Network architectures built not to fall over

Taking over an existing network is harder than building one

A live network carries twenty years of decisions nobody remembers. Each addition answered a real need, none was documented, and the whole thing works: until you have to touch it. Taking it over means first understanding it, and that is never a short phase.

A switch added for an office move, a VLAN created for a pilot that became permanent, a carrier link renewed by default at every term: the resulting structure is nobody’s intention.

It has two consequences. Nobody in the organization knows which flows cross the core any more, which makes every change risky. And an attacker who gains a foothold moves through it unimpeded, because no compartmentalization was ever designed.

That is why our engagements start with measurement rather than with an architecture proposal. A target architecture drawn without knowing the existing estate is a stylistic exercise.

Migrating a multi-site network, in reversible waves

The cutover runs site by site, against a single target architecture defined in advance. Each cutover has a scheduled window outside service hours, a written success criterion, and a rollback that has been exercised. Centralized monitoring is deployed before the first wave, not after.

• Target architecture first. One model applied everywhere, rather than a per-site adaptation. Exceptions are paid for over ten years in operating cost.
• Monitoring before cutover. Without a prior baseline, it is impossible to say whether a site is better or worse after migration, and therefore impossible to decide what comes next.
• A pilot on a representative site. Neither the simplest nor the most critical. The first reveals nothing, the second forgives nothing.
• A rollback that has been tried. A fallback plan never executed is a hypothesis. We exercise it on the pilot site, during the window, before continuing.

Industrial Wi-Fi does not follow office rules

The physical environment and the tolerance for interruption. In a warehouse or a plant, metal structures, moving racking and vehicles create dead zones that appear on no floor plan. And a micro-interruption that would go unnoticed in an office stops a production line here.

Design therefore happens on site, not on paper. A coverage study produced from software gives a plausible and wrong result: it ignores what pallets, movable partitions and forklifts do to radio waves.

The second difference is roaming. A terminal mounted on a forklift changes access point constantly; the quality of those transitions matters more than signal strength, and it determines whether the line stops.

Finally, the device estate imposes its own constraints. Older industrial equipment does not support recent protocols, and the design has to accommodate them rather than ignore them.

SD-Access is not justified everywhere

It brings segmentation driven by policy rather than by device configuration, which changes operations fundamentally, for the better when the estate is homogeneous and the teams trained, for the worse otherwise.

The real gain is operational: applying an access policy without reconfiguring each device, and having it follow the user rather than the network port. Across a multi-site estate, that removes an entire class of configuration error.

The real cost is the learning curve. Day-to-day operations change in nature, and a team that was not supported through the change falls back on old practice: having paid for the technology.

We therefore check three things before recommending that direction: the homogeneity of the estate, the maturity of identity management, and the teams’ genuine availability for the transition.