Why office networks decay
Nobody plans an unreliable network. What happens instead is accretion: an office opens with a sensible setup, then a switch is added for a new team, an access point for the meeting room, a port forwarded for the CCTV installer, a cable run over a ceiling tile for the printer that had to move. Each change was reasonable. None was documented. Years later the network "kind of works", nobody knows what would break if that one switch were replaced, and the person who understood it has left.
This is the state of most networks we inherit, and it is why our practice is documentation-first: survey what exists, draw what should exist, and make the two converge. A network is not finished when the packets flow; it is finished when the next engineer — ours or anyone's — can understand it from the diagram in an afternoon.
The commercial point is worth stating plainly: an undocumented network is not cheaper. It is a deferred cost that comes due at the worst possible moment — during an outage, an office move, or a change of provider.
Design before hardware
The sequence matters. Topology diagram, IP addressing plan and VLAN scheme are written down before any cable goes in, because retrofitting design onto installed hardware costs many times what designing first does. For a new office fit-out, that means being involved before the walls close — cabling routed while the contractor is still on site, containment planned alongside power, and the comms room specified as a room rather than whichever cupboard happened to be spare.
- Structured cabling — runs terminated, tested and labelled at both ends, with a patch schedule that matches reality. Cabling is the cheapest component to install during a fit-out and the most disruptive to fix afterwards.
- An IP plan — addressing that leaves room to grow, written down, so the next device is added by design rather than on whatever address happened to be free.
- A VLAN scheme — which traffic is separated from which, and why — decided before the switches are configured, not discovered after an incident.
- A hardware horizon — switches, firewalls and access points specified for a five-year life, not the cheapest box that works today. Mid-life replacement of core network gear is disruption you can design out.
Commissioning ends with testing before move-in day, not during it — every port, every access point, every VLAN verified while the office is still empty.
Wi-Fi that behaves like a utility
Bad office Wi-Fi is rarely a mystery. It is some combination of too few access points, access points in the wrong places, consumer hardware asked to do enterprise work, interference nobody surveyed for, and every kind of traffic competing on one network. Fixing it starts with the building, not the box: coverage planned around the actual floor plate, walls and usage, then centrally managed access points placed to serve it.
We deploy UniFi for most SMB environments: centrally managed access points, seamless roaming between them, guest traffic segregated from company traffic, and a controller hosted on-premise or in the cloud depending on how many sites you run. Where requirements go beyond it, we design on Cisco or Fortinet instead — the point is fit, not brand loyalty.
Guest Wi-Fi deserves its own sentence: visitors get internet, not your network. A guest SSID that lands on the same segment as your file server is an open door dressed as hospitality.
Segmentation and the firewall
A flat network — everything on one segment, everything able to talk to everything — turns any single compromised device into a bridgehead. VLAN segmentation is the control: CCTV cameras, guest devices, printers, servers and staff machines separated into their own segments, with the firewall deciding what may cross between them. A camera with a vulnerability, on its own VLAN, is a contained problem; on a flat network it is a starting point.
We deploy Fortinet, Cisco Meraki or UniFi gateways depending on the environment, and we treat the firewall as a living system rather than an installation: rules reviewed quarterly so that temporary exceptions do not calcify into permanent holes, and firmware kept current — unpatched perimeter devices are one of the most common ways attackers get in, and the ones we inherit are frequently years behind.
How this fits the wider security baseline →
Connecting sites, and what stays on-premise
Multi-site businesses need the branches to behave like one network. We build site-to-site VPNs on IPsec or WireGuard with monitoring and failover, so the link between offices is a measured service rather than a thing that "kind of works" until the day it doesn't. The design question is always the failure case: what happens at the branch when the link drops, and does anyone find out before the users do?
On servers and storage: the answer is not always the cloud, whatever the market says. Businesses with large files, latency-sensitive applications or specific residency constraints often keep a file server or NAS on-premise, in hybrid with Microsoft 365. We spec that hardware for a five-year horizon and back it with the backup and disaster recovery practice described on its own page — because an on-premise server without a tested restore is a liability with a warranty.
Backup & disaster recovery for on-premise workloads →