Network Architecture and Design
Design networks around business-critical communication.
Assess topology, capacity, segmentation, resilience, security, monitoring and application dependencies.
Discuss this requirement →Start with the environment, risk and required outcome.
Assess topology, capacity, segmentation, resilience, security, monitoring and application dependencies. Namandla Consultants begins with evidence and recommends a proportionate engagement rather than a generic technology package.
Connected expertise for the wider environment.
Clear steps. Visible decisions.
What an architecture consists of
Six documents. If your environment has none of them, that is the starting point rather than a criticism, and it is the normal state of a network that grew.
Physical topology
What is connected to what, where it lives, which rack, which patch panel, which port. Including the switch under someone’s desk.
Logical topology
VLANs, their purpose, their addressing, the routing between them and what is permitted across each boundary.
Addressing plan
Allocated centrally across the estate rather than site by site, with room to grow. Overlapping ranges between sites is the most common obstacle in an acquisition and it is expensive to unpick afterwards.
Resilience design
Where the single points of failure are, which of them are deliberate and which are accidents, and what happens when each one fails.
Wireless design
Access point placement, channel and power plan, SSID structure, roaming configuration and the capacity assumption behind it.
Standards
Naming conventions, configuration baselines per device class, cabling and labelling standards and the change process.
The last one is what stops the architecture decaying. Without a baseline to compare against, every fault fixed in a hurry moves a device further from the standard and nobody notices until the estate is a set of individual devices rather than a system.
Design decisions that matter
Topology
Collapsed core merges core and distribution into one layer. Correct for most single-site mid-market environments. Simpler, cheaper, fewer devices to maintain.
Three-tier separates access, distribution and core. Appropriate for large campuses and multi-building sites where the port count and the physical spread justify it.
The failure mode is buying three-tier for a single-building office because the reference architecture showed it. The other failure mode is a collapsed core with no redundancy at the collapsed point, which turns the simplification into a single point of failure for the whole site.
Resilience, chosen rather than inherited
Every network has single points of failure. The question is whether each one is a decision.
A single core switch, a single uplink from a floor, a single power supply, a single firewall, one uplink to the internet. Each is defensible if the cost of its failure has been weighed. What is not defensible is not knowing they exist.
Redundancy costs money and adds complexity, and complexity has its own failure modes. A badly implemented redundant pair fails more often than a well-maintained single device. The decision is per point rather than a policy.
Addressing
Allocate from a central plan with structure: a range per site, subnets per function within it, consistent third octets across sites where possible so that the addressing itself is readable.
Reserve space. A plan with no growth room produces the situation where the only free range is somewhere unrelated, and the readability is lost within two years.
Wireless
Design for capacity, not coverage
A coverage map showing signal everywhere says nothing about whether thirty people in a boardroom can all use it. Access point count follows client density and application, not floor area.
Channel planning
Too many access points on overlapping channels is worse than fewer. In the 2.4 GHz band there are three non-overlapping channels and that is the whole budget.
Power settings
Access points at maximum transmit power hear clients that cannot reply and hold clients that should have roamed. Reducing power is usually the fix for a network with “good signal” and poor performance.
Roaming
Defaults keep devices attached to a distant access point long past the point of usefulness. For voice and for scanners this is the difference between working and not.
Separate SSIDs by purpose, not one for everything. Corporate on certificate authentication, guest isolated and a separate one for scanners and devices that cannot do modern authentication.
Cabling
Unglamorous and it is what everything sits on. Category specification appropriate to the horizon, containment with room for additions, patching to a scheme and labelling at both ends that matches the documentation.
Labelling in particular sounds trivial and is not. An unlabelled patch panel turns a two-minute fault into an afternoon, every time, for the life of the installation.
Documentation
The architecture is only useful while it is accurate.
Diagrams that match reality, updated as part of change rather than annually. A diagram known to be out of date gets ignored, which wastes the original effort entirely.
