Layer 2 vs. Layer 3 Distribution/Core

As progress with our baseline network has come to a halt, we have been struggling with coming to a conclusion with how the distribution/core area of our network will handle connectivity between the two buildings. As the network requires user segmentation where students, guests, academic staff, registry, payroll and management require separation through the use of virtual lans or VLANs, we are finding it difficult coming to a solution as to how to span the VLAN information across our layer 3 distribution/core.

An easier solution would be to convert that portion of the network to layer 2 which can be easy to configure VLANS across that portion of the network, it also runs into issues with size and the number of devices in the network. As layer 2 networks expand, the broadcast area increases which can generate spanning tree issues. This meant that layer 3 was the alternative and this is why the distribution area of the network is layer 3. However, we are now finding issues with spanning VLAN tags across the network, so we realistically have one whole VLAN across both buildings for each user segment.

In order to combat this issue, there are alternative routes we can take in order to resolve this issue. We could consider separation of VLANs by running a VTP server on each building layer 2 network, as the broadcast domain will be small and shouldn't run into spanning tree issues. We could also consider a VPN operating across the distribution/core network, and use this VPN connection as a trunk interface to effectively bridge the buildings. Using VPN could also be a security benefit as trunked data could be encrypted across this VPN connection.