A government compound looks like any office campus until you read the rules it has to obey. The internal business plane and the external public-facing plane must be physically separate — separate cabling, separate switches, separate cabinets. Every port has to know who plugged in. Every session has to be logged long enough to survive an inspection. We design government campus networks around those rules first and the Wi-Fi second, sized honestly for a township office, a county agency or a municipal compound — and we tell you up front what the two-plane rule costs, because pretending it is free is how these projects run out of money.
Four problems we find in almost every government compound that calls us:
How a government compound differs from an ordinary enterprise campus — and where the extra money goes:
Architecture drawn by AtlasCommTech following carrier-grade design practice. Diagram labels are kept in English for engineering clarity.
Why us: our founder spent 13 years inside the Huawei partner ecosystem delivering carrier networks. The layered design is the same one we use for any campus — what changes here is that the separation and the admission logs are requirements you will be audited against, so they are designed in on day one rather than bolted on before the inspection.
The solution is sized to your requirements and budget first — the same architecture can be delivered on several vendors' product lines. We help you choose by supply availability in your destination country, budget and your team's operating habits.
Six things a government campus network must do that an ordinary office network is never asked to:
Tell us the building count, the staff count and which rules apply to you — the tier tells you the shape of the network:
| Scale tier | Typical site | What the design includes |
|---|---|---|
| Township office | One small building · a few dozen staff · a service counter for the public | Two small stacks, one per plane, in two cabinets. Internal plane wired only; external plane carries the service counter, visitor Wi-Fi and internet through one firewall. Admission by port whitelist rather than a full 802.1X rollout — at this size the identity platform costs more to run than it saves, and we will say so. |
| County agency | A main building plus annexes · several departments · meeting rooms used for provincial sessions | A core pair per plane, access per floor on each plane, 802.1X across staff ports with a device whitelist for printers and codecs, visitor portal on the external plane, a conference segment with a priority class end to end, firewall with session logging at the external edge, and one management platform covering both planes. |
| Municipal compound | Several buildings in one compound · many departments · a public service hall · uplinks to the bearer network | Core pair plus aggregation per building on each plane, campus-wide 802.1X with a real identity source, department zoning inside the internal plane, a public service hall on the external plane with its own segment and rate limits, conference priority across the compound, dual firewalls at the external edge, full audit retention, and a migration that converts one building at a time — never the compound in one weekend. |
The solution is built from these equipment categories — the brand is chosen with you at design stage. Exact models depend on your port counts, PoE budget, building count and country — so we spec models after your requirements list, not before.
| Role | What it does |
|---|---|
| Core switch pair (per plane) | Two chassis running as one logical switch, routing between departments inside their own plane. Two planes means two pairs — this is the line item that surprises budgets written for an ordinary office campus. |
| PoE access switches (per plane) | Connect and power desk PCs, printers, room codecs, cameras and access points. Sized by port count plus total PoE watts, with headroom — and counted twice, because each plane has its own access layer. |
| WLAN access points (external plane) | Coverage for staff and visitor SSIDs across offices, corridors and the service hall, with a controller function for roaming and radio planning. Which plane the wireless serves is a policy decision we ask you to make in writing before we plan the radio. |
| Firewalls (external edge) | Guard the external plane's internet edge with intrusion prevention and, just as importantly, produce the session logs your audit will ask for. Standard from the county tier up, and deployed as a pair at the municipal tier. |
| Admission / identity platform | Decides what happens when something plugs in: authenticate the staff device, match the printer against the whitelist, send the visitor to the portal, and write a record for each. This is the box that turns "we don't know" into an answer. |
| Management platform (both planes) | Topology, alarms, configuration backup and change history for both planes, with the same conventions on each. Two networks run by one small team only works if they look the same on the screen. |
Send us your floor plans, your department list, your device counts and the separation and retention rules you are held to — and the model list follows. That order keeps the design honest.
An engineer replies with a two-plane design, an admission plan and the equipment-category list. Send us your requirements list — the model list follows.