Design, deliver, document. In that order.
The VLAN plan, the rack elevations and the cable schedule exist before a single patch lead goes in. We build it, label it, and commission it, and the as-built set is the one we hand you, matching what is actually in the cabinet. The handover pack matters more than the diagram.
Why it matters
A design that looks good on a slide and cannot be maintained by the site's own staff is a liability the day the consultant leaves. So the drawings that match what was actually built, not the ones drawn before the change orders, are the deliverable.
The other worry is the cut-over. Every cut-over we plan has a way back, written down before the window opens.
What it covers
- Campus, datacentre and plant floor
- Core and distribution, datacentre top-of-rack and leaf-spine, wireless, and industrial Ethernet on a plant floor or in a substation where the site has one, with DIN-rail, fanless or extended-temperature kit where the environment needs it.
- Segmentation and network access control
- VLANs and VRFs, 802.1X network access control, firewalls between user, server and management zones, and where a control network exists, the industrial DMZ and a data diode where one-way is the right answer.
- Redundancy and timing
- Ring topologies and their recovery (MRP, DLR, REP/ERPS), RSTP, PRP and HSR for zero-recovery-time redundancy, first-hop redundancy, OSPF, and NTP or PTP (IEEE 1588) where timing matters.
- The physical build
- Fibre (OM3/OM4/OS2), patch panels and splice trays, structured cabling to TIA-568, labelling to TIA-606, PoE budgets, and out-of-band console servers.
How it runs
Design
High-level and low-level design, an IP and VLAN plan, rack elevations and a cable schedule. Resilience is designed against the failure you can actually afford, not against a diagram that looks symmetrical.
Stage and test
Factory acceptance testing before anything ships, so the kit arrives configured and proven rather than boxed and hopeful.
Deliver and cut over
Racking, patching and labelling to the scheme, site acceptance testing, and a cut-over run to a plan that has a rollback beside it. Every cut-over has a way back.
Document
The as-built drawing set, the firewall rule set with a reason per rule, and the configuration backups taken at handover, so the next engineer does not delete something to make a problem go away.
A page of what you are handed
ARTA CYBER
Representative deliverable — site and figures redacted.
VLAN and IP plan — excerpt
| VLAN | Name | Subnet | Gateway | May reach | Note |
|---|---|---|---|---|---|
| 10 | MGMT | 10.10.10.0/24 | Core, VRF mgmt | Admin jump hosts only | Switch, firewall, UPS and server out-of-band controllers. Not routed to any user VLAN. |
| 20 | STAFF | 10.10.20.0/22 | Core SVI | File, print, internet via firewall | 802.1X with dynamic VLAN assignment. A port that fails authentication falls to VLAN 99, not to this one. |
| 30 | SERVERS | 10.10.30.0/24 | Firewall, not the core | Per rule only | The server gateway sits on the firewall so staff-to-server traffic is inspected and logged. |
| 99 | QUARANTINE | 10.10.99.0/24 | Firewall | Remediation portal and DNS only | Landing VLAN for failed 802.1X. Nothing else is reachable from here. |
What you are left holding
- High-level and low-level design.
- IP and VLAN plan.
- Rack elevations.
- Cable schedule and labelling scheme.
- Bill of materials with support renewals shown.
- Firewall rule set with a reason per rule.
- FAT and SAT test sheets.
- Cut-over and rollback runbook.
- As-built drawing set and configuration backups taken at handover.
Worked to
- TIA-568
- TIA-606
- IEC 62443-3-2
- IEEE 1588 (PTP)
Questions we are asked first
Will there be an outage during cut-over?
We plan the cut-over to avoid one, and where a break is unavoidable it happens inside a window you agree, with a rollback written down before we start. Every cut-over has a way back.
Will our own staff be able to maintain what you build?
That is the test we design to. The as-built set matches the cabinet, the rule set explains itself, and the configuration backups are handed over, so the network does not depend on us being in the room.
Are you going to sell us more hardware than we need?
The bill of materials shows the support renewal up front, and the redundancy is sized to the cost of a lost minute on that line, not to a diagram that looks symmetrical. A ring that heals in milliseconds is worth it on some lines and wasted on others.
Related work
Tell us what is bothering you.
An email is enough to start with. A scoping call is free and there is nothing to commit to, and where we are not the right people we will say so and point you at someone who is.
A first call about one site. No charge, and nothing to commit to.
Our named next step: we come to one site and hand you an assessment you can act on.