Home / Solutions / Industrial Networking & Datacom / Government Campus Network

Government Campus Network: Where Separation and Admission Are Rules, Not Options

A government compound looks like any office campus until you read the rules it has to obey. The internal business plane and the external public-facing plane must be physically separate — separate cabling, separate switches, separate cabinets. Every port has to know who plugged in. Every session has to be logged long enough to survive an inspection. We design government campus networks around those rules first and the Wi-Fi second, sized honestly for a township office, a county agency or a municipal compound — and we tell you up front what the two-plane rule costs, because pretending it is free is how these projects run out of money.

Why This Is Not Just an Office Campus

Four problems we find in almost every government compound that calls us:

The two planes must be physically separateThe rule is not "put them in different VLANs". Internal business and public-facing services need their own cabling, their own switches and their own cabinets — and somebody will come and check. Half the retrofits we see failed because the original design treated this as a VLAN problem.

Visitors and staff share one flat networkThere is a Wi-Fi password on a card at reception, and it reaches the same switches the registry uses. Nobody set out to do this — it grew, one access point at a time, and now no one dares change it because they do not know what would break.

Meeting-room video stutters at the worst momentThe session with the province starts, and the picture breaks up. Nothing is broken — the network simply has no idea that this stream matters more than the file sync running on forty desktops on the same floor.

No record of who was on the networkAn inspection asks which device used which address last March, and the answer is a shrug. Without admission control and retained logs, the question cannot be answered at all — and "we don't know" is the worst possible finding.

Architecture: Two Physical Planes + Admission Control + Wireless That Knows Which Plane It Is On

How a government compound differs from an ordinary enterprise campus — and where the extra money goes:

Architecture drawn by AtlasCommTech following carrier-grade design practice. Diagram labels are kept in English for engineering clarity.

Why us: our founder spent 13 years inside the Huawei partner ecosystem delivering carrier networks. The layered design is the same one we use for any campus — what changes here is that the separation and the admission logs are requirements you will be audited against, so they are designed in on day one rather than bolted on before the inspection.

Equipment Options

The solution is sized to your requirements and budget first — the same architecture can be delivered on several vendors' product lines. We help you choose by supply availability in your destination country, budget and your team's operating habits.

Huawei — enterprise campus, WAN and security linesMature ecosystem with a global service network.

ZTE Wantong — comparable datacom linesPrice-performance direction; supply runs smoother in some markets.

H3C — campus and data-center linesWidely deployed campus and data-center portfolio.

Zhongxin Shutong industrial switches — industrial-scenario access layerOur own industrial line — compatible with any brand's core layer.

What the Design Delivers

Six things a government campus network must do that an ordinary office network is never asked to:

Two planes, built as two networksInternal business and public-facing services get their own cabling, switches and cabinets. There is no cable, no VLAN and no route between them — which is the only version of this rule that survives an inspection.

Every port knows who plugged in802.1X on staff ports, a whitelist for printers and room codecs that cannot authenticate, and a portal for visitors. An unknown device gets nothing — not a guest VLAN, nothing.

Meeting video that holds upConference rooms get their own access segment and a priority class on every uplink, so a session with the province is not competing with a file sync on the same floor.

Wireless that knows which plane it servesStaff and visitor SSIDs live on the external plane, authenticated separately, each rate-limited. The internal plane is wired only unless your own rules explicitly allow otherwise — and we ask to see that rule in writing before we design it.

An audit trail that answers the questionAdmission logs, firewall session logs and configuration change history, retained for the period your own regulation sets. When an inspection asks who used what and when, the answer is a query — not an archaeology project.

A design a small team can actually runTwo planes mean twice the boxes, so both are managed from one platform with the same conventions, the same naming and the same backups. Compliance that only one person understands is not compliance — it is a resignation letter waiting to happen.

Three Sizes, One Design Logic

Tell us the building count, the staff count and which rules apply to you — the tier tells you the shape of the network:

Numbers we design around:

Two physical planes means roughly two access layers — count the cabling and the cabinets twice, from the first budget draft

Every access port is an admission point — 802.1X for staff, whitelist for printers and codecs, portal for visitors

Log retention is set by your regulation, not by us — tell us the period and we size the storage for it

Scale tier	Typical site	What the design includes
Township office	One small building · a few dozen staff · a service counter for the public	Two small stacks, one per plane, in two cabinets. Internal plane wired only; external plane carries the service counter, visitor Wi-Fi and internet through one firewall. Admission by port whitelist rather than a full 802.1X rollout — at this size the identity platform costs more to run than it saves, and we will say so.
County agency	A main building plus annexes · several departments · meeting rooms used for provincial sessions	A core pair per plane, access per floor on each plane, 802.1X across staff ports with a device whitelist for printers and codecs, visitor portal on the external plane, a conference segment with a priority class end to end, firewall with session logging at the external edge, and one management platform covering both planes.
Municipal compound	Several buildings in one compound · many departments · a public service hall · uplinks to the bearer network	Core pair plus aggregation per building on each plane, campus-wide 802.1X with a real identity source, department zoning inside the internal plane, a public service hall on the external plane with its own segment and rate limits, conference priority across the compound, dual firewalls at the external edge, full audit retention, and a migration that converts one building at a time — never the compound in one weekend.

