Networking & Enterprise WiFi

Most problem networks share one flat subnet. The point of sale sits next to the guest phones. The cameras broadcast into the same domain as the office computers. One compromised laptop can reach everything. We start with VLANs: payment devices on their own segment, IP cameras on another, door and building systems on a third, staff wireless separated from guest wireless and both firewalled from the rest.

Segmentation is a performance decision as much as a security one. Cameras push video continuously, and a dozen high-resolution streams will happily consume a switch uplink that nobody sized for them. When that happens, the symptom is never that the cameras are slow — it is that the card reader times out at the register. Giving camera traffic its own VLAN and its own path to the recorder keeps the rest of the building responsive.

Rules between segments get written on purpose. The camera VLAN reaches the recorder and nothing else. Guest wireless reaches the internet and nothing else. Management interfaces answer only to specific hosts. Every allowed path exists because someone decided it should, and it is documented so the next person can see why.

Access point placement comes from the floor plan and a walk of the space, not from wherever the cable happened to land. Sheetrock, block, brick, mirrored walls, walk-in coolers and steel racking all attenuate differently. A layout that ignores building materials produces dead spots that no amount of transmit power will fix, and cranking power usually makes roaming worse, not better.

Density matters as much as square footage. A 4,000 square foot restaurant with two hundred people on their phones is a completely different problem from a 40,000 square foot warehouse with six scanners. Dense spaces get more access points at lower power with tighter channel reuse. Open spaces get fewer units placed for reach. Outdoor coverage gets hardened, properly grounded APs rated for weather rather than an indoor unit shoved under a soffit.

Channel plans and power levels are set deliberately, DFS behavior is accounted for, and features like band steering and minimum RSSI are enabled where they genuinely help clients hand off instead of clinging to a distant AP two rooms away.

Commercial equipment earns its cost in the details. Managed switches give you VLANs, port isolation, link aggregation, spanning tree and per-port counters when you need to prove where a problem lives. Consumer equipment gives you a reboot button and a guess.

Power over Ethernet gets budgeted rather than assumed. A switch advertising a few hundred watts of PoE will not carry a full run of PTZ cameras with heaters, and PoE++ devices such as high-power pan-tilt-zoom cameras, wireless bridges and large touch panels draw multiples of what a standard access point needs. We total the real draw per switch, leave headroom for growth, and size the UPS so the network and the recorder stay up through a short outage instead of dropping together.

We work primarily with UniFi and MikroTik. UniFi covers most offices, restaurants, retail and multi-AP wireless well, with a controller that a manager can actually look at. MikroTik goes in where routing, bandwidth shaping, tunneling or unusual carrier handoffs need precise control. Running both in one building is normal when each is doing what it is good at.

For a business that cannot take orders when the circuit drops, a single internet connection is a single point of failure. We configure dual-WAN with active health checks so traffic moves to a secondary circuit or an LTE backup automatically, and we decide in advance which services follow — usually payment and phones first, guest wireless last or not at all, so a metered backup link is not consumed by streaming video.

Multi-site businesses get site-to-site tunnels so locations share resources, cameras and management without exposing anything to the open internet. Client VPN handles the owner checking in from home or a vendor needing temporary access to one system. Remote access is scoped to what the person needs rather than dropped onto the whole network.

Where the equipment supports it, we monitor the network — a WAN failure, an access point that stopped responding, a switch port flapping or a PoE fault, often before anyone on site calls. Firmware and configuration backups can be handled the same way, so a failed device is a swap and a restore instead of a rebuild from memory.

How much documentation a build includes depends on its scale, and we scope that up front rather than leaving it vague. On anything with multiple VLANs or more than a couple of switches it is worth having — it matters when a new phone vendor shows up, when a landlord changes the demarc, or when you eventually work with someone else. Either way we build networks another competent technician can pick up and understand.