In short
Office network setup covers six parts: an internet connection (with backup if the business depends on it), a firewall, switches with power over Ethernet, business Wi-Fi with separate guest access, VLANs that keep staff, guests, phones and devices apart, and secure remote access. Plan cabling and the comms room early, especially before an office move.
Want help with Office network setup?
We can plan it with you or do it for you. Tell us where you are up to.
What an office network needs
- Internet connection: broadband or a leased line, sized for cloud applications, video calls and backups, with a second connection or cellular backup if downtime would stop work.
- Firewall: the boundary between your office and the internet, controlling what gets in and out, and usually providing VPNs to other sites and home workers.
- Switches: wired connections for desks, printers, phones, access points and cameras, with power over Ethernet (PoE) so those devices draw power from the cable.
- Wi-Fi: business-grade access points positioned for coverage and capacity, not a single router in a cupboard.
- Guest access: a separate wireless network for visitors that cannot reach your systems.
- Segmentation: VLANs that keep staff, guests, phones, printers and building devices apart.
- Remote access: a secure way for staff to reach office resources from home or on the move.
- Management: a way to see and change all of the above without visiting every box.
Plan before you build (or move)
Office moves are where network problems are baked in. Cabling is fitted before anyone thinks about where access points go, the comms cupboard is too small or too warm, and the internet circuit is ordered too late. Before a move or refit, work through:
- Headcount and growth: how many people and devices now, and how many in three to five years.
- Layout: desks, meeting rooms, reception, kitchen and any warehouse or outdoor areas.
- Internet lead times: leased lines and new fibre connections can take weeks to install, so order early and plan a temporary connection if needed.
- Comms room or cabinet: space, power, cooling, ventilation and security for the equipment.
- Cabling: data points to desks, ceilings (for access points), meeting rooms, printers and cameras, terminated back to the cabinet.
- Phones and AV: whether desk phones, meeting room systems and screens need wired ports and PoE.
- Security and compliance: what your insurer, clients or Cyber Essentials ask of you.
- Cutover: when the old network can be switched off and how to move without losing a working day.
Internet and WAN
For most offices the internet connection is now the network's most important part, because email, files, phones and line-of-business applications live in the cloud. Business broadband suits smaller offices; a leased line gives dedicated, symmetrical bandwidth for larger or busier ones.
Plan for failure as well as speed. A firewall with two WAN ports can fail over to a second connection, and a cellular gateway such as a Meraki MG can provide 4G or 5G backup. Forever Group supplies EE Business and Three Business, and can also supply O2 Business and Vodafone Business, for the data SIMs. If you have more than one office, see multi-site networks for joining them up.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Firewall and security
Your firewall should block unsolicited inbound connections, have its default admin password changed, and only expose services that genuinely need to be reachable from the internet. Those are among the controls Cyber Essentials sets out for firewalls, which is a good baseline for any UK office.
A unified threat management appliance such as the Meraki MX adds intrusion prevention, content filtering and malware protection on top of the firewall, depending on its licence edition (see Meraki Advanced Security). DNS-layer protection such as Cisco Umbrella with Meraki extends protection to users wherever they work.
Switching and power over Ethernet
Switches connect everything wired. When choosing them:
- Count ports, then add headroom for growth and new devices.
- Add up PoE. Access points, desk phones and cameras draw power from the switch. Check the total budget, not just the port count, and whether newer access points need higher-power PoE.
- Uplinks to the firewall and between switches should be fast enough that they are not the bottleneck.
- Managed, not unmanaged: VLANs, port security and monitoring all need managed switches.
Cloud-managed switches put every port in the same dashboard as your Wi-Fi and firewall. Our guide to cloud managed switches explains the options, and Meraki MS covers Meraki's own range.
Wi-Fi and guest access
Office Wi-Fi problems are usually design problems: too few access points, access points in the wrong place, or too many devices on one radio. Ceiling-mounted access points, positioned using a wireless site survey, fix most of them.
Run separate wireless networks for staff and guests. Staff Wi-Fi should use WPA3 or WPA2-Enterprise where devices support it, with each user or device signing in individually. Guest Wi-Fi should be isolated from your internal network, with a splash page where visitors accept your terms. Our cloud managed Wi-Fi page covers splash pages, identity PSK and guest isolation in detail.
