Network Diagrams: How to Draw One (Symbols and Examples)
A network diagram is a map of how devices, subnets, and services connect — and it is usually the first thing anyone asks for during an outage, an audit, or a cloud migration. A good one answers questions in seconds: what sits behind the firewall, which VLAN a printer lives on, which subnet a database occupies. This guide covers the standard symbols, the common topology patterns, the layered layout convention professionals use, and two worked examples you can copy: an office LAN and an AWS VPC.
What is the difference between a physical and a logical network diagram?
A physical network diagram shows hardware and cabling: which switch port connects to which patch panel, where devices sit in the rack, and what medium each link uses (Cat6, OM4 fiber, DAC). It is the diagram a field tech needs when tracing a dead link, so it includes rack units, port numbers, and cable IDs. Physical diagrams change every time someone moves a cable, which is why they are the hardest to keep accurate.
A logical network diagram shows how traffic flows: subnets, VLANs, routing boundaries, firewall zones, and trust levels. Two servers plugged into the same physical switch can sit on opposite sides of a logical diagram if they belong to different VLANs. Logical diagrams are what security reviewers, architects, and incident responders actually read, because they answer questions like which segments can reach the database tier.
Draw both, but keep them separate. Mixing rack positions with VLAN boundaries on one canvas produces a diagram nobody can read. For most engineering documentation — runbooks, design docs, SOC 2 evidence — the logical diagram is the one that matters, and it is the style this guide focuses on.
What are the standard network diagram symbols?
Most network diagrams use the Cisco symbol conventions, and every serious network diagram tool ships them as a shape library. The router is a circle (or hockey puck) with four arrows pointing in and out, representing traffic routed between networks. The Layer 2 switch is a flat rectangle with crossing arrows; a Layer 3 switch adds a routing overlay to the same shape. Learn these five and you can read almost any diagram: router, switch, firewall, load balancer, cloud.
The firewall is drawn as a brick wall, often with a flame in modern icon sets, and it always marks a trust boundary — everything above it is less trusted than everything below. The load balancer is typically a rectangle with diverging arrows showing one flow split across targets. The cloud shape means any network you do not control: the public internet, an ISP backbone, or an MPLS WAN. Round out the set with a server (tower or rack rectangle), a wireless access point (antenna waves), and an end-user workstation.
For cloud architectures, use the provider's official icons instead of generic shapes: AWS publishes its Architecture Icons set (orange-boxed service icons for VPC, ALB, EC2, RDS) and Azure and GCP publish equivalents. Reviewers recognize the official ALB icon instantly; a generic 'load balancer' rectangle inside an AWS diagram forces them to read labels. Consistency matters more than artistry — pick one icon set per diagram and never mix Cisco shapes with AWS icons on the same canvas.
Star, mesh, or hub-and-spoke: which topology pattern should you draw?
Star topology puts one central device — usually a core switch — in the middle with every access switch or endpoint connected directly to it. It is the default for office LANs because it is cheap and simple, and the diagram mirrors that: core in the center or at the top, spokes fanning out. Its weakness is obvious on the page: the center is a single point of failure, which is why real deployments often draw two core switches with a stacked or MLAG pair.
Full mesh connects every node to every other node, giving n(n-1)/2 links for n nodes — 6 links for 4 sites, 45 for 10. Mesh diagrams get unreadable fast, so reserve full mesh for small, redundancy-critical cores (paired firewalls, dual data center interconnects) and draw partial mesh for everything else. If your mesh diagram looks like a plate of spaghetti, that is a design smell, not a drawing problem.
Hub-and-spoke is the pattern behind most WANs and modern cloud networks: branch offices connect to headquarters, or spoke VPCs connect through an AWS Transit Gateway or an Azure hub VNet running shared firewalls and VPN gateways. Draw the hub in the center with spokes radiating outward, and annotate each spoke link with its type (site-to-site VPN, Direct Connect, VNet peering) and bandwidth. This pattern dominates cloud network diagrams because it matches how Transit Gateway route tables actually work.
How should you lay out and label a network diagram?
Professional network diagrams follow a top-to-bottom layered convention: internet (cloud shape) at the top, then the edge firewall, then the core layer, then distribution, then access switches, with endpoints at the bottom. This mirrors Cisco's three-tier hierarchical model, and it means anyone can find the trust boundary — the firewall — without hunting. Small networks collapse core and distribution into one Layer 3 switch (a 'collapsed core'), which removes a row from the diagram but keeps the top-down flow.
Traffic direction should read vertically: north-south traffic (user to internet) flows up and down the page, east-west traffic (server to server) flows horizontally within a layer. Keep redundant pairs side by side at the same height, and route lines orthogonally with minimal crossings — every crossed line costs the reader a second of parsing. If two lines must cross, a line jump (small arc) makes clear they do not connect.
Labels are what separate a useful diagram from wall art. Label every subnet with its CIDR (10.20.30.0/24), every VLAN with ID and purpose (VLAN 20 — Voice), every inter-switch link with its speed (2x 10G LACP), and every firewall with the zones it separates. Skip per-host IPs except for infrastructure that other things point at: gateways, DNS servers, load balancer VIPs. A reader should be able to write a firewall rule or plan an IP allocation from the diagram alone, without SSH-ing into anything.
