IT & Infrastructure
Networking · Campus, Wireless & Data Centre
SERVICE ENGINEERING GUIDE
A new campus, a congested wireless estate or a data-centre migration needs more than a switch configuration. We connect application requirements to topology, capacity, identity and resilience, then prove the result through a controlled rollout.
What we deliver in practice
Campus LAN & switching
Plan access, distribution and core layers; size PoE budgets and uplinks; implement VLANs, resilient gateways, QoS and routing. Select a collapsed core or three-tier campus according to site scale and failure domains.
Port schedules, VLAN/IP plan and tested resilient paths.
Enterprise Wi-Fi
Combine predictive planning with on-site RF validation. Tune channels, power and client density; separate corporate, guest and IoT access; validate authentication and roaming using the actual client devices and applications.
AP placement, survey heatmaps and roaming test records.
SD-Access / SDA & identity
Build the campus fabric with Catalyst Center and ISE integration where selected. Define virtual networks and group-based policy, prepare underlay dependencies and pilot device onboarding before extending the fabric across the site.
Fabric design, identity policy matrix and onboarding runbook.
Data-centre networking
Implement spine-leaf connectivity and application segmentation. For ACI, define tenants, VRFs, bridge domains, endpoint groups and contracts; for an EVPN-VXLAN fabric, plan the routing, overlay and external connectivity separately.
Fabric build book, application-flow mapping and migration waves.
Branches, WAN & operational visibility
Assess carrier diversity and SD-WAN policies around business applications. Configure secure branch connectivity, path selection, telemetry, alerts and configuration backups; rehearse link failure and recovery without assuming uninterrupted service.
Circuit and policy matrix, monitoring views and rollback plan.
The technology, explained
VLAN / VRF
A VLAN separates a Layer-2 network; a VRF separates routing tables. Neither replaces a complete access-policy design.
SD-Access / SDA
A policy-based campus fabric that combines automated provisioning, identity-aware segmentation and assurance. SDA and SD-Access describe the same Cisco approach.
ACI / APIC
Cisco ACI uses an application-policy model for a data-centre fabric; APIC is its policy controller. Policies must reflect approved application communication.
EVPN-VXLAN
VXLAN carries an overlay network over IP; EVPN can distribute endpoint reachability. It is a fabric approach with its own control-plane and routing design.
RF planning & roaming
RF planning balances coverage, interference and capacity. Roaming is a client moving between access points; results depend on both network configuration and client behaviour.
SD-WAN
Software-defined WAN applies centrally managed policies to branch connectivity and path selection. Link diversity and application behaviour still need physical and operational validation.
Reference architectures & design practices
Illustrative patterns for project discussions. Final topology, sizing, products and acceptance criteria are developed against your requirements. These are BrightGate concept diagrams, not vendor-certified designs.
01 / Resilient campus + Wi-Fi+
On smaller screens, scroll the diagram sideways to see all components.
A collapsed-core example for a building or smaller campus. Access switches have diverse uplinks; wireless access points connect at the access layer. Larger estates may need a separate distribution layer and site-specific routing boundaries.
Design practices to apply
- Select uplink capacity from traffic and growth.
- Separate guest, employee and device access.
- Agree recovery targets before selecting redundancy.
02 / SD-Access campus fabric+
On smaller screens, scroll the diagram sideways to see all components.
Management and identity services support the fabric; they are not user-traffic forwarding hops. Fabric edges provide access and policy enforcement, while border and control-plane roles connect and locate endpoints. Placement and redundancy are resolved in detailed design.
Design practices to apply
- Map identity groups to permitted application flows.
- Validate DNS, NTP, certificates and IP reachability.
- Pilot authentication before broad migration.
03 / Data-centre spine-leaf+
On smaller screens, scroll the diagram sideways to see all components.
Each leaf connects to both spines in this simplified fabric. Cisco ACI with APIC and a separately engineered EVPN-VXLAN deployment are alternative approaches, not interchangeable configurations. Server attachment, external routing and failure domains depend on the selected platform.
Design practices to apply
- Document permitted east-west application flows.
- Confirm optics, MTU and platform compatibility.
- Test external routing and a fabric-link failure.
04 / Connected branches+
On smaller screens, scroll the diagram sideways to see all components.
Branches use available transport paths under application-aware policy. Internet breakout, VPN access and data-centre connectivity are evaluated together; two circuits do not guarantee diversity unless their physical and provider dependencies are checked.
Design practices to apply
- Confirm carrier demarcation and routing ownership.
- Prioritise critical traffic with measurable criteria.
- Test failover and restoration in agreed windows.
Systems, products & official references
Examples to evaluate during scoping. Selection, supported features, hardware and licences depend on the agreed solution; a product mention does not imply a certification or an included purchase.
Cisco Catalyst + enterprise wireless
Campus switching and WLAN options; hardware sizing follows the survey and port/power requirements.
Official reference Cisco campus LAN & WLAN designCatalyst Center + Cisco ISE
Management and identity components for a selected SD-Access deployment.
Official reference Cisco SD-Access design guideCisco Nexus / ACI / APIC
Data-centre fabric and application policy components, subject to compatibility and licensing.
Official reference Cisco ACI design guideA result your team can accept
Acceptance evidence
Campus / WAN resilience
Link and device failure tests with measured restoration and application impact.
Wireless experience
Agreed coverage, capacity and roaming checks on representative devices.
Segmentation
Positive and negative access tests against the signed policy matrix.
View the complete capability checklist
- Campus LAN: access, distribution and core switching
- Enterprise wireless: RF surveys, capacity, roaming and guest access
- Data-centre fabrics: spine-leaf, Cisco ACI / APIC and EVPN-VXLAN
- Software-defined campus: Cisco SD-Access (SDA), Catalyst Center and ISE
- WAN and branches: SD-WAN, routing, VPN and resilient connectivity
- Network access control: 802.1X, segmentation and identity policies
- Network automation, telemetry and configuration assurance
- Fibre / copper connectivity, IP addressing, QoS and migration