Wiring up a new SMB office with a workable VLAN layout.
An SMB of 10 to 100 people does not need ten VLANs. Four or five is normal: management, staff, guest, IoT and optionally servers/voip. Too few and you do not really segment, too many and nobody understands the design once you leave. Keep names short and consistent across switch and firewall.
Try this first
- 1VLAN 10 management: switch, AP, firewall mgmt. Reachable only from jump host or admin VPN.
- 2VLAN 20 staff: laptops, phones. DHCP, internet, talk to servers through firewall rules.
- 3VLAN 30 voip / servers: static IPs, QoS tag, no general internet beyond update endpoints.
- 4VLAN 40 IoT: printers, cameras, smart TV, sensors. No access to staff, only mDNS relay for printing.
- 5VLAN 90 guest: internet only, no visibility into other VLANs, dedicated DHCP pool.
- 6Document subnet, VLAN ID, gateway and purpose in one table and tape a copy inside the patch cabinet.
When to bring us in
The office is growing to multiple sites or you face audit demands like NEN 7510 or NIS2: a flat L2 trunk over everything is no longer an option, move to SD-WAN or VRF with a partner who does this for a living.
See also
- Wi-Fi drops randomly across the officeFirst rule out whether it is the access points or the internet connection itself. Different fix.
- One room or corner has no or bad Wi-FiNot always "add another AP"; often one is poorly positioned, or there is a metal wall in the way.
- Internet is suddenly slow for everyoneThree suspects: your provider, a colleague soaking the line, or a backup or update kicking in unexpectedly.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.