Each post in this series takes one real kind of business and designs its network from nothing: the brief, the requirements, the VLAN and address plan, the policy matrix, every line of config, animated diagrams for anything that happens over time, failure drills before handover, and a bill of materials.
The architecture guides explain patterns in the abstract, and the Cisco and MikroTik series teach one technology at a time. A Build post starts from a client brief instead, and every VLAN, ACL line and config block has to trace back to a requirement in it. That traceability is the point of the series. All of them are also filed under the build category on the blog.
Each one follows the same structure: brief → design decisions → address plan → policy matrix → build → verify & break → attacker's view → bill of materials. The core of each build also runs in Packet Tracer, and the post says which parts need CML or EVE-NG.
Professional Offices
Small offices with large legal duties: client files, regulators, and visitors in the meeting room.
01The Law Firm Network28 people on two floors, built bottom-up in 13 tested steps, with Packet Tracer-style diagrams for each step: access, core, servers, policy, 802.1X, edge, PAT, failover, VPN, backups.70 min→Hospitality & Leisure
Strangers on the Wi-Fi or at the keyboard, payments at the counter, and latency or uptime as the product.
02The Gaming Center Network40 diskless seats isolated in the switch chip, a LAN game cache, UPnP for consoles only, games pinned to one WAN, latency-first queues and a scheduled tournament mode. MikroTik.49 min→ 03The Coffee Shop NetworkOne router and one PoE switch: a sealed payment VLAN, click-through guest portal, a 4G backup only the tills may use, mDNS for the music, and management that dials out. MikroTik.38 min→ 06The Holiday Villa NetworkStarlink in bypass mode with 4G backup, Wi-Fi to the pool and a 60 GHz bridge to the annex, owner and smart home kept from guests, CAKE, a new guest key per booking, and remote care behind CGNAT. MikroTik.33 min→Retail
Branch stores of a chain: dozens of payment devices, store IoT, and a tunnel to the data center.
04The Supermarket NetworkPCI-segmented lanes that only reach HQ, scales, shelf labels and refrigeration on their own VLANs, CCTV on its own switch, IKEv2 to HQ, tunnel-only LTE and a time-boxed vendor window. Cisco.45 min→Healthcare
Special-category health data, vendor-certified medical devices, and a reception that has to keep working.
05The Medical Clinic NetworkMedical devices fenced into their own VLAN, a local PACS, per-device Wi-Fi keys, a 5G backup reserved for patient care, and vendor support windows on a schedule. MikroTik.36 min→Temporary & Events
Networks that exist for one event: pre-staged, rehearsed, watched by a crowd or a broadcast audience, and torn down afterwards.
07The Festival NetworkNOC tent and 60 GHz backhaul, offline-capable ticket scanners, public Wi-Fi for thousands, two Starlinks and 5G assigned by routing tables, a dedicated stream line, and a clean teardown. MikroTik.34 min→ 08The Esports Arena NetworkA broadcast final: a sealed stage pod with equal paths to the match servers, a DNS-enforced player allowlist, an NDI production network, packet capture for disputes, and a stream sent twice over two ISPs. Cisco.38 min→Coming next
The accounting office (tax-season peaks and the same confidentiality duties).
Every post in this series is how I approach a real client: requirements first, segmentation that's tested rather than assumed, and a written record of every decision. If your office network grew without a design, this is where we start.
Book a Discovery Call →