Separating the WAN from the Core

There’s a point in most networks where everything ends up in the core. Not by design. Just by accumulation.

Routing decisions.
WAN connectivity.
Internal traffic.

All of it converging on the same place. That works. Until it doesn’t. At one site, we reached that point.

The core switches were doing too much.

They handled internal routing, but they were also responsible for WAN decisions — effectively acting as both core and edge. The plan wasn’t to rebuild the network. It was to reshape it. A multilayer switch had already been introduced at the WAN edge. The idea was simple:

separate intra-site routing from WAN routing

Or, more practically:

Let the core be the core.
Let the edge handle the edge.

This change was part of that transition. Not the whole move. Just one phase. From the change plan:

“moving the remaining WAN decisions away from the Core Switches”

The approach was incremental.

Extend the relevant VLANs out to the new WAN distribution switch. Allow traffic to flow there naturally. That sounds straightforward. It rarely is. Some VLANs were well understood. Others… less so. There were notes in the plan like:

“VLAN 6 – REVIEW!!!”
“VLAN 801 – What is this?”

Which is fairly typical in long-lived environments. Not everything has a clean origin story. So the work had to be careful. Not just technically correct, but observant. At the same time, the underlying behaviour needed to be aligned. Spanning Tree and HSRP were adjusted so that:

traffic paths followed the intended design
gateway decisions matched the physical topology

That alignment mattered. Without it, traffic would take inefficient paths — crossing the network unnecessarily before reaching its destination.

There was a brief moment of disruption.

As Spanning Tree recalculated, ports transitioned, and paths shifted. From the plan:

“the switch… will not forward any data… for a few moments”

That’s expected. The real risk wasn’t a pause. It was a loop.

“Spanning Tree Loop — Low probability, High impact”

So everything was controlled.

Backups taken.
Changes applied in order.
Verification at each step.

Checking:

root bridge placement
HSRP active nodes
actual traffic paths

And finally, simple end-user validation:

Can a device still reach the network?
Can a phone still make a call?

Nothing about this change was dramatic. No visible transformation. No new capability from a user perspective. But structurally, it mattered. The network was no longer relying on the core for everything.

Responsibility was starting to separate.

The shape was changing. Looking back, this kind of work sits somewhere between engineering and gardening. You’re not building something new. You’re reshaping something that already exists.