Skip to content
IT Atlas

Architecture · Network Architecture

Network Architecture

The structural design of an organisation's networks: segmentation, routing, redundancy, edge services and policy enforcement points.

AdvancedUpdated 2026-09-01

Overview

Network architecture defines zones and their trust relationships, address space allocation, routing design, redundancy, and where inspection and policy are applied. It determines both resilience and how effective every security control can be.

A good design is legible: someone new should be able to read the diagram and predict how traffic flows between any two systems and which device enforces policy in between.

Sequence

Traffic path for a published application
  1. 1Client
  2. 2DNS resolution
  3. 3Edge / CDN
  4. 4Edge firewall
  5. 5Load balancer / reverse proxy
  6. 6Application segment
  7. 7Database segment

Each hop is a control point where policy, logging and inspection can be applied, or where an unnecessary flat path can undo the design.

Layer model

Edge
Internet circuits from diverse providersBorder routersDDoS protectionEdge firewallsPublished services in a DMZ
Core & distribution
Redundant layer 3 coreDistribution switches per building or floorRouted links with fast convergenceOut of band management network
Access
Access switches with 802.1XWireless access points and controllersVoice and IoT VLANsGuest network with isolated egress
Data centre & cloud
Server segments by functionEast west inspectionHybrid connectivity via VPN or private circuitCloud hub and spoke virtual networks

Design considerations

  • Allocate address space hierarchically per site and per environment so routing and policy can be summarised.
  • Place the default gateway for sensitive segments on a firewall so inter segment traffic is inspected by default.
  • Design a genuine out of band management network with its own access path, not a VLAN reachable from the user network.
  • Document expected flows so exceptions in firewall policy have a reference to be judged against.

Security considerations

  • Default deny between segments and on egress, with logging on denies.
  • Authenticate device access with 802.1X or NAC rather than trusting physical ports.
  • Restrict and monitor administrative access to network devices; use central authentication with MFA and unique accounts.
  • Collect flow data for east west visibility, not only perimeter logs.

Common misconfigurations

  • Flat layer 2 across an entire site.
  • Any/any rules between server segments 'to avoid application issues'.
  • Overlapping RFC 1918 ranges between sites and cloud networks.

Failure points

  • Single circuit, single edge device or single power feed presented as redundant.
  • Management network reachable from the user segment.
  • Asymmetric routing breaking stateful inspection after a partial failure.
  • Undocumented legacy links that bypass segmentation.