Networks, Topologies and Devices

A network links devices so they can exchange data and share resources. Opening a shared folder, printing a document and loading a website all involve devices communicating, but they do not all follow the same path.

Devices, links and rules

Each connected device is a node. An endpoint creates or receives the data: a laptop, phone, server, printer or camera. An intermediary device, such as a switch, router, access point or firewall, moves or controls data between endpoints. A server remains an endpoint even when it serves hundreds of clients.

A network interface card (NIC) provides a device’s wired or wireless connection to a medium. Copper Ethernet cable carries electrical signals; fiber-optic cable carries light and suits longer links or places with electrical interference. Wi-Fi, cellular and Bluetooth use radio. A laptop can have both a wired interface and a wireless interface.

Devices follow protocols, agreed communication rules. Ethernet handles wired local links, Wi-Fi handles wireless local links, Internet Protocol (IP) carries packets between networks, and Hypertext Transfer Protocol Secure (HTTPS) secures web requests. Following common rules lets equipment from different manufacturers work together. Data travels in smaller units with source and destination addresses: frames on local links and packets across networks.

Two addresses with different jobs

An ordinary Ethernet MAC address has 48 bits, shown as six pairs of hexadecimal digits. An interface has a manufacturer-assigned address, but software can use a locally assigned address. Many phones and laptops use private Wi-Fi MAC addresses that differ between networks. Moving a laptop to another office usually changes its IP address; its wired MAC normally stays the same. Do not treat a MAC address as an unchangeable identity for a whole computer.

Capacity, achieved rate and delay

Bandwidth is a link's maximum data rate. Throughput is the rate actually achieved. Latency is travel delay, usually measured in milliseconds. A wide link can still have a long delay, and competing traffic can reduce throughput without changing the advertised bandwidth.

Network rates use bits per second: 1 Mbps is 1,000,000 bit/s, and 1 Gbps is 1,000 Mbps. File sizes use bytes: 1 byte is 8 bits. Lowercase b and uppercase B matter.

For a 1 GB file on a 100 Mbps link:

1. Convert bytes to bits: $\mathrm{1,000,000,000}\times 8=\mathrm{8,000,000,000}$ bits.
2. Divide by the rate: $\mathrm{8,000,000,000}÷\mathrm{100,000,000}=80$ seconds.
3. At 1 Gbps the same ideal transfer takes 8 seconds. Overhead and shared traffic make real transfers longer.

A 100 Mbps link therefore carries at most 12.5 MB per second, not 100 MB per second. Also separate Wi-Fi from internet access: Wi-Fi joins the local network; a router and internet service provider (ISP) supply the route beyond it. Local printing can still work during an internet outage.

Network names often describe reach and ownership. Start with the devices and sites being joined, then ask who runs the links. A connection's speed alone will not tell you its network type.

From one person to distant offices

These are practical categories with approximate boundaries. A university can own a CAN between its buildings and lease a WAN connection to a research site in another city. A fast WAN remains a WAN. The internet joins networks globally and has no single owner; it is often described as the largest WAN.

Two other labels answer different questions. A storage area network (SAN) is named for its job of connecting servers to shared storage. Small office/home office (SOHO) describes a small setup, often built around one all-in-one internet router.

How distant sites connect

A leased line supplies a dedicated point-to-point connection with fixed bandwidth. A provider's Multiprotocol Label Switching (MPLS) network or Metro Ethernet can also link business sites. Business broadband can use digital subscriber line (DSL) over telephone wiring, cable over the television network, or fiber to the premises. Cellular 4G/5G and satellite reach places where fixed connections are difficult and can provide backup links.

A virtual private network (VPN) adds an encrypted tunnel over another network, often the internet. The physical connection still comes from an internet service provider; the tunnel protects the traffic between its ends. Software-defined WAN (SD-WAN) manages multiple WAN links centrally and chooses suitable paths for applications. For example, an office can have fiber and cellular links, with application traffic directed according to link conditions.

Why a high rate can still feel slow

A geostationary satellite is about 35,786 km above the equator. A request travels up and down, and the reply travels up and down again. Even the shortest such round trip covers roughly 143,000 km. At about 300,000 km/s, signal travel alone takes about 0.48 seconds, or 480 ms. Equipment and the rest of the route add more delay.