Configuration backup and baseline comparison
Automated, with drift reported. This is what catches the change made outside the change process.
Asset and port records
What is connected where, and what is not connected at all. Free ports are capacity and unknown connections are exposure.
Change records
What changed, when, by whom and why.
What Namandla delivers
Discovery and documentation
Physical and logical topology, addressing, configuration collection and a written description of what actually exists. On most takeovers this is the first phase and it reliably finds things nobody knew about.
Architecture design
Topology, segmentation, addressing, routing, resilience and wireless, documented to a standard a different engineer could maintain.
Migration planning
Phased, with a fallback at each stage. We do not design a target state and leave you to find your own way to it.
Wireless survey and design, predictive and on site, against actual usage rather than floor area.
Cabling design and installation, including containment, patching and labelling to a documented scheme.
Standards and baselines per device class, with configuration backup and drift comparison.
Ongoing maintenance of the documentation as part of the managed service, so it stays accurate rather than becoming a historical artefact.
Onsite work is Gauteng. Design and documentation run nationally.
Common questions about Network Architecture
We have no network documentation. Where do we start?
Discovery. Configuration collection, physical and logical topology mapping and a written description of what exists. Nothing gets changed until the environment is mapped.
This is the normal starting position rather than an unusual one, and the discovery phase reliably finds things nobody knew about: an unmanaged switch under a desk, a link running at a hundred megabits because of a duplex mismatch, a rule permitting access nobody intended. Those findings are usually worth the exercise on their own.
Do we need a network redesign or just fixes?
Usually fixes, sequenced. A full redesign is warranted where the addressing is unworkable, the topology cannot support what the business now does, or the estate is being consolidated after an acquisition.
Most environments need segmentation, a resilience decision at two or three specific points, wireless rework and documentation. That is a series of projects rather than a rebuild, and it can be done while the network stays in service.
How many access points do we need?
It follows client density and application, not floor area. A boardroom that holds thirty people needs capacity for thirty concurrent devices regardless of its size, and an open-plan floor with forty desks needs a different design from a warehouse with forty scanners.
A predictive design followed by an on-site survey gives you the number. Beware of a quotation based on square metres, which is how sites end up with signal everywhere and poor performance where people actually work.
Our Wi-Fi has good signal but poor performance. Why?
Most often too many access points at too high a power on overlapping channels, plus default roaming configuration. Devices hold onto a distant access point instead of switching, and the access points interfere with each other.
Reducing transmit power is counterintuitive and it is frequently the fix. The other common cause is insufficient uplink capacity from the access switch, where the wireless is fine and the wired path behind it is the bottleneck.
What is the right topology for a single-site office?
A collapsed core in almost every case. Merging core and distribution is simpler, cheaper and easier to maintain, and three-tier is warranted where a large campus or multiple buildings justify the port count and the physical spread.
The thing to get right in a collapsed core is redundancy at the collapsed point, because the simplification concentrates risk there. A single core switch is a defensible decision if it was a decision.
How important is cable labelling?
More than it sounds. An unlabelled patch panel turns a two-minute fault into an afternoon, every time, for the life of the installation.
Labelling at both ends, matching the documentation, to a scheme, is a small cost during installation and it is essentially impossible to retrofit accurately afterwards. It is the single highest return per rand in a cabling project.
Can you work with our existing equipment?
Almost always. Most mid-market environments have capable switching and firewalls that are under-configured rather than inadequate, and the architecture work is design and configuration rather than replacement.
Where equipment is genuinely at end of support, undersized or lacking a capability the design needs, we say so and quote it separately. We would rather redesign around what you own.
How do we keep the documentation current?
Make updating it part of the change process rather than an annual exercise, and automate what can be automated: configuration backup, baseline comparison and drift reporting.
A diagram known to be out of date gets ignored, which wastes the effort that produced it. Where we run the managed service, documentation maintenance is included, because documentation nobody maintains is worth roughly nothing after eighteen months.