Simple Network Design

1. Understanding the requirements

Write down the objectives before selecting or placing any equipment.

Examples of objectives:

• Wi-Fi should cover areas X, Y, and Z.
• Network X is intended for staff devices.
• Network Y is intended for guest devices.
• Cameras must communicate with the recording server.
• IP phones must reach the VoIP service.
• Guest devices must have internet access but no access to internal systems.

Write down the technical requirements separately.

Example requirements:

• Staff VLAN:
  • Password-authenticated or centrally authenticated.
  • Access to approved internal services.
• Guest VLAN:
  • Open network with web-portal authentication.
  • Internet access only.
  • Client isolation when required.
• Camera VLAN:
  • Access to the recording system.
  • No unnecessary internet access.
• Management VLAN:
  • Used only for managing network devices.

Also define:

• Required internet speed.
• Expected number of users.
• Expected number of devices per user.
• Maximum number of simultaneous clients.
• Applications that will be used.
• Required Wi-Fi coverage areas.
• Required availability.
• Acceptable downtime.
• Expected future growth.

The number of simultaneous users is usually more important than the total number of possible users. A space with many concentrated clients requires more capacity and may need more access points, even when one access point could technically cover the entire area.

Example: A small hotel wants Wi-Fi in the reception, restaurant, and 30 guest rooms. The network must support up to 80 simultaneous guest devices, 15 staff devices, 20 cameras, and 10 IP phones. Guests must access only the internet, while staff must also access the property-management system and printers.

2. Recording the scope and constraints

Write down the limits that affect the design.

These may include:

• Available budget.
• Installation deadline.
• Areas included in the project.
• Areas excluded from the project.
• Existing equipment that must be reused.
• Available internet connections.
• Building restrictions.
• Available cable routes.
• Locations of electrical outlets.
• Allowed installation downtime.
• Equipment availability.
• Environmental conditions.

Inspect the existing infrastructure before designing replacements or additions.

Record:

• Existing router or firewall.
• Existing switches.
• Existing access points.
• Existing network cabinets.
• Existing cabling.
• Existing fiber links.
• Internet service entry points.
• Existing VLANs and IP ranges.
• Equipment that is outdated, damaged, or unsupported.

A technically ideal design may not be practical when the available budget, cabling, power, or building structure is taken into account.

Example: The project has a budget of €5,000 and must reuse two existing PoE switches. New cables cannot be installed through the main lobby during operating hours. The installation must therefore use existing cable routes and be completed between 01:00 and 06:00.

3. Estimating users, devices, and traffic

Estimate how the network will be used.

Record:

• Number of staff users.
• Number of guests.
• Number of devices per person.
• Number of cameras.
• Number of phones.
• Number of printers.
• Number of servers and controllers.
• Maximum number of simultaneous Wi-Fi clients.
• Expected peak usage times.

Identify the expected traffic.

Examples include:

• General web browsing.
• Video streaming.
• Video calls.
• Cloud applications.
• File transfers.
• Camera streams.
• VoIP calls.
• Backups.
• Software updates.

Consider both current and future demand. A reasonable design should leave room for growth without requiring the entire network to be rebuilt.

Example: A restaurant expects 100 customers during peak hours. If each customer may use two devices, the design should consider up to 200 guest devices instead of assuming only 100. Staff tablets, payment terminals, cameras, and phones must be added separately.

4. Designing the logical network

The logical design explains how devices communicate, regardless of where they are physically installed.

Define:

• VLANs.
• IP subnet for each VLAN.
• DHCP range for each subnet.
• Default gateway for each subnet.
• DNS services.
• Static IP reservations.
• Routing between VLANs.
• Firewall rules.
• Internet access rules.
• SSID-to-VLAN assignments.
• Management access rules.

For every VLAN, clearly define:

• Which devices belong to it.
• Which internal services it may access.
• Whether it may access the internet.
• Whether other VLANs may connect to it.
• Whether devices inside it may communicate with each other.

Use the principle of least privilege. Allow only the communication that is required.

For example:

• Guest devices should normally reach the internet but not staff devices, cameras, printers, servers, or network-management interfaces.
• Camera devices should normally reach the recording server but not unrelated internal systems.
• Network-management interfaces should be accessible only from approved administrator devices or a management network.

Example logical plan:

• VLAN 10 — Staff:
  • Subnet: 192.168.10.0/24
  • Internet access: Allowed.
  • Access to printers and internal applications: Allowed.
• VLAN 20 — Guests:
  • Subnet: 192.168.20.0/23
  • Internet access: Allowed.
  • Access to internal networks: Blocked.
• VLAN 30 — Cameras:
  • Subnet: 192.168.30.0/24
  • Access to recording server: Allowed.
  • General internet access: Blocked.
• VLAN 99 — Management:
  • Subnet: 192.168.99.0/24
  • Accessible only from administrator devices.

