFE
nwdiag {
network Distribution_Uplink {
address = "L3 or LACP Trunk"
color = "#B0E0E6"
description = "Uplinks to Distribution"
Access_SW [description = "48-Port Access Switch\nPoE+ Capable"];
}
network Data_VLAN {
address = "VLAN 100 - Ports 1-8, 25-32"
color = "#98FB98"
description = "Data VLAN"
Access_SW;
Laptops [description = "Laptops\nWorkstations"];
}
network Voice_VLAN {
address = "VLAN 110 - Ports 9-16"
color = "#FFE4B5"
description = "Voice VLAN"
Access_SW;
Phones [description = "IP Phones"];
}
network Camera_VLAN {
address = "VLAN 120 - Ports 17-24"
color = "#FFDAB9"
description = "Security VLAN"
Access_SW;
Cameras [description = "IP Cameras"];
}
network Wireless_VLAN {
address = "VLAN 130 - Ports 33-40"
color = "#DDA0DD"
description = "Wireless AP VLAN"
Access_SW;
APs [description = "Wireless APs"];
}
network Mgmt_VLAN {
address = "VLAN 999 - Ports 41-44"
color = "#F0FFF0"
description = "Management VLAN"
Access_SW;
}
}
@enduml
Χαρακτηριστικά ασφαλείας στρώματος πρόσβασης:
Εδώ είναι πώς όλες οι ενότητες συνδέονται για να σχηματίσουν ένα πλήρες δίκτυο επιχειρήσεων:
@startuml Complete Modular Network Topology
skinparam backgroundColor #FEFEFE
title Complete Enterprise Modular Network
nwdiag {
internet [shape = cloud, description = "Internet/WAN"];
network Internet_Edge {
address = "Module 1"
color = "#FFE4E1"
description = "INTERNET EDGE MODULE"
internet;
ISP_A [description = "ISP-A"];
ISP_B [description = "ISP-B"];
MPLS [description = "MPLS"];
Edge_RTR [description = "Edge Router"];
FW_A [description = "FW-A"];
FW_B [description = "FW-B"];
}
network Internal_Edge {
address = "Module 2"
color = "#E6E6FA"
description = "INTERNAL EDGE / DMZ MODULE"
FW_A;
FW_B;
IntEdge_A [description = "IntEdge-A"];
IntEdge_B [description = "IntEdge-B"];
WLC [description = "WLC"];
Proxy [description = "Proxy"];
VPN [description = "VPN"];
DNS [description = "DNS/DHCP"];
}
network Core {
address = "Module 3"
color = "#B0E0E6"
description = "CORE MODULE"
IntEdge_A;
IntEdge_B;
Core_A [description = "Core-A"];
Core_B [description = "Core-B"];
}
network Distribution_L3 {
address = "Variation 1"
color = "#98FB98"
description = "DIST - L3 Adjacent\n(Building A)"
Core_A;
Core_B;
Dist_1A [description = "Dist-1A"];
Dist_1B [description = "Dist-1B"];
Access_L3 [description = "Access\n(L3)"];
}
network Distribution_MCLAG {
address = "Variation 2"
color = "#DDA0DD"
description = "DIST - MCLAG\n(Building B)"
Core_A;
Core_B;
Dist_2A [description = "Dist-2A"];
Dist_2B [description = "Dist-2B"];
Access_L2 [description = "Access\n(L2)"];
}
network Datacenter {
address = "Variation 3"
color = "#FFE4B5"
description = "DATACENTER\n(Spine/Leaf)"
Core_A;
Core_B;
Border_Leaf [description = "Border\nLeaf"];
Spine [description = "Spine"];
Leaf [description = "Leaf"];
Servers [description = "Servers\nStorage\nPBX"];
}
network Campus_Users {
address = "End Devices"
color = "#F0FFF0"
description = "Campus Users"
Access_L3;
Access_L2;
Users [description = "Laptops\nPhones\nCameras"];
}
}
@enduml
Όταν τα δίκτυα αναπτύσσονται ώστε να περιλαμβάνουν πολλαπλές ζώνες ασφαλείας, επιχειρηματικές μονάδες ή όρια συμμόρφωσης,VRF (εικονική διαδρομή και προώθηση)παρέχει την απομόνωση του τραπεζιού διαδρομής. Ωστόσο, η επέκταση των VRF μέσω πολλαπλών βαθμίδων προσθέτει πολυπλοκότητα:
Ένα καλοσχεδιασμένο σχήμα υποδικτύου κάνει τα πρότυπα αναγνωρίσιμα, μειώνοντας το γνωστικό φορτίο και τα σφάλματα διαμόρφωσης.
