The Missing Manual
⌘K
← Back to guide / Phase 0
Updated Jun 19, 2026

Designing an Enterprise Network

You already understand a home network. One router does everything: it hands out addresses, it connects every device to every other device, and it is the single door to the internet. That design is perfect for a dozen devices and one household that trusts each other. The moment you have hundreds of machines, several departments who should not see each other's traffic, services the public must reach, and an outage that costs real money - that one-router picture quietly stops working, and usually it stops working at the worst possible time.

This guide is about the leap. Not "buy a bigger router," but the handful of design ideas that let a network hold up: how you carve it into pieces so one bad day doesn't become a bad week, how you keep it standing under load and through hardware failure, and how you build an edge that lets the world reach what it should while keeping it firmly away from what it shouldn't. You'll come out able to reason about a real network's shape - to look at a diagram and know why each box is where it is.

We assume you're comfortable with addresses, DNS, and ports. If any of that is fuzzy, the related guides at the bottom will steady you first.

How to read this

  • Designing or reviewing a real network right now? Each phase stands on its own - jump to the one you need. But the order is the argument: segmentation makes scaling sane, and both make the security edge possible.
  • Want it to finally make sense? Read in order. We build one network across three phases, adding a layer of design thinking each time, and every phase ties back to the one before it.

The phases

  1. Segmentation - why you carve one big network into pieces. Subnets and a calm take on CIDR and address planning, VLANs for separating departments on shared hardware, and the real prize: a problem in one zone stays in that zone.
  2. Scaling & Reliability - keeping it up under load. Load balancers that spread traffic, redundancy so no single cable or box can take you down, and the quiet infrastructure services (DHCP, internal DNS) every real network leans on.
  3. Security & the Edge - the perimeter and beyond. Firewalls and stateful filtering, the DMZ that holds public-facing services apart from your insides, VPNs for secure remote access, and a nod to zero-trust - the modern admission that the perimeter alone was never enough.

Deliberately deferred to follow-up guides: routing protocols (OSPF, BGP), spanning-tree and switch-loop mechanics, SD-WAN, and vendor-specific configuration. This guide gives you the design model; those guides give you the machinery.

Related guides