Low-Earth-orbit satellites are much closer and have lower travel delay. This comparison concerns latency, not the number of bits a service can carry per second. A large download and a live voice conversation can therefore experience the same satellite connection quite differently.

A service can be requested from a central system or shared directly by the computers that use it. These two arrangements change how accounts, files and backups are managed. The roles belong to software, so the shape of the computer case tells you little about the sharing model.

A client asks; a server provides

In client-server networking, clients request services from dedicated servers. A web browser is a client of a web server. An office computer can request a shared folder from a file server and send a job through a print server. Email, databases and central sign-in are other common server roles.

A directory and authentication server, such as Microsoft Active Directory, holds accounts and checks logins. A Dynamic Host Configuration Protocol (DHCP) server hands out network addresses. A Domain Name System (DNS) server resolves names, such as "example.com", to addresses. One physical machine can run several services, while one busy service can be spread across several machines.

Server hardware is designed for reliability and many users, but a desktop can run server software. Likewise, a cloud service remains client-server: the browser requests the service from the provider's servers.

Sharing between peers

In peer-to-peer (P2P) networking, each computer can request services and provide them. Three people might share folders and a printer from their own computers. The shared folder depends on the computer hosting it: switch that computer off and its folder becomes unavailable.

In a Windows workgroup, each computer holds its own accounts. If one person uses several computers, those accounts must be managed separately. In a domain, a directory holds accounts centrally. An administrator can disable one central account when an employee leaves.

Choose from the work people need to do

A dental practice starts with four PCs sharing a printer and a folder. Peer-to-peer is simple at that size. At 25 staff, patient records need controlled access, accounts must be removed centrally and backups must run every night. A client-server arrangement, using local servers or suitable cloud services, makes those tasks manageable.

Centralization also concentrates responsibility. If one server supplies a vital service, its failure interrupts that service unless there is redundancy. Redundancy keeps a service available through a failure; backups restore earlier data after loss or damage. An organization can need both.

Some applications mix arrangements. A video-call service may use central servers for sign-in and finding other users, then send media directly between participants. Describe the role of each part instead of assuming every connection in an application follows one model.

A topology describes which devices have links to which other devices. The physical topology describes equipment and cables. The logical topology describes how data moves. Read the connections, not the outline a diagram happens to form on a page.

Follow the links and the possible failures

Early coaxial Ethernet used a bus. Modern wired local area networks (LANs) commonly use stars and extended stars. Rings remain useful in provider fiber networks. In a hub-and-spoke wide area network (WAN), "hub" means the central site, not an old Ethernet hub device.

A star is easy to expand because a new endpoint needs one cable and a spare central port. It also makes a cable fault easy to contain. Its center is still a single point of failure. A partial mesh spends more on selected links to keep important routes available.

Count full-mesh links once

With five sites, each site connects to four others. Multiplying gives 20 link ends, but every link was counted at both ends. Divide by two:

Here $n$ is the number of nodes and $L$ is the number of undirected links. Five sites need 10 links and four ports per site. Ten sites need 45 links and nine ports each. This rapid growth makes a full mesh costly; most networks reserve extra links for the places that need them most.

Physical and logical arrangements can differ

An old hub can sit at the center of physically star-shaped cables. It repeats every incoming signal to the other ports, so all devices hear the shared traffic: logically it behaves like a bus. Token Ring equipment could also use star-shaped cabling while passing data around a logical ring.

A modern switch learns destinations and sends known unicast traffic along the relevant link, giving a logical star. Real systems often combine designs: each branch office has a star, the branches join headquarters as spokes, and headquarters has a partial mesh. That combination is a hybrid topology.

A large campus becomes easier to grow when switches have clear roles. A hierarchical design separates endpoint connections, policy decisions and high-speed transport. These are jobs in the network, not floors in a building.

Three roles

An uplink carries traffic from an access switch toward the rest of the network. The distribution layer collects many such connections. It is the usual place to decide whether traffic may cross from one internal network to another. The core then transports traffic between distribution blocks. Keeping detailed filtering at distribution avoids slowing the backbone with unnecessary processing.