Segmenting the office network
VLANs split one physical network into separate logical ones, so a compromised guest laptop or smart TV cannot reach your file server. A typical small office plan looks like this:
| VLAN | Who or what uses it | Typical rules |
|---|---|---|
| Staff | Company laptops and desktops | Access to internal resources and the internet |
| Guest | Visitors' devices | Internet only; no access to other VLANs; bandwidth limits |
| Voice | Desk phones and meeting room systems | Prioritised with quality of service; access only to the phone system |
| Printers and devices | Printers, screens, building systems and other IoT | Reachable from staff devices for the services they offer; little else |
| Cameras | CCTV cameras | Reachable only by the people and systems that view footage |
| Management | Switches, access points and other network devices | Reachable only by network administrators |
Firewall rules between VLANs decide what may talk to what. Start strict and open only what is needed.
Not sure which plan applies to you? Ask us
Tell us about your organisation and we will point you to the right plan.
Remote access for staff
Staff working from home or travelling still need some office resources. The main options:
- Client VPN from the firewall, which gives a laptop a tunnel back to the office.
- A teleworker gateway at home, such as a Meraki teleworker gateway, which extends the office network (including Wi-Fi) to a home desk.
- Zero trust network access, which gives users access to specific applications rather than the whole network. Our sister site explains ZTNA.
If most of your applications are already in the cloud, remote access may be needed only for a few internal systems.
The cloud-managed office network
A cloud-managed design puts the firewall, switches and Wi-Fi in one web dashboard. With Cisco Meraki that looks like this:
| Part of the network | Meraki product family | Read more |
|---|---|---|
| Firewall, SD-WAN and VPN | MX security and SD-WAN appliances | Meraki MX |
| Switching and PoE | MS switches or cloud-managed Catalyst switches | Meraki MS |
| Wi-Fi | MR access points or Cisco Wireless Wi-Fi 7 access points | Meraki MR, Meraki Wi-Fi 7 |
| Cellular backup | MG cellular gateways | Meraki MG |
| Home workers | Z-series teleworker gateways | Teleworker gateway |
| Cameras | MV smart cameras | MV licence |
There is no controller or management server to look after, firmware upgrades are scheduled from the browser, and adding a second office later means adding a network to the same dashboard. Every Meraki device needs an active licence, which is the main ongoing cost to plan for: see Meraki licensing models. For the step-by-step build, read Meraki setup.
How Forever Systems helps
Forever Systems is a Cisco Partner and part of Forever Group, which also supplies business connectivity and phone systems. For an office network we can plan the move with you, survey the building, design the network, order the internet connection, supply and configure the equipment, and coordinate cabling and installation.
Ask us for a quote: contact us with your address, headcount and move date if you have one.
Working with us on Cisco Meraki
Forever Systems helps organisations plan, buy and run cloud-managed networks built on Cisco Meraki wireless, switching, security and SD-WAN.
- Plan the network: we look at your sites, users and existing kit, and can arrange a wireless site survey before anything is ordered
- Choose the right products: access points, switches, security appliances, cellular gateways, sensors and cameras sized to what each site needs, rather than a one-size bundle
- Licensing made clear: we explain co-termination, per-device and subscription licensing, check renewal dates and quote the licences you need
- Deployment help: we can set up the Meraki dashboard, organisations, networks, templates and policies, and help move you from older or on-premise kit
- Ongoing help: changes, licence renewals and reviews as your sites grow, with the scope agreed at quote
Ask us for a quote and we will confirm what is included for your organisation.
Frequently asked questions
What equipment do I need for a small office network?
An internet connection, a firewall, one or more managed switches with power over Ethernet, business Wi-Fi access points and the cabling to connect them. Most offices also need guest Wi-Fi, VLANs to separate traffic and some form of remote access for staff.
How do I set up a network for a small office?
Plan the layout, cabling and internet connection first, then install a firewall, switches and access points, create separate VLANs and Wi-Fi networks for staff and guests, set firewall rules between them, and test coverage and security before staff move in. A cloud-managed system lets you do the configuration from a web dashboard.
Should office Wi-Fi and guest Wi-Fi be separate?
Yes. Guests should be on their own wireless network and VLAN, with internet access only and no route to your internal systems. Cloud-managed access points can add a splash page and bandwidth limits to the guest network.
Do I need a leased line for my office?
Not necessarily. Business broadband suits many small offices. A leased line makes sense when you need dedicated, symmetrical bandwidth or depend heavily on cloud applications and video calls. A second connection or cellular backup protects you if the main one fails.
What is PoE and why does it matter?
Power over Ethernet lets a switch supply power through the network cable to access points, desk phones and cameras. It removes the need for a power socket next to each device, but the switch must have enough total PoE budget for everything connected to it.
Still have a question about Office network setup?
Ask us and a member of our team will reply by email.