Small Office Network, Wi-Fi and Phone System Guide

Most small office networks weren't designed. They grew. The internet provider dropped off a router, someone bought a Wi-Fi extender when the back office had no signal, the phone vendor added a switch under the front desk, and the imaging company plugged its PC into whatever port was free. It mostly works, until the Wi-Fi drops during a patient's check-in, calls start sounding robotic every afternoon, or the cyber insurance renewal asks whether your guest Wi-Fi is separated from your office network and nobody knows.

A well-designed small office network isn't expensive or exotic. It uses a handful of business-grade building blocks, set up deliberately: a firewall, managed switches, separate networks for different kinds of devices, properly placed Wi-Fi, an internet connection sized for how you actually work, and a phone system that doesn't depend on one box in a closet.

This guide walks through each part in plain English, for offices with roughly 5 to 50 people, with particular attention to medical and dental practices and professional offices like CPA firms. It covers what each piece does, how to size it, what it typically costs, and the mistakes we see most often.

What does a good small office network look like?

A good small office network has a business firewall at the edge, managed switches in the middle, separate VLANs for different kinds of devices, business Wi-Fi access points on the ceiling, and a backup internet connection. Everything important sits on a battery backup.

Here's the typical layout, from the street inward:

1. Internet connections: a primary line (usually fiber or cable) and a backup (a second wired provider or a cellular connection).
2. Firewall: the security gateway between your office and the internet. It handles both internet connections and switches between them automatically.
3. Core switch: a managed switch, usually with Power over Ethernet (PoE), that connects everything else.
4. Access points: ceiling-mounted Wi-Fi units powered by the switch.
5. Devices: computers, printers, phones, imaging equipment, cameras, card terminals, each on the appropriate network segment.
6. UPS: battery backup for the firewall, switches and modem, so a power blip doesn't drop the whole office.

And the components that make it manageable:

• Central management: firewall, switches and access points managed from one dashboard, with alerts.
• Documentation: a simple diagram, a list of what's plugged in where, and labeled cables.
• Monitoring: someone notices when a device goes offline before staff do.

Let's take each piece in turn.

Do you need a business firewall?

Yes, if you handle patient, client or payment data. A firewall is the security checkpoint between your office and the internet, and a business-grade one does far more than the router from your internet provider.

The box your internet provider installs is designed to get a household online. A business firewall adds:

• Threat filtering: blocking known malicious websites, intrusion attempts and, depending on the model and subscription, scanning traffic for malware.
• Network segmentation: creating and enforcing separate networks (VLANs) so guest devices can't reach office computers.
• Multiple internet connections with automatic failover.
• Secure remote access (VPN) for staff working from home, when needed.
• Logging: a record of what happened, which matters for incident investigations and audits.
• Central management and updates: the firewall's own software gets security patches on a schedule, not "whenever someone remembers."

What to look for

• A model sized for your internet speed with security features turned on. Firewalls often advertise raw throughput; real-world throughput with threat inspection on is much lower. If you have 1 Gbps internet, the firewall must handle 1 Gbps with filtering enabled.
• Security subscription (threat feeds, web filtering, support and firmware updates). This is usually an annual fee. Without it, many features stop updating.
• Dual WAN ports for a primary and backup internet connection.
• Cloud or central management so your IT provider can monitor, update and back up the configuration remotely.
• Vendor support for the hardware for at least several years. An end-of-life firewall that no longer receives updates is a liability.

Firewall settings that matter most

1. Change default admin credentials; protect admin access with MFA where supported.
2. Disable remote management from the internet, or restrict it to known addresses.
3. Keep firmware updated on a schedule.
4. Block all inbound traffic by default; open only what's documented and needed.
5. Turn on logging and keep logs for an appropriate period.
6. Back up the configuration after every change.

What switches does a small office need?

Use managed switches with Power over Ethernet (PoE), sized with room to grow. A switch is the device that connects all your wired equipment; "managed" means it can be configured, monitored and segmented.

Cheap unmanaged switches (the small plastic boxes under desks) can't do VLANs, can't be monitored, and are a common source of mystery problems. Replace them with properly managed switches in the network closet, and run cables to where devices are.

What is PoE?

PoE (Power over Ethernet) carries electricity over the same network cable as data, so Wi-Fi access points, desk phones and cameras don't need a power outlet nearby. If the PoE switch is on a UPS, those devices stay powered during brief outages too.

PoE comes in a few standards, and the one you need depends on what you're powering:

Check two numbers when buying a PoE switch: the standard each port supports, and the total PoE budget for the whole switch. A 24-port switch with a small power budget can't run 24 access points and phones at full power.

Sizing your switches

• Count every wired device: PCs, printers, phones, access points, imaging devices, cameras, card terminals, the copier.
• Add 25–50% for growth.
• Put critical equipment (firewall, switch, modem) on a UPS.
• If you have more than one closet, link the switches with fiber or high-quality copper, and don't daisy-chain small switches through the office.

What are VLANs, and which ones should you have?

A VLAN (virtual local area network) is a separate, isolated network running on the same physical equipment. VLANs let you keep guests, phones, office computers and specialty devices apart, so a problem in one doesn't spread to the others.

Think of the office as a building with separate locked suites rather than one big open room. Guests get the lobby and the internet. Staff get their suite. Phones get a quiet room with priority. Imaging devices get their own locked room that only the right computers can enter.

This isn't just good practice. The U.S. Department of Health and Human Services' 405(d) program, which publishes voluntary Health Industry Cybersecurity Practices, recommends that guest networks have access only to the internet, with a separate network for staff, and that network segmentation restricts traffic between devices to only what's required for operations.