Grouping equipment by role also limits disruption. An access-switch failure affects its attached devices, while other access switches can continue working. Adding another access block grows the network without redesigning every connection.

Two tiers when the campus is smaller

A collapsed core combines distribution and core roles in one pair of switches. This uses fewer devices and costs less, making it useful for one building with several floors or a smaller campus. It leaves less expansion room and fewer redundancy options than separate distribution blocks and a core.

A very small office with one switch needs no formal tiers. At the other end, a campus with many buildings benefits from three tiers. Choose the architecture by the number of blocks, the traffic they exchange and the growth needed. A switch on a middle floor is not necessarily a distribution switch; it might simply connect desks on that floor.

Work through a redundant design

Suppose three buildings each have four floors, with one access switch per floor:

1. There are $3\times 4=12$ access switches.
2. Each access switch has one uplink to each member of its distribution pair.
3. The total is $12\times 2=24$ uplinks.

If one distribution switch fails, the access switches still have the other uplink and the other distribution switch. If an access switch itself fails, its endpoints still lose their immediate connection. Redundant uplinks protect the paths above the access switch; they do not replace that switch.

A switch decides which local link should carry a frame. It learns from traffic instead of needing a technician to enter every endpoint address. This makes it more efficient than an old hub, which repeats each signal to every other port.

Learn the source, forward to the destination

A switch stores a media access control (MAC) address table that maps interface addresses to ports. On receiving a frame, it learns the source address on the incoming port, then looks up the destination address.

Flooding leaves out the incoming port. It stays within the frame's VLAN. Unused table entries age out; 300 seconds is a common default, allowing the table to follow moved or disconnected devices.

Start with an empty table, PC A on port 1, B on port 2 and C on port 3. A sends to B. The switch learns A on port 1 but has not learned B, so it floods to ports 2 and 3. C discards the frame because it is addressed to B. B replies: the switch learns B on port 2 and already knows A, so it sends only to port 1. Later A-to-B frames can go only to port 2.

Shared signals versus separate links

A hub makes all endpoints share bandwidth and take turns sending: half duplex. Simultaneous sending causes collisions. Each switch port provides a separate link and normally runs full duplex, sending and receiving at the same time without collisions. The devices still share broadcasts within their VLAN, called a broadcast domain.

An unmanaged switch works without configuration. A managed switch offers settings and monitoring for VLANs, port security, power and traffic statistics. Businesses use managed switches to control and observe their networks.

Separate logical networks and supply power

A VLAN divides a physical switched network into separate logical local area networks (LANs), such as staff, guest and cameras. Different VLANs need routing to exchange traffic. A Layer 2 switch forwards by MAC address; a Layer 3 switch also routes by Internet Protocol (IP) address between VLANs and subnets.

Power over Ethernet (PoE) carries power and data on the same cable, useful for phones, cameras and access points. Switch-side limits and device-side power differ because cable resistance consumes some energy:

Check both a port's supported standard and the switch's total budget. A switch with enough ports can still lack enough power for all connected devices.

A switch finds a local destination port; a router finds a path to another Internet Protocol (IP) network. The router looks at a packet's destination IP address and consults a routing table. Its interfaces attach to different networks.

Decide whether the destination is local

A laptop has address 192.168.10.25 on network 192.168.10.0/24. For this /24 network, the first three numbers identify the network. Its default gateway is 192.168.10.1.

1. A print request to 192.168.10.40 stays on the same network and travels through the switch to the printer.
2. A request to the web server 203.0.113.80 is for another network.
3. The laptop sends that packet to its default gateway, the router interface on its local network.
4. The router chooses the next step toward the server.

A routing table lists destination networks with a next hop or an exit interface. A default route supplies a next hop when no more specific route matches. With neither a matching route nor a default route, the router drops the packet. The laptop's default gateway and the router's default route are related settings on different devices, not interchangeable names for one setting.

Routers separate ordinary local broadcast domains. They also reduce a packet's time to live (TTL) by one at every routed hop and discard it at zero, preventing endless circulation in a routing loop.

