Constraint that shaped everything
The campus could not go offline for the work. That single constraint decided the approach: the new architecture had to be built alongside the old one and traffic moved across in stages, rather than a weekend cutover with a rollback plan.
Wireless design
Access point placement came from a physical survey with measured signal and client density, not from marking up a floor plan. Classroom density is the case that breaks floor-plan guesswork: coverage looks fine until thirty devices associate to the same radio.
Segmentation
- Guest, student, VoIP, and corporate traffic split onto separate VLANs.
- Inter-VLAN routing restricted to what each segment genuinely needs, so the default answer between segments is no.
- Guest isolated from internal resources by design rather than by exception list.
- VoIP prioritized with QoS so call quality holds when the classrooms fill up.
Result
Full redesign delivered in stages. No campus-wide outage during the migration, and a segment map that makes the next security question answerable.