Networking & Enterprise Connectivity

Good Wi-Fi is designed, not bought.

• Cisco Catalyst or Aruba switching and wireless - matched to the building and the team that will run it: full controller setups - one device running every access point - for larger estates, and none where a controller would be overkill.
• Dell PowerSwitch N-Series and the older PowerConnect - the N-Series is configured like any enterprise gear. PowerConnect is out of vendor support. Where it's already in the building, we check the firmware version, the known vulnerabilities and the role it plays in the network. Then we configure, harden and segment it, and put it on the replacement plan. We replace it when the requirement outgrows it or the risk becomes unacceptable.
• Survey first - we measure the building with Ekahau before deciding access point counts and placement, then tune power and channels after installation against how the building actually behaves.

If someone quotes an AP count without a site survey, they're guessing. Guesses cost you either coverage or money.

Every vendor makes equipment for this range; the real question is who runs it afterwards.

• Ubiquiti UniFi - solid wireless and simple day-to-day management for one building with no IT department and no server room. Built properly: controller configured, network segmented, roaming tested.
• Cisco small-business switching and ISR 1000-series routers - the routers run the same IOS-XE as the bigger boxes. The switches run simpler software, but with a published lifecycle and a clean path to grow into the larger Catalyst lines. The choice for a small site that needs enterprise features.
• MikroTik hAP-class routers - when RouterOS covers everything the site needs and budget matters more than a vendor logo.
• Compact FortiGate - a firewall that inspects what is in the traffic, not just where it came from and where it is going; at the perimeter, for a small office that has something worth protecting.
• We run it for you - no IT staff doesn't mean nobody watching: monitoring, updates, and changes under a support contract, so a small network gets the same care as a large one.

Small-site gear is built for small sites. If the business needs complex routing, detailed audit logging, or traffic kept separate between locations, it needs equipment a class up - even if the company itself is small.

• Cisco Nexus, with Arista as an alternative - modern leaf-spine fabrics (EVPN/VXLAN), where every server is equally close to every other, managed as code from the first day.
• New or post-lease - factory-new when the requirement or the vendor's support terms call for it; vetted post-lease hardware when it delivers the same fabric for a fraction of list price.

If two well-chosen switches meet the requirement with headroom, you don't need a fabric. We'll say so plainly.

The goal is simple: if one device gets compromised, the damage stays contained. How far we go depends on what's at stake:

• Zones and VLANs - the baseline: staff, guests, management, and devices like printers or cameras kept apart by design.
• VRF separation - departments or systems that must never mix get their own separate, unconnected networks on shared hardware, with controlled crossover only where it's needed.
• Identity-based access (AAA) - users and devices authenticate before they get onto the network, and admin logins to the equipment itself are centrally controlled and logged (802.1X, RADIUS, TACACS+).
• Micro-segmentation - isolation down to individual workloads, for the rare cases that justify it. Most companies don't need this level yet, and you'll hear that from us.
• Perimeter - where a straightforward firewall is enough, FortiGate does it well; when security is tangled up with complex routing, we keep both on the Cisco stack so one vendor is accountable for the whole path.
• Equipment in the building (IoT) - sensors, controllers, and building equipment get their own locked-down segments. We don't do industrial control systems (PLC/SCADA), and we say so up front.

A firewall license isn't a segmentation design. If nobody has mapped what must be kept apart from what, the hardware won't do it for you.

• VPNs - site-to-site and remote access, over IPsec, WireGuard, or SSL - chosen by throughput, what the devices at each end support, and who manages it afterwards.
• Traffic kept apart beyond the building - when departments or systems must stay isolated end to end, each keeps its own path across the link between sites too, so the separation designed in one building holds across all of them.

Remote access that's painful gets bypassed, and bypasses become breaches. Whatever we build has to be easy enough that people actually use it.

A surprising share of network problems start in the cabling, the rack, or the power - so we do that work ourselves.

• Copper and fiber - we plan the runs, then terminate and test them ourselves; fiber is spliced and measured, with the loss of every run - how much signal the path gives up - recorded in the handover documents.
• Racks and power - mounting, grounding, and cable management done properly; UPS and PDU capacity planned with whoever is responsible for the building's electrical installation.
• All the equipment, not just the network - printers, cameras and recorders, UPS units: configured, labeled, and documented along with everything else.

When a bid treats cabling as someone else's problem, the problem usually ends up being yours.

This is for companies where the whole network currently lives in one person's head.

• Configuration in Git - the whole network's settings live in a repository, and every change is reviewed, tested automatically before rollout, and has a rehearsed way back if something goes wrong.
• No secrets in text files - credentials are stored and rotated in a vault, and the procedures are written down.

Automating an undocumented network just automates the mess. Documentation comes first.