How to Build an Enterprise LAN from Scratch: Switches, Firewalls, APs, and Controllers Explained

1. Identify the right devices before buying

Network design starts with clarifying roles: access switches connect end devices, core/Layer‑3 switches route between VLANs, a router or firewall handles the Internet exit, wireless APs provide Wi‑Fi, and a wireless controller (AC) manages APs. Supporting hardware such as racks, cabling, optics, and UPS are also essential.

2. Plan VLANs, IP subnets, and gateways

A planning table drives the whole configuration. Example layout:

VLAN 10  Office      192.168.10.0/24   Gateway 192.168.10.1
VLAN 20  Server      192.168.20.0/24   Gateway 192.168.20.1
VLAN 30  Guest       192.168.30.0/24   Gateway 192.168.30.1
VLAN 40  Staff Wi‑Fi 192.168.40.0/24   Gateway 192.168.40.1
VLAN 99  Management  192.168.99.0/24   Gateway 192.168.99.1

Two practical tips: keep the guest network isolated and restrict it to Internet access only; place all management interfaces (switches, AC, AP, firewall) in VLAN 99 for easier troubleshooting.

3. Switch configuration: Access, Trunk, and Layer‑3 gateway

Access port – for PCs, printers, cameras, APs. Example:

interface GigabitEthernet1/0/10
 port link-type access
 port access vlan 10
 description Office-PC

Trunk port – uplinks between switches, AC, or APs, carrying multiple VLANs:

interface GigabitEthernet1/0/48
 port link-type trunk
 port trunk permit vlan 10 20 30 40 99
 description Uplink-To-Core

Layer‑3 VLAN interfaces act as default gateways for each VLAN:

interface Vlanif10
 ip address 192.168.10.1 255.255.255.0
interface Vlanif20
 ip address 192.168.20.1 255.255.255.0
interface Vlanif30
 ip address 192.168.30.1 255.255.255.0

Small sites can let the firewall provide the gateway, but once internal traffic grows the core switch should host the VLAN gateways for clearer structure and better performance.

4. Router/Firewall: Internet exit, NAT, and security policies

Four essential tasks for the outbound device:

Default route to the ISP.

NAT to translate private addresses.

Security policies to control traffic.

Log auditing.

Default route example : ip route-static 0.0.0.0 0.0.0.0 100.64.1.1 NAT configuration (ACL 3000 permits the internal 192.168.0.0/16 range):

acl number 3000
 rule permit ip source 192.168.0.0 0.0.255.255
interface GigabitEthernet1/0/0
 nat outbound 3000

Security policy example (minimum‑allow rule set):

security-policy ip
 rule name trust_to_untrust
  source-zone Trust
  destination-zone Untrust
  source-address 192.168.0.0 16
  action pass
 rule name guest_to_lan_deny
  source-zone Guest
  destination-zone Trust
  action deny

The author recommends starting with a “least‑allow” approach: only open required ports for the office network, restrict the guest network to Internet only, and limit management network access to admin workstations.

5. Wireless APs and Controller (AC)

Wi‑Fi is highly visible; therefore AP placement, PoE power, controller‑based SSID segregation, and management must be done carefully.

Typical VLAN mapping:

Staff SSID: Corp-Staff  -> VLAN 40
Guest SSID: Corp-Guest  -> VLAN 30
AP management: AP-Mgmt   -> VLAN 99
AC address: 192.168.99.10
AP address range: 192.168.99.101‑192.168.99.200

AP count is estimated by coverage area and concurrent user density, not merely signal strength.

6. Example office LAN (≈50 users)

Recommended hardware set:

One outbound firewall (Internet, NAT, security, VPN).

One Layer‑3 core switch (VLAN routing, DHCP).

PoE access switches for PCs, printers, APs.

Wireless controller (AC) to manage APs and SSIDs.

APs covering office, conference rooms, and reception.

Do not cram all functions into a single “high‑end router”. Clear layering avoids troubleshooting headaches such as “servers reachable, printers not, Wi‑Fi intermittent”.

7. Example campus network (multi‑floor, multi‑department)

Scale the same pattern: core layer (dual stacked or virtual core) handles VLAN gateways and OSPF backbone; aggregation layer connects each building or zone with dual uplinks; access layer provides PoE switches for endpoints; the edge zone contains firewalls, internet exit, WAN links, and VPN.

Key focus points: redundant links for core and edge, clean routing without unnecessary advertisements, and strict security zone separation (office, server, guest, monitoring, management).

8. Pre‑deployment checklist

All VLANs allowed on core, access, and AC links.

Gateway, DHCP pool, and DNS settings match the planning table.

Firewall default route, return routes, and NAT policies are complete.

Guest VLAN isolated from office and server VLANs.

Switches, AC, AP, and firewall configurations saved.

Device admin passwords, SSH, NTP, and log server configured.

Each area tested with real terminals (ping gateway, DNS, business apps, Internet).

The author’s habit is to use a laptop to verify connectivity on office LAN ports, guest Wi‑Fi, staff Wi‑Fi, and conference‑room ports before hand‑over.

Conclusion

Do not start configuring before drawing the topology and defining VLANs and IP schemes. Follow the order: physical layer → Layer‑2 → Layer‑3 → policies/NAT → applications. Using this structured approach dramatically reduces misconfigurations and troubleshooting effort.