Backbone axis, peer networks & centralized management
The 9 architecture models are organized in 2 main connection directions, the backbone axis (vertical layering) and peer networks (cross-connection), together with centralized management instead of managing each device separately.
3 linked parts of one technology solution
Vertical layered connection, with one main axis running through the system
The 4 models below share one principle: traffic passes through one central axis (the core switch, the headquarters hub or the Spine layer) before branching out. This is easy to control and easy to extend with new branches without redesigning the main axis.
| Model | Core technology | Benefits | Redundancy |
|---|---|---|---|
| Single office | Collapsed Core architecture: firewall and core switch at one point, with access/wireless layers below | Lowest investment and operating cost, fast to deploy, and sufficient for small and medium offices | Firewall and core switch as an HA pair, 2 ISP lines |
| Multi-floor / multi-building | Layered architecture (Core-Distribution-Access): central core switch, with floor/building switches linked back by fiber when copper limits are exceeded | Incidents are isolated by area, and adding a floor/building does not affect the overall system | Central core switches as an HA pair; losing the link to one floor/building does not affect the others |
| Multi-branch | SD-WAN/site-to-site VPN, with policies synchronized from the central hub down to each branch | Centralized operations and monitoring across many locations, with security synchronized across the whole system | Each branch has a backup WAN line; the SD-WAN hub at headquarters is also redundant |
| With a data center | Spine-Leaf architecture for many racks: each Leaf connects to every Spine via Layer 3 (BGP/OSPF) + ECMP | Even bandwidth between racks, with no bottleneck at one point as in a traditional layered architecture | Tier III/IV standard, UPS + generator N+1/2N |
Cross-connection, with no rigid hierarchy
The 3 models below do not depend on a single central axis. Devices/layers at the same level share connections or data directly, which reduces single points of failure and improves local fault tolerance.
| Model | Core technology | Benefits | Redundancy |
|---|---|---|---|
| Ring Backbone | Ring Protection protocol + centralized switch management through one controller; switches are connected in a closed ring instead of a star | High availability at lower cabling cost than a fully redundant star, and easy to add switches into the ring | Any single cable cut causes no interruption: traffic reroutes automatically, usually recovering in under 50 ms |
| Fully integrated security (Fabric) | API/telemetry integration that shares threat data and policies between firewall, switch, AP and endpoint | Faster incident detection and response because data is shared across all layers, with no manual work on each device | An anomaly detected at any layer automatically isolates the related device/network segment across the whole system |
| High-density wireless | Separate network zones per area + AP density calculated by simultaneous devices, with intelligent roaming between APs | A stable experience even with many users, and overload in one area does not affect other areas | Smooth roaming between APs when one AP fails |
Neither backbone nor peer: it is about where the infrastructure sits and where it is accessed from
These 2 models address a different question: whether infrastructure is on site or in the cloud, and whether staff access it from the office or remotely. They can be combined with any backbone or peer network above.
| Model | Core technology | Benefits | Redundancy |
|---|---|---|---|
| Cloud-first / no dedicated server room | SD-WAN/VPN connecting the office directly to cloud infrastructure (SaaS/IaaS), with no on-site server room | No investment or operating cost for a server room, with flexible scaling to usage | 2 high-speed Internet lines from independent carriers; no large UPS/generator needed as there are no on-site servers |
| Remote work / Hybrid | Client-to-site VPN or a ZTNA agent on each employee's device, with no limit on access location | Staff access securely from anywhere, and adding staff needs no additional physical sites | Multiple VPN/ZTNA gateways at once, with load balancing between gateways as connections grow |
For the reasons for each choice, how COREIT implements it and application examples for each model, see the page Architecture models.
Centralized management, not device by device
Whichever model you choose, COREIT designs it so each infrastructure layer is managed from one point, reducing manual work and configuration errors and detecting incidents earlier.
| Infrastructure layer | Centralized management approach | Benefits |
|---|---|---|
| Switch / core network | One controller provisions and synchronizes configuration for all switches (Switch Fabric), or merges several switches into one control plane (virtual stacking, usually 4-8 physical switches); the network is segmented automatically by policy (Software-Defined Access) | No need to log in to each switch to configure it; changes synchronize instantly across the whole system, reducing manual configuration |
| Wireless | Manage all access points through one cloud or on-premises platform | Deploy or change policies for hundreds of access points at once, with no manual configuration of each point |
| Multi-layer security | Synchronize firewall-switch-AP policies on one platform (see also the Fabric security model under Peer networks) | Fewer manual configuration errors, and faster incident detection and response |
| Server infrastructure (HCI) | Combine compute + storage + network on the same x86 server cluster, managed centrally through a single piece of software | Less operational complexity than managing SAN/NAS, servers and network separately |
| Operations monitoring | Real-time centralized monitoring of all network devices, servers and lines; automated configuration backup, backup health checks and scheduled security patching | Early warning before users are affected, and less reliance on manual work |
The specific monitoring tool is chosen based on the customer's existing infrastructure (the equipment vendor's own platform or an independent centralized monitoring tool); we do not impose a fixed tool.
New technologies worth watching
These are developing trends in enterprise network infrastructure. COREIT follows them continuously and advises adopting them when they fit each customer's size and budget, rather than imposing new technology in every case.
- SASE (Secure Access Service Edge) — converging SD-WAN and security (firewall, ZTNA, anti-malware) into one cloud-delivered service, suited to businesses with many branches or remote staff who want fewer separately managed devices.
- AIOps for network operations — using AI/machine learning to analyze logs and telemetry, detecting anomalies and predicting incidents before they happen, instead of only alerting after a fault occurs.
- Wi-Fi 7 (802.11be) — simultaneous multi-band operation (Multi-Link Operation), reducing latency and improving stability at high device density; current spectrum regulations in Vietnam must be checked before deployment.
- Private mobile networks (Private 5G/CBRS) — suited to large campuses or factories needing steadier coverage than traditional Wi-Fi; currently fit for only a few cases in Vietnam that have the budget and site.
- Post-quantum cryptography — new encryption standards that equipment vendors are gradually building into VPNs/firewalls to prepare for the long-term risk from quantum computers; not yet a mandatory requirement for most businesses today.
The technology and protocol names above follow vendor publications and regulations in force at the time of writing (August 2026). COREIT selects specific equipment models at the time of the survey and actual implementation.
Need a deeper technical discussion?
If you are a CTO or IT Manager and want to discuss the architecture directly, send a request and COREIT's engineering team will respond.
A technology or outsourcing company? See the dedicated solution page →