Skip to content
Log in Sign up My account

2.3 Multicampus Layer 3 Infrastructure

Blueprint 2.3: Multicampus Layer 3 infrastructure

  • 2.3.a Convergence
  • 2.3.b Load sharing
  • 2.3.c Route summarization
  • 2.3.d Route filtering
  • 2.3.e VRFs
  • 2.3.f Optimal topologies
  • 2.3.g Redistribution

When a company has several campuses, or several buildings that act like separate campuses, the routing design decides how stable the network is, how traffic is shared, and how far a failure spreads. Protocol mechanics are covered in ENCOR and ENARSI. This page is about where to apply them. Useful companions are OSPF multiarea, EIGRP stubs, summarization, redistribution and VRF-Lite.

A hierarchy that matches the addressing

Scalable routing needs the same hierarchy in the routing protocol and in the address plan. Each building gets a contiguous block, each campus gets a contiguous block of blocks, and the boundary router summarises.

graph TB
  subgraph "Campus A"
    A1["Bldg A1 dist<br/>10.1.0.0/20"]
    A2["Bldg A2 dist<br/>10.1.16.0/20"]
    AC["Campus A core<br/>summary 10.1.0.0/16"]
    A1 --- AC
    A2 --- AC
  end
  subgraph "Campus B"
    B1["Bldg B1 dist<br/>10.2.0.0/20"]
    BC["Campus B core<br/>summary 10.2.0.0/16"]
    B1 --- BC
  end
  AC --- DC["Data centre and WAN edge"]
  BC --- DC

2.3.a Convergence

Convergence time is the sum of detection, propagation and calculation.

Phase What shortens it
Detection Fast link-down on fibre, BFD for failures that keep the link up, see 2.1
Propagation Small areas and routing domains, summarisation that hides internal flaps, LSA and update pacing set to modern values
Calculation Few prefixes to compute, stubs and totally stubby areas, EIGRP stubs that cut queries, incremental SPF where available
FIB programming Platform dependent. Prefix-independent convergence, where available, programs many prefixes with one pointer change

Design practices that help in any protocol:

  • Use point-to-point network types on routed links so OSPF skips DR election and neighbours come up fast.
  • Use equal-cost paths. When a link fails, traffic shifts to the surviving next hop already in the FIB, with no recalculation. Triangles give this, squares do not.
  • Use passive interface on user-facing links. Fewer adjacencies means fewer events.
  • Authenticate and tune neighbours, but do not set timers lower than the platform can sustain.

Exam trap

Summarisation improves stability but delays reaction to some failures. If the summary stays advertised while a more-specific prefix is down, remote routers keep sending traffic into the summarising router, which may drop it. For this reason summarise at the boundary, but understand what the router does with traffic to a missing more-specific destination.

2.3.b Load sharing

Mechanism Behaviour Design note
ECMP Splits flows across equal-cost next hops by a hash on addresses and ports Per-flow, not per-packet. A single large flow stays on one path
EIGRP variance Uses feasible successors with unequal metrics in proportion Useful when two paths differ in bandwidth. Requires feasibility
Link bundling Parallel links as one logical link Use for adjacent devices
Per-VLAN or per-subnet gateway split Different gateways active for different subnets Layer 2 and FHRP level, see 2.1
PBR or traffic engineering Policy decides the path Last resort, adds state and operational load

Bandwidth must be sized so one path can carry the traffic of both after a failure. Two 10 Gbps links shared at 8 Gbps each is not redundant, because one failure leaves 16 Gbps of demand on 10 Gbps. That oversubscription arithmetic is a favourite exam setup.

Exam trap

ECMP load-shares per flow using a hash. It does not guarantee even distribution when there are few flows or one elephant flow. "Per-packet" balancing risks reordering and is rarely the answer for TCP traffic.

2.3.c Route summarization

Summarisation is the most important Layer 3 stability tool. It reduces routing table size, keeps changes local, and shortens convergence for remote parts of the network.

Protocol Where to summarise Notes
OSPF At the ABR between areas (area range) and at the ASBR for external routes (summary-address) Cannot summarise inside a single area. Needs contiguous addressing per area
EIGRP Any interface, with ip summary-address eigrp (classic) or summary-address (named mode) Also limits query scope, so it stops stuck-in-active spreading
IS-IS Level 1 to Level 2 boundary Level 1 areas are stub-like by default
BGP aggregate-address at the edge Use summary-only to suppress specifics when appropriate

Placement for a campus: summarise from the building (distribution) toward the core, and from each campus toward the WAN and data centre. The core then holds one prefix per building or campus.