Κατανομή site:10.0.0.0/13 (Κατασκευαστική Περιοχή Alpha) - 524.286 χρησιμοποιήσιμοι οικοδεσπότες
@startuml VRF Subnet Schema
skinparam backgroundColor #FEFEFE
title Large Site VRF Allocation Schema (10.0.0.0/13)
nwdiag {
network Corporate_VRF {
address = "VRF: CORPORATE\n10.0.0.0/17"
color = "#98FB98"
description = "Production Users"
Corp_Transit [description = "Transit\n10.0.0.0/23"];
Corp_Users [description = "Users\n10.0.32.0/19"];
Corp_Voice [description = "Voice\n10.0.64.0/19"];
Corp_Wireless [description = "Wireless\n10.0.96.0/19"];
Corp_Server [description = "Servers\n10.0.112.0/20"];
}
network Guest_VRF {
address = "VRF: GUEST\n10.1.0.0/17"
color = "#FFE4B5"
description = "Visitor Network"
Guest_Transit [description = "Transit\n10.1.0.0/23"];
Guest_Users [description = "Users\n10.1.32.0/19"];
}
network Security_VRF {
address = "VRF: SECURITY\n10.2.0.0/17"
color = "#FFDAB9"
description = "Physical Security"
Sec_Transit [description = "Transit\n10.2.0.0/23"];
Sec_Camera [description = "Cameras\n10.2.32.0/19"];
Sec_Badge [description = "Badge Readers\n10.2.64.0/19"];
Sec_NVR [description = "NVR/VMS\n10.2.96.0/20"];
}
network IOT_VRF {
address = "VRF: IOT\n10.3.0.0/17"
color = "#E6E6FA"
description = "Manufacturing OT"
IOT_Transit [description = "Transit\n10.3.0.0/23"];
IOT_PLC [description = "PLCs\n10.3.32.0/19"];
IOT_HMI [description = "HMIs\n10.3.64.0/19"];
IOT_SCADA [description = "SCADA\n10.3.96.0/20"];
}
}
@enduml
Στοιχεία τμήματος διαμετακόμισης (10.0.0.0/23 - 510 χρησιμοποιήσιμα IP):
| Subnet | Link Description | |--------|------------------| | 10.0.0.0/30 | FW-Inside → Internal-Edge-A | | 10.0.0.4/30 | FW-Inside → Internal-Edge-B | | 10.0.0.8/30 | Internal-Edge-A → Core-A | | 10.0.0.12/30 | Internal-Edge-A → Core-B | | 10.0.0.16/30 | Internal-Edge-B → Core-A | | 10.0.0.20/30 | Internal-Edge-B → Core-B | | 10.0.0.24/30 | Core-A → Distribution-A | | 10.0.0.28/30 | Core-A → Distribution-B | | 10.0.0.32/30 | Core-B → Distribution-A | | 10.0.0.36/30 | Core-B → Distribution-B | | 10.0.0.40/30 | Distribution-A → Access-SW-1 | | 10.0.0.44/30 | Distribution-B → Access-SW-1 | | ... | (Pattern continues) |
Σημείωση:/31 υποδίκτυα (RFC 3021) μπορούν επίσης να χρησιμοποιηθούν για συνδέσμους από σημείο σε σημείο, συντηρώντας χώρο διευθύνσεων.
