Enterprise Network Architecture — HLD
This page provides the high-level view of Abhavtech's enterprise network — the infrastructure that the automation framework targets. It shows what Cisco components exist at each site tier across all three regions.
Scope
This is the network architecture (what exists on the wire). The automation toolchain that manages this infrastructure is covered in 2.2 Automation Architecture .
Architecture Overview
CLOUD SERVICES & MANAGEMENT PLANE
SaaS Applications
Microsoft 365
Salesforce · Box
Internet Breakout (DIA)
Webex Cloud (UC)
Calling — 3,200 users
Meetings · Messaging
Contact Center — 175 agents
Cisco Security Cloud
Umbrella SIG (DNS/SWG/CASB)
XDR · Duo MFA
FMC — NJ Primary / LON DR
Management Plane
DNAC — 6 nodes (NJ + LON DR)
ISE — 14 nodes (2 PAN + 12 PSN)
vManage — Cloud HA cluster
SD-WAN Controllers
vSmart × 2 (Route Policy)
vBond × 2 (Orchestration)
24 × cEdge (ISR4451/4351)
WAN TRANSPORT LAYER
SD-WAN IPsec Overlay
App-aware routing · QoS · FEC
MPLS (Primary)
Tata (APAC) · AT&T (US) · BT (EMEA)
Internet DIA
SaaS breakout · Tunnel backup
5G / LTE Backup
Branch failover — activated only on WAN outage
REGIONAL INFRASTRUCTURE — 19 SITES (6 Hubs + 13 Branches)
APAC REGION
Mumbai — Primary Hub
• SD-WAN Edge (C8500)
• SD-Access Border/CP
• FTD Firewall (FPR-4115 HA)
• ISE PSN × 2
• WLC C9800-80 (HA)
• C9300/C9500 Fabric
• Data Center (Primary)
Chennai — Secondary Hub
• SD-WAN Edge (ISR4451)
• SD-Access Border/CP
• FTD Firewall (FPR-2130 HA)
• ISE PSN × 2
• WLC C9800-40 (HA)
• C9300/C9500 Fabric
• Data Center (DR)
APAC Branches (3): Bangalore · Delhi · Noida
• SD-WAN Edge (ISR1100 / ISR4351)
• Fabric-in-a-Box (C9300-48UXM × 2)
• Extended Nodes (C9200) · APs (C9120AXI)
• 5G/LTE Backup · 802.1X via ISE PSN (hub)
SD-Access Fabric (All APAC Sites)
VN_CORPORATE · VN_VOICE · VN_GUEST · VN_IOT · VN_SERVERS
TrustSec SGTs enforced via ISE SGACL
LISP/VXLAN overlay · C9500 Border Nodes
EMEA REGION
London — Primary Hub
• SD-WAN Edge (C8500)
• SD-Access Border/CP
• FTD Firewall (FPR-4115 HA)
• ISE PAN (Secondary)
• ISE PSN × 2
• WLC C9800-80 (HA)
• C9300/C9500 Fabric
• DNAC DR Cluster (3-node)
Frankfurt — Secondary Hub
• SD-WAN Edge (ISR4451)
• SD-Access Border/CP
• FTD Firewall (FPR-2130 HA)
• ISE PSN × 2
• WLC C9800-40 (HA)
• C9300/C9500 Fabric
• FMC (Secondary)
EMEA Branches (5): Paris · Amsterdam · Dublin · Madrid · Milan
• SD-WAN Edge (ISR1100 / ISR4351)
• Fabric-in-a-Box (C9300) · APs (C9120AXI) · 5G/LTE Backup
• 802.1X via ISE PSN (hub) · TrustSec SGT enforcement
SD-Access Fabric (All EMEA Sites)
VN_CORPORATE · VN_VOICE · VN_GUEST · VN_IOT · VN_SERVERS
TrustSec SGTs enforced via ISE SGACL
LISP/VXLAN overlay · C9500 Border Nodes
AMERICAS REGION
New Jersey — Global HQ ★
• SD-WAN Edge (C8500)
• SD-Access Border/CP
• FTD Firewall (FPR-4115 HA)
