Network design and availability: the capstone
Lesson 4 of 5
4Network design and availability: the capstone
The big pictureYou have reached the end of the path. Everything you learned, from the cable to BGP to the cloud, is a toolbox. Design is choosing from it what this business needs, and explaining why, in words the finance director understands: "this design stops at worst 52 minutes a year and costs this much; if we want 5 minutes, it costs that much".
What the picture shows: Top down: the business first, then the constraints (budget, time, team), then the design, then the numbers that back it, then the build in small changes with rollback.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
An architect does not draw a house before asking: how many people will live there? Will that grow? What is the budget? Is it an earthquake zone? Network design is the same: you ask about the business first, then you draw. And availability is a number: 99.9% means about nine hours of downtime a year, 99.99% about 52 minutes. Every extra "nine" costs more, so the question is always: how much does the business lose in an hour of downtime?
Availability in series: A × B (a chain weakens with every link). In parallel: 1 − (1 − A)(1 − B) (duplication strengthens). A failure domain: how many users are hit if one piece fails? Shrink it by splitting (sites, cloud zones, VLANs kept to one switch, routing instead of stretching layer 2). A tiered design (access, distribution, core) for a big campus, or a collapsed core for a medium one. Capacity planning: today's 95th percentile × yearly growth ^ years of the plan, upgrading when it passes 70%. Documents: an HLD (the picture and the reasons) and an LLD (addresses, ports, configs). Change: an MOP (method of procedure), a rollback plan, a maintenance window, pre and post checks, and CAB approval.
Before You Start
🏗️The branch project
You built a branch with no single point of failure.
🏭Data centres and cloud
The three earlier lessons of this stage.
The Core Idea
1Start with questions
Before any drawing, collect answers to these questions and write them on the first page of the design document. Every later decision must trace back to one of these lines.
| Question | Sample answer | What it decides |
|---|---|---|
| Which apps are critical? | Point of sale and stock | Where to duplicate and where to accept downtime |
| What does an hour down cost? | SAR 200,000 | How many nines are worth paying for |
| How many users, and growth? | 1200, and 20% a year | Capacity for five years |
| What are the constraints? | A budget and a team of 3 | Simplicity against flexibility |
| What regulation applies? | NCA controls and data kept in the Kingdom | Separation, logging and cloud region |
2Availability in numbers
Every piece has an availability. Pieces in series (the road needs all of them) multiply and drop. Pieces in parallel (one is enough) rise. That is why one switch at 99.9% is worse than two at 99% in parallel.
Notice the access switch stayed single in the second design: it is now the weakest link. Duplication is spent where it moves the number.
def series(*parts):
total = 1.0
for a in parts:
total *= a
return total
def parallel(*parts):
down = 1.0
for a in parts:
down *= (1 - a)
return 1 - down
def minutes_down(a):
return (1 - a) * 365 * 24 * 60
single = series(0.999, 0.999, 0.9995) # access, core, internet link, one of each
paired = series(0.999, parallel(0.999, 0.999), parallel(0.9995, 0.995)) # two cores, fibre + 5G
for name, a in (("one of everything", single), ("paired core and links", paired)):
print(f"{name:<22} {a * 100:.4f}% -> {minutes_down(a):6.0f} minutes down a year")
for nines in (0.999, 0.9999, 0.99999):
print(f"{nines * 100:g}% allows {minutes_down(nines):7.1f} minutes a year")3Failure domains and safe change
Duplication protects you from a piece failing, but a failure domain protects you from a mistake that spreads: a broadcast storm, a wrong config, a bad update. Keep each domain small: a VLAN on one switch instead of stretched across the building, routing between sites, and changes in batches. Every change is written as an MOP: the steps, the pre-check, the post-check, when and how to roll back, with no improvising at midnight.
4The capstone
This is your biggest project: a mid-sized company network with a head office, a data centre, two branches and a cloud region. You walk five phases, each with a practical condition. The output is a design document, a working lab and a ten-minute presentation.
The capstone: a whole company network
The made-up company: 1200 staff, downtime costs SAR 200,000 an hour, growth 20% a year. About four weeks at one to two hours a day.
1 · Requirements and numbers
- Goal
- A requirements page and a calculated availability target.
- What you do
- Answer the opening questions, work out how many nines are worth the cost, and mark the failure domains you accept.
- Done when
- Every later decision in the document points to a line of the requirements page.
2 · High-level design
- Goal
- The whole picture and its reasons.
- What you do
- A collapsed core at head office, a small spine-leaf in the data centre, SD-WAN for the branches, a cloud hub with a dedicated link and backup VPN, and an overlap-free IPv4 and IPv6 plan.
- Done when
- A colleague reads the document and answers "what if X fails?" for every box without asking you.
3 · The numbers
- Goal
- Numbers that back the design.
- What you do
- A script working out availability from the drawing, five-year capacity planning, and an estimate of link costs.
- Done when
- The calculated availability meets the target, and the weakest link is named and justified.
4 · The lab
- Goal
- A live slice of the design.
- What you do
- Build in containerlab: a small spine-leaf with EVPN, two BGP edge routers and a branch. Generate configs from a data file and run pre and post checks.
- Done when
- A failure-test table for every link and device, with numbers within the target.
5 · The presentation
- Goal
- Convince a non-technical and a technical listener.
- What you do
- Ten minutes: the problem, the design, the numbers, the cost and the remaining risks. Publish the document and the lab on GitHub.
- Done when
- The non-technical listener repeats the target and the cost back to you, and the technical one finds no failure point you did not mention.
Worked example
The task: the finance director asks: "why buy a second core switch for SAR 150,000?". Answer with numbers, given downtime costs 200,000 an hour.
The answer: one core switch at 99.9% means about 8.8 hours of expected downtime a year, about SAR 1.75 million of expected loss. Two in parallel: 1 − (0.001)² = 99.9999%, under a minute. The difference in expected loss is over 1.7 million a year against 150,000 once. Even if the availability figures are ten times too hopeful, the purchase still pays. Then state the limit: the second switch does not protect against a config mistake that spreads to both, which is what the change plan is for.
Myth vs Reality
| Myth | Reality |
|---|---|
| The best design uses the newest technology. | The best is the simplest that meets the requirements and that your team can run at 3 am. |
| 100% availability is possible if you pay enough. | Each extra nine costs many times the last, and human error remains. The target is a number the business can justify. |
| Documents are written after the build. | An HLD is written before buying and reviewed, then the LLD is built from it. Writing after the build is a description, not a design. |
Where you meet it at work
🏛️Network architect
Writes the HLD and defends it before management and security.
📋Change board
Reviews the MOP and rollback plan before any big change.
💰Budgeting
Availability and expected-loss figures justify every purchase.
Test your understanding
Two pieces in series at 99% each. What is the total availability?
In series they multiply: 0.99 × 0.99 = 0.9801.
The same two pieces in parallel?
1 − (0.01 × 0.01) = 0.9999.
Roughly how many minutes a year does 99.99% allow?
0.0001 × 525,600 minutes ≈ 52.6.
What protects against a spreading config mistake that duplication does not?
A mistake hits both copies if it is applied to both at once.
What does an HLD hold?
The fine detail lives in the LLD.
Quick review cards
Check Your Understanding
Why start the design by asking "what does an hour down cost?"
Because the answer sets how much duplication is worth paying for, and turns design into an understandable financial decision.
You duplicated everything except the access switch. What does that mean?
It is now the weakest link, and its failure domain is only the users on it; an acceptable call if documented and justified.
What must any change plan hold before approval?
The steps, the pre and post checks, the rollback trigger and method, the time window, and the expected impact.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.