Network Segmentation, VLANs and Device Isolation for Business

Does this sound familiar?

• Our guest Wi-Fi shares the office network.
• Our CCTV cameras and computers are all on one subnet.
• Card machines, tills, laptops and access-control equipment all sit together.
• We need to separate factory or warehouse devices from office IT.
• Nobody is sure which devices can reach the server, or why.

None of these are unusual. Networks tend to grow one device at a time, and the result is often one large network where everything can talk to everything else. That is convenient until a single infected laptop, an out-of-date camera or a visitor's phone can reach systems it should never see.

What we design and configure

• Discovery and risk review of the existing switches, router, Wi-Fi, IP addressing, unmanaged devices and internet links.
• Trust zones for management, staff, servers and business applications, guests, VoIP, CCTV, door access, IoT and production equipment where needed.
• VLANs plus firewall or ACL rules that decide which zones may talk to each other, denying traffic by default where that suits how the business works.
• Guest Wi-Fi isolation, so visitors get internet access without reaching internal devices.
• Separate CCTV and NVR networks, with only the viewing and management access you approve, and no cameras left openly exposed to the internet.
• Switching and wireless setup: PoE switch ports, SSID-to-VLAN mapping, and Wi-Fi security such as 802.1X or per-device keys where the equipment supports it.
• Voice quality: QoS for VoIP, and the DNS, DHCP and controller access that phones and other devices still need.
• Records: configuration backups, documentation and change control, so the design survives staff changes and future work.

An example layout

This is an illustrative layout, not a customer's network. Every site is designed around its own devices and the way the business works.

• Internet or private WAN, into a managed firewall or gateway, then a managed PoE switch with VLAN support. From there:
  • Staff and office devices: controlled access to approved systems
  • Servers and business applications: restricted services only
  • Guest Wi-Fi: internet only, no access to the office network
  • VoIP phones: the call services they need, with voice prioritised
  • CCTV and recorder: restricted management and approved viewing
  • Door access and IoT: only the controllers they rely on
  • Factory or production equipment: approved operational traffic only
  • Network management: administrator access only

For an example of completed work, see the Wi-Fi 7 installation at a manufacturing site, where the machines on the factory floor were isolated on their own network segment, separate from the office network.

A VLAN on its own is not isolation

Separating devices into VLANs only helps if the rules between them are set and enforced. Without firewall or ACL policies, traffic can often still pass from one VLAN to another through the router. We design the rules as a simple trust matrix (which zone may reach which, on which services), apply them on equipment that can enforce them, and then test them.

Testing matters. We check that each zone can reach what it should and nothing else, including printers, phones, cameras and any failover connection, before the network is handed back. Segmentation reduces the routes an attacker or a faulty device can take. It cannot guarantee that every attack is stopped, so it works best alongside properly configured firewalls, endpoint protection and patching.

How a segmentation project works

1. Survey the site, the devices and how they are used.
2. Design the zones and the trust matrix, and agree them with you.
3. Implement the VLANs, rules and wireless settings, usually in planned stages.
4. Test isolation, essential services and failover behaviour.
5. Hand over documentation, configuration backups and the agreed change process.
6. Optional ongoing management of the firewall, switches and Wi-Fi under a support agreement.

Existing switches and access points can sometimes be kept if they support VLANs and the rules you need. We check that first and tell you plainly if a device has to be replaced.

Related services

• Business firewalls and secure routers - where the rules between zones are enforced
• Business Wi-Fi installation - staff, guest and device Wi-Fi on separate networks
• CCTV installation - cameras on their own isolated network
• Cyber security services - how segmentation fits a wider security approach

Onsite network design and installation across Northern Ireland, including Belfast and Lisburn. Remote management and support elsewhere where suitable.