A router and a line terminal do different work

A small office/home office (SOHO) wireless router combines a router, a small switch, an access point, a firewall, a Dynamic Host Configuration Protocol (DHCP) address service and network address translation (NAT). NAT lets private devices share a public internet address. Some boxes also include the modem. Wi-Fi comes from the access-point function, not from routing itself.

Follow an internet request

A home laptop sends a web request over Wi-Fi to the access point in the combined box. The router forwards toward the provider, NAT translates the private source address, and the modem or ONT carries the traffic onto the provider's access link. The internet service provider (ISP) and other routers deliver it onward to the web server. Reply traffic returns through the edge device to the laptop; its wider internet path can differ from the outward path.

Business edge routers may terminate virtual private network (VPN) tunnels, use two providers for resilience, and apply quality of service (QoS) to favor delay-sensitive traffic such as voice. A Layer 3 switch is common for fast internal routing, while an edge router offers the wide area network (WAN) interfaces and services needed at the provider boundary.

A wireless access point (AP) joins Wi-Fi devices to a wired local area network (LAN). It bridges wireless frames onto Ethernet through its switch connection. Users recognize the wireless network by its service set identifier (SSID), the name shown in their device's Wi-Fi list.

Build coverage around wired connections

A standalone AP does not route between networks. A home wireless router contains both an AP and a router, which can hide the distinction. Business networks usually put separate APs where users need coverage and cable them to managed switches. Power over Ethernet (PoE) can supply each AP through that same cable.

Radio coverage depends on walls, building materials, distance and interference. One AP might serve a few rooms or an open area; a crowded room may need more capacity even when signal strength is good. Set neighboring APs to nonoverlapping channels to limit interference between their transmissions.

Several APs can offer the same SSID and security settings across a building. As a person walks, the phone can roam to another AP. Consistent settings support this movement, while coverage and client behavior still affect the handoff. Full signal bars describe the radio connection to the AP, not the speed or availability of the internet beyond it.

Manage several access points

Central management can apply SSIDs and security consistently and adjust channels and transmit power. It reduces the work of repeating changes at many devices.

Where cabling is impossible, mesh APs and range extenders relay traffic wirelessly. That wireless backhaul also consumes airtime, so additional hops usually reduce throughput. A wired backhaul carries AP traffic directly to the switch without using Wi-Fi airtime for those relay hops.

Keep staff and guests separate

Use Wi-Fi Protected Access 3 (WPA3), or WPA2 where older equipment requires it. Personal mode uses a shared passphrase. Enterprise mode checks individual user logins through an authentication server, allowing one person's access to be removed without replacing everyone's shared password. Wired Equivalent Privacy (WEP) is broken and unsuitable for staff access.

Consider an office with an AP on each of three floors. Each has a wired PoE connection to the floor's switch. All offer "Office" for staff and "Guest" for visitors. Staff traffic maps to the staff virtual LAN (VLAN), while guest traffic maps to a separate VLAN with rules allowing internet access and blocking internal resources. A second SSID supplies a name; the VLAN assignment and traffic rules provide the actual separation.

A firewall controls traffic between networks or zones using rules. Rules can inspect source, destination, protocol and port. A port identifies a service endpoint, such as Transmission Control Protocol (TCP) port 443 for secure web traffic.

Match the protection to the traffic

A network firewall protects a zone; a host firewall protects one device. A laptop's host firewall still matters when the laptop leaves the office. Together they provide defense in depth, with protection at more than one point.

Work through an ordered rule list

Many network firewalls use first-match processing: inspect rules from top to bottom and stop at the first match. Unmatched traffic receives the default policy, commonly an implicit deny. Processing rules differ between products; for example, Windows Defender Firewall gives explicit blocks precedence over allows and normally allows outbound traffic.

Use a first-match firewall with default deny and these rules:

1. Allow TCP 443 from any source to web server 203.0.113.10.
2. Deny all traffic from 198.51.100.0/24.
3. Allow TCP 22 from administrator 198.51.100.7 to that web server.

