How to design a network from scratch
Most of the cost of a network is decided in the first hour, by choices that are cheap now and expensive later.
The order that works
- Count what connects. Devices now, and honestly what in three years.
- Decide what needs separating. Guests, cameras, building systems and management are the usual four. Not departments.
- Get an address space and divide it. Larger than you need, with gaps.
- Draw the physical topology. What plugs into what.
- Then choose equipment. Not before — the design tells you what the equipment has to do.
Buying first and designing around what arrived is the commonest way to end up with a network nobody can extend.
Addressing decisions you cannot undo cheaply
Take more space than you need. A 10.x.0.0/16 per site costs nothing and removes renumbering from your future. Starting with a /24 because that is what you need today is the decision people regret most.
Leave gaps. VLANs 10, 20, 30 rather than 1, 2, 3. Subnets with room between them. Renumbering a live segment is disruptive; leaving space is free.
Be consistent. VLAN 20 on 10.x.20.0/24, gateway always at .1. It costs nothing at design time and saves a great deal at two in the morning.
Avoid 192.168.0.0/24 and 192.168.1.0/24. They are the default on every home router, and the day someone connects by VPN from home, both ends have the same subnet and nothing routes.
What to separate, and what not to
Separate things that differ in how much you trust them, not in which department owns them.
- Guest wireless — internet only, nothing internal.
- Cameras and building systems — rarely patched, often reachable by their vendor, and should be able to talk to almost nothing.
- Management — switch and firewall interfaces, reachable only from where administration happens.
- Everything else can usually share until there is a reason otherwise.
A VLAN per department in one office adds configuration to maintain and separation nobody enforces, because the routing between them permits everything anyway.
The mistakes that cost most
A DHCP pool covering the gateway. The scope eventually leases the router's own address to a laptop and the subnet loses its default route.
An address space too small. Every fix is renumbering.
No documentation. Not because documentation is virtuous, but because the next person starts every change with an investigation.
Single points of failure nobody noticed. One switch that everything hangs off, one uplink, one firewall.
Frequently asked questions
How much address space should I take?
More than you need. A /16 per site costs nothing and removes renumbering from your future. Starting with exactly what fits today is the decision people regret most.
How many VLANs does a small office need?
Often four or five: users, voice, guest wireless, cameras and management. A VLAN per department adds work without adding separation anyone enforces.
Why avoid 192.168.1.0/24?
It is the default on nearly every home router. The day someone connects by VPN from home, both ends have the same subnet and nothing routes.
Should I document the design if it is only a small network?
Especially then. Small networks are the ones with no second person who knows how they work, and the document is what makes a change possible without an investigation first.
Should I buy equipment first?
No. The design tells you what the equipment has to do. Designing around what already arrived is how networks end up impossible to extend.
Open the architecture designer →