Most office network problems are not caused by slow internet. They come from how the network was put together: consumer equipment that was never meant for 30 people, Wi-Fi access points hidden in a cupboard, guests on the same network as the finance laptop, and nobody quite sure which cable goes where.
A well-designed network is mostly about a few sound decisions made early. This guide walks through them.
1. Start with requirements
Before choosing equipment, answer:
- How many people, devices and rooms? Include printers, phones, cameras, meeting room screens and anything else that connects.
- What depends on the network? Cloud apps, VoIP phones, video calls, point-of-sale, CCTV.
- How much downtime is acceptable? For some businesses, an hour without internet is an annoyance; for others it stops trading.
- Is there more than one site, and do they need to connect to each other?
These answers drive everything else.
2. Get the wired foundation right
Wi-Fi gets the attention, but the wired network does the heavy lifting:
- Use business-grade switches that support VLANs, and Power over Ethernet (PoE) if you will power access points, phones or cameras from them. Check the PoE budget covers every device.
- Cable access points, rather than relying on wireless links between them, wherever you can.
- Wire fixed devices such as desks used all day, printers and meeting room equipment.
- Label everything at both ends and keep a record of what each port connects to.
3. Plan Wi-Fi properly
- Place access points where people are, typically on ceilings in the middle of working areas, not in corridors or comms cupboards.
- Plan for capacity, not just coverage. A meeting room with 15 people on a video call needs more than one bar of signal.
- Use current standards. For new installations, Wi-Fi 6 (802.11ax) or Wi-Fi 6E access points are a sensible choice.
- Use WPA3 where your devices support it, with WPA2 only for older devices that need it. For larger offices, enterprise authentication (individual sign-in rather than one shared password) is far more secure.
- Keep one vendor across the office so devices roam smoothly between access points.
4. Segment the network with VLANs
A flat network, where every device can talk to every other device, means one compromised laptop or camera can reach everything. VLANs split one physical network into separate logical networks, with the firewall controlling what can pass between them.
For most small and mid-sized offices, a handful of segments is enough:
- Staff devices.
- Guest Wi-Fi, completely isolated from internal systems and allowed only out to the internet.
- Infrastructure and management for switches, access points and the firewall itself, reachable only by administrators.
- Devices that need extra care, such as printers, phones, cameras or point-of-sale, added where the business actually has them.
The key rule: guest traffic should never reach internal systems, and management interfaces should never be reachable from guest or general staff networks.
5. Choose the firewall carefully
The firewall sits between your network and the internet and enforces the rules between segments. Look for one that supports VLANs, VPN or secure remote access, regular security updates, and clear logging. Keep its firmware updated and its admin interface accessible only from the management network.
6. Plan for failure
- Second internet connection. If downtime is costly, a backup line from a different provider (or a mobile broadband failover) with automatic switchover is often worth it.
- Power protection. A UPS for the firewall, core switch and anything critical keeps the network up through short outages and allows a clean shutdown in longer ones.
- Spare parts or support contracts for critical hardware.
- Configuration backups for the firewall and switches, stored somewhere other than the devices themselves.
7. Connecting multiple sites
If you have more than one office, sites can be connected with site-to-site VPNs or with SD-WAN, which can use several internet connections at each site, choose the best path for each type of traffic, and be managed centrally. For businesses with several locations or heavy use of cloud applications, SD-WAN can simplify management considerably.
8. Monitor and document
- Monitor uplinks, switches, access points and the firewall so problems are noticed before users call.
- Keep a network diagram, IP address plan, list of VLANs, equipment inventory and the location of configuration backups.
- Record admin access and change it when staff or providers change.
Good documentation is what makes a network supportable by anyone other than the person who built it.
Where to start
If your network grew piece by piece, a short review of segmentation, Wi-Fi placement and single points of failure usually reveals a few high-value fixes. If you are moving offices, opening a new site or simply tired of network problems, book a free consultation and we will help you plan it.