Campus Network Design for Irish Universities: 2025 Technical Guide

Irish higher education institutions (HEIs) operate some of the most demanding network environments in the country — simultaneously supporting research data at 100GbE throughputs, 30,000-student device populations on Wi-Fi, eduroam roaming for international visitors, high-density lecture theatre deployments with hundreds of concurrent devices, and an expanding IoT footprint of smart building sensors, EV chargers and CCTV on the same IP backbone. This guide provides the complete technical framework for designing resilient, future-proof campus networks for Irish universities — from three-tier architecture design through Wi-Fi 7 planning, eduroam implementation and the HEAnet WAN connection.

Irish HEI Network Landscape

Ireland's seven universities (TCD, UCD, UCC, DCU, University of Galway, University of Limerick and Maynooth University), fifteen institutes of technology/technological universities and multiple private HEIs all depend on HEAnet as their primary WAN and internet service provider. HEAnet (Higher Education Authority Network) connects all Irish HEIs to the pan-European GÉANT research and education network, providing:

• 100Gbps WAN connectivity to all major Irish HEIs — the campus internal backbone must be designed not to create a bottleneck below this WAN speed
• Dark fibre between Dublin campuses: HEAnet operates dark fibre rings connecting TCD, UCD and DCU in Dublin, allowing HEI-owned wavelengths for inter-campus research data transfer
• eduroam federation — HEAnet operates the Irish eduroam AAA (Authentication, Authorisation and Accounting) tier, federating Irish HEI RADIUS servers into the global eduroam network
• Cloud connectivity: HEAnet provides connectivity to AWS, Microsoft Azure and Google Cloud Ireland regions via dedicated peering, enabling Irish HEIs to access cloud services without WAN bottleneck

Campus Network Tiers: Architecture Design

The standard Irish university campus network follows a three-tier hierarchical architecture:

• Core layer (aggregation): high-capacity switches at the heart of the campus network — all inter-building traffic flows through the core. Core switches operate at 100GbE interconnect speeds. Typical equipment: Cisco Catalyst 9500, Aruba CX 8360, Juniper EX9200. Dual-core switches in a resilient pair for redundancy. Connected to HEAnet WAN router and campus data centre
• Distribution layer (building entry): one or two distribution switches per building — aggregate traffic from all floor-level access switches, connect upstream to the core. Distribution-to-core links: 10GbE minimum (2025), 25GbE increasingly specified for large buildings. Distribution switches also implement inter-VLAN routing and QoS policies
• Access layer (floor level): one switch per floor or per zone — provide 1GbE ports to desktop computers and Cat6A ports to PoE++ APs and PoE devices. Access switches connect to distribution via 10GbE uplinks. Access-layer PoE switches must be properly sized for the PoE budget (see our guide to PoE power budget calculation)

For smaller Irish HEI buildings (IoT, single-floor structures), a collapsed two-tier design (core-access, eliminating the distribution layer) reduces cost and complexity while maintaining sufficient capacity. The three-tier full design is recommended for any building above three floors or 200 users.

Inter-Building Campus Backbone

The physical backbone connecting campus buildings is the most critical infrastructure investment on an Irish HEI campus — correctly specified, it will last 25–30 years with only transceiver upgrades. Incorrectly specified, it will require replacement within 10 years as bandwidth demands increase.

• OS2 single-mode fibre: mandatory for all inter-building links. Armoured, loose-tube construction for direct burial or HDPE duct installation. Minimum 24-core per inter-building route (12 cores for current use, 12 spare for future). OS2 supports any speed from 1GbE to 400GbE and beyond with transceiver upgrades — the fibre is permanent, the transceivers are upgradeable
• Ring topology: inter-building links connected in a ring so that any single cut in the campus fibre ring fails over automatically — no building is isolated by a single fibre cut. RSTP convergence under 1 second for ring link failure
• HDPE duct system: all underground campus fibre routes should be installed in HDPE (High Density Polyethylene) ducting with pull-through rope, future spare ducts (minimum 2 spare per route), and accessible draw pits at direction changes. This allows additional fibre cables to be installed in future without civil excavation works
• Fibre route documentation: GPS-surveyed fibre route records in the campus GIS system (Esri ArcGIS or similar) — essential for avoiding cable strikes during future campus development. Underground fibre strikes are the most common cause of campus network outages on Irish university campuses

HEAnet: Ireland's National Education Network

HEAnet provides Irish HEIs with the following network services relevant to campus ICT design:

