Ask why a campus network has an "access layer" or why data centers abandoned the tree design entirely, and you're asking about topology architectures - CCNA exam objective 1.2 and, more usefully, the vocabulary every design conversation assumes you know. This guide covers the two-tier and three-tier campus models, spine-leaf in the data center, and where SOHO, WAN, and cloud designs fit.
Why architecture models exist
You could connect switches in any shape that links up. Architecture models exist because some shapes fail predictably: they contain broadcast storms poorly, they force traffic through chokepoints, and nobody can troubleshoot at 3 a.m. what nobody can draw. The hierarchical models give each device a defined role, which is what makes networks scalable and debuggable.
The three-tier campus model
Cisco's classic hierarchy, for large campuses (multiple buildings, thousands of users):
The design rule that makes it work: access never connects to access, and everything dual-homes upward (each access switch to both distribution switches, each distribution pair to both cores). Failure of any single box or link costs capacity, not connectivity.
The two-tier (collapsed core) model
Most networks are not giant. A two-tier design merges core and distribution into one redundant pair - the collapsed core - with access switches hanging off it. Same principles, one less layer of boxes to buy. This is the right answer for a single building or a small multi-floor campus, and it's the design you'll actually deploy most often in the mid-market. If the exam asks when two-tier is appropriate: when the network is small enough that a separate core adds cost without adding meaningful scalability.
Spine-leaf: the data center answer
Campus hierarchies optimize north-south traffic (users to servers/internet). Data centers flipped: most traffic became east-west (server to server - microservices, storage replication, VM migration). Spine-leaf optimizes for that:
- Every leaf connects to every spine. Leaves are top-of-rack switches where servers plug in; spines only interconnect leaves. Leaves never connect to leaves, spines never to spines.
- Predictable latency: any server to any server is exactly leaf-spine-leaf. Two hops, always.
- Scale horizontally: need more capacity? Add a spine. More racks? Add leaves. Bandwidth grows linearly, and equal-cost multipath (ECMP) load-shares across every spine simultaneously - no spanning-tree blocked links wasting half your uplinks.
This is the fabric underneath VXLAN overlays and Cisco ACI, and the "underlay" you keep hearing about in SD-WAN and SDN conversations - see our VLAN vs VXLAN explainer for what runs on top.
SOHO, WAN, on-prem and cloud
The remaining 1.2 sub-objectives are quick, but the exam does test them:
- SOHO: the small office/home office collapses every role - router, switch, AP, firewall - into one box. Architecturally interesting precisely because there is no architecture: all layers, one device.
- WAN: connects sites. Traditional MPLS hub-and-spoke gave every branch a private path back to HQ; internet VPN and SD-WAN mesh sites over commodity links with policy deciding per-application paths. Topologically: hub-and-spoke, full mesh, or partial mesh, trading circuit cost against branch-to-branch latency.
- On-prem vs cloud: the same tiers exist in the cloud, rebadged - a VPC is your distribution block, availability zones are your redundant pairs, and the provider owns the spine-leaf you never see. Hybrid designs connect your campus to that via VPN or dedicated interconnect, which makes the WAN design part of your LAN conversation.
Choosing: the decision in practice
FAQ
What is the difference between two-tier and three-tier architecture?
Three-tier separates access, distribution, and core into distinct layers; two-tier merges distribution and core into one "collapsed core" pair. Functionally identical policy and redundancy - the third tier only earns its cost when multiple distribution blocks (buildings) need interconnecting at scale.
Why doesn't spanning tree run the data center anymore?
STP prevents loops by blocking redundant links - in a spine-leaf fabric that would idle half the capacity you paid for. Spine-leaf runs routing (often BGP) to every leaf and uses ECMP to load-share across all spines at once. Loop prevention comes from the routing protocol, not from blocking ports. Campus access still uses STP, so learn both.
Can spine-leaf be used in a campus network?
The pattern appears in campus as routed access designs and in SD-Access fabrics, which borrow the underlay/overlay split. But classic campus traffic is north-south with policy at aggregation points, so two/three-tier remains the default answer - and the exam keeps spine-leaf associated with data centers.
What layer do firewalls and WLCs attach to?
Services attach where their traffic aggregates: internet edge firewalls beside the core or in a dedicated edge block, east-west/data-center firewalls at the DC boundary, and WLCs traditionally at distribution/services (with 9800s, often virtualized). The principle: policy devices sit at choke points the architecture already created.
How many devices before three-tier makes sense?
There's no magic number - the trigger is distribution blocks, not device count. When you have three or more distribution pairs (buildings/large floors) meshing to each other, a dedicated core turns N-squared inter-building links into N links to the core, and earns its boxes.
Key takeaways
- Three-tier = access, distribution, core; two-tier collapses core into distribution. Role separation is the whole point.
- Spine-leaf: every leaf to every spine, two hops between any two servers, ECMP instead of blocked links - built for east-west traffic.
- Redundancy is designed in pairs and dual-homing, so failures cost capacity rather than connectivity.
- Know the SOHO, WAN, and cloud framings - objective 1.2 lists them explicitly.
Related reading: VLAN, Subnet, and Broadcast Domain for what these layers segment, and the Network Fundamentals guide for the full domain-1 map.