• ISE PAN (Primary)
• ISE PSN × 2
• WLC C9800-80 (HA)
• C9300/C9500 Fabric
• DNAC Primary (3-node XL)
• FMC Primary · Data Center
Dallas — Secondary Hub
• SD-WAN Edge (ISR4451)
• SD-Access Border/CP
• FTD Firewall (FPR-2130 HA)
• ISE PSN × 2
• WLC C9800-40 (HA)
• C9300/C9500 Fabric
Americas Branches (5): Chicago · Seattle · LA · Atlanta · Denver
• SD-WAN Edge (ISR1100 / ISR4351)
• Fabric-in-a-Box (C9300) · APs (C9120AXI) · 5G/LTE Backup
• 802.1X via ISE PSN (hub) · TrustSec SGT enforcement
SD-Access Fabric (All Americas Sites)
VN_CORPORATE · VN_VOICE · VN_GUEST · VN_IOT · VN_SERVERS
TrustSec SGTs enforced via ISE SGACL · LISP/VXLAN overlay
VIRTUAL NETWORKS — SD-ACCESS SEGMENTATION (ALL SITES)
VN_CORPORATE
10.100.0.0/16 · SGT 10-19
Employee workstations
VN_VOICE
10.190.0.0/16 · SGT 20
VoIP · Webex endpoints
VN_GUEST
10.200.0.0/16 · SGT 40
Visitor — Internet only
VN_IOT
10.150.0.0/16 · SGT 50-70
Cameras · Sensors · OT
VN_SERVERS
10.180.0.0/16 · SGT 80-90
DC workloads · Dev servers
INFRA
10.252/16
Mgmt only
LEGEND & KEY INVENTORY
Primary Hub (C8500 Border · FPR-4115 · C9800-80 · ISE PSN)
Secondary Hub (ISR4451 Edge · FPR-2130 · C9800-40 · ISE PSN)
Branch (ISR1100/4351 SD-WAN · C9300 FiaB · C9200 Access · C9120 APs · 5G Backup)
NJ — Global HQ: DNAC Primary (3×XL) · ISE PAN Primary · FMC Primary
London — EMEA Hub: DNAC DR (3-node) · ISE PAN Secondary · FMC Secondary
SD-WAN: vManage (cloud HA) · vSmart ×2 · vBond ×2 · 24 cEdge routers
Total:
19 sites · 12,400 users · 238 C9300 access switches · 590 APs · 18 FTD firewalls · 14 ISE nodes · 6 DNAC nodes
Component Summary by Site Tier
Component
Global HQ (NJ)
Primary Hub
Secondary Hub
Branch
SD-WAN Edge C8500
C8500
ISR 4451
ISR 1100 / 4351
Firewall (FTD) FPR-4115 HA
FPR-4115 HA
FPR-2130 HA
—
SD-Access C9500 Border + CP
C9500 Border + CP
C9500 Border + CP
C9300 FiaB
Wireless C9800-80 HA
C9800-80 HA
C9800-40 HA
C9120 APs
Identity (ISE) PAN Primary + PSN×2
PSN × 2
PSN × 2
Via hub PSN
DNAC 3-node XL (Primary)
—
—
—
DNAC DR —
—
London only
—
FMC Primary
—
London (DR)
—
vManage Cloud HA cluster
—
—
—
WAN Backup MPLS + Internet
MPLS + Internet
MPLS + Internet
5G / LTE
Virtual Network Segmentation
All sites run the same SD-Access VN model. Inter-VN routing occurs only at Border Nodes. Policy enforcement is via ISE TrustSec SGACL.
Virtual Network
Subnet
VNI
SGT Range
Access
VN_CORPORATE
10.100.0.0/16
8001
10–19
Employee workstations
VN_VOICE
10.190.0.0/16
8005
20
VoIP · Webex endpoints
VN_GUEST
10.200.0.0/16
8002
40
Internet-only
VN_IOT
10.150.0.0/16
8003
50–70
Cameras · Sensors · OT
VN_SERVERS
10.180.0.0/16
8004
80–90
DC workloads
INFRA_VN
10.252.0.0/16
—
Mgmt
Network management
Next Step
See 2.2 Automation Architecture for how Terraform, Ansible, and Python manage this infrastructure through the automation control node.