The administrator's TCP 22 request reaches rule 2 first and is denied. Rule 3 never gets a turn. Moving the specific administrator allowance above the broad denial lets that connection through. The same administrator's TCP 443 request matches rule 1 and is allowed. A request from 192.0.2.50 to TCP 25 matches none of the rules and reaches default deny.

Separate exposed services from internal work

A screened subnet, also called a demilitarized zone (DMZ), holds public services such as a web server. It sits behind rules that distinguish the outside internet, the public-service zone and the internal network. If the public server is compromised, internal resources still have a separate controlled boundary.

An intrusion detection system (IDS) inspects a copy of traffic from a mirror port or network tap and raises alerts. An intrusion prevention system (IPS) sits inline and can drop traffic as it crosses. Both can use signatures of known attacks or detect behavior that differs from a normal baseline. Signatures need updates; anomaly detection can find unfamiliar attacks but also raises false alarms.

A false positive flags harmless traffic; a false negative misses a real attack. False positives in an inline IPS can interrupt legitimate users. A unified threat management (UTM) appliance combines functions such as firewall, IPS, scanning, filtering and virtual private networking (VPN). Protection still needs several layers: permitted web or email traffic can carry harmful content.

Network appliances add services around the basic switching and routing path. Choose an appliance by the job it performs. A physical box and a virtual machine can perform the same network function.

Share requests and relay them

A load balancer distributes requests across a server pool behind a shared virtual address. It checks server health and stops selecting a failed server. With round robin across S1, S2 and S3, requests 1 through 7 go to S1, S2, S3, S1, S2, S3 and S1. If S2 fails its health check, new requests alternate between S1 and S3. Least connections is another method: choose the server with the fewest active sessions.

A forward proxy acts for users making requests to the internet. It can filter websites, cache content and log access. A reverse proxy acts for servers receiving requests, handling tasks such as encryption, caching or load distribution. A content delivery network (CDN) keeps copies at many locations so users receive content from nearby servers, reducing delay and origin-server load.

Connect sites or remote users securely

A virtual private network (VPN) carries network traffic through an encrypted tunnel over a public network. A site-to-site VPN joins networks through gateways. A remote-access VPN joins one user's device to the organization. A VPN concentrator or headend terminates many remote-user tunnels.

A full-tunnel setup sends the device's internet traffic through the tunnel. A split-tunnel setup sends selected company traffic through it and lets other traffic use the local internet connection. A forward proxy relays an application's requests; that is a different job from tunneling network traffic. Check which traffic a VPN is configured to carry before predicting its route.

Files, disk blocks and electrical power

NAS commonly uses Server Message Block (SMB) or Network File System (NFS) file protocols. A SAN can use Fibre Channel or Internet Small Computer Systems Interface (iSCSI) over Ethernet. Users see a shared folder on NAS; a server sees a block volume from the SAN. The difference is the access presented, not simply how many drives are in the cabinet.

Business servers are often rack-mounted and run several virtual machines. Network functions such as firewalls, routers and load balancers can also run as virtual appliances. Put the switches, router and firewall on protected power as well as the servers: a running server cannot serve users through a powered-off switch. A load balancer keeps new requests away from failed servers, but it does not restore deleted data; backups serve that purpose.

A small business network has a chain of connected roles. The provider line ends at a modem or optical network terminal (ONT). A router and firewall protect the edge. A main switch joins the servers and storage to access switches, which attach desks, printers, cameras and wireless access points (APs).

Connect a device to the right place

A typical wired path is device → patch cable → wall outlet → permanent wall cable → patch panel → patch cable → switch port. The patch panel terminates fixed cabling; it does not switch traffic. Fixed devices that need steady performance, including storage, printers, cameras and APs, are good candidates for wired connections.

Mobile devices join the wireless local area network (WLAN) using the staff network name, or service set identifier (SSID). Use Wi-Fi Protected Access (WPA3, or WPA2 for older compatible equipment). Disable Wi-Fi Protected Setup (WPS), especially its vulnerable PIN method. Give printers, cameras and other fixed peripherals reserved or fixed Internet Protocol (IP) addresses so their users can keep finding them.

Work out a power budget

A switch has a total Power over Ethernet (PoE) budget of 370 W. It reserves 30 W for each of six PoE+ APs and 15.4 W for each of four cameras.

