Network Topology Diagram

Segments, address ranges, routes and the control points between them — the view that says what can reach what at layer three.

Type Deployment & Infrastructure View Stage Design Topic Networking Area Networking

flowchart TB
  inet(["Internet"])
  dc["Corporate Data Centre<br/><i>10.0.0.0/8</i>"]

  subgraph hub["Hub — 10.100.0.0/16"]
    direction TB
    fw["Egress Firewall<br/><i>FQDN allow-list</i>"]
    vpn["VPN / Direct Link<br/><i>BGP</i>"]
    dns["Private DNS Resolver"]
  end

  subgraph spokeA["Spoke: Prod — 10.101.0.0/16"]
    direction TB
    pub["Public Subnet<br/><i>10.101.0.0/24 — ingress LB only</i>"]
    app["App Subnet<br/><i>10.101.10.0/23 — no public IPs</i>"]
    data["Data Subnet<br/><i>10.101.20.0/24 — private endpoints</i>"]
    pub --> app --> data
  end

  subgraph spokeB["Spoke: Non-Prod — 10.102.0.0/16"]
    appn["App Subnet<br/><i>10.102.10.0/23</i>"]
  end

  inet -->|"443 only"| pub
  app -->|"all egress"| fw --> inet
  appn --> fw
  dc <-->|"BGP"| vpn
  vpn --- spokeA
  vpn --- spokeB
  spokeA x--x spokeB

What it is

Layer three. Segments with their CIDR ranges, the routes between them, and the devices that enforce policy at each hop. The crossed link between the two spokes is not decoration — an explicit statement that two segments cannot reach each other is one of the most useful things on the page.

When you produce it

Alongside the landing zone, before any address space is allocated, and again whenever a merger, a new region or a new partner connection is proposed. Address collisions after an acquisition are the single most predictable and most expensive network surprise there is.

Who reads it

Network and platform engineers who implement it. Security, who audit the egress path and the segmentation. Anyone debugging a connection that should work and does not.

What good looks like

Every segment has its CIDR on the diagram. A network diagram without addresses is a picture.
The egress path is explicit and singular. If there are three ways out, that is itself the finding.
Denied paths are drawn as denied rather than simply omitted.
Where the hybrid link is, what protocol it runs, and what happens when it drops.

Common mistakes

Overlapping ranges nobody noticed until two environments needed to talk.
Drawing only the allowed paths. The reader cannot distinguish "forbidden" from "not drawn".
Confusing it with a data flow diagram. This is reachability; what actually flows is a different artifact with different reviewers.