Setting up a Branch Office

[JoseGarcia96642]

Good day, to whoever is reading this. Also, if I submitted this subject on the incorrect location please let me know

I'm currently a network specialist for educational institution and it is expanding very fast. I'm pretty sure that one of these days I'll be tasked with working on expanding the existing network to new branch office. At the moment I have little experience with this subject, so I'll post the steps that I believe need to take place. Please let me know if I missed a procedure or if a step is incorrect. 

Scenario: Setting up a branch office from with an existing infrastructure.

• Contact client, institution, organization, etc
• Arrange to visit client on site
• Analyze existing infrastructure
  • Does the building have an existing communication room?
  • If it doesn’t a closet room will have to be selected and used for that purpose
• Is the client satisfied with the current infrastructure or do they require any changes (network ports, cameras, access points, etc)?
• Ask client about how many users are going to work on the area, and what are the plans for it
  • This will determine the networking devices that are going to be installed, such as a 24 or 48 port switch
• Proceed with infrastructure change if the user requested it
  • Will be done through outsourcing
• Install appropriate rack for the networking devices in the communication room 
• Install networking devices such as switches, access points, UPS, router, and firewall
  • Install UPS and connect devices to it. Install SMNP card for monitoring.
  • Configure Switch
    • Create or expand appropriate VLANS to the switch
    • Connect devices into the ports, such as computers, VoIP phones,wireless access points, cameras, etc)
    • Configure Uplink port
  • Configure router (step can be skipped if a multilayer switch was installed)
  • Configure firewall
  • Connect Multilayer Switch/Router to firewall
  • Connect firewall to WAN/ISP device
• On main office branch, connect the newly installed network to a core switch
• Test and monitor new LAN

[Leo Laohoo]

First question should always be "what is the budget". 

This is immediately followed by "what is the timeline". 

All other dot points are, sadly, irrelevant if questions 1 & 2 cannot be established first.

[JoseGarcia96642]

Sounds good, I'll add it to the procedures. Anything else that I should consider? 

[Leo Laohoo]

---

@JoseGarcia96642 wrote:

If it doesn’t a closet room will have to be selected and used for that purpose

---

This one will not make sense because the lack of "guidelines" to determine what specifications are needed to make a communications room and what cabling standards will be rolled out. 

---

@JoseGarcia96642 wrote:

Is the client satisfied with the current infrastructure or do they require any changes

---

Funny

[JoseGarcia96642]

Ok, I'll remove that one from the list. 

May I ask, why do you consider the second one funny? 

[Leo Laohoo]

---

@JoseGarcia96642 wrote:

May I ask, why do you consider the second one funny? 

---

If you are a surgeon, would you ask your patient HOW they wanted to be operated? 
Even if this was a school assignment, it would NOT make sense.  How could/would a client know how "satisfied" with the current infrastructure?  Because I can guarantee you, if the objective is to answer this question, the client will always vote for getting something done for free.  

If the objective is to make the dot points longer, then I have several I can throw in:

• How many wired users?
• How many printers?
• How many VoIP?
• Size, shape and dimension of the building(s)?  
• Is it one big building or several building(s)? 
• Distance between building(s)? 
• How many floors? 
• Define the coverage of the wireless?
• Indoor and/or outdoor wireless?
• Size of the WAN?  HOW MANY? 

[JoseGarcia96642]

Interesting analogy and you make valid points. As I mentioned before, I'm fairly new to this and when the time comes and I want to be ready for an assignment like this. 

Thank you for the feedback, I appreciate it. 

[Richard Burts · Accepted solution]

I appreciate your desire to be prepared for a task like adding a branch office. Depending on size of organization and of branch this could become quite complex. I think you have a good start and would add a few suggestions:

- you mention having router and firewall which gets into layer 3 issues. That is a good start but I think you should flesh this out a bit.

* I think that there should be some steps in your plan about analyzing the existing network organization, such as how many existing subnets/networks.

* Is there any reason to change/enhance the existing subnet/network architecture?

* What is the need for additional subnets/networks?

* What is the existing routing logic for the existing network?

* Is there any reason to change/enhance the routing logic for the existing network?

* If you will be adding subnets/networks how does that impact the routing logic for the branch?

* Does this new branch have existing connectivity to the Internet? If so how is this set up? Will the new branch continue to use this Internet access or would a new connection/new ISP be beneficial?

- There are multiple ways for a branch office to connect to the main office. You should analyze the possible approaches and choose the most attractive approach:

* Branch office operates fairly independently having its own Internet access with its own ISP and communicates via Internet with the main office.

* Branch office continues to use its ISP and uses a site to site VPN to communicate with the main office.

* Branch office uses some type of leased line/Metro Ethernet or other private network infrastructure to become an extension of the main network without using Internet facilities to communicate with the main office.

* Branch office communication with the main office set up using an MPLS service from an ISP.

- There should be some analysis of the existing branch network relative to security policy. Is there an existing security policy? How does the existing security policy relate to any security policy of the main office? What kind of changes should be made in security policy to become compliant with the policy of main office?

[JoseGarcia96642]

Thank you so much for the feedback and help. I want to make sure that I'm ready when the time comes and this information is very helpful

"- you mention having router and firewall which gets into layer 3 issues."

It does? How so? How can I flesh it out? Would it be fine just with a router/multilayer switch? 

[Richard Burts]

I am glad that our suggestions and discussion have been helpful. Thank you for marking this question as solved. But we can continue to have some discussion about your questions.

I suggested that it gets into layer 3 issues and you respond "It does? How so?" So let me identify a few things that would need to be considered:

- Will the connection from your existing office/network to the new site be a private connection (carries only traffic between the sites) or will you use a service from an ISP (perhaps something like MPLS)? Or will you set up some tunneling solution (GRE tunnel or VPN site to site) to connect the sites?

- Will the new site use a block of addresses from the addressing that you currently use or will the new site have its own independent block of addresses?

- Will you use some dynamic routing protocol between the sites? If so will you advertise individual subnets or will you use some type of route summarization?

- Will the new site have its own connection to the Internet? Or will its traffic to the Internet be forwarded to you and from you to the destination?

[JoseGarcia96642]

Hello Richard, sorry I took so long with replying...been hectic these days. As soon as I get time I'll write a better response. 

Seeing how these thread/question remained idle for almost 4 years, I decided to mark your reply as accepted solution as you were very helpful. Being with the institution, I learned that most of the remote locations use a metro ethernet / point-to-point (which is something you mentioned) to expand our network, no routing is required on our part. If we do have to connect a remote location via the internet, we would end up using a firewall (such as an SRX) to create a Site-to-Site VPN infrastructure

I'll create a more detailed response later on, thank you again for all information 

[Richard Burts]

You are welcome. I look forward to your next post.