Equipment Roles (Categories, Not Models)

The solution is built from these equipment categories — the brand is chosen with you at design stage. Exact models depend on your port counts, PoE budget, building count and country — so we spec models after your requirements list, not before.

Role	What it does
Core switch pair (per plane)	Two chassis running as one logical switch, routing between departments inside their own plane. Two planes means two pairs — this is the line item that surprises budgets written for an ordinary office campus.
PoE access switches (per plane)	Connect and power desk PCs, printers, room codecs, cameras and access points. Sized by port count plus total PoE watts, with headroom — and counted twice, because each plane has its own access layer.
WLAN access points (external plane)	Coverage for staff and visitor SSIDs across offices, corridors and the service hall, with a controller function for roaming and radio planning. Which plane the wireless serves is a policy decision we ask you to make in writing before we plan the radio.
Firewalls (external edge)	Guard the external plane's internet edge with intrusion prevention and, just as importantly, produce the session logs your audit will ask for. Standard from the county tier up, and deployed as a pair at the municipal tier.
Admission / identity platform	Decides what happens when something plugs in: authenticate the staff device, match the printer against the whitelist, send the visitor to the portal, and write a record for each. This is the box that turns "we don't know" into an answer.
Management platform (both planes)	Topology, alarms, configuration backup and change history for both planes, with the same conventions on each. Two networks run by one small team only works if they look the same on the screen.

Send us your floor plans, your department list, your device counts and the separation and retention rules you are held to — and the model list follows. That order keeps the design honest.

Design Notes & Honest Limits

Read this before you commit:

The two-plane rule is not free, and we will not pretend it is. It roughly doubles the access layer: cabling, switches, cabinets, ports, spares and the hours to run them. Every government campus project that ran out of money we have been called into ran out of money exactly here, because the first budget was written as if this were an ordinary office campus.
We build to your rules; we do not interpret them. Separation requirements, admission requirements and retention periods differ by country, by level of government and by the classification of what you handle. Send us the rule text you are held to. If you are not sure which rules apply, that question belongs with your own legal or security office before it belongs with us.
Admission control fails on the devices nobody listed. Old printers, room codecs, door controllers and building systems often cannot authenticate at all, and switching on 802.1X without inventorying them first is how you lock your own staff out on a Monday morning. We inventory before we enforce — and that inventory takes real time.
Licensing policy and product availability differ by brand and destination country. Admission and identity features in particular are often licensed per device or per user, and a licence that is bundled in one market is an add-on in another. We check and confirm both for your country at the design stage — before you commit to anything.
If none of these rules apply to you, do not buy this design. An agency that has no separation requirement and no audit obligation is an ordinary office campus, and an ordinary office campus network will serve it better and cheaper. We would rather point you at that page than sell you two planes you do not need.

FAQ

How is this different from your Enterprise Campus Network solution?

The layered discipline is identical; the requirements are not. On an enterprise campus, network separation and admission control are options you choose if the budget allows — a nice-to-have that improves security. In a government compound they are rules you are audited against: the internal and external planes must be physically separate, every port must have an identity behind it, and the logs must survive long enough to be inspected. That difference changes the equipment count, the cabling, the budget and the schedule. If you have no separation requirement and no audit obligation, the enterprise campus page describes a better and cheaper network for you.

Can't we just use VLANs instead of two physical networks?

Technically VLANs isolate traffic very well, and for a company that is usually the right answer. The question here is not whether it works — it is what your rule says. If your regulation requires physical separation, a VLAN design will be found non-compliant no matter how well it is built, and you will pay twice: once for the VLAN design and once for the rebuild. Send us the rule text. If it permits logical separation we will design it that way and save you the second access layer; if it does not, we will not quietly build one and hope nobody reads the cabinet.

Can staff use Wi-Fi to reach internal systems?

That is a policy question, not a technical one, and we will not answer it for you. Technically, yes — an authenticated staff SSID can be placed on the internal plane. Whether your rules allow the internal plane to have any radio at all is something we ask you to confirm in writing before we plan the coverage. Many governments say no, some say yes with certificate-based authentication and link encryption, and a few say yes for some departments and no for others. We design to whichever answer you give us, but we need the answer before the radio plan, not after the access points are on the ceiling.

Can a working compound be rebuilt without stopping work?

Yes — building by building, and that is the only way we will plan it. The new planes are built alongside the existing network, one building or one floor is cut over in an agreed window, it runs and is proven, and only then does the next one follow. The service counter and the meeting rooms are usually cut over last, because they are the two things that are noticed within minutes when they stop.

What do we have to give you before you can design anything?

Four things: floor plans with the cabinet locations, a department list with headcount, an inventory of the devices that will need network — including the printers and door controllers everyone forgets — and the text of the separation, admission and retention rules you are held to. The last one matters most. Without it we would be guessing at the requirement that drives the entire budget, and a guess there is not a design, it is a gamble with your money.

Send us your floor plans and the rules you are held to

An engineer replies with a two-plane design, an admission plan and the equipment-category list. Send us your requirements list — the model list follows.

WhatsApp an engineer →