Όταν τα μοντέλα υποδικτύων είναι συνεπή σε VRF:
Τι ξέρεις; Τι μπορείς να πεις |---------------|-------------------| | Transit link in Corporate uses 10.0.0.40/30 | Guest equivalent is 10.1.0.40/30 | | Access-SW-5 users are on 10.0.36.0/24 | Security cameras on same switch are 10.2.36.0/24 | | Site Alpha is 10.0.0.0/13 | Site Beta could be 10.8.0.0/13 |
Αυτό επιτρέπει στους μηχανικούς να:
@startuml Small Site Template
skinparam backgroundColor #FEFEFE
title Small Site Template (< 50 users)
nwdiag {
internet [shape = cloud];
network WAN {
color = "#FFE4E1"
description = "ISP/MPLS Circuit"
internet;
UTM [description = "UTM/SD-WAN\nAppliance\n(Router+FW+VPN+WLC)"];
}
network LAN {
address = "10.100.x.0/24"
color = "#98FB98"
description = "Single Subnet"
UTM;
Access [description = "Access Switch\n(or UTM ports)"];
}
network Endpoints {
color = "#F0FFF0"
description = "End Devices"
Access;
AP [description = "WiFi AP"];
Users [description = "Users"];
Phones [description = "Phones"];
}
}
@enduml
Μικρές σημειώσεις σχεδιασμού site:
@startuml Medium Site Template
skinparam backgroundColor #FEFEFE
title Medium Site Template (50-500 users)
nwdiag {
internet [shape = cloud];
network WAN_Edge {
color = "#FFE4E1"
description = "Internet Edge"
internet;
ISP_A [description = "ISP-A"];
ISP_B [description = "ISP-B/MPLS"];
Edge_RTR [description = "Edge Router"];
}
network Firewall_Tier {
color = "#FFDAB9"
description = "Firewall HA Pair"
Edge_RTR;
FW_A [description = "FW-A"];
FW_B [description = "FW-B"];
}
network Distribution {
address = "10.50.x.0/21"
color = "#DDA0DD"
description = "MCLAG Distribution\n(Dist/Core Combined)"
FW_A;
FW_B;
Dist_A [description = "Dist-A"];
Dist_B [description = "Dist-B"];
}
network Access_Tier {
color = "#98FB98"
description = "Access Switches (LACP)"
Dist_A;
Dist_B;
Acc1 [description = "Acc1"];
Acc2 [description = "Acc2"];
Acc3 [description = "Acc3"];
Acc4 [description = "Acc4"];
Acc5 [description = "Acc5"];
}
network Users {
color = "#F0FFF0"
description = "End Devices"
Acc1;
Acc2;
Acc3;
Acc4;
Acc5;
Endpoints [description = "Laptops/Phones\nCameras/APs"];
}
}
@enduml
Μεσαίου σχεδιασμού site σημειώσεις:
@startuml Large Site Template
skinparam backgroundColor #FEFEFE
title Large Site Template (500+ users)
nwdiag {
internet [shape = cloud];
network Internet_Edge {
color = "#FFE4E1"
description = "INTERNET EDGE MODULE"
internet;
ISP_A [description = "ISP-A"];
ISP_B [description = "ISP-B"];
MPLS [description = "MPLS"];
Edge_RTR [description = "Edge-RTR"];
FW_A [description = "FW-A"];
FW_B [description = "FW-B"];
}
network Internal_Edge {
color = "#E6E6FA"
description = "INTERNAL EDGE MODULE"
FW_A;
FW_B;
IntEdge_A [description = "IntEdge-A"];
IntEdge_B [description = "IntEdge-B"];
WLC [description = "WLC"];
Proxy [description = "Proxy"];
VPN [description = "VPN"];
DNS [description = "DNS"];
}
network Core {
color = "#B0E0E6"
description = "CORE MODULE"