Pitfalls:

  • Discontiguous addressing makes summaries impossible or unsafe. Fix the addressing plan first.
  • Black holes. A summary that covers prefixes that do not exist attracts traffic that has nowhere to go. A Null0 discard route for the summary prevents loops. EIGRP and OSPF install this automatically on the summarising router.
  • Suboptimal routing. If a prefix is reachable through two summarising routers but only one is closer, the summary hides that. Tolerate it or add a more-specific prefix.
  • Dual-homed summarisation. If a campus has two exits and both advertise the same summary, a failure of one exit's downstream link may not be reflected remotely. Design the topology so the summarising routers have a link between them.

2.3.d Route filtering

Filters control which routes cross a boundary. The reasons are security, scale and loop prevention.

Tool Use
Prefix list The preferred match for prefixes, fast and readable
Distribute list Applies a prefix list or ACL to routing updates. Works at the protocol level
Route map Combines match and set. Used with redistribution, BGP policy and PBR
Route tags Mark routes at one point and match elsewhere, the basis of safe redistribution
Stub areas and EIGRP stubs Filter by design. Stubs remove external or transit routes structurally
OSPF area filter-list, EIGRP offset and prefix filters Boundary-specific tools

Where to filter:

  1. At the campus boundary, so one campus does not leak a failed or private prefix into another.
  2. Inbound from partners and acquired networks, accepting only expected prefixes.
  3. At the redistribution point, to block feedback of routes into the protocol they came from.

Link-state protocols have a limit: you cannot hide routes inside an area, since every router has the same database. Filtering between OSPF areas relies on area boundaries and filter lists. Distance-vector and path-vector protocols can filter at nearly any hop.

Exam trap

A distribute list in OSPF filters what is installed in the local routing table, not what is in the LSDB. It does not stop the LSAs being flooded, so other routers still learn the route. Real filtering between OSPF areas needs ABR features, such as filter lists or area range with not-advertise.

2.3.e VRFs

VRFs create separate routing tables on one physical device. In a multicampus network they provide segmentation for guests, IoT, building systems, tenants or merged organisations.

Approach How it works Scale and fit
VRF-Lite VRFs on each hop, each link carries a VLAN per VRF (trunk or subinterfaces) with a routing instance per VRF Few VRFs (a handful) and few hops. Operationally heavy as VRFs and links grow
MPLS L3VPN in the campus MP-BGP and labels carry many VRFs over one core Many VRFs and many sites. Needs MPLS skills and platform support
SD-Access virtual networks Overlay VRFs managed by Catalyst Center Large segmentation with simple operations. See 2.4
GRE or other tunnels per VRF Tunnels carry each VRF across a core Small scale and a core that cannot be changed

Design notes:

  • The shared services (DNS, DHCP, internet access, security tools) usually live in a separate VRF or the global table. Reaching them from user VRFs needs route leaking or a firewall in a fusion role.
  • Every extra VRF multiplies configuration, routing instances, and troubleshooting. Add a VRF for a real separation requirement, not for convenience.
  • If separation must be enforced, put a firewall between VRFs. Route leaking creates connectivity, not inspection.
vrf definition GUEST
 address-family ipv4
 exit-address-family
!
interface TenGigabitEthernet1/0/1.200
 encapsulation dot1Q 200
 vrf forwarding GUEST
 ip address 10.99.1.1 255.255.255.252

2.3.f Optimal topologies

Topology Properties Verdict
Triangle (each distribution to both cores) Two equal-cost paths, a failure leaves a local alternate Preferred
Square or ring Failure may need routing reconvergence, uneven load Avoid where possible
Full mesh of buildings Many links and adjacencies, poor scale Only for tiny sites
Hub-and-spoke through a core Simple, predictable, easy to summarise Typical for multicampus
Dual core with cross-connect Each distribution pair connects to both core switches Standard campus core 
graph LR
  subgraph "Triangle"
    D1["Dist"] --- C1["Core 1"]
    D1 --- C2["Core 2"]
    C1 --- C2
  end
  subgraph "Square"
    X1["Dist 1"] --- Y1["Core 1"]
    Y1 --- Y2["Core 2"]
    Y2 --- X2["Dist 2"]
    X2 --- X1
  end

Principles that make a topology optimal:

  • Every Layer 3 device has two equal-cost paths toward every destination.
  • The core is not a policy point. It forwards fast, and policy and summarisation happen at the distribution layer.
  • Place the services and exits at the edge of the core, not hanging off one building, so every campus reaches them with similar paths.
  • Do not make the core a transit for unrelated campuses unless required, because a failure in one campus then affects others.