1. AP allocation: $6\times 30=180$ W.
2. Camera allocation: $4\times 15.4=61.6$ W.
3. Total allocation: $180+61.6=241.6$ W.
4. Remaining budget: $370-241.6=128.4$ W.

Four more 30 W devices need 120 W and fit. Five need 150 W and do not. These are the switch-side reservation figures; delivered device power is lower. Free ports alone do not show whether more powered devices will work.

Prepare and test the connection

Change default logins, update firmware, disable unused services and place cameras and smart devices on a separate virtual LAN (VLAN). A network video recorder (NVR) receives camera recordings; voice over IP (VoIP) phones, access-control devices and metering devices are other common networked peripherals.

Check the physical link light. On Windows, ipconfig shows the IP address, mask and default gateway; ip addr on Linux and ifconfig on macOS show interface addresses. A Windows device set for Dynamic Host Configuration Protocol (DHCP) that automatically assigns itself a 169.254 address has not obtained a DHCP address. Check its cable or Wi-Fi connection and the DHCP service. Use ping to test the gateway, then an internet address or name; a blocked ping can also prevent a reply.

A staff laptop printing to a printer on its own subnet uses AP → switch → printer. For a cloud portal, the path continues through the main switch, firewall/router, provider terminal and internet service provider (ISP) toward the cloud. A home router added without planning can introduce another address service and an extra network; a managed AP is the appropriate way to extend business Wi-Fi.

A data center houses servers, storage and networking with cooling, physical security and redundant power. An organization can operate its own facility, rent space for its equipment through colocation, or use a cloud provider's facilities. The network must connect both users to services and services to each other.

Racks and traffic directions

A standard 19-inch rack has 482.6 mm-wide front panels. Equipment height uses rack units: 1U = 44.45 mm, and a common full-height rack holds 42U. A top-of-rack switch connects the servers in its own rack; end-of-row switches collect server cables from a row of racks.

North-south traffic enters or leaves the data center, such as a user's website request. East-west traffic moves between its servers, such as a web server querying a database or storage copying data to another server. These names describe relationships, not compass directions on a floor plan.

Build predictable paths between servers

In spine-and-leaf networking, servers connect to leaf switches, and every leaf connects to every spine. In the basic design, leaves do not connect directly to other leaves and spines do not connect directly to other spines. Traffic between servers on different leaves takes leaf → spine → leaf.

With four spines and eight leaves, the design needs $4\times 8=32$ leaf-to-spine links. A server on leaf 2 can reach leaf 7 through any of the four spines. Losing one spine leaves three such paths. Adding a leaf supplies more server ports; adding a spine supplies more capacity between leaves. The consistent path length suits heavy east-west traffic, which can take longer paths through a traditional campus hierarchy.

Several computers inside one host

Server virtualization runs several virtual machines (VMs) on one physical host. Each VM has its own operating system. A hypervisor allocates the host's resources and provides the virtual hardware the VMs use.

A virtual switch connects VMs inside the host and connects them to the physical network through the host's network interfaces. Two VMs on the same virtual switch can exchange traffic without using a physical switch, so control may be needed inside the virtual network.

A container packages an application and its dependencies while sharing the host operating-system kernel. It is generally smaller and starts faster than a VM with its own operating system. Docker is a familiar container platform.

Network functions virtualization (NFV) runs functions such as routers and firewalls as software on standard servers. Software-defined networking (SDN) separates the control plane, which decides traffic paths, from the data plane, which forwards traffic. A central controller coordinates those decisions across the network.

Cloud computing supplies shared computing resources on demand over a network. Resources can be provisioned and released quickly, and usage is measured. The important choice is which tasks the provider handles and which tasks remain with the customer.

What makes a service cloud computing?

The National Institute of Standards and Technology (NIST) identifies five characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. A customer can request resources without waiting for someone to install hardware, reach them over the network, and adjust capacity from a shared pool. Measurement makes usage and charges visible.

Service models divide the work

Amazon EC2 and Azure Virtual Machines are IaaS examples. Azure App Service and Google App Engine are PaaS examples. Microsoft 365 email and Salesforce are SaaS examples.

