Campus high availability is a system design problem that spans physical redundancy, Layer 2 loop prevention, first-hop gateway resilience, routed convergence, power, software, and operational change. The current 300-420 ENSLD v1.1 scope includes advanced enterprise campus design, so the important skill is choosing a failure model rather than memorizing isolated HSRP or spanning-tree commands.
Good designs first decide where Layer 2 ends and Layer 3 begins. That boundary determines whether a link failure is handled by spanning tree, EtherChannel, a first-hop redundancy protocol, or a routing protocol. Mixing several mechanisms without a clear demarcation often increases convergence time and makes outages harder to explain.
Design around explicit failure domains
List the components whose failure must not interrupt service: access switch, uplink, distribution switch, power supply, supervisor, routing adjacency, default gateway, and key services. Then map which redundant element protects each failure. “Dual-homed” is not enough if both uplinks terminate on one chassis or share the same fiber path.
Physical diversity should include power and cabling where the business requirement justifies it. Logical protocols cannot compensate for two links cut by the same construction work.
Define convergence objectives for common failures. A voice campus may have tighter loss tolerance than an office guest network. The architecture should match the application requirement rather than chasing the fastest possible timer everywhere.
Choose routed access or Layer 2 access deliberately
Traditional multi-tier campuses often extend VLANs from access switches to redundant distribution switches. Spanning Tree Protocol prevents loops, while HSRP, VRRP, or another first-hop redundancy mechanism provides a resilient default gateway. This design can support requirements for Layer 2 adjacency but introduces STP and FHRP convergence dependencies.
Routed access moves the Layer 3 boundary down to the access switch. Each uplink is routed, ECMP can use parallel paths, and STP is no longer the primary uplink convergence mechanism. This often simplifies failure behavior but may not fit environments that require VLANs to span access switches.
The choice should be based on endpoint and service requirements, operational skill, and platform capabilities—not a blanket rule that one architecture is modern and the other obsolete.
Use EtherChannel to reduce single-link failure impact
Link aggregation combines multiple physical links into one logical interface and can maintain connectivity when one member fails. LACP also provides negotiation that helps detect mismatched bundling. EtherChannel is particularly valuable where parallel links would otherwise be blocked by spanning tree.
Member links should have consistent speed, trunking, VLAN, and other relevant parameters. A partial bundle can create capacity loss without a total outage, so monitoring should track member state and utilization rather than only port-channel status.
Design hashing expectations realistically. One large flow normally remains on one member, so a four-link bundle does not make a single transfer four times faster. High availability and aggregate capacity are related but not identical benefits.
Align spanning tree roots with gateway placement
In Layer 2 access designs, traffic should not cross the distribution block unnecessarily because the spanning-tree root and active default gateway live on different switches. Align primary STP root placement with the active FHRP gateway where possible, then align secondary roles on the other distribution device.
Use Rapid PVST+ or MST according to scale and operational standards, and protect the topology with root guard, BPDU guard, and other controls where appropriate. Avoid tuning timers aggressively without validating every switch and link behavior.
Spanning tree should be boring. Frequent topology changes are an operational defect that needs root-cause analysis, not a normal condition to be hidden with logging filters.
Design first-hop redundancy for deterministic failover
HSRP and VRRP provide a virtual gateway so endpoint default-gateway configuration does not depend on one physical router or switch. Track critical uplinks or routing state where supported so the active gateway can relinquish its role when it has lost upstream connectivity but its local interface remains up.
Preemption policy should match operations. Automatic restoration to the original active device can be useful, but immediate failback after recovery may create a second traffic hit. Some environments intentionally delay or control preemption to allow the recovering device to stabilize.
Test ARP/ND behavior, stateful services, and application sessions during FHRP transitions. A fast protocol state change is only one part of the user experience.
Use routing and BFD for fast Layer 3 convergence
In routed-access or core designs, OSPF, EIGRP, or another IGP can reconverge around a failed path. Failure detection is often the first component of convergence time. Bidirectional Forwarding Detection can provide rapid liveness detection to routing protocols when the platform and design support it.
Aggressive detection must be backed by stable links and sufficient control-plane resources. False BFD failures on a congested or oversubscribed device can create more instability than slower routing timers would have produced.
Keep the routed topology simple enough that alternate paths are obvious. ECMP and summarization can provide fast, predictable failover when the addressing plan supports them.
