Networking
Networking is the foundation every other system sits on. Our team designs and builds business networks from the cable up: structured cabling and cable management, PoE, switching, routing, wireless, fiber, point-to-point radio and 5G links, on the hardware businesses actually run.
Our team has designed networks for buildings of five to ten floors that had to serve thousands of members, and for small offices that needed one reliable link. The method is the same: a documented design, structured cabling, PoE, segmented switching and wireless planned from a site survey, and redundant circuits where an outage would cost real money. The track record page describes the network behind a coworking pioneer's first New York buildings.
Delivery covers the whole lifecycle. We survey, specify, install, configure and then operate the network under monitoring, with diagrams kept current so any engineer can pick up the work. When a design goes wrong, we also repair it: finding the loop, the failing uplink or the access point that was never placed correctly.
What we do
- Switching, routing and VLAN design with documented addressing
- Enterprise Wi-Fi design, surveys and tuning
- PoE planning for phones, cameras, access points and door controllers
- Structured cabling and fiber runs with clean labeling
- Redundant internet circuits with automatic failover
- Point-to-point radio and 5G links where fiber is not available
- Switch and access point migrations with tested rollback plans
- Network monitoring and configuration backup
We design for a quiet, predictable network: clear VLANs, clean addressing, redundant circuits, monitored uplinks, current documentation and a rollback plan for every change. Voice, cameras, access control and Wi-Fi share the same wires, so we plan power, capacity and segmentation together.
Networking connects directly to our Managed IT and Cybersecurity services. The same team that builds the network monitors and patches it, and the same design carries the segmentation, logging and remote-access controls that our security work depends on.
Leading platforms we work with
- Fortinet
- Juniper Networks
- HPE Aruba Networking
- Arista Networks
- Cisco
- Ubiquiti
- Cisco Meraki
- Extreme Networks
- MikroTik
Platforms and practices
- HPE
- Netgear
- TP-Link Omada
- Point-to-point radio
- Fiber
- 5G networks
- PoE
- Structured cabling & cable management
- VLANs, routing & wireless design
References
- Fortinet: Leader, 2025 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN Infrastructure (vendor-reported)
- Juniper Networks: Leader, 2025 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN Infrastructure (vendor page, report dated June 25, 2025)
- Juniper: Business Wire release on the 2025 Magic Quadrant (vendor release)
- HPE Aruba Networking: Leader, Gartner Magic Quadrant for Enterprise Wired and Wireless LAN, "19 years in a row" (vendor page; report dated June 25, 2025)
- Arista Networks: Leader, 2026 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN, report dated 18 May 2026 (vendor page)
- Cisco: Leader, 2026 Gartner Magic Quadrant for Enterprise Wired and Wireless LAN, report dated 18 May 2026 (Cisco blog, 20 May 2026, vendor-reported)
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
One VLAN, two datacenters, two carriers
VLAN 10 is carried in a VXLAN tunnel between two datacenters on separate carrier networks, and BGP EVPN announces where every MAC and IP lives. A workload can move to the other site and keep its IP address, its MAC and its sessions.
How we use Networking for clients
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan you take over our existing network equipment?
Yes, in most cases. We document what you run, review configurations and firmware, and take over day-to-day operation without a forced replacement. Where gear is end-of-life or cannot be managed properly, we say so and plan its replacement with you.
Do you work with several vendors or only one?
Several. The vendors listed on this page are platforms we have worked with, shown as experience and not as partnerships. We choose equipment for your needs and budget.
Can you monitor our network and respond when something fails?
Yes, as part of Managed IT. Paying clients get a 15-minute response.
Can you stretch VLANs between datacenters or sites?
Yes, using VXLAN with an EVPN control plane (RFC 7432) over a routed underlay. It suits live migration and disaster recovery, but the design must handle MTU (VXLAN adds about 50 bytes), latency and failure domains. When an application can be re-addressed, routing between sites is usually safer.
Do you run BGP, and what about our carriers?
Yes. We configure BGP (RFC 4271) sessions with carriers and peers, prefix filters and max-prefix limits, communities and local preference for path control, RPKI origin validation (RFC 6811) and BFD for fast failover. We use BIRD 2 and commercial routers, whichever fits.
What is the upgrade path from 10G to 25G, 100G or 400G?
Switch and server ports move through SFP+ (10G), SFP28 (25G), QSFP28 (100G) and QSFP-DD (400G). SFP28 ports accept SFP+ optics at 10G, and QSFP28 ports can break out into four 25G links, so a fabric can be upgraded in steps. We check optics, fiber type and reach before ordering.
Can you build separate networks per country or business unit?
Yes. We use separate VRFs, VLANs and firewall zones per region or unit, joined over IPsec, WireGuard or private circuits with explicit inter-segment rules. Overlapping address space can be isolated and, where needed, translated at controlled gateways.
How do you protect the network from floods and DDoS?
We combine upstream scrubbing or CDN protection for volumetric attacks with BGP blackholing or FlowSpec at the edge, and XDP/eBPF or firewall rate limiting closer to the servers. Sizing depends on your circuits and the traffic you expect, and the response is rehearsed in a runbook.