Secure Your Network
Smarter Segmentation. Stronger Protection.
Not every device in your business should have access to everything. Pulsar IT designs and secures business networks to protect sensitive systems, reduce unnecessary access and help prevent security incidents spreading across your organisation.
What is Secure Your Network?
In many small business networks, every device sits on one flat network: staff laptops, the file server, guest Wi-Fi, desk phones, CCTV cameras, printers and smart devices. That's simple to run, but it means one compromised device can try to reach everything else.
Network segmentation divides your network into separate zones, usually using VLANs (virtual local area networks). A VLAN groups devices into their own logical network, even when they share the same switches, cabling and Wi-Fi. Your business firewall then sits between the zones and decides, rule by rule, which traffic may pass from one to another.
Pulsar IT reviews your current network, designs segments around the way your business actually works, configures your switches, Wi-Fi and firewall, tests that everything still works and documents the result.
Key benefits
- Sensitive systems kept apart from guests, cameras and smart devices
- Each group of devices reaches only what it genuinely needs
- Incidents are less likely to spread across the whole organisation
- Clear firewall policies controlling traffic between network segments
- A documented design that's easier to manage, troubleshoot and audit
How does it work?
We create separate segments for different types of device, then use your business firewall to control which traffic may pass between them. The starting point is least privilege: if a segment doesn't need to reach something, the firewall blocks it.
Review your network
We review your sites, switches, Wi-Fi, firewall, devices and the systems each team uses, and check whether your equipment supports VLANs and the firewall features the design needs.
Design segments and policies
We agree a segment plan with you, for example staff, servers, guests, voice, CCTV/IoT and management, and the firewall policy for traffic between them, based on what each group genuinely needs.
Implement and test
We configure VLANs on switches and Wi-Fi, build the inter-VLAN firewall policies, move devices into their segments and test printing, phones, cameras and business applications, working in planned stages to limit disruption.
Document and hand over
We document the final design, segments, addressing and firewall rules, and agree how the network will be looked after, whether by us or by your own team.
- Staff VLANAllowed: the internet and approved business systems on the server VLAN. Blocked: CCTV, IoT devices and management interfaces.
- Server VLANAllowed: only the services staff need, and only the outside destinations servers require, such as updates and backups. Blocked: guest and IoT traffic.
- Guest Wi-Fi VLANAllowed: filtered internet access only. Blocked: every internal network, including servers and staff computers.
- Voice VLANAllowed: your phone system and telephony provider. Blocked: staff computers and servers.
- CCTV / IoT VLANAllowed: the recorder or cloud service each device needs. Blocked: staff computers, servers and the wider network.
- AllowedInternetPermitted, filtered by the firewall
- BlockedCorporate serversNo path from the guest network to business systems or data
- BlockedStaff computersGuest devices can't see or connect to office laptops and PCs
Technologies we use
- VLAN segmentation: separate logical networks on shared switches and Wi-Fi, so groups of devices are kept apart
- Corporate network: a segment for staff computers and the business devices they use every day
- Guest networks: internet-only Wi-Fi for visitors, kept away from business systems
- Voice VLANs: a dedicated segment for desk phones, keeping them separate from computers and allowing call traffic to be prioritised
- CCTV and IoT VLANs: cameras, recorders, door entry, smart TVs and building systems kept away from business data (IoT, the Internet of Things, means everyday devices connected to the network)
- Server VLANs: business servers grouped behind tighter firewall controls
- Management networks: a restricted segment for the administration pages of switches, access points and firewalls
- Inter-VLAN security policies: firewall rules that decide what may pass between segments
- Least-privilege network access: each segment and user group gets only the access it needs, and nothing more
- Firewall access control: traffic between segments, and to and from the internet, checked against your agreed policies
- Layer 3 routing restrictions: control over which networks and addresses can reach each other
- Layer 4 protocol and port filtering: control over which types of connection are allowed between segments
- Layer 7 application-aware inspection: control based on the application in use, where your firewall supports it
- Secure firewall policies: rules kept as narrow as practical, clearly named and documented
- Secure network administration: management access limited to authorised people and locations, with multifactor authentication where supported
- Security monitoring and alerting: firewall logs can be monitored automatically through our Managed Firewalls service, with alerts reviewed by our team in line with your agreed service level
- Firewall rulebase review: existing rules checked, and unused or overly broad rules flagged, as part of the design
- Network documentation: diagrams, segment and addressing plans and rule descriptions for your records
Why it matters: everyday examples
A guest on your Wi-Fi
A visitor's phone or laptop may be infected without them knowing. On a guest VLAN it can reach the internet but not your company's internal servers, so customer records, accounts and shared files stay out of reach.
A CCTV camera
Cameras and other smart devices often run software that is rarely updated. On their own VLAN, a camera can't automatically communicate with staff computers, so a compromised camera is much harder to use as a stepping stone into the business.
A business server
A server should only access the destinations and services it genuinely needs, such as update sources and backup storage. Limiting it reduces what an attacker could do with it and makes unexpected connections stand out.