Include software and maintenance in availability planning
Redundant hardware does not help if a software upgrade requires every chassis in the pair to restart together. Evaluate in-service software upgrade capabilities, stack or virtual-chassis behavior, maintenance procedures, and whether peers can run mixed versions during an upgrade window. Features such as graceful restart can reduce disruption during selected control-plane events, but they must be validated with the actual platform, protocol, and failure mode rather than treated as a substitute for redundant design.
Configuration change is another failure source. Stage changes, validate them on one failure domain where possible, and maintain rollback procedures. A synchronized configuration error can take down redundant devices at the same time, proving that logical duplication is not independent resilience.
Operational availability also depends on monitoring, backups, console access, and tested replacement procedures. Mean time to recover matters as much as mean time between failures.
Validate high availability with controlled failure drills
Pull one uplink, shut one distribution device, remove the active gateway, fail a routed adjacency, and simulate a power loss in a controlled environment. Measure packet loss, convergence time, path changes, and application impact. Compare the result with the stated service objective.
Capture baseline topology and protocol state before the test so the team can explain exactly what changed. A successful ping after failover does not prove there was no harmful micro-outage or asymmetric state.
Campus resilience comes from matching the redundancy mechanism to the failure domain. EtherChannel protects member links, STP protects Layer 2 loops and paths, FHRP protects the endpoint gateway, routing protocols protect Layer 3 paths, and physical design protects against real-world infrastructure loss. The architecture is strong when those mechanisms complement rather than fight each other.
Design observability around the user-visible convergence path
High-availability monitoring should correlate physical events with protocol events and application impact. A distribution uplink failure may trigger port-channel member loss, routing reconvergence, FHRP state changes, and a short burst of packet loss. Looking at any one log in isolation can make the event appear slower or faster than users actually experienced. That end-to-end view is what turns individual redundancy features into measurable campus resiliency.
Timestamp accuracy is essential. Synchronize switches, routers, wireless controllers, and monitoring systems so an incident timeline can show which event happened first. This is particularly valuable when a link flap causes both spanning-tree and routing changes and teams disagree about the root cause.
Track degraded redundancy, not only total failure. One failed power supply, one missing port-channel member, one standby gateway in an unexpected state, or one BFD session down can leave the network working with no safety margin. Alerting on those conditions gives operators time to repair them before the second failure becomes an outage.
Availability metrics should therefore include resilience state as well as reachability. A campus that is “up” but has lost every alternate path is not healthy. Treating degraded redundancy as a first-class operational condition keeps the architecture aligned with its design assumptions.
Wireless and wired convergence should be considered together. A campus may keep switching and routing available while a wireless controller path, DHCP service, or authentication dependency is lost. If the availability requirement is defined at the user-service level, those dependencies belong in the same failure analysis as access and distribution switches.
Layer 2 extension should be minimized across failure domains unless an application truly requires it. Stretching VLANs across buildings or sites can enlarge the impact of loops, broadcast problems, and spanning-tree changes. Where Layer 3 boundaries are possible, they often provide clearer fault containment and simpler path selection.
Operational runbooks should name the expected active/standby states for FHRP, spanning-tree root roles, port-channel members, and routed adjacencies. During an incident, engineers can compare observed state with a known healthy model instead of deciding on the fly whether a topology change is normal.
High availability also means capacity after a failure. If two distribution uplinks each run at 70 percent in normal conditions, losing one cannot move all traffic onto the other without congestion. Redundancy calculations must include N+1 bandwidth and hardware forwarding capacity, not only duplicate links.
Gateway and routing redundancy should be paired with DHCP, DNS, AAA, and controller resilience. Many campus incidents blamed on switching are actually service dependencies exposed by a network failover. If users move to a backup path but cannot renew an address or reach identity services, the campus is not functionally available even though every distribution switch is forwarding.
Design documentation should include the steady-state traffic path and the expected path after each major failure. That makes asymmetric routing visible before deployment, especially when stateful firewalls or service appliances sit near the campus core. A failover that sends outbound traffic through one appliance and return traffic through another may break sessions even when Layer 3 reachability is technically correct.
For stacked or virtualized distribution systems, understand which failures are local and which affect the logical pair. Shared control planes, stack links, and software defects can create common-mode failure that dual chassis diagrams do not show. Physical separation should be matched by control-plane and software risk analysis.