A business park, a school with annexes, a care home spread over four buildings: physically several buildings, organisationally one location. That is a different problem from branches in different cities, because here the fibre is yours and you need no provider and no tunnel.
One location or several
This is the first decision, and the tool nudges you into it politely. On the network board a location is a rectangle with its own address range, and the checks expect exactly one device with a router role inside it. A location with devices but no router raises a warning: nothing there gets a gateway or DHCP.
For a campus with its own fibre the answer is nearly always one location. One router in the building where the internet arrives, and switches and access points in the others. The fibre carries the VLANs on, tagged; the VLAN numbers, the SSIDs and the management VLAN are the same everywhere and come from the shared settings.
You only make several locations on one site when each building genuinely has to stand alone: its own router, its own address range, its own DHCP that keeps working when the fibre breaks. That is a routed design with a transit network in between, a different choice with different consequences; see Stretching layer 2 or routing.
Star or ring
A star is one central switch with a fibre to each building. Simple, predictable, one path per building. The central switch is a single point of failure, and a broken fibre takes one building out.
A ring runs from building to building and back to the core. Every building has two ways round, and a break costs no outage. Draw that ring on the board and the check reports that the closing cable makes a loop and that RSTP blocks one of the paths: it works, but it does not add speed. That wording is exactly right, because that is what a ring is: redundancy, not capacity.
A few rules apply to a ring: keep the number of buildings in it modest, set the bridge priority so the core becomes the root, and know that traffic between two distant buildings may in the worst case travel all the way round. Read Switches in a ring before you draw one.
SFPs and distances
The tool knows the type of port from the catalogue: copper (ether1), SFP at 1 Gbit/s (sfp1), SFP+ at 10 Gbit/s (sfp-sfpplus1), and up. What the tool does not know is which module you put in it, which fibre is in the ground and how long it is. That choice is yours, and these are the rules of thumb:
| Distance | Fibre | Module | Watch out |
|---|---|---|---|
| up to 300 m | multimode OM3/OM4 | SX (1G) or SR (10G) | Cheap, but OM3 and OM4 differ in reach at 10G |
| up to 10 km | single-mode OS2 | LX (1G) or LR (10G) | On a campus this is nearly always plenty |
| one fibre per link | single-mode OS2 | BiDi, in pairs | Always order in pairs: one end 1310/1550, the other the reverse |
| short, inside a rack | none | DAC cable | Cheaper than two modules, but a fixed length |
What the tool does do is check the cabling. Connect a copper port to an SFP port on the board and it says that needs a copper SFP module or a media converter. If the two ends differ in speed, it says the cable runs at the lower of the two. And when your internet subscription lands on a port that cannot carry it, it works out how much you lose and suggests a better port.
Fibre carries no power. An access point or camera in another building hangs off a switch there, and that switch needs power. Think of the UPS in the annexe, not only the one in the main cupboard. See Cables and power.
Where the router belongs
The router lives where the internet arrives, preferably the building with the best line and the best lock on the door. All the VLANs meet there, because that is where the addresses and the DHCP servers are.
The consequence: all traffic between two VLANs goes through that building, even when both devices sit in building D. That is normal and rarely a problem, as long as the fibre is not your narrowest link. If it is, that is a reason to put that one fibre on 10 Gbit/s, not a reason to put a router in every building.
In the site you give the switches in the other buildings the switch role and the access points the access point role. They get the same VLAN table to tag with, but without an address and without DHCP, and a management address counting on from the router's address in the management VLAN.
The rollout plan in one list
- Draw all the buildings as one location, with the router in the building where the line arrives.
- Draw the cable from the core switch to the switch in each building. Those two ports become trunks with every VLAN tagged, which is exactly what you want.
- Look at the cabling checks for a port used by two cables and for an unintended loop.
- Set the MTU the same everywhere. The tool compares it per cable and per connected network and names the two ports where the difference is.
- Generate, and keep the board. The drawing with the port names is the document you will need in three years.
Further reading: Switches in a ring, Checks about speed and FiberBox Plus.