DEV Community

InterDataLink
InterDataLink

Posted on

How We Built a 200-User Office Network in Three Weeks

#networking #infrastructure #wifi #sysadmin

A financial firm was moving into a full floor in Midtown Manhattan. More than 200 people would sit down on opening day and expect the wired ports, the Wi-Fi, the phones and the conference rooms to work. We had three weeks, and we were starting from a floor with no cabling in it.

This is what we installed, why we chose it, and the one thing that went wrong.

The design in one picture

**[IMAGE:

  • 4 Cisco Catalyst 9300 UPOE switches in a single stack
  • 10 Cisco CW9166I access points (tri-band Wi-Fi 6E)
  • 2 Meraki MX95 firewalls as a warm-spare pair
  • 2 internet circuits at 1 Gbit each, from separate carriers
  • All of it managed from the Meraki dashboard

If you build software, the rule behind this design will look familiar. Find every single point of failure, then either duplicate it or decide on purpose to live with it.

Start with the edge

The two firewalls run as a warm-spare pair. One carries the traffic, and the other takes over automatically if it fails. Each of the two internet circuits comes from a different carrier, so one carrier's outage does not take the office offline.

It is the same idea as keeping a standby replica in a second availability zone. You pay for hardware that sits idle most of the time, and you are glad of it once.

One stack, not four switches

The four Catalyst 9300s are stacked, so they run and are managed as one switch. That means one configuration to maintain and one place to look when something is wrong.

Do the power math before you mount anything

Access points take their power over the same cable that carries their data. Every switch has a total power budget for this, and every port has its own limit. Go over either one and some devices will not power up.

We chose UPOE switches for the headroom. Each UPOE port can supply up to 60 W, and a CW9166I draws 30.5 W at most, so every access point gets full power with room to spare.

This is capacity planning, and it is easy to script. We later packaged the check as a small open-source command-line tool, poe-budget. You give it a switch's power budget and a list of devices, and it reports the demand, the headroom, and which devices would go unpowered. The 740 W budget below is an example figure, not the budget of this stack:

npx @interdatalink/poe-budget --budget 740 --port-max upoe "Access point:30.5x10"
Enter fullscreen mode Exit fullscreen mode 
Device        Qty    Each    Total  Status
------------  ---  ------  -------  ------
Access point   10  30.5 W  305.0 W  ok

Demand      305.0 W
Budget      740.0 W
Headroom    435.0 W (58.8% free)
Port limit   60.0 W

Result: fits.
Enter fullscreen mode Exit fullscreen mode

It exits with a non-zero code when something will not be powered, so it can sit in a script.

Survey first, mount second

We surveyed the floor before deciding where the ten access points would go. The CW9166I broadcasts on 2.4, 5 and 6 GHz, and where you put each one matters as much as how many you buy. Guessing from a floor plan is how offices end up with dead conference rooms.

One team owns the whole path

We ran the cabling for the floor and built the rack and IDF ourselves, along with the switching, the Wi-Fi and the firewalls. One team owned the path from the wall jack to the firewall. When a port was dead, it was ours to trace, with no handoff between a cabling contractor and a network crew.

One dashboard

Firewalls, switches and access points all report to the Meraki dashboard. The whole network is visible in one place, which makes it much easier to support after opening day.

What went wrong: the dependency we did not control

The internet circuits were the one item on the schedule that belonged to someone else, and carrier delivery ran late.

Rather than move the opening date, we put the network on an LTE connection until the circuits arrived, then cut over to the two carrier circuits. The office opened on schedule.

In software terms, the external dependency with the longest lead time is your critical path. Have the fallback ready before you need it.

What we would pass on

  1. Order internet circuits before anything else. They have the longest lead time, and it is not yours to control.
  2. Have a cellular fallback ready before you need it.
  3. Check your PoE budget against the worst-case draw of every powered device.
  4. Survey before you mount access points.
  5. Give one team the whole path, from wall jack to firewall.

Written by Alec, Senior Network Engineer (CCIE #53073) at InterDataLink. This post was drafted with AI assistance and reviewed by the author.

Top comments (0)