Who this is for
If any of this sounds familiar, network design should be the first conversation, not the last.
You probably need this if…
- You're moving offices or opening a new site and need the network ready on day one.
- Wi-Fi complaints keep coming back after every fix.
- Your switches are past end-of-support and spares are getting hard to find.
- An audit flagged weak or missing network segmentation.
- You're opening a new branch or warehouse and need it connected fast.
- Nobody can say for certain what's actually plugged into the network right now.
Where it applies
Probably not the right fit when…
- A single small office that just needs a reliable ISP router — a full design engagement is overkill.
- You only need one or two extra access points added to an otherwise healthy network.
Technical overview
Enterprise networks fail at the seams: between access and core, between sites, and between IT and OT. We design the network as a layered, segmented and observable system, documented in HLD/LLD before a single device is racked.
Technologies we work with
Reference architecture
Design principles
- Segment user, server, management, voice, IoT and building-system traffic using VLANs and routed VRFs aligned to trust boundaries.
- Use IEEE 802.1X with centrally managed identity policies and a documented fallback for devices that cannot authenticate.
- Size PoE budgets against endpoint power requirements, switch capacity, simultaneous demand and planned growth.
- Validate wireless coverage, capacity, roaming and interference through predictive planning and an on-site survey.
Specification baseline
| Aspect | Specification | Why it matters |
|---|---|---|
| Access authentication | IEEE 802.1X with RADIUS and role-based network access | Identity-based access limits unauthorised connectivity. |
| Wireless | Wi-Fi 6 as a baseline; Wi-Fi 6E where supported clients and local regulations permit 6 GHz operation | Additional spectrum can improve capacity when clients and the RF environment support it. |
| PoE | Select IEEE 802.3af, 802.3at or 802.3bt according to endpoint requirements | The switch power budget must cover simultaneous endpoint loads. |
| Core routing | Layer 3 routing with ECMP or a documented gateway redundancy mechanism | Redundant paths improve availability and failure recovery. |
| Oversubscription | Calculate aggregate access bandwidth divided by aggregate uplink bandwidth and validate against peak traffic | A universal oversubscription ratio does not suit every traffic profile. |
| Availability | Provide independent power and physical paths for critical components where justified | Redundancy is ineffective when paths share the same failure point. |
Key design decisions
Core topology
A small or medium campus has manageable scale and limited routing-domain complexity.
Multiple buildings, larger access layers or separate scaling and policy requirements justify distinct core and distribution tiers.
WAN connectivity
Applications need policy-based path selection across multiple internet, broadband or private WAN links.
Private connectivity and contractual service characteristics are priorities.
Access switch redundancy
A supported switch family and unified local management suit the access block.
Endpoints require dual-homing to separate switches without relying on a single logical chassis.
Sizing & calculations
PoE budget = sum of maximum planned endpoint power demand, plus growth capacity and required operating margin.
24 endpoints at 15 W each require 360 W of endpoint power before growth allowance and switch overhead.
Access oversubscription = aggregate configured access-port bandwidth divided by aggregate uplink bandwidth.
Forty-eight 1G access ports and two 10G uplinks produce a nominal 2.4:1 ratio.
AP count = the greater of coverage-based and capacity-based estimates, validated by an RF survey.
If coverage requires 8 APs and concurrent-client capacity requires 12, plan around 12 APs and validate placement and interference.
Standards, protocols & references
Handover documentation
- Physical and logical network as-built diagrams
- IP address, VLAN and VRF register
- Firewall and routing configuration backups
- Wireless survey and validation report
- Failover and acceptance test results
- Operations runbook and escalation matrix
What you get
- Fewer outages traced back to network misconfiguration
- Faster rollout of new sites and branches
- A clear audit trail for every policy and segmentation change
What we deliver
Campus & enterprise LAN
- Core, distribution and access switching
- HA design (HSRP / VRRP / stacking)
- Layer-2 / Layer-3 segmentation
Wireless
- High-density Wi-Fi 6 / 6E design
- Industrial and warehouse wireless
- RF surveys, heatmaps, optimisation
WAN & internet edge
- Dual ISP, load balancing, failover
- MPLS, SD-WAN, broadband
- Secure internet breakout
Security integration
- Perimeter and internal firewalls
- NAC and access policies
- Secure IT–OT segmentation
Data centre networks
- Spine-leaf and traditional designs
- Redundant uplinks, fabric resiliency
Monitoring & operations
- NMS, performance and fault monitoring
- SLA and uptime governance
