Design a network for a new office of 200 people. Walk me through it.

1. Questions first

How many floors and how large? Growth in three years? Desk phones or softphones? Cameras, badge readers, meeting room AV? Applications in SaaS, a data center or local servers? Connection to HQ? Downtime cost? Budget and in-house skills? Then state assumptions: two floors, growth to 250 people, mostly laptops on Wi-Fi, desk phones in some areas, SaaS heavy, a link to the HQ data center.

2. Physical

One closet per floor within the 100 m copper limit, fiber between closets and the main room on two paths, UPS per closet sized for the PoE load, a small comms room for the core and edge.

3. Switching

• Ports: about 200 desks, 30 meeting room and AV ports, printers, about 14 APs, 20 cameras, plus 20 percent spare: roughly 330 ports, so seven or eight 48-port PoE+ switches, a stack of four per floor. Multigigabit ports for the APs.
• Each stack has two 10G uplinks from different members, bundled into one EtherChannel to the core pair. 192 x 1G down against 20G up is 9.6:1, well inside campus norms.
• Collapsed core: two layer 3 switches, either a StackWise Virtual pair or two independent switches with VRRP or HSRP. The core hosts the SVIs and connects to the firewalls.

4. VLANs and addressing (site block 10.20.0.0/16)

5. Wireless

With 200 people carrying two or three devices each, plan for 400 to 600 wireless clients, not all active at once. A rule of thumb of 25 to 35 active clients per AP gives about 12 to 16 APs before meeting rooms are counted; a predictive survey sets the number and a validation survey checks it. 5 GHz and 6 GHz for corporate devices, 20 or 40 MHz channels on 5 GHz, WPA3-Enterprise with 802.1X, a guest SSID with a portal. Keep it to three or four SSIDs, since each one costs airtime.

6. Internet and WAN

Two internet circuits from different carriers with diverse building entries, an active/standby firewall pair, tracked default routes (or BGP if they have their own address space), and IPsec or SD-WAN to HQ and the cloud. SaaS breaks out locally.

7. Security

802.1X on wired ports with MAB for printers and cameras, DHCP snooping, dynamic ARP inspection, BPDU Guard, storm control. Firewall policy between users, IoT and servers. Guest isolated.

8. Services and management

DHCP (central with relay, or on the core), DNS, NTP, RADIUS, syslog, SNMPv3 or telemetry, NetFlow. A management VRF, a console server with LTE for out-of-band access, config backups and IPAM from day one.

9. Tradeoffs

On a tight budget I would accept one ISP plus LTE backup, or a single firewall with a fast support contract. I would not cut the second core switch or the UPS, because either failure takes the whole office down.