The shared responsibility model keeps physical facilities and underlying provider infrastructure with the provider. Customers remain responsible for their data and who can access it. An unpatched operating system on an IaaS VM is the customer's task. A SaaS customer does not patch the provider's application but still removes departed users and sets access rights. Backup coverage and retention also need to match the customer's needs.

Deployment models describe who uses the cloud

A public cloud serves many customers on provider infrastructure. Multitenancy shares physical hardware while isolating customers' resources logically. A private cloud serves one organization; it may be on-premises or hosted elsewhere. A hybrid cloud joins private or on-premises resources with a public cloud so workloads and data can be shared. A community cloud serves organizations with common needs. Multicloud means using more than one public provider.

A privately hosted cloud and an on-premises server room are therefore different ideas. "Private" describes the cloud's dedicated audience, not its street address.

Increase capacity and follow demand

Scalability is the ability to grow capacity. Vertical scaling uses a larger machine; horizontal scaling adds more machines. Elasticity adds and removes resources automatically as demand changes.

A web shop normally runs two servers. A sale triggers eight more, bringing the total to ten; afterward those eight are removed. Adding more servers is horizontal scaling, and automatically adding and removing them with demand demonstrates elasticity. Cloud use replaces large hardware purchases with continuing usage costs and fast provisioning. On-premises equipment offers direct control of hardware and data location, and local services can remain available during an internet outage.

A virtual private cloud (VPC) is a logically isolated network inside a public cloud. Azure calls its corresponding service a virtual network, or VNet. The customer chooses address ranges, divides them into subnets and controls the routes and filters between resources.

Separate public entry points from private services

Consider a VPC with range 10.0.0.0/16. Its public subnet, 10.0.1.0/24, holds a public-facing load balancer. Its private subnet, 10.0.2.0/24, holds application servers and a database.

A public subnet has a route to an internet gateway. An internet-facing resource also needs suitable public addressing and rules that allow the traffic. A private subnet has no direct internet route to its resources. Its servers can still make outbound connections through a network address translation (NAT) gateway, for example to download updates. That gateway allows the initiated connections' replies without giving internet clients a direct way to start connections to the private servers.

Putting the database behind a private boundary keeps public visitors at the entry point. The application reaches the database over an allowed internal path. The labels "public" and "private" describe routing arrangements; they must agree with addresses and rules to produce the intended access.

Apply filters at the right level

Security groups attach to instances or network interfaces. Network access control lists (ACLs) apply at subnet boundaries. Provider behavior differs; in Amazon Web Services (AWS):

For a simple web/database setup, allow TCP port 443 into the web server's group from public visitors. Allow database TCP port 3306 only from members of the web server's group. The database rule limits the source to the web tier; it does not grant all internet visitors the same access. Combine these filters with private routing and keep the database without a public entry path.

Join the office to the cloud

A site-to-site virtual private network (VPN) encrypts traffic between the office gateway and cloud network over the internet. It is quick to establish and relatively inexpensive, but depends on the internet's variable speed and delay. Individual remote users use a remote-access VPN.

A dedicated private connection, such as AWS Direct Connect, Azure ExpressRoute or Google Cloud Interconnect, avoids the public internet and provides more predictable bandwidth and latency. It costs more and takes longer to arrange. "Private connection" identifies the transport path; do not infer an encryption guarantee from that name.

For the web-shop design, the public load balancer accepts visitors, private servers fetch updates through NAT, and administrators use the office-to-cloud VPN. Keeping those three paths separate makes it possible to describe exactly who can initiate each connection.

A network diagram turns a set of devices and links into a view a technician can use. Choose the view that answers the question: where something is installed, which network it belongs to, how traffic travels, or how much rack space it occupies.

Choose the right drawing

Layer 1 drawings emphasize cables and ports. Layer 2 drawings emphasize switches, VLANs and trunks, links carrying multiple VLANs. Layer 3 drawings emphasize routers, subnets, Internet Protocol (IP) addresses and gateways. Physical and logical details can also appear in combined drawings, so read the labels and legend.