5. Designing the physical plan

Open the building map digitally or print it.

Sketch where each device should be installed. Label every device with its type and, when possible, a unique identifier.

Examples:

• Access point.
• Camera.
• PC.
• Printer.
• IP phone.
• Router.
• Firewall.
• Switch.
• Network cabinet.
• Patch panel.
• Server.
• UPS.

The physical plan should also show:

• How the devices connect.
• Cable routes.
• Uplink connections.
• Fiber links.
• Switch locations.
• Internet service entry points.
• Network cabinet locations.
• Power sources.
• Outdoor installation areas.
• Connections between floors or buildings.

Do not design only the final device positions. Also design how power and data will reach each device.

Example: Place one network cabinet in the ground-floor technical room. Connect it to a second-floor cabinet using fiber. Connect access points, cameras, and phones to the nearest PoE switch instead of running every cable directly to the main cabinet.

6. Planning Wi-Fi coverage and capacity

Do not treat Wi-Fi coverage as a fixed circle around an access point.

Usable coverage depends on:

• Access-point model.
• Antenna type.
• Antenna orientation.
• Transmit power.
• Frequency band.
• Channel width.
• Client-device capabilities.
• Walls and construction materials.
• Furniture and equipment.
• Metal structures.
• Interference.
• Number of simultaneous clients.
• Required speed and connection quality.

Higher-frequency bands generally provide less penetration and range than 2.4 GHz, although they can provide more available bandwidth and channels.

Access points should usually be placed close to the users they serve.

Keep the building materials in mind. Additional interior access points may be necessary when:

• The space is very wide.
• There are many separate rooms.
• Walls are thick.
• Walls contain concrete or metal reinforcement.
• Elevators, machinery, storage systems, or metal surfaces block or reflect the signal.
• One access point would need to pass through several walls.
• The expected number of clients is high.

Approximate signal-power reduction through common materials may include:

• Drywall: approximately 3 dB, or about 50% power reduction.
• Brick wall: approximately 10 dB, or about 90% power reduction.
• Concrete wall: approximately 12 dB, or about 94% power reduction.

These values are planning estimates. Actual loss depends on:

• Material thickness.
• Moisture.
• Reinforcement.
• Conductivity.
• Construction method.
• Frequency band.
• Signal angle.

The percentages describe approximate radio-power reduction. They do not mean that usable Wi-Fi range is reduced by exactly the same percentage.

Metal and reinforced structures can cause even more severe signal loss or reflection. Treat them conservatively during planning.

Design access-point placement based on expected real conditions, not the best-case range advertised by the manufacturer.

Also plan:

• Frequency bands.
• Channel allocation.
• Channel width.
• Transmit power.
• SSIDs.
• VLAN assignments.
• Cell overlap.
• Roaming.
• Minimum acceptable signal strength.
• Minimum acceptable throughput.
• Maximum expected clients per access point.

Access-point orientation also matters. An access point designed for ceiling installation may not provide the intended coverage pattern when mounted vertically on a wall.

Start with a conservative predictive design. After installation, perform an on-site wireless survey and test the network using real client devices.

Example: A corridor has ten rooms on each side, separated by reinforced concrete walls. One access point at the beginning of the corridor may show a signal at the opposite end but still provide poor performance inside the rooms. A safer design may use multiple ceiling-mounted access points distributed along the corridor and validate the result inside each room.

7. Planning cabling and power

For every wired device, verify:

• Required cable type.
• Cable-route length.
• Cable quality.
• Patch-panel capacity.
• Available switch ports.
• Uplink capacity.
• Need for fiber between floors or buildings.
• Indoor or outdoor cable requirements.
• Grounding and surge-protection requirements.

For Power over Ethernet devices, verify:

• Whether the switch supports the required PoE standard.
• Power required by each device.
• Total PoE budget of the switch.
• Available PoE capacity after all devices are connected.

A switch may have enough physical ports but still lack enough PoE capacity to power every connected access point, camera, or phone.

Plan electrical protection for important equipment.

Consider:

• UPS protection.
• Required UPS runtime.
• Surge protection.
• Generator support.
• Safe shutdown procedures.
• Cooling and ventilation inside network cabinets.

Example: A 24-port PoE switch has a total power budget of 195 watts. Twelve cameras require 10 watts each, and six access points require 15 watts each. The total expected demand is 210 watts, so the switch does not have enough PoE capacity even though it has enough available ports.

8. Planning security

Security should be part of the original design, not something added after installation.

Define:

• Staff authentication.
• Guest authentication.
• Guest-device isolation.
• Firewall rules.
• Inter-VLAN access.
• Administrator access.
• Management VLAN.
• Credential policy.
• Firmware-update policy.
• Logging and monitoring.
• Configuration-backup policy.
• Physical access to cabinets and devices.