IntEdge_A;
IntEdge_B;
Core_A [description = "Core-A"];
Core_B [description = "Core-B"];
}
network Dist_Var1 {
color = "#98FB98"
description = "L3 Adjacent"
Core_A;
Core_B;
Dist_1 [description = "Dist-1"];
Access_1 [description = "Access"];
}
network Dist_Var2 {
color = "#DDA0DD"
description = "MCLAG Trunk"
Core_A;
Core_B;
Dist_2 [description = "Dist-2"];
Access_2 [description = "Access"];
}
network Dist_Var3 {
color = "#FFE4B5"
description = "MCLAG Trunk"
Core_A;
Core_B;
Dist_3 [description = "Dist-3"];
Access_3 [description = "Access"];
}
network Datacenter {
color = "#87CEEB"
description = "SPINE/LEAF DC"
Core_A;
Core_B;
Border [description = "Border-Leaf"];
Spine [description = "Spine"];
Leaf [description = "Leaf"];
Servers [description = "Servers"];
}
}
@enduml
Μεγάλες σημειώσεις σχεδιασμού site:
Όταν τα τμήματα πρέπει να επεκτείνονται μέσω πολλαπλών βαθμίδων, κάθε όριο L3 προσθέτει τη διαμόρφωση γενικά:
@startuml Multi-VRF Path Through Tiers
skinparam backgroundColor #FEFEFE
title Multi-VRF Traffic Path: Camera to NVR
nwdiag {
network Camera_Segment {
address = "VLAN 120\n10.2.36.0/24"
color = "#FFDAB9"
description = "VRF: SECURITY"
Camera [description = "Camera"];
Access_SW [description = "Access-SW\nSub-int: 10.2.0.40/30"];
}
network Access_to_Dist {
address = "10.2.0.40/30"
color = "#DDA0DD"
description = "VRF: SECURITY"
Access_SW;
Distribution [description = "Distribution\nSub-int: 10.2.0.24/30"];
}
network Dist_to_Core {
address = "10.2.0.24/30"
color = "#B0E0E6"
description = "VRF: SECURITY"
Distribution;
Core [description = "Core\nSub-int: 10.2.0.8/30"];
}
network Core_to_IntEdge {
address = "10.2.0.8/30"
color = "#E6E6FA"
description = "VRF: SECURITY"
Core;
Internal_Edge [description = "Internal-Edge\nSub-int: 10.2.0.0/30"];
}
network IntEdge_to_FW {
address = "10.2.0.0/30"
color = "#FFE4E1"
description = "VRF: SECURITY"
Internal_Edge;
Firewall [description = "Firewall\nInter-VRF Policy"];
}
network DC_Path {
address = "VXLAN/EVPN"
color = "#87CEEB"
description = "Datacenter Fabric"
Firewall;
Border_Leaf [description = "Border-Leaf"];
Spine [description = "Spine"];
Leaf [description = "Leaf"];
NVR [description = "NVR"];
}
}
@enduml
Configuration πάνω κεφαλής:
Στόχος του modular network design είναι η δημιουργία ενόςεπαναλαμβανόμενο μοτίβοαυτό επιτρέπει:
| Scale | Sites | Pattern | |-------|-------|---------| | Small | 10,000+ | Collapsed UTM + single switch, /24 per site | | Medium | 1,000+ | Edge + MCLAG distribution + access, /21 per site | | Large | 100+ | Full modular (Edge, Internal Edge, Core, Distribution variants, DC fabric), /13-/15 per site |
Με την καθιέρωση αυτών των προτύπων και την εφαρμογή τους με συνέπεια, οι οργανισμοί μπορούν να κατασκευάσουν δίκτυα που κλιμακώνονται από ένα και μόνο γραφείο τμήματος σε μια παγκόσμια επιχείρηση, διατηρώντας παράλληλα επιχειρησιακή απλότητα και στάση ασφαλείας.
Άρθρο έκδοση 2.0