Office LAN Topology Diagram

A small company office with about sixty people needs internet access, wired desks, Wi-Fi for staff and guests, a few servers and some printers. This network topology diagram shows every device, every link and how VLANs split the network into zones. A second diagram adds redundancy.

1. The Diagram

1. Internet edge. The ISP hands off on a small /30 link to the edge router. Many offices merge router and firewall into one box; drawing them separately makes the responsibilities clear.
2. Firewall. All traffic in or out passes the firewall, which does NAT for the private address space, intrusion prevention and the remote-access VPN.
3. Core switch. A layer-3 switch is the default gateway for every VLAN and routes between them. It relays DHCP requests to the server VLAN.
4. Access layer. Yellow 802.1Q trunks carry several VLANs to each access switch. Ports facing PCs, phones and printers are access ports in a single VLAN; AP ports are trunks so each SSID lands in its own VLAN.
5. Segmentation. The coloured dashed zones are VLANs. Guest Wi-Fi (yellow) can reach only the internet; the policy box spells out that rule.

2. How to Read It

Topology diagrams are not UML: boxes are physical or virtual devices and lines are links, with no time order. Draw one box per device, label it with role and key address, and use zones for VLANs or sites.

Keep layers separate: this view shows physical devices and VLAN membership. IP addressing sits in the side box, and firewall rules belong in their own table. Putting everything on one picture is the fastest way to make it unreadable.

3. Variant: Redundant Core

The same office with no single point of failure: two ISPs, an active/standby firewall pair, a two-member core stack and access switches dual-homed with LACP. The trade-off is roughly double the hardware and a more complex failover test plan.

4. Pros, Cons, and When to Use

Pros

• One page explains the whole site to a new admin or auditor.
• Makes single points of failure visible.
• VLAN zones show the security segmentation at a glance.
• Doubles as cabling and change-management documentation.
• Works for non-technical readers when icons are simple.

Cons

• Goes stale quickly unless generated from inventory.
• Mixes L1, L2 and L3 unless you draw separate views.
• Does not show firewall rules in detail.
• Large sites need several pages or a zoomable tool.

When to use

• Site build-outs, audits, onboarding, incident runbooks.
• Planning VLANs, Wi-Fi coverage and uplink capacity.

When not to use

• Explaining a protocol exchange (use a sequence diagram).
• Cloud networks, where logical constructs matter more than boxes (see the VPC sample).

5. As Diagrams-as-Code

Graphviz (DOT), which handles layout for undirected topology graphs:

graph office {
  rankdir=TB; node [shape=box, style=rounded];
  internet [shape=ellipse, label="Internet (ISP)"];
  router  [label="Edge Router"];
  fw      [label="Firewall (NGFW)"];
  core    [label="Core L3 Switch"];
  internet -- router -- fw -- core;
  subgraph cluster_v10 { label="VLAN 10 Staff";  sw1 [label="Access SW 1"]; pcs; phones; }
  subgraph cluster_v30 { label="VLAN 10+30 Wi-Fi"; sw2 [label="Access SW 2"]; ap1; ap2; }
  subgraph cluster_v40 { label="VLAN 40 Servers"; srv [label="Server Switch"]; nas; ad; }
  subgraph cluster_v50 { label="VLAN 50 Printers"; sw3 [label="Access SW 3"]; printers; iot; }
  core -- sw1 [label="802.1Q"]; core -- sw2; core -- srv; core -- sw3;
  sw1 -- pcs; sw1 -- phones; sw2 -- ap1; sw2 -- ap2;
  srv -- nas; srv -- ad; sw3 -- printers; sw3 -- iot;
}

6. Related

• Architecture Diagrams — the notation reference for infrastructure and topology diagrams
• UML Deployment Diagrams — the UML way to show nodes and links
• Firewall — host and network firewall practice
• DMZ Firewall Diagram — sibling sample in this section
• Data Center Leaf-Spine — sibling sample in this section
• OSI and TCP/IP Layers — sibling sample in this section