Decode symbols and labels

Common conventions show a router as a circle with arrows, a switch as a flat box, a firewall as a brick wall, an access point (AP) with radio waves, and a server as a tower or rack device. A cloud hides the internal detail of an internet or provider network. Solid lines often mean wired links; dashed lines can mean wireless links or virtual private network (VPN) tunnels. The legend decides the meaning in that drawing.

A name such as "HQ-SW-02" identifies the second headquarters switch. In common Cisco notation, "Gi1/0/2" names a GigabitEthernet port, while "Te1/1/1" names a 10-gigabit port. Labels such as "1G" or "10G" show link speed; "192.168.20.0/24" identifies a subnet, and "VLAN 20 Guest" gives a logical network's number and purpose.

Trace one complete path

A drawing connects Internet → FW1 → CORE-SW → ACC-SW1 → AP1. The switch trunk carries Staff VLAN 10 and Guest VLAN 20. Server SRV1 is on CORE-SW in VLAN 30.

A guest phone's internet path is phone → AP1 → ACC-SW1 → CORE-SW → FW1 → Internet. To decide whether it can reach SRV1, check routing and firewall policy between VLAN 20 and VLAN 30. Sharing a physical switch path does not grant permission between separate networks.

Count rack space

A 42U rack has $42\times 44.45=\mathrm{1,866.9}$ mm of mounting height. Two 1U patch panels, two 1U access switches, a 1U firewall, a 1U router, two 2U servers, a 2U storage unit and a 2U battery unit use:

$2+2+1+1+4+2+2=14$ U.

That leaves $42-14=28$ U of total mounting space. The elevation shows where that free space lies. Check the drawing's date, version and as-built status before relying on it for a change.

Useful records let another technician understand the installation without guessing. Update them as the network changes and keep a copy accessible during an outage. A technically correct installation also needs a handover that users can follow.

Keep records with clear jobs

An asset inventory records each device's make, model, serial number, location, firmware or software version, licenses and warranty. Include lifecycle milestones, especially the dates security fixes and technical support end. An end-of-life announcement begins a lifecycle process; it does not necessarily end updates that day.

IP address management (IPAM) records subnets and addresses that are assigned, reserved or free. It helps prevent duplicate allocation and shows where fixed devices such as printers and cameras can be found. Keep the address plan consistent with the devices actually installed.

Label both ends of each cable, plus the patch panel and outlet. A cable map joins those labels to the service. One row might read: outlet "2.14" → panel B port 14 → switch ACC-SW2 port 14 → VLAN 10 → printer PRN-2F. A technician can then identify the correct port without pulling cables to discover their ends.

Record the installed result and each change

As-built documentation shows what was actually installed, including changes made during the work. The original plan records intent; the as-built record supports later maintenance. Change management records and approves changes before they happen. Back up device configurations and retain a known-good baseline so a failed change can be reversed.

For a printer moved to another outlet, update its location, cable-map row and affected drawing. Check that the address record and switch-port information still match. A single correct entry among several contradictory records wastes time during an outage.

Interpret a service promise

A service-level agreement (SLA) sets measurable targets such as availability and response time. To translate annual availability into downtime, first find the unavailable fraction. For a 365-day year:

$365\times 24=\mathrm{8,760}$ hours.

At 99.9% availability, the unavailable share is 0.1%, or 0.001:

$0.001\times \mathrm{8,760}=8.76$ hours.

At 99.99%, it is 0.01%, or 0.0001:

$0.0001\times \mathrm{8,760}\times 60=52.56$ minutes.

Read the contract's measurement period and exclusions when applying an SLA to a real service. Availability is different from how quickly the provider first responds to a fault report.

Hand over the service in plain language

A short user guide explains which staff or guest Wi-Fi name to join, how to connect, how to add the relevant printer, the password rules and whom to contact. Walk users through the tasks and check that they can perform them. Give a user a useful instruction such as "Join Office and sign in with your staff account."

Keep administrator passwords and device logins in a protected password manager or vault. They do not belong in a user guide or on a diagram. Store an outage-accessible copy of the technical records, such as a printed rack folder or a protected copy outside the network it describes.