Your entire on-site network, from internet connectivity through firewall, switching and WLAN to zoning. Everything is planned, documented and continuously maintained, whether in a small office or in a group with multiple sites.
Networks often grow without control, because a switch is added here and a firewall rule there, until nobody knows why anything exists. Yet the network is the foundation on which everything else is built.
That is why network and security are not separate topics, but the same topic seen from two sides.
Everything is denied by default; only what is demonstrably needed gets opened, between internal zones too. With Fortinet or Palo Alto.
Flat for a small office, three-tier with core, distribution and access for critical environments, spine-leaf in the datacenter.
Site-to-site VPN, MPLS or SD-WAN with local or central internet breakout, up to international MPLS connectivity via partners.
Workstations, servers, IoT and guests in separate zones. A compromised system stays confined to its area.
A network consists of several layers that have to work together. The most important building blocks are:
Internet connectivity is your link to the outside world, and when it fails, the whole operation usually stops. That is why it is planned to match your needs, because bandwidth-intensive applications have different requirements than latency-critical services. Where it pays off, a second, independent provider runs in parallel with automatic failover, and your existing contracts and providers are integrated.
The firewall doesn't just protect against the open internet, it also controls access between the zones within your network. It consistently follows the Zero Trust principle, where everything is blocked by default and only what is actually needed is opened. Depending on the environment, devices from Fortinet or Palo Alto are used. This is complemented by VPN connections for secure remote access and a division into security zones following the tiering principle, with publicly reachable systems in a DMZ and internal systems clearly separated from them. Between internal zones, too, only explicitly permitted traffic gets through.
Switches connect everything in your network, which is why a clean structure is essential. VLANs are divided sensibly, extensions can be added easily, and what is plugged in where is documented. The topology depends on size and requirements: smaller environments often manage with a flat design, while larger or critical environments benefit from a three-tier architecture with core, distribution and access, which can be built for high availability with redundant uplinks and automatic failover. In the datacenter, a spine-leaf topology is often used, in which every leaf switch is connected to every spine switch. This ensures consistently low latency and can easily be extended with further leafs, without the bottlenecks of a classic tree structure.
A poorly planned WLAN is unreliable and a security risk at the same time. Radio coverage and channels are therefore planned so that neighboring access points don't interfere with each other, and where several are needed, roaming works seamlessly. Where it makes sense, each person logs in individually instead of sharing one password. Guests are cleanly separated from the internal network, so they can never access internal systems.
Multiple sites or secure remote access are connected via VPN, depending on requirements as classic site-to-site connections, over MPLS or with SD-WAN. This ranges from a single connection between two sites to the worldwide networking of a group, because international MPLS connections are also possible through partners where a pure VPN solution is no longer enough. With SD-WAN, hybrid setups with local internet breakout at every site or with central breakout in the datacenter are possible, among others, and what always matters is that the connection stays resilient where it really counts.
Not every system needs to be able to talk to every other one. That is why your network is divided into clearly separated zones following the principle of micro-segmentation, for example for workstations, servers, IoT devices and guests, with defined rules for which traffic is allowed in each zone. This keeps a security incident confined to the affected area, even if a single system has already been compromised.
For the network, too, managed doesn't just mean set up, but continuously maintained. This includes:
Availability, utilization and error rates of your network components are monitored continuously. If a connection fails or a link approaches its capacity limit, this is usually known before you notice anything, so there is time to respond, for example by switching to the redundant path or planning an extension.
Switches, routers and firewalls have a limited lifespan. Their entire lifecycle is therefore covered, from procurement and installation to replacement in case of a defect, so you don't have to deal with spare parts, delivery times or compatibility.
Network devices often run outdated firmware for years because nobody dares to touch a production system, and with every new vulnerability the risk grows. Firmware and security patches are therefore kept up to date, and maintenance windows are scheduled to disrupt your operations as little as possible.
When the network is down, every minute counts. That is why you can reach someone who already knows your environment directly through the support portal, by phone or by email.
The following two situations show what Managed Network can look like in practice:
You have several sites that need to be connected securely and reliably, for example for a shared ERP system or central servers? Then the network is planned so that it runs reliably and can be extended to further sites when needed, without starting from scratch each time. Whether a classic site-to-site VPN or SD-WAN fits better depends on the number and size of your sites.
Your network has grown over the years and nobody knows exactly what each rule is for? Then it starts with an honest overview of topology, firewall rules and zoning. After that, things are cleaned up where it makes sense and ongoing operations are taken over, without you having to rebuild everything at once.
When the network is down, you don't want to explain how your environment is built first. Through the support portal, by phone or by email, you reach someone who knows your network.
No two networks are alike, even if many providers work from the same template. Your structure is therefore built to fit your business, your size and your security requirements, from the topology to the zoning.
Where it makes sense, connections and sites run redundantly across datacenters in Switzerland and Germany, so that a single outage, for example of power or the internet connection, doesn't bring your entire operation to a halt.
Security vulnerabilities affecting your network devices are closed promptly, so you neither have to track firmware versions nor plan update cycles.
You need neither your own network team nor your own hardware that has to be procured, configured and replaced after a few years. The infrastructure is already in place and stays up to date.
Here, too, there are no flat-rate packages with features you never use, but a solution that fits your needs, with costs that follow from it.
Because every network is different, there is no off-the-shelf price list. Send a short note about what you need, and you'll receive a tailored proposal.