• 100Gbps WAN internet connectivity for major HEIs via GÉANT — the pan-European research network connecting 10,000 research institutions across 40 countries
• eduroam AAA service: HEAnet operates the Irish top-level RADIUS server in the eduroam federation hierarchy — Irish HEIs connect their local RADIUS servers to HEAnet AAA to join eduroam
• Network Time Protocol (NTP) servers: HEAnet operates stratum-1 NTP servers for Irish HEIs — critical for time synchronisation of authentication servers, logging systems and network devices
• Network security services: DDoS mitigation, intrusion detection and sinkholing services protecting Irish HEI networks from volumetric attacks — particularly important during Irish CAO application and exam result publication periods when HEI web services experience peak traffic

eduroam Design for Irish Campuses

eduroam (education roaming) allows students and staff to connect to Wi-Fi at any participating institution worldwide using their home institution credentials. Implementation requires:

1. 802.1X port authentication: all eduroam Wi-Fi SSIDs must use WPA3-Enterprise (or WPA2-Enterprise minimum) with 802.1X authentication. The campus Wi-Fi controller redirects authentication requests to the local RADIUS server
2. Local RADIUS server: the Irish HEI operates a RADIUS server (typically FreeRADIUS on Linux or Microsoft NPS on Windows Server) that handles authentication for home-institution users. The RADIUS server connects upstream to HEAnet AAA for visiting users from other institutions
3. HEAnet AAA federation: HEAnet proxies authentication requests for visiting users (whose credentials belong to a different institution) to the correct home institution RADIUS server via the eduroam federation
4. EAP method selection: PEAP (Protected EAP with MS-CHAPv2) is the most widely supported and recommended for Irish HEIs — compatible with Windows, macOS, iOS and Android without third-party supplicant software. EAP-TLS (certificate-based) provides stronger security and is recommended for research networks requiring higher assurance
5. Guest portal for visitors: non-eduroam visitors (conference attendees, industry partners, public) require a separate captive portal SSID with email or SMS registration — on the Guest VLAN, internet-only, isolated from eduroam users

Wi-Fi Density Design for Irish Campuses

Wi-Fi 7 for Irish Campuses: IEEE 802.11be

Wi-Fi 7 (IEEE 802.11be, ratified 2024) introduces features that are particularly beneficial for the high-density, latency-sensitive environment of an Irish university campus:

• Multi-Link Operation (MLO): a single Wi-Fi 7 client can maintain simultaneous connections on multiple bands (2.4GHz + 5GHz + 6GHz) and aggregate their bandwidth. For online exam environments where latency fairness is critical, MLO eliminates the "unlucky channel" problem where one student's device gets a congested channel
• 320MHz channels in 6GHz: the 6GHz band (5.925–7.125GHz) provides up to 1,200MHz of usable spectrum — far more than the congested 2.4GHz (83MHz) and 5GHz (500MHz) bands. 320MHz channels in 6GHz enable 9.6Gbps+ PHY rates per client, sufficient for 8K video streaming and real-time collaborative applications
• 4096-QAM modulation: Wi-Fi 7 supports 4096-QAM (4K-QAM) compared to Wi-Fi 6's 1024-QAM — 20% more bits per symbol at short range, improving throughput in library and lab environments where clients are close to APs
• Multi-RU (Resource Unit) Puncturing: Wi-Fi 7 can "puncture" occupied sub-channels within a 320MHz channel to avoid interference sources — enabling wider effective channels even in environments with some legacy device interference

The infrastructure implication for Irish campus buildings: Cat6A to every AP mounting point is mandatory for Wi-Fi 7 — Cat5e and Cat6 cannot reliably support PoE++ at the cable lengths required, and their bandwidth limitations become a bottleneck for high-throughput Wi-Fi 7 backhaul. Every Irish HEI building designed or refurbished after 2023 should specify Cat6A throughout.

Network Security for Irish Campus Networks

Irish university campuses face a diverse threat landscape: student devices introducing malware, research data as a high-value target, ransomware attacks on administrative systems, and the constant challenge of a large, transient user population connecting devices of unknown security posture. Key security design elements:

• 802.1X wired port authentication: wired network ports in accessible locations (student study areas, library, corridors) should require 802.1X authentication before granting network access — preventing unauthenticated devices from joining the network. Staff and student credentials are used; MAC authentication bypass (MAB) for managed IoT devices
• WPA3-Enterprise Wi-Fi: all eduroam and staff SSIDs must use WPA3-Enterprise minimum — WPA3's Simultaneous Authentication of Equals (SAE) replaces Pre-Shared Key (PSK), eliminating offline dictionary attacks against Wi-Fi passwords
• VLAN isolation: student devices on a student VLAN; staff on a staff VLAN; IoT devices on an IoT VLAN; building automation on a BAS VLAN; guest/eduroam on a guest VLAN. Inter-VLAN ACL policies prevent cross-VLAN access except where explicitly required
• Zero-trust for research networks: research networks handling sensitive data (clinical trial data, defence research, commercially sensitive IP) should implement zero-trust access — no implicit trust based on network location, identity verification required for every access request regardless of whether the user is on-campus or remote