Worked examples: an office network and a cloud VPC
Office LAN example, top to bottom: an ISP cloud at the top connects to a FortiGate edge firewall (WAN 203.0.113.10, LAN zone trust). Below it, a collapsed-core Layer 3 switch pair (stacked, 2x 10G uplink to the firewall) does inter-VLAN routing for VLAN 10 — Users (10.0.10.0/24), VLAN 20 — Voice (10.0.20.0/24), and VLAN 30 — Guest (10.0.30.0/24, isolated from the other two by an ACL noted on the diagram). Each floor gets an access switch with a 10G uplink and 1G edge ports, plus two wireless APs trunked to carry both the Users and Guest VLANs.
Cloud VPC example: an AWS VPC (10.0.0.0/16) drawn as the outer container, split into two availability-zone columns. An Internet Gateway sits at the top edge; each AZ has a public subnet (10.0.1.0/24 and 10.0.2.0/24) holding one Application Load Balancer node and one NAT Gateway, a private subnet (10.0.11.0/24, 10.0.12.0/24) running ECS tasks, and an isolated subnet (10.0.21.0/24, 10.0.22.0/24) for an RDS Postgres primary and standby. Arrows show the request path — IGW to ALB to ECS to RDS — and the outbound path from private subnets through the NAT Gateways.
Notice what both examples share: the untrusted network is at the top, trust increases as you move down, and every box that holds addresses carries a CIDR label. The VPC diagram uses AWS's official icons and nested container rectangles for VPC, AZ, and subnet boundaries — the container-in-container pattern is the single most important convention in cloud diagrams. If you sketch either of these on a whiteboard first, AIDrawIO can convert a photo of that sketch into an editable vector diagram, which beats redrawing it shape by shape.
How do you generate a network diagram with AI?
You have several good options for drawing network diagrams by hand. draw.io (diagrams.net) is free, ships Cisco and AWS shape libraries, and stores diagrams as XML you can commit to git. Mermaid renders from text and works inside GitHub READMEs, but its layout engine struggles with layered network topologies and it lacks proper network icons. Lucidchart has polished networking shape libraries and real-time collaboration, but the useful features sit behind a paid plan. The common pain across all of them is the same: placing forty shapes and routing sixty edges by hand takes an hour.
AIDrawIO takes a different route: describe the network in plain English and it generates a draw.io-compatible diagram, using the official AWS and Azure icon sets for cloud components. A working prompt for the VPC example above: 'Draw an AWS VPC network diagram: VPC 10.0.0.0/16 across two availability zones, Internet Gateway at the top, ALB in public subnets 10.0.1.0/24 and 10.0.2.0/24, ECS services in private subnets, RDS Postgres primary and standby in isolated subnets, one NAT Gateway per AZ. Label every subnet with its CIDR.' The output is draw.io XML, so you can fine-tune port labels or move a switch in AIDrawIO's editor or in diagrams.net itself — you are never locked into a proprietary format.
Exports cover draw.io XML for version-controlled documentation, SVG for wikis, and PNG for slide decks, and version history means you can diff the diagram as the network evolves. The free tier at aidrawio.com/en/tools/network-diagram-generator gives 5 generations per hour with no account, running on Gemini 3 Flash; subscribers get Claude Opus 4.8, Claude Sonnet 5, and Gemini 3.1 Pro, which handle denser topologies with more reliable layouts. Generate the first draft from a prompt, then spend your time on the part AI cannot know: the CIDRs, VLAN IDs, and link speeds that make the diagram true.
Try the free Network generator
AI network topology diagrams. Describe in plain English, get draw.io XML in seconds. No account required.
Frequently asked questions
What symbols are used in a network diagram?
The core set follows Cisco conventions: a circle with four arrows for a router, a flat rectangle with crossing arrows for a switch, a brick wall for a firewall, a rectangle with diverging arrows for a load balancer, and a cloud for the internet or any external network. For cloud architectures, use the official AWS, Azure, or GCP architecture icons instead of generic shapes. Pick one icon set per diagram and stay consistent.
What is the difference between a physical and a logical network diagram?
A physical diagram shows hardware and cabling: rack positions, switch ports, patch panels, and cable types. A logical diagram shows traffic flow: subnets, VLANs, routing boundaries, and firewall zones, regardless of where the hardware sits. Most documentation, security reviews, and incident response work off the logical diagram.
How do you draw a network diagram step by step?
List your devices and subnets first, then place them in layers: internet at the top, edge firewall below it, then core, distribution, and access switches, with endpoints at the bottom. Connect the layers with orthogonal lines, keeping redundant pairs side by side. Finish by labeling every subnet with its CIDR, every VLAN with its ID, and every uplink with its speed.
How do you show VLANs and IP ranges on a network diagram?
Label each VLAN with its ID, purpose, and subnet, for example 'VLAN 20 — Voice — 10.0.20.0/24', either next to the switch that hosts it or as a color-coded container around its members. Mark trunk links carrying multiple VLANs with the VLAN list. Skip individual host IPs except for gateways, DNS servers, and load balancer VIPs.
What is the best free tool to draw a network diagram?
draw.io (diagrams.net) is the strongest free hand-drawing option, with Cisco and AWS shape libraries and git-friendly XML files. Mermaid works for simple text-based diagrams but handles network layouts poorly. If you want to skip manual placement, AIDrawIO generates draw.io-compatible network diagrams from a plain-English description, free for 5 generations per hour with no account.