Network Topology: how a solid infrastructure should be built
Before picking equipment brand or model, every reliable network is built on the same layered architecture. This is the mental map we use to design and explain every project.
The problem is almost never in a single piece of equipment. It's in how the firewall, switches, load balancers and access points connect to each other. This is the recommended architecture, from the internet entry point to the end user's device.
Internet / WAN link
The entry point to the internet, usually via fiber or a dedicated link. It's the foundation everything else depends on. Here we define guaranteed bandwidth, SLA with the ISP, and redundancy (fiber + LTE, two providers) when the operation can't stop.
Firewall
Filters incoming traffic and protects the network from unauthorized access before it reaches any other equipment. Responsible for NAT, routing, VLANs, captive portal, and segmentation between profiles (staff, guests, IoT).
Load balancer
Distributes traffic across multiple links or servers, avoiding saturation and single points of failure. In critical operations it's the difference between "the network is down" and "one link is down but we're still operating".
Core Switch
The network core. Connects all distribution switches on site at high speed. It's the backbone through which all internal traffic passes; its capacity and redundancy define the performance ceiling.
Distribution switches
Distribute the wired connection to each area, floor or building. Redundant uplinks in rings or stars, with VLAN segmentation according to physical topology. They don't go directly to the end device — they connect to the access switches.
Access switches
The last wired link before the end device or AP. They receive the uplink from the distribution switch and provide PoE ports to each terminal device: cameras, IP phones, user network drops and access points. Their capacity and PoE budget define how many devices you can connect per area.
Access Points (APs)
Deliver the WiFi signal to end users. Quantity and location are calculated with a site survey , not improvised. Density per area, non-overlapping channels, and assisted roaming for movement between APs.
Connected devices
Laptops, phones, IoT sensors and mission-critical equipment. The endpoint of the entire architecture, and the only one the user actually perceives.
Weak WiFi is almost never the WiFi's fault.
Most connectivity problems come from a layer before the access point: a misconfigured firewall, a saturated switch, or a missing load balancer in a network that already needs one. We diagnose all 8 layers, not just the last link.