A new site is the one moment you get to do the network right from scratch. Spend an hour on the firewall before anyone connects, and you avoid months of retrofitting security onto a live office.
Before you plug in
The design decisions are cheapest before there is any traffic. Map the segments — staff, guests, servers, management — and decide what may cross between them while the network is still empty.
- Plan the VLANs and the rules between them up front.
- Provision the circuits, including a secondary link if continuity matters.
- Prepare the rule base from a known-good template, not a blank slate.
“Security added on day one is design. Security added in month six is a project.”
Day-one configuration
With the plan ready, the build is quick and repeatable: change every default, lock management to trusted access only, enable the UTM services, confirm licences, and switch on failover if the site has it.
Document before you leave
Record the rule base, the segments and the owners the same day, and set the first review date. A site documented at deployment never becomes the one nobody understands.
All guides