Desk phones
Putting phones on a voice VLAN keeps them separate from computers and lets the network give call traffic priority, which can help call quality on a busy network.
Understanding Layer 3, Layer 4 and Layer 7 Security
Firewalls can control traffic at different levels, often described as 'layers' from a standard networking model. You don't need to know the model to follow the idea. Picture your network as an office building and the firewall as the security desk in reception.
Layer 3: which networks can talk
Layer 3 is about addresses and routes: which segments and devices are allowed to reach each other at all. It's like deciding which floors a visitor's pass will open. Routing restrictions at this level can stop the guest network reaching the server network entirely.
Layer 4: which doors are open
Layer 4 is about protocols and ports, the specific 'doors' a connection uses. Even where two segments may talk, you can allow only certain services, for example letting staff computers print and browse the web while blocking remote management connections to the same devices.
Layer 7: which applications are allowed
Layer 7 looks at the application itself, not just the door it uses. It's like the security desk checking what's in a parcel rather than only which entrance it came through. Application-aware inspection can recognise and control particular applications, such as file-sharing or remote access tools, even when they use common ports.
Layer 7 application control depends on your firewall's features, inspection capability and licensing, and inspecting encrypted traffic may need extra configuration. We confirm what your firewall can do during the review.
Problems solved
One flat network for everything
When every device shares one network, a single compromised laptop or gadget can try to reach every server and computer in the business.
Guests on the same network as staff
Sharing the office Wi-Fi password with visitors gives their devices a path towards your internal systems. A separate guest network removes it.
Cameras and smart devices next to business data
CCTV, door entry and smart devices are often poorly updated. Separating them limits what an attacker could reach through one of them.
VLANs that don't actually restrict anything
Some networks already have VLANs but allow all traffic between them, so the separation offers little real protection. Firewall policies close that gap.
Nobody knows how the network fits together
Networks that grew one device at a time are hard to secure and troubleshoot. A documented design makes changes safer and faster.
What's included
Included as standard
- Review of your current network, equipment and firewall capability
- Segmentation design agreed with you
- VLAN configuration on supported switches and Wi-Fi
- Inter-VLAN firewall policy implementation
- Guest, voice and CCTV/IoT separation
- Testing of key systems and devices after changes
- Documentation of the final design
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Replacement or additional managed switches, access points or firewall licences
- Layer 7 application control and advanced inspection, where your firewall and licensing support them
- Changes outside normal working hours, by agreement
- A Firewall Rulebase & Configuration Assessment before the project starts
- Ongoing management through Managed Firewalls and Managed Network Infrastructure
What's not included
- Network hardware, firewall licences and subscriptions, unless agreed in your proposal
- Structured cabling work, unless specifically included
- Changes to third-party systems, such as CCTV, door entry or phone platforms, that need the supplier's involvement
- Ongoing monitoring and management after handover, unless you take a managed service
VLAN separation alone isn't a complete security boundary. Segments are only protected when communication between them is appropriately controlled by firewall policies, and those policies are kept up to date.
Layer 7 application control depends on your firewall's features, inspection capability and licensing. We confirm what is available during the review.
VLANs need managed switches and compatible Wi-Fi, so some equipment may need upgrading. Segmentation reduces the impact of an incident, but devices still need endpoint protection, updates and backups.
Who it's suitable for
- Offices that offer guest or visitor Wi-Fi
- Businesses with CCTV, door entry, smart TVs or other connected devices
- Organisations with on-site servers or sensitive customer data
- Businesses using VoIP desk phones on the same network as computers
- Growing businesses whose network has expanded one device at a time
Pricing
This service is tailored to your business, so we confirm the price after a short conversation about your requirements. There is no charge for the conversation.
Use the quote builder to add Secure Your Network to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Tailored pricing based on network size and complexity.
What affects the price
- Number of sites
- Number of switches
- VLAN requirements
- Firewall capability
- Existing network topology
- Device counts
- Network complexity
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
What is a VLAN, in simple terms?
A VLAN is a separate network created in software on your existing switches and Wi-Fi. Devices in different VLANs behave as if they were on separate networks, even though they share the same cables, and the firewall controls what passes between them.
Are VLANs enough on their own?
No. VLANs separate devices, but if all traffic between them is allowed, the separation offers little real protection. The security comes from firewall policies that control what each segment can reach.
Will we need new equipment?
Possibly. VLANs need managed switches and Wi-Fi that support them, and your firewall needs the capacity and features for the policies. We check your existing equipment first and only recommend replacements where they are needed.
Will segmentation stop our printers, phones or cameras working?
Some devices rely on finding each other on the network, so separating them needs care. We identify those dependencies during the review, create specific rules where needed and test in planned stages.
How is this different from Secure Remote Working?
This service secures the networks in your offices. Secure Remote Working protects staff working away from the office with an always-on VPN. Many businesses use both, with the same firewall enforcing policies for office and remote devices.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.