A shared Wi-Fi password may be sufficient for a small, controlled environment. Larger environments may benefit from WPA2-Enterprise or WPA3-Enterprise with individual user authentication.

Protect network-management interfaces from guest and ordinary staff networks.

Change default credentials and disable unused management services.

Example: Guests connect to an open SSID and authenticate through a captive portal. Firewall rules allow them to access the internet but block all private IP ranges. Switches, access points, and the firewall can only be managed from the management VLAN using approved administrator devices.

9. Planning resilience

Identify what happens when each important component fails.

Review:

• Internet connection.
• Router or firewall.
• Core switch.
• Access switches.
• Wireless controller.
• Fiber uplinks.
• Power supply.
• UPS.
• DHCP and DNS services.

Depending on the importance of the network, consider:

• Backup internet connection.
• Redundant firewall.
• Redundant core switch.
• Redundant uplinks.
• Link aggregation.
• Controller high availability.
• Spare access points or switches.
• Configuration backups.
• Replacement procedures.

Not every simple network needs full redundancy. However, every design should clearly identify its single points of failure and the effect of each possible failure.

Example: A small office may use one firewall without redundancy because temporary internet downtime is acceptable. However, its configuration should be backed up, and a replacement device should be available so the network can be restored without rebuilding the configuration manually.

10. Questioning and polishing the designed plan

Review the original requirements again.

Cross-check every part of the plan against them.

Ask:

• Does Wi-Fi cover every required area?
• Is the design based on realistic building materials?
• Is there enough capacity for peak usage?
• Are access points placed near the users?
• Does every device have a suitable network connection?
• Does every VLAN have a clear purpose?
• Are IP ranges large enough?
• Are firewall rules clearly defined?
• Are guest devices isolated?
• Are management interfaces protected?
• Are enough switch ports available?
• Is the PoE budget sufficient?
• Are cable routes practical?
• Are any links likely to become bottlenecks?
• Are important components protected by a UPS?
• Are there unacceptable single points of failure?
• Can the network expand without major redesign?
• Can another technician understand and maintain the design?

Be conservative when information is uncertain. Avoid designing around perfect signal propagation, maximum advertised performance, or ideal client behavior.

Example: The original plan includes one access point for a conference room that can hold 100 people. The signal may cover the room, but the access point may not provide enough capacity for 100 active devices. The plan should be revised based on expected client density, not only coverage.

11. Defining testing and acceptance criteria

Define measurable acceptance criteria before installing the network.

Examples:

• Every required area has usable Wi-Fi coverage.
• Clients connect to the correct SSID.
• Clients receive an IP address from the correct subnet.
• Staff devices can access approved services.
• Guest devices cannot access internal networks.
• Cameras can reach the recording server.
• IP phones can reach the VoIP service.
• Internet speed meets the agreed target.
• Roaming works in areas where users move between access points.
• The network remains stable during expected peak usage.
• Backup links work when the primary link fails.
• UPS systems provide the required runtime.

After installation, test:

• Wired connectivity.
• Wireless coverage.
• Wireless throughput.
• DHCP.
• DNS.
• Internet access.
• Inter-VLAN routing.
• Firewall restrictions.
• Guest isolation.
• Roaming.
• PoE operation.
• Failover.
• Monitoring.
• Logging.

Test under realistic conditions where possible. An empty building may produce different Wi-Fi results from the same building when it contains people, furniture, equipment, and many active devices.

Example: Connect a test device to the guest Wi-Fi. Confirm that it receives an address from the guest subnet, can access the internet, cannot reach the staff printer, cannot open the firewall-management page, and cannot communicate with another guest device when client isolation is enabled.

12. Documenting the final network

Update the original plan after installation so it represents the network that was actually built.

Document:

• Physical topology.
• Logical topology.
• Device names.
• Device models.
• Serial numbers.
• Management IP addresses.
• VLANs.
• Subnets.
• DHCP ranges.
• Default gateways.
• Switch-port assignments.
• Patch-panel ports.
• Cable labels.
• Rack positions.
• SSID assignments.
• Firewall rules.
• Firmware versions.
• Configuration-backup locations.
• Internet-provider information.
• Maintenance procedures.
• Troubleshooting notes.
• Change history.

Store sensitive credentials separately in an approved password manager. Do not place plaintext passwords inside general network diagrams or documentation.

Good documentation allows another technician to understand, maintain, troubleshoot, and expand the network without having to rediscover how it works.

Example: Document that access point AP-02 is installed in the first-floor corridor, uses management IP 192.168.99.12, connects to switch SW-F1 port 8, receives power through PoE, broadcasts the Staff and Guest SSIDs, and is connected to patch-panel port F1-08.