Architecture Design

4.1 Typical System Topology

The typical enterprise router security architecture follows a hierarchical, multi-tier design that enforces strict plane separation at every layer. The topology diagram below illustrates the complete system, showing how WAN Edge, Core, and DC Edge routers are interconnected through production links (blue), while a completely separate OOB Management Network (green) provides independent administrative access to all devices. This separation ensures that even a complete production network failure does not prevent administrative access for recovery operations.

The architecture places BGP policy filters at every external peering point, OSPF authentication on all internal links, and iBGP sessions between routers in the same tier. The Management Services cluster — comprising AAA Server, NTP Server, and Syslog/SIEM Server — is reachable only through the OOB network, preventing any production traffic from reaching these critical infrastructure components.

Figure 4.1: Typical System Topology — Multi-Tier Enterprise Router Security Architecture with OOB Management

Topology Design Rationale

The three-tier hierarchy (WAN Edge → Core → DC Edge) provides multiple points of security enforcement: WAN Edge applies external BGP policy and anti-spoof; Core applies internal routing policy and VRF segmentation; DC Edge applies tenant isolation and data-plane ACLs. This defense-in-depth approach ensures that a misconfiguration or compromise at one tier does not automatically expose all resources.

4.2 Device Wiring & Connection Diagram

The device wiring diagram provides a detailed view of the physical and logical connections for a WAN Edge router deployment. Each interface is labeled with its logical role, IP address, VRF assignment, and cable type, enabling field engineers to verify the installation without referencing separate documentation. Color-coded cables distinguish production traffic (orange), management traffic (blue), and console access (yellow), reducing the risk of mis-cabling during installation or maintenance.

The diagram shows the complete connection set: ISP patch panels feeding the WAN interfaces, core switch uplinks carrying production traffic, OOB management switch providing independent administrative access, terminal server enabling console access for emergency recovery, and dual PDU connections ensuring power redundancy. Every connection is labeled with the interface name, IP address, and VLAN assignment.

Figure 4.2: Device Wiring & Connection Diagram — WAN Edge Router Physical and Logical Connections

Wiring Standards and Best Practices

• Cable color coding: Orange = production/transit, Blue = management/OOB, Yellow = console/serial, Red = power, Green = monitoring/SPAN.
• Label requirements: Every cable must be labeled at both ends with interface name, remote device, and port number. Labels must be machine-readable and human-readable.
• Console port protection: Console port must have a tamper-evident seal when not in use. Console access must be logged via the terminal server.
• Power separation: Router must be connected to two independent PDUs on separate power circuits. Never connect both power supplies to the same PDU.
• Fiber management: Fiber cables must be routed through cable management trays with bend radius protection. Minimum bend radius must not be violated.
• Documentation: As-built wiring diagram must be updated within 24 hours of any physical change and stored in the configuration management system.

4.3 Configuration Architecture

The configuration architecture defines how security controls are organized within the router's configuration, ensuring that all controls are consistently applied and easily auditable. The architecture follows a modular approach: each security domain (management plane, routing protocol, data plane) has its own configuration block with clear boundaries and dependencies. This modularity enables targeted changes without risk of unintended interactions between security domains.

4.4 High Availability & Redundancy Design

High availability design for router security deployments must balance redundancy against configuration consistency. Both routers in an HA pair must have identical security configurations, including all ACLs, CoPP policies, routing protocol authentication keys, and AAA settings. Configuration drift between HA peers is a common source of security incidents and must be actively detected and remediated.