FIP
Resources
Food Industries Polytechnic

FIP Network Architecture — Recommended (v4)

FIP premises, the Supply Chain building and the Trainees Accommodation, each remote site linked to FIP by a point-to-point (P2P) link with LTE failover.

Internet FIP Premises Supply Chain Building Sophos X2100 (Firewall) 172.30.143.254 (FIP side) P2P Link 172.30.175.0/29 172.30.175.1 172.30.175.2 Cisco 4507 (L3 Switch) Inter-VLAN routing + DHCP (FIP VLANs 100–400) Cisco 2960 (L2 Access Switch) Client devices ClientPCs Wi-FiAPs IPPhones CCTV /Other
(Failover) Uplink to LTE Router 172.30.175.9 Cisco 9200L-48P-4X (L3 Switch) Inter-VLAN routing + DHCP (VLANs 510–590) Cisco 2960 (L2 Access Switch) Client devices Client PCs Wi-Fi APs IP Phones Printers / Other
P2P Link to Accommodation subnet TBD Trainees Accommodation (Failover) Uplink to LTE Router IP TBD Cisco L3 Switch (model TBD) Inter-VLAN routing + DHCP (VLANs TBD) IP TBD L2 Access Switch (Cisco 2960 or equivalent) Client devices Client PCs Wi-Fi APs IP Phones Printers / Other
Remote location: Trainees Accommodation Same services as the Supply Chain building, connected to the FIP 4507 by its own P2P link. VLANs, subnets, P2P subnet and LTE IP are not confirmed yet and show as TBD.

Key Requirements / Components

FIP Building

  • Cisco 4507 L3 switch (inter-VLAN routing + DHCP)
  • Cisco 2960 L2 access switch (client computers)
  • Sophos X2100 firewall
  • P2P link to Supply Chain (172.30.175.0/29)

Supply Chain Building

  • Cisco 9200L-48P-4X L3 switch
  • Cisco 2960 L2 access switch
  • P2P link to FIP (172.30.175.0/29)
  • Uplink to LTE router (172.30.175.9)
  • Sophos X2100 firewall (available in FIP)

Trainees Accommodation (remote)

  • Same services as Supply Chain: L3 switch, L2 access switch (model TBD)
  • P2P link to FIP 4507 (subnet TBD)
  • LTE failover uplink (IP TBD)

FIP Campus VLAN Roles (from network records)

DNS: 172.30.143.185, 172.30.143.186 (all data VLANs)  |  Voice: none

Supply Chain L3 Switch Config (Cisco 9200L)

Key features

  • 8 VLANs (510–590) with gateways (.1)
  • Trunks to L2 switches (Te1/1/1–2)
  • Uplinks: Gi1/0/48 → P2P (172.30.175.2); Gi1/0/47 → LTE (172.30.175.9)
  • DHCP (staff, Wi-Fi 12h, voice → FIP phone servers, printers)
  • IP SLA failover: 5s ping, 15s fail, 60s recover
  • NTP from RODC
  • SNMPv3 + syslog → ManageEngine (172.30.143.100)
  • SSH only

Before deployment

  1. Replace <...> placeholders (passwords, SNMP).
  2. Confirm Supply Chain supports routing & IP SLA (show license summary).
  3. Add 4507 routed port 172.30.175.1/29 and route 172.30.160.0/20 via 172.30.175.2.

Failover Logic (IP SLA)

P2P Link Up(172.30.175.2)
▼
Normal Operation(use P2P)
▼
P2P Down(15 sec)
▼
Use LTE(172.30.175.9)
▼
P2P Stable(60 sec)
▼
Back to P2P

Traffic Flow

  1. Client → VLAN (access switch)
  2. Inter-VLAN routing (FIP 4507 or Supply Chain 9200L)
  3. To Internet: → 4507 → Sophos → ISP
  4. Supply Chain → FIP: via P2P (172.30.175.0/29); Accommodation → FIP: via its own P2P (TBD)
  5. Failover: P2P → LTE if down

Legend

Uplink / Trunk
P2P Link (172.30.175.0/29)
LTE (Failover)
L3 Switch
L2 Switch
Firewall
Internet