2.3.g Redistribution

Redistribution moves routes between routing domains, for example a merged company with OSPF in one campus and EIGRP in another, or static routes and BGP into an IGP.

Rules of safe redistribution:

  1. Prefer one point of redistribution. With two or more points a route can leave one protocol, enter the other, and return through the second point as a worse or looped path.
  2. If you need two points (for redundancy), tag and filter. Tag routes at the point where they are injected and deny those tags at the other point. See route tags and loop prevention.
  3. Control metrics and metric types. Seed a deliberate metric, and choose OSPF E1 or E2 to match whether internal cost should count.
  4. Mind administrative distance. EIGRP external routes have AD 170 while OSPF has 110. A route can be pulled to a worse protocol path if the ADs are mismatched in a two-way design.
  5. Redistribute the minimum. Prefer a default route in one direction and summaries in the other over the whole table.
  6. Do not redistribute connected or static blindly. Use route maps with prefix lists.

Exam trap

Mutual redistribution at two points without tags or filters is the classic design that creates routing loops or suboptimal paths. The correct fix is not to raise or lower AD everywhere. It is to tag and filter at the redistribution points, or reduce them to one point with a default route.

Design exercise

Scenario. A manufacturer has two campuses, each with a collapsed core pair and four buildings. Campus 1 runs OSPF (everything in area 0, 2,000 routes). Campus 2, from an acquisition, runs EIGRP. A pair of routers connects the campuses and the data centre. Requirements: a failure in one building must not cause SPF runs in the other campus, convergence for a core link failure under a second, the guest and OT networks must be isolated end to end, and the two routing domains must exchange routes with no loops. The addressing is already contiguous per building.

Model answer

Hierarchy: move Campus 1 to a multiarea OSPF design with each building as its own area (totally stubby where the building only needs a default) and the core in area 0. The ABRs on each building distribution pair summarise the building block. Campus 2 summarises from each building distribution toward the core with EIGRP interface summaries and EIGRP stubs at the access.

Convergence and load sharing: triangles from each building distribution to the two core switches with point-to-point links, BFD on the routed links, and ECMP. Size each core link so that one can carry the load of two.

Interconnect: a single pair of boundary routers redistribute between OSPF and EIGRP. Because there are two routers, tag routes from each protocol on injection and deny the tags on the other router. Send only summaries across, and a default route toward the campus that does not need the full table.

Segmentation: guest and OT as VRFs. With only two VRFs and a simple core, VRF-Lite on the routed links is reasonable. If the VRF count were to grow, plan an overlay or MPLS L3VPN. Enforce guest and OT isolation with a firewall at the shared-services edge.

Rejected alternatives:

  • Keep everything in area 0. Any building flap forces SPF everywhere and nothing can be summarised.
  • Full redistribution of both tables in both directions. Large tables on both sides and a loop risk without tags.
  • Raising AD to resolve loops. It treats a symptom and breaks again when topology changes.
  • Leaking guest into the global table for convenience. It defeats the isolation requirement.

Quick check

Why does an OSPF distribute list not stop a route from being learned by other routers in the area?

It only filters what is installed in the local routing table. The LSAs still flood and exist in the LSDB, so other routers learn the route.

What makes a triangle topology converge faster than a square after a link failure?

In a triangle the surviving equal-cost path is already in the FIB, so traffic shifts when the link goes down. In a square the failure usually needs a routing recalculation.

Two redistribution points exist between OSPF and EIGRP. What is the standard way to prevent loops?

Tag routes where they are redistributed and filter routes carrying that tag at the other redistribution point, using a route map.

References

  • Cisco Enterprise Campus design guides and the Campus LAN CVD: search on cisco.com
  • RFC 2328 (OSPFv2), RFC 4271 (BGP-4) at rfc-editor.org
  • Cisco EIGRP and OSPF design guides: search "OSPF design guide" and "EIGRP scalability" on cisco.com
  • Cisco Live On-Demand Library: search "routing design best practices" and "campus convergence"