NetDraw Pro — Network Diagram Tool

🏗️ Deploy Site Template

Site name

🏢

Small

Branch / SMB

🏬

Medium

Campus / Regional

🏭

Large

Enterprise / DC

🏢

Distribution

Core / Dist / Access

🗄️

Data Center

Spine / Leaf / ToR

🛡️

Forti Branch

Secure Branch Deployment

🔷

Cisco Branch

Secure Branch Deployment

Firewall vendor

Fortinet

Meraki

Palo Alto

Cisco ASA

Juniper SRX

Switch vendor

Cisco Cat

Cisco Nexus

Meraki MS

Arista

Juniper EX

Aruba CX

FortiSwitch

Wireless

Cisco

Meraki MR

Aruba

None

LAN Core

Router

L3 Switch

FW routes

Redundancy

Firewall HA Core RR (HSRP) vPC / Stack

Appliance

FortiGate model

FortiOS version

Availability HA pair (A-P)

WAN 1

ISP name

IP / prefix

Gateway

WAN 2 (enables dual-WAN SD-WAN)

ISP name

IP / prefix

Gateway

VLANs & Zones

VLAN	Name	Subnet (CIDR)	Zone	DHCP

Guest zone is Internet-only (explicit logged deny to internal zones)

IPsec site-to-site VPN

Management

DNS primary

DNS secondary

NTP server

Syslog server (opt.)

SNMP community (opt.)

Admin trusted host (opt.)

Platform

WAN edge router

9300 core stack members

9200 access switches

Meraki APs (MR46)

Gateway architecture

L3 at the stack (CVD-aligned default)

SVIs + DHCP on the 9300 stack · routed transits to the routers · OSPF area 0 · the stack IS the gateway redundancy

Gateways on the routers (HSRP)

Stack runs L2 · per-VLAN subinterfaces on both routers · HSRP VIP .1 · DHCP on the routers · requires WAN 2 (dual routers)

WAN 1 — RTR-A

ISP name

IP / prefix

Gateway

WAN 2 — RTR-B (untick for single-router branch)

ISP name

IP / prefix

Gateway

WAN routing

BGP

eBGP to each ISP · site summary advertised · iBGP between routers over the transit

Static + IP SLA

Tracked default per router — failover is real, not decorative

Cisco SD-WAN (cEdge)

Generates a clearly-labeled onboarding SCAFFOLD — not deployable without vManage

Local AS

WAN 1 peer AS

WAN 2 peer AS

VLANs, roles & VRFs

VLAN	Name	Subnet (CIDR)	Role	VRF	DHCP

Guest defaults to VRF GUEST — strict isolation: its only path is NAT to the Internet. No route-leaking in v1.

Security & identity

Zone-Based Firewall on the WAN edge routers Snort IPS/IDS on the WAN edge (UTD service container) Cisco ISE integration (AAA / RADIUS / CoA / TACACS+ / 802.1X)

Management

DNA Center IP (opt.)

DNS primary

DNS secondary

NTP server

Wireless SSIDs (Meraki — documentation + Dashboard note)

SSID	Mapped VLAN

Deploys onto a blank canvas. Your current diagram will be replaced.

Loading preview…

NetDraw Pro

🏢 Viewing:

🪞 Mirror topology changes across sites

⚙️ Config Viewer – ✕

⚙️

Click a device to view config.

📖 NetDraw Pro Help ✕

💬 Send Feedback ✕

Props

Redund

LAG

HLD

LLD

BOM

Change

Drag devices onto canvas.

🏗️ Site Template — pick Small,
Medium, or Large with your
preferred vendors and
redundancy options.

↩ Undo · 💾 Save · 📂 Load

✏️ Properties

🗑️ Delete

🗑️ Delete with links

Activate NetDraw Pro

Enter the license key from your purchase email to unlock the app.

Need help? Contact support

Team plan feature

This feature is part of the Team plan, which unlocks multi-site deployment, site-to-site routing, schema mirroring, and Mirror Mode. Your current plan is Solo.