Enterprise networks, without the enterprise licence bill.

A regulated financial services firm with four offices, an examination cycle, and an auditor who asks for evidence rather than assurances. Their incumbent camera platform recorded to a vendor cloud, their door system was a separate silo with its own spreadsheet of badge holders, and their wireless had no documented design at all.

We rebuilt the estate on UniFi with the control framework as the design input. Network segmentation was mapped to their data classification: client data, corporate, guest, IoT and camera zones, each with an explicit firewall policy. Protect replaced the cloud VMS with on-premises recording to a redundant NVR, retention set to the firm’s stated obligation rather than a vendor default. Access and Identity put badge, WiFi and VPN behind one directory identity, so joiner-mover-leaver became one action with a log entry.

Every phase closed with an evidence pack: as-built topology, zone policy matrix, cable certification results, retention calculations, access review procedure. They walked into examination with a binder instead of a story.

A 24/7 operation with a single gateway, a single internet circuit and a BCP document whose recovery objectives the infrastructure could not actually meet. No maintenance window existed that the business would accept: the answer was always "not this week".

So we built the new core alongside the old one. A second Cloud Gateway went in as a Shadow Mode (VRRP) peer with dual hot-swappable power supplies, a second carrier was terminated as a weighted WAN member, and aggregation switches were paired so no access closet depended on one uplink. Configuration was staged and validated off-site, then adopted in place.

The cutover itself was a failover test, run during business hours on purpose: we pulled the primary and watched the shadow take the estate. Nobody in the building noticed. Failover is now rehearsed quarterly as part of their DR programme, with the results written into the BCP rather than assumed by it.

Twelve offices accumulated through growth and acquisition, each with its own kit, its own local IT arrangement and its own renewal date. Every change meant a ticket to a different party, and the annual licensing and support bill from the incumbent vendors had grown faster than the headcount it served.

We designed one hub-and-spoke fabric: regional hubs on Enterprise-class gateways, spokes on Cloud Gateway Max and Dream Machine Pro Max sized to headcount, and license-free Site Magic SD-WAN joining them with policy-based routing back to the hubs for the traffic that has to be inspected centrally. One site template (VLANs, zones, SSIDs, port profiles, guest portal) was applied everywhere, so site eleven took a fraction of the effort of site one.

Their network team now runs the whole fabric from a single Site Manager view with ISP health per site, alarms landing in their service desk by webhook, and firmware rolled out on a schedule they control. The recurring vendor licence line is gone.