Network & Wi-Fi | Primetime IT Solutions

What we find

Flat networks. Forgotten firewalls. IoT on the same VLAN as payroll.

Most SMB networks were never designed — they accumulated. Switches added when seats grew. Wi-Fi access points wherever there was an outlet. A firewall configured once in 2019. Here’s what we keep seeing.

Everything on one VLAN
Workstations, servers, printers, IoT cameras, smart TVs, the guest Wi-Fi — all in the same broadcast domain. One compromised IoT device sees everything.
Firewall rules that nobody owns
“Allow Any/Any” rules added for a one-time vendor connection in 2021 and never removed. Logging disabled. Default admin credentials still active on the WAN side.
Consumer-grade Wi-Fi at a business
Off-the-shelf routers, mixed-vendor APs, no roaming, no segmentation, no central management. Coverage dies in the conference room.
VPN that everyone shares
Generic credentials. No MFA. Split-tunnel disabled. Compromised laptop drops the attacker inside your corporate LAN with full access to file servers and finance shares.

Get Your Free Network Audit →

Design principles

Networks that segment, monitor, and survive.

Every network we deploy follows the same playbook — whether it’s a 12-person law firm or a 200-employee warehouse. Reproducible, supportable, and built for cyber-insurance underwriting.

Segmented VLANs

Corporate, IoT, Guest, Voice, Management. Each on its own VLAN with explicit firewall rules between them. The IoT camera can’t reach the file server. Period.

SD-WAN with failover

Dual-carrier failover. Application-aware routing. VoIP prioritized. Backup over the secondary link. Subsecond cutover when the primary line drops.

Wi-Fi 6/6E coverage

Predictive site survey. Right number of APs for the floor plan. Seamless roaming. Separate SSIDs per VLAN. Guest portal with auto-expiring credentials.

Next-gen firewall

WatchGuard Firebox or Unifi Gateway. IDS/IPS enabled. SSL inspection where appropriate. Geo-blocking. Threat-intelligence feeds. Logs centralized for incident response.

Zero-trust remote access

ZTNA or identity-aware VPN. MFA required. Conditional Access integrated. Device-compliance check before any tunnel completes. No flat-network VPN.

Firewall policy review

Quarterly review of every firewall rule. Stale rules retired. New rules documented with owner, reason, and review date. Audit-ready trail.

Centralized monitoring

WatchGuard Cloud or Unifi Network Console. Single pane for switches, APs, firewalls, SD-WAN. Alerting tied to our help desk. Performance baselines tracked.

Documented and labeled

Network diagrams. IP plan. Cable labeling. Wiring closet photos. The documentation a next engineer (yours or ours) can pick up cold.

Lifecycle & refresh

Hardware EOL tracked. Firmware patched on schedule. Refresh budgeted into your vCIO roadmap so you’re never running a 7-year-old switch in 2026.

How we deliver

Audit, design, deploy, operate.

A four-phase rollout that gives you a clean network you can defend — and the documentation to prove it.

Phase 01

Audit

Topology discovery. VLAN inventory. Firewall rule review. Wi-Fi heat-map. WAN/ISP audit. External attack-surface scan. Documented gaps and risks.

Phase 02

Design

Segmentation plan. Firewall policy framework. Wi-Fi predictive design. Failover strategy. ZTNA rollout plan. Reviewed and approved before any work.

Phase 03

Deploy

Staged cutover. Test plan per phase. After-hours work where needed. Documentation built as we go. Old gear decommissioned and audited.

Phase 04

Operate

24/7 monitoring. Quarterly firewall review. Annual Wi-Fi survey. Firmware patching. Refresh planning. Capacity tracking ahead of growth.

Zero trust · identity is the new perimeter

The network isn’t the trust boundary anymore. Identity is.

Most SMBs still treat “inside the LAN” as trustworthy. That assumption died with remote work, cloud apps, and AI-augmented credential theft. Modern network design starts from the assumption that the threat is already inside — and limits what it can reach.

Identity at the gate
Entra Conditional Access + device-compliance checks before any sensitive resource. No more “they have the VPN, they’re fine.”
Lateral movement contained
East-west firewall rules between VLANs. Servers segmented from workstations. Compromised endpoints can’t pivot freely — they hit a wall fast.
Continuous monitoring
Firewall logs, IDS/IPS alerts, NetFlow data piped to the security stack. Anomalies surfaced fast — not buried in a vendor portal nobody opens.

See Cybersecurity Stack →

“If your VPN drops a user onto the same VLAN as your file server, you don’t have a network — you have a single failure away from a ransomware event.”

Laz De La Vega · Practice Lead, Primetime IT Solutions

Common questions

What we get asked on every network call.

WatchGuard or Unifi — what’s the difference?

Both are in our standard stack. WatchGuard Firebox is our go-to for enterprise-grade security — IDS/IPS, DNS filtering, full SSL inspection, and regulatory-ready logging. Unifi handles switching, APs, and the gateway layer where simplicity and centralized management matter more than deep threat-prevention. Most deployments use both: WatchGuard at the perimeter, Unifi for the internal switching and wireless infrastructure.

Do you support our existing gear?

Often, yes — especially if it’s recent WatchGuard, Unifi, Cisco, or Aruba. We’ll inventory what you have, validate firmware, and either bring it under our management or recommend a phased refresh. We won’t force a rip-and-replace if the gear has runway.

How do you handle multi-site or remote workers?

SD-WAN connects sites with optimized routing and failover. ZTNA (or identity-aware VPN) handles remote workers without dropping them onto the corporate LAN. Conditional Access ties identity to device compliance before any sensitive resource opens.

What about VoIP and call quality?

VoIP QoS is configured at the SD-WAN layer with prioritization across the link. We work with most major UCaaS providers (RingCentral, 8x8, Zoom Phone, Microsoft Teams Phone). For new deployments we’ll help you pick — usually based on existing tooling, not phone bills.

Can you handle a new-office build-out?

Yes — structured cabling, IDF/MDF design, switches, APs, firewall, internet circuits, security cameras, access control. We coordinate with your general contractor and electrical from day one so the IT spaces are ready when you move in.

Networks designed for uptime and security.