Network Infrastructure

How It Works & Technology Overview

Network infrastructure is the transport layer every other trade rides on — and in technical-services work it carries relentless real-time payloads (camera streams, door controllers, voice, AV-over-IP) that punish design shortcuts bursty office traffic would forgive. The design axes: switching architecture (access/distribution/core; sustained non-blocking backplane throughput, not port count), uplink sizing (aggregate closet-to-core load; 10G+ fiber trunks where multiple IDFs converge), PoE budgets (calculated on peak draw with ~20% headroom — the facility-wide reboot after a power event is the sizing case; PoE/PoE+/PoE++ classes matter per endpoint), segmentation (VLANs per system, firewall zones, increasingly zero-trust micro-segmentation), multicast control (IGMP snooping + querier placement wherever AVoIP or camera streams live), and WAN/edge (firewall sizing on inspected throughput with UTM enabled, SD-WAN traffic steering, LTE failover for continuity — with data-cap and latency caveats). Copper runs live under the 100 m/328 ft Ethernet limit; beyond that it's fiber or extension hardware. Cloud-managed platforms have made basic deployment fast; the complexity moved into integration with what already exists.

Common Deployment Scenarios

• Greenfield buildout: design-first — closet topology, endpoint payload matrix, right-sized everything. The clean case; also the rare case.
• Brownfield refresh: replacing switching/routing inside someone else's undocumented decisions — runs 30–50% longer than identical greenfield scope; discovery and tracing hours are real line items.
• Dedicated AV/security networks: isolated infrastructure for cameras, access control, or AVoIP — often the cleanest architecture when corporate IT doesn't want integrator traffic on their LAN.
• Corporate-network integration: integrator endpoints on a managed enterprise network — 802.1X onboarding, change control, firewall requests; friction worth an explicit labor premium.
• Multi-site SD-WAN: cloud-managed edge devices with auto-VPN; per-site cookie-cutter after the first site's template is right.
• Cloud-managed pre-provisioning: claim devices in the dashboard and build the network profile before the site visit — converts field time into bench time and is standard practice on Meraki-class platforms.

Products, Vendors & Characteristics

• Cloud-managed: Cisco Meraki (dashboard simplicity, auto-VPN; license-lapse bricks management; advanced troubleshooting still needs real network skills), Ubiquiti UniFi (no licensing, SMB/prosumer sweet spot, support is community-grade), Aruba Instant On, Fortinet's Fabric.
• Enterprise switching/routing: Cisco Catalyst, HPE Aruba, Juniper (both HPE since it closed the Juniper acquisition in July 2025 — confirm which platform and management tool the client actually runs); multi-gig (2.5/5/10G) access ports for modern APs.
• Firewalls: FortiGate (UTM depth — full inspection cuts rated throughput several-fold; size on inspected numbers), Palo Alto, SonicWall, WatchGuard, Meraki MX (SD-WAN-first). "Any-any" rule migrations and unoptimized policies tax both security and throughput.
• SD-WAN/SASE: Meraki, Fortinet, Velo/Broadcom, Cato — each with its own policy engine; SASE converges SD-WAN with cloud-delivered security and moves policy management to yet another pane of glass.
• Firmware discipline: auto-updating platforms occasionally ship behavior changes — review release notes, schedule maintenance windows; factory-fresh gear ships with mismatched firmware that breaks device discovery, so bench-stage and sync before deployment.

What Makes It Hard (Gotchas & Failure Modes)

• The physical layer is where "network problems" start: marginal terminations pass at 1G and fail at 2.5/10G (get certification reports before committing to multi-gig); legacy multimode fiber fails at modern distribution speeds (demand certified test results; verify single- vs multi-mode before ordering optics); hot, unventilated IDF closets throttle and kill switches.
• The "available port" deception: an open slot ≠ capacity — check PoE budget remaining, backplane load, and whether admin access even exists.
• Multicast escapes: misconfigured IGMP lets AVoIP/camera streams flood the corporate LAN and take down business systems during commissioning — the classic integrator-meets-IT-director incident.
• Undocumented reality: treat existing network maps and port schedules as unverified; discovery/audit hours belong in every brownfield estimate. Poor documentation can double integration time.
• Cutovers without rollback: production VLAN changes and core swaps need maintenance windows and a tested rollback path — 2 a.m. is not the time to design plan B.
• External dependencies: ISP circuit delivery and static-IP assignment gate cloud-dependent systems — enforce a live-circuit contractual milestone before mobilizing techs; carrier timelines are not yours.
• Zero-trust ambitions vs legacy applications: micro-segmentation requires an application-dependency map nobody has; without discovery, ZTA projects stall at the first broken legacy app.

Effort & Estimation Patterns

• Access-layer switch replacement (24-port, same closet, existing cabling): 2–3 hours including config migration.
• Core switch replacement with VLAN reconfiguration: 4–8 hours plus maintenance window.
• Firewall deployment + initial policy set: ~1 day; complex rule-set migrations 3–5 days (see cybersecurity category).
• Full IDF build-out (patch panels, stack, terminations, labeling): 1–2 days per closet by port count.
• SD-WAN per site: 4–6 hours after the first-site template exists; first site carries the design time.
• Bench staging (claim, configure, firmware-sync): 15–45 minutes per device that pays for itself in field time.
• Brownfield multiplier: +30–50% over greenfield for the same scope; add explicit discovery hours (network diagrams, IP schema, application inventory) — without discovery, estimates are guesses that reliably overrun.
• Testing and documentation are project labor: copper certification, fiber OTDR/power-meter tests, labeled as-builts, and client handover commonly add 15–25% and are the first thing cut and the first thing regretted.
• Recurring: cloud-managed licensing resale, monitoring/alert response per site per month, and firmware-maintenance windows as scheduled service.