A small office network that just works

The short answer

A reliable small office network has six parts: a business internet connection with a backup line, a business-grade firewall, managed network switches, ceiling-mounted Wi-Fi access points managed from one console, separate networks for staff, guests and devices like printers and cameras, and up-to-date documentation. Buy business-grade equipment that receives firmware updates, change every default password, keep the firewall and access points patched, and write down how it all fits together. The sections below walk through each part in the order you would set it up.

Start with what the network must do

Before buying anything, answer five questions. They decide every choice that follows.

• How many people, and how many devices per person? Count laptops, phones, desk phones, printers, cameras, TVs and anything else that connects.
• Which systems are in the cloud, and which are in the office? A cloud-first office needs a strong internet connection. An office with a local server needs a strong internal network.
• Do you use internet phones or video calls all day? Voice and video need low delay and priority settings.
• Do visitors or patients need Wi-Fi?
• How much downtime can you tolerate? If an internet outage stops the business, budget for a backup line.

1. Internet and a backup line

Choose a business internet plan with enough upload speed for video calls and cloud backups, not just download speed. Fiber is ideal where available. Ask about a static IP address if you host anything or need site-to-site connections.

Add a second connection from a different provider or technology, such as cable plus fiber, or fiber plus a 5G or fixed wireless line. A firewall that supports two internet connections can switch over automatically when one fails. For many offices the backup line costs far less than a single afternoon of downtime.

2. A business-grade firewall

The firewall sits between your internet connection and everything else. It decides what traffic is allowed in and out, separates your internal networks, and handles remote access. Look for:

• Regular firmware updates from the manufacturer, with a published support life
• Support for multiple internal networks (VLANs) and two internet connections
• Content filtering and intrusion prevention, usually with a yearly subscription
• Remote access with multi-factor authentication
• Central logging you can keep for months

Firewalls and VPN devices are frequent targets. CISA’s Known Exploited Vulnerabilities catalog regularly lists flaws in edge devices from major vendors, which is why prompt firmware updates matter more than any single feature.

3. Managed switches

Switches connect wired devices: desktops, printers, phones, access points and cameras. Use managed switches so you can assign ports to the right network and see what is plugged in. Choose switches with Power over Ethernet (PoE) if you have access points, desk phones or cameras, so they draw power from the network cable. Leave room to grow: buy more ports than you need today.

Run cabling to every desk and to each access point location. Wired connections are faster and more reliable for fixed devices, and they free up Wi-Fi capacity for laptops and phones.

4. Wi-Fi access points

• Mount access points on the ceiling, spread across the space, rather than relying on one router in a closet.
• Manage them from one console so settings, updates and passwords stay consistent.
• Use WPA3 where your devices support it. The Wi-Fi Alliance says WPA3 adds stronger protection against password guessing and is mandatory for Wi-Fi CERTIFIED devices.
• For staff Wi-Fi, consider individual sign-ins through your directory rather than one shared password, so a leaver’s access ends with their account.
• Walk the space after installation and check signal strength in conference rooms, break rooms and corners.

5. Separate networks for staff, guests and devices

Segmentation means splitting one physical network into separate virtual networks. NSA’s Network Infrastructure Security Guide recommends segmenting networks and limiting traffic between segments so a problem in one area cannot spread easily. A typical small office uses:

• Staff: company laptops and desktops.
• Guest: internet only, isolated from everything else, with a password you change regularly.
• Devices: printers, cameras, TVs, door controllers and other equipment that rarely gets updates.
• Voice: desk phones, with priority for call quality.
• Management: the admin interfaces of the firewall, switches and access points, reachable only by IT.

If you want an outside view of how your current network holds up, our free Technology Health Assessment takes 30 minutes of data collection and gives you a plain-language report the next day on IT operations, cybersecurity and business continuity, with next steps in order.

If the office has a server

Many small offices still run a file server, a database for accounting or practice software, or a network storage box. Put it on the wired staff network or its own server network, never on Wi-Fi. Connect it to a small uninterruptible power supply (UPS) that also covers the firewall and core switch, so a short power blip does not take everything down. Allow only the staff network to reach it, and do not expose it directly to the internet; remote users should connect through the firewall’s VPN with multi-factor authentication. Back it up to a location outside the office.

If the server is mostly shared files, it may be time to ask whether it should stay at all. Moving files to SharePoint or Google Drive removes a box to patch and replace, and it changes what the network needs to do.

6. Security settings to apply on day one

• Change every default username and password on every device.
• Turn off remote administration from the internet unless it is protected by MFA and limited to known addresses.
• Disable services you do not use, such as old management protocols, as NSA’s guide advises.
• Turn on automatic firmware update checks and schedule a monthly review.
• Send firewall logs to a place where they are kept for months, not days.
• Back up device configurations so a failed firewall can be replaced in an hour.

Document it on one page

A network nobody understands is a network nobody can fix quickly. Keep a simple diagram and record:

• Internet providers, account numbers, circuit IDs and support phone numbers
• Each device’s model, location, serial number, firmware version and warranty or support end date
• Network names, address ranges and which ports belong to which network
• Where admin passwords are stored, in a password manager rather than a sticky note
• Who to call for each part

JLB USA provides managed IT for businesses with roughly 25 to 100 employees, including networks, vendor management and security. On-site work is available in Atlanta, Birmingham and Chattanooga, with remote support everywhere else. Moving offices? Use our new office IT setup checklist alongside this guide.

Keep reading

• On-premise server vs cloud: should a small business keep the office server?
• How to migrate a file server to SharePoint, step by step
• Windows 10 end of life for business: what it means in 2026 and what to do now
• New office IT setup checklist: a 90-day plan for moving or opening an office

Related services

• Managed IT services
• Free Technology Health Assessment
• New office IT setup checklist
• Cybersecurity services