Reference Architecture Diagram + Narrative (edu-identity + research-grade backbone)
┌─────────────────────────────────────────────────┐
│ USERS & ROLES │
Students │ Faculty/Staff │ Researchers/PI │ Admin/Registrar │ Guests/Visitors
└───────────┬──────────┬──────────┬──────────┬────────┘
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────────┐
│ CAMPUS / SITE EDGE (MAIN + SATELLITES) │
│ SD-Branch / SD-WAN (dual underlays; ZTP) │
│ Managed Wi-Fi (high-density halls/dorms; eduRoam roaming) │
│ VRFs/VLANs: Student │ Faculty/Staff │ Research/HPC │ Admin │ Guest
│ NAC/NGFW; QoS (voice/video/class streaming) │
└───────────────┬──────────────────────────────┬─────────────────┘
│ │
DIA / Metro Ethernet / IX │ LTE/5G FWA (backup),
(peering: Internet2/GEANT/NREN) │ SATCOM (remote field sites)
│ │
▼ ▼
┌────────────────────────────────────────────────────────────────┐
│ SASE / SSE POPs (Zero-Trust access fabric) │
│ ZTNA │ SWG │ CASB │ FWaaS │ DLP │ Email Sec │ RBI │ DNS Sec │
│ Geo/data-residency & privacy policies (FERPA/GDPR) │
└───────────────┬──────────────────────────────────┬─────────────┘
│ │
▼ ▼
┌────────────────────────────────────┐ ┌──────────────────────────────────┐
│ CAMPUS CORES / SOVEREIGN DCs │ │ CLOUD ON-RAMPS (DX/ER/GCI) │
│ SIS/Registrar │ LMS │ IdP/SSO/MFA │ │ LMS SaaS │ UCaaS/VCaaS │ DaaS/VDI│
│ Library/Repos │ HPC Gateway │ │ HPC Cloud │ Data Lakes │ SaaS │
│ HSM/KMS │ SIEM/SOAR │ Backups │ └───────────────┬───────────┬───────┘
└──────────────┬────────┬────────────┘ │ │
│ │ │ │
▼ ▼ ▼ ▼
┌─────────────────────────────┐ ┌────────────────────────────┐ ┌───────────────────────┐
│ RESEARCH FABRIC (on-prem) │ │ RESEARCH NRENs / IX │ │ ACADEMIC COLLAB APPS │
│ HPC clusters, schedulers │<─────>│ Internet2/GEANT/APAN │ │ CMS, wikis, repos │
│ Lustre/GPFS, object store │ │ (peered science data) │ │ conferencing suites │
└─────────────────────────────┘ └────────────────────────────┘ └───────────────────────┘
Telemetry/Observability (logs/metrics/traces) ───► NOC/SOC (AIOps) │ ITSM/CMDB │ Privacy & FERPA dashboards
Narrative (how the campus stays coherent, fast, and private)
1) Purpose & posture
- Objective: Deliver seamless learning and research across main/satellite campuses and global collaborators, with edu-identity federation, research-grade throughput, and privacy by design.
- Posture: Zero-Trust everywhere (users/devices/apps), data-sovereignty aware (FERPA/GDPR), education-first QoS (class video, labs, HPC flows).
2) Edge & transport (syntax of the network)
- SD-Branch/SD-WAN at each campus; ZTP for templated turn-ups; VRFs/VLANs separate Student, Faculty/Staff, Research/HPC, Admin, Guest.
- Managed Wi-Fi (dense halls/dorms) with eduRoam roaming; per-SSID policies map to VRFs.
- Underlays: DIA/MetroE/IX with research peering (Internet2/GEANT/NREN); LTE/5G (and SATCOM for field sites) keep classes and labs online during terrestrial incidents.
3) Zero-Trust access fabric (semantics preserved)
- SASE/SSE POPs enforce ZTNA (user+device+posture+role), SWG/CASB/FWaaS/DLP/Email Sec/RBI/DNS Sec; geo-pinning keeps regulated data in-region.
- IdP/SSO/MFA integrates with eduRoam/eduGAIN/InCommon; device health gates access to LMS, VDI, HPC portals.
4) Campus cores & cloud destinations (where meaning lives)
- Campus cores/DCs host SIS/Registrar, LMS (if on-prem), IdP, HSM/KMS, SIEM/SOAR, and immutable backups.
- Cloud on-ramps (Direct Connect/ExpressRoute/Interconnect) provide private access to LMS SaaS, UCaaS/VCaaS, DaaS/VDI, HPC cloud queues, and research data lakes.
5) Research fabric (science-grade flows)
- HPC clusters & storage (Lustre/GPFS/object) fronted by HPC gateways;
- NREN peering (Internet2/GEANT/APAN) for large science data exchanges; QoS profiles prioritize bulk-transfer and control planes without starving classes.
6) Resilience patterns (grammar under stress)
- Policy-based failover: class traffic (LMS/VCaaS) and labs steer to backup DIA/LTE in <60s; non-critical guest traffic throttled.
- Store-and-forward for repositories and library sync during outages; pre-staged VDI/DaaS keeps labs running if a campus core is impaired.
7) Security, privacy & evidence (pragmatics)
- DLP for student records and research IP; pseudonymization where analytics need aggregate behavior.
- AIOps observability bus streams KPIs to NOC/SOC; ITSM/CMDB anchors change control; FERPA/GDPR dashboards expose access trails and retention status.
8) Reference KPIs
- Availability: ≥99.99% (LMS/IdP paths) • Video class jitter: <20 ms • Failover: <60 s
- HPC data throughput: ≥80% of link line-rate sustained • Privacy incident MTTR: ≤2 h
9) Minimal BOM (aligned to your matrix)
DIA/MetroE/IX (NREN peering), SD-WAN/SD-Branch, Managed Wi-Fi (eduRoam), LTE/5G/SATCOM (backup/field), SASE/SSE (ZTNA/SWG/CASB/FWaaS/DLP/Email Sec/RBI), Campus cores (SIS/LMS/IdP/HSM/SIEM), Cloud on-ramps, HPC clusters & gateways, Object/Lustre/GPFS storage, AIOps observability, ITSM/CMDB.