sequenceDiagram
    autonumber
    participant U as Client User (Wired/Wi-Fi)
    participant A as Access SW (SW1/SW2)
    participant C as Core SW (SW3)
    participant F as Firewall / DMZ
    participant I as ISP (ClassicTech 150/150)
    participant V as Site-to-Site VPN
    participant N as NTC Router / SIP
    participant B as NIC Asia Bank

    U->>A: DHCP Request / 802.1X (VLAN)
    A->>C: Uplink 1Gbps (UTP)
    C->>F: Route to WAN / NAT
    alt Primary Link Up
        F->>I: Internet Egress
        I-->>F: Internet Response
    else Primary Down (Failover via Huawei SW)
        F->>I: Switch to Backup ISP
        I-->>F: Internet Response (Failover)
    end
    opt VPN Destinations
        F->>V: IPSec Tunnel
        V->>N: Reach NTC Services (SIP/Router)
        V->>B: Reach Bank Services
        N-->>V: SIP/Signaling/Routes
        B-->>V: Bank App/Endpoints
        V-->>F: Encrypted Traffic
    end
    F-->>C: Return Traffic
    C-->>A: L3/L2 Forward
    A-->>U: Response to Client

sequenceDiagram
    autonumber
    participant U as Client User (PC/Mobile)
    participant A as Access SW (SW1/SW2)
    participant C as Core SW (SW3)
    participant AC as AP Controller
    participant NVR as CCTV NVR
    participant ATT as Attendance System
    participant SRV as Application Servers (SRV01/SRV02)
    participant NAS as NAS/Storage
    participant SIP as NTC SIP Server

    U->>A: Join VLAN (Student/Staff/VoIP/CCTV)
    A->>C: 1Gbps Uplink
    par Wi-Fi/Devices
        C->>AC: AP Mgmt / SSIDs
        AC-->>U: Auth & WLAN Access
    and CCTV
        U->>NVR: Stream/Record (via VLAN CCTV)
        NVR-->>U: Playback
    and Attendance
        U->>ATT: Punch/Sync
        ATT-->>U: Confirmation
    and App/Storage
        U->>SRV: Web/App/DB Requests
        SRV->>NAS: File Shares
        NAS-->>SRV: Backups
        SRV-->>U: App Response
    and IP Phone
        U->>SIP: SIP Register/Calls (VoIP VLAN)
        SIP-->>U: Call Media/Signaling
    end

graph TB
    subgraph WAN
        ISP[ClassicTech 150/150]
        VPN[Site-to-Site VPN]
        NTC[NTC Router & SIP]
        BANK[NIC Asia Bank]
    end

    FW[Firewall / DMZ]:::dmz
    CORE[Core Switch SW3]:::core
    SW1[Access SW1]:::access
    SW2[Access SW2]:::access
    APC[AP Controller]:::svc
    NVR[CCTV NVR]:::svc
    NAS[NAS/Storage]:::svc
    SRV01[SRV01]:::svc
    SRV02[SRV02]:::svc

    ISP --- FW
    VPN --- FW
    NTC --- VPN
    BANK --- VPN

    FW --> CORE
    CORE --> SW1
    CORE --> SW2
    CORE --> APC
    CORE --> NVR
    CORE --> NAS
    CORE --> SRV01
    CORE --> SRV02

    %% Building Uplinks (1 Gbps)
    SW1 --> CBlock[C-Block]:::bldg
    SW1 --> Arch[Architecture]:::bldg
    SW1 --> RAC[RAC]:::bldg
    SW1 --> BBlock[B-Block]:::bldg
    SW2 --> MLab[Machine Lab]:::bldg
    SW2 --> Library[Library]:::bldg
    SW2 --> BCTL[BCT Lab]:::bldg
    SW2 --> Canteen[Canteen]:::bldg
    SW2 --> Guard[Guard House]:::bldg
    SW2 --> Indus[Industrial B-Block TOP]:::bldg
    SW2 --> ELib[E-Library]:::bldg

    classDef dmz fill:#fde68a,stroke:#b45309,stroke-width:1px,color:#111827;
    classDef core fill:#bfdbfe,stroke:#1d4ed8,stroke-width:1px,color:#111827;
    classDef access fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#111827;
    classDef svc fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#111827;
    classDef bldg fill:#f3f4f6,stroke:#111827,stroke-width:1px,color:#111827;