Designing a Simple SOHO Network

Plan a small office network: the equipment, how the pieces connect, and the segmentation that keeps sensitive systems separate.

By the end of this lesson you can

Identify the components of a small office network and what each does
Distinguish LAN from WAN, and wired from wireless
Design a segmented network appropriate to a small medical practice
Explain why guest and IoT traffic must be separated from clinical systems

📘 Reading Lesson

Lesson Notes

Read through the key concepts before you try the challenge.

The equipment and what each piece does

On the job

Lakeside Medical Associates is opening a second location.

The new office needs eight workstations, two printers, wireless for staff, wireless for patients in the waiting room, four IoT devices, and a connection to the main office's systems. The vendor quote is one router, one switch, and a single wireless network for everyone. That design would put a patient's phone on the same network as the workstation holding patient records.

Your task: Design a network where the pieces are separated according to what they are trusted with.

Key terms

LAN: Local Area Network — the devices in one location, connected to each other.
WAN: Wide Area Network — connections spanning locations. The internet is the largest WAN.
Modem: Connects your network to the internet service provider's line.
Router: Directs traffic between networks and between your LAN and the internet. It is the boundary of your network.
Switch: Connects wired devices within the LAN and forwards traffic only to the intended recipient.
Access point: Provides the wireless network. Often built into the router in a small office.
Firewall: Filters traffic by rule. Usually built into the router in a small office.
VLAN: A logical division of one physical network into separate segments that cannot reach each other by default.

Worked example

Designing the second location's network

Produce a network design for eight workstations, two printers, staff and guest wireless, four IoT devices, and a link to the main office.

1
Start from the internet connection and work inward: modem, then router.
The router is the boundary and the place where separation is enforced. Designing outward from the devices tends to produce a flat network where everything can reach everything, which is exactly the vendor's proposal.
2
Separate the network into segments by trust level.
Four segments: clinical workstations, staff wireless, guest wireless, and IoT. Each holds devices trusted with different things. A patient's phone and a workstation with the EHR open have no business being able to reach each other, and segmentation is what makes that structural rather than a matter of hoping.
3
Wire the workstations and printers; reserve wireless for devices that must move.
Wired connections are faster, more reliable, and cannot be intercepted from the parking lot. A workstation that never moves has nothing to gain from wireless and something real to lose.
4
Give the guest network internet access only, with no route to any internal segment.
Waiting-room patients need the internet, not the practice's systems. Guest isolation is a standard router feature and takes minutes to enable — and skipping it is one of the most common small-office mistakes.
5
Connect the two offices with a VPN over the internet.
A VPN encrypts traffic across the public internet so the link behaves like a private connection at a fraction of the cost of a dedicated line. For traffic that may include patient information, the encryption is not optional.
6
Document the design and label the physical equipment.
The person troubleshooting at 7am will not be you, and an unlabeled rack costs an hour before any diagnosis starts. Documentation is part of the design, not an afterthought.

Result: A segmented network where guest and IoT devices cannot reach clinical systems, and the two offices are linked over an encrypted connection.

Segment by trust level. The question is never only 'can these devices connect' but 'which devices should be able to reach which others.'

A flat network — everything on one segment — means any compromised device can reach every other. A patient's malware-infected phone on the same network as a workstation with the EHR open is a direct path to protected health information. Segmentation is the single most valuable network security measure available to a small practice, and on most business routers it costs nothing but configuration time.

Check your understanding

Why should patient wireless in the waiting room be on a separate network segment from clinical workstations?

Challenge

Apply what you've learned in this lesson.

Produce a design document, not just a diagram.

Draw a network diagram for the second location described in this lesson. Show the modem, router, switch, access points, and every device, and mark which segment each belongs to.
Write a one-paragraph justification for each segment: what is on it, what it may reach, and what it may not.
Identify the single point of failure in your design and propose a mitigation.
List what you would document and label so that someone else could troubleshoot the network without you.

Finished this lesson?

Progress is saved in this browser only. It is not a grade — official progress lives in Brightspace.

← The Internet of Things