A typical VLAN plan for a small practice

Smaller offices can combine some of these, but the minimum for any office with patient or client data is staff, guest and voice. If you have imaging equipment or older devices that can't be kept fully patched, give them their own segment too. That's especially important for any computer still running an older version of Windows because it controls a piece of equipment; our Windows 10 end-of-support guide covers that situation.

Imaging networks need special care

Dental and medical imaging is the most demanding traffic in many practices. Large image files move between acquisition devices, servers and operatory computers, and slowness is very visible to clinicians. Practical tips:

• Wire imaging workstations; don't rely on Wi-Fi for image capture or viewing.
• Use gigabit (or faster) switch ports for imaging servers and workstations.
• Follow the imaging vendor's network requirements exactly, including any required firewall rules.
• Keep imaging segments isolated from guest and IoT networks.

Our dental imaging network and computer guide goes deeper on this.

How should you design office Wi-Fi?

Use ceiling-mounted business access points, place them based on walls and rooms rather than square footage, and run separate wireless networks for staff and guests. Consumer mesh kits and range extenders are the most common cause of "the Wi-Fi is bad in the back."

Access points, not extenders

A Wi-Fi access point (AP) is a device, wired back to the switch, that provides Wi-Fi in an area. Business APs are designed to work together: devices roam smoothly between them, they coordinate channels, and they're managed centrally. Range extenders repeat a weak signal and cut speed; avoid them in a business.

How many access points?

There's no reliable rule of thumb from square footage alone because walls matter enormously. Medical and dental offices have lots of small rooms, some with lead-lined walls around X-ray equipment, which block Wi-Fi. A long, narrow suite needs a different layout from an open-plan office.

General guidance:

• Aim for strong signal in every room where devices are used, not just "a signal."
• Mount APs on the ceiling, centrally in the areas they serve, not in closets or above metal ductwork.
• Plan for capacity, not just coverage: a waiting room with 15 phones on guest Wi-Fi needs more than a hallway.
• For new builds or major renovations, a wireless survey (measuring signal with professional tools) is worth doing.

For many small medical or dental suites, that works out to roughly two to four APs, but walk the space before deciding.

Which Wi-Fi standard?

• Wi-Fi 6 (802.11ax) is the practical baseline for business APs today.
• Wi-Fi 6E adds the 6 GHz band, which has more room and less interference. WPA3 security is mandatory on 6 GHz.
• Wi-Fi 7 adds wider channels in 6 GHz and multi-link operation, which the Wi-Fi Alliance describes as supporting more efficient load balancing across bands.

You don't need the newest standard to get good Wi-Fi; placement and configuration matter more. But if you're buying APs that should last five or more years, Wi-Fi 6E or Wi-Fi 7 is reasonable, provided your switch can power them (many need PoE+ or higher).

Wi-Fi settings that matter

1. Two to three SSIDs (network names) at most: staff, guest, and possibly one for devices that need a special configuration. Each extra SSID adds overhead.
2. Staff Wi-Fi security: WPA3 where devices support it (WPA2/WPA3 transition mode otherwise). Ideally use enterprise authentication tied to your Microsoft Entra ID accounts or device certificates managed by Intune, rather than one shared password everyone knows forever.
3. Guest Wi-Fi isolation: guests on their own VLAN with internet only, and "client isolation" so guest devices can't see each other.
4. Band steering to nudge capable devices onto 5 GHz or 6 GHz, where there's more capacity.
5. Channel planning: let the management system or your IT provider assign non-overlapping channels and reasonable power levels. Microsoft's Teams networking guidance specifically recommends that neighboring access points use channels that don't overlap and that you prioritize voice and video traffic (WMM/QoS) on Wi-Fi.

Guest Wi-Fi done right

Guest Wi-Fi is a courtesy, and it's also one of the most common network risks in small offices because it's so often on the same network as everything else.

• Separate VLAN, internet only.
• Speed limit per device, so one guest streaming video doesn't slow down your front desk.
• A password that changes periodically, or a simple splash page.
• Content filtering to block malicious and obviously inappropriate sites.
• Never put office devices (printers, smart TVs showing patient education) on the guest network "because it's easier."

How much internet speed does your office need?

Size your internet for real usage at the busiest hour, give equal attention to upload speed, and always have a backup. A connection that's fast on paper but drops twice a week is worse than a slower, reliable one.

What uses bandwidth in a small office

• Cloud practice-management, EHR and accounting software: steady but usually modest traffic.
• Microsoft 365: email, OneDrive and SharePoint sync, Teams chat.
• Voice and video calls: sensitive to quality more than raw speed.
• Imaging uploads to cloud storage or a cloud imaging platform.
• Off-site backups, which upload a lot of data, usually overnight.
• Guest Wi-Fi (rate-limited).
• Updates: Windows and application updates can be large.

Microsoft's Teams numbers as a reference

Microsoft publishes per-device bandwidth figures for Teams in its network planning guidance. They're a useful reference for any calling or meeting platform:

Audio calls use very little bandwidth; what hurts call quality is latency, jitter and packet loss, which is why voice gets its own VLAN and priority. Video and screen sharing add up quickly when several people are on calls at once.

Practical sizing

Rather than doing the math by hand, use our Internet Bandwidth Calculator, which estimates your needs based on staff count, phones, video calls, cloud apps and backups. As general context:

• Upload matters. Cable internet often has much lower upload than download. Video calls, cloud backups and image uploads all depend on upload speed. Fiber usually offers symmetrical speeds, which is why it's the first choice where available.
• Leave headroom. Plan so your busiest hour uses well under the line's capacity.
• Watch for quality, not just speed. If calls sound bad with plenty of bandwidth, the problem is usually Wi-Fi, a missing QoS setting, or a congested upload.

How does internet failover work?

Internet failover means a second connection takes over automatically when the primary goes down, usually within seconds to a minute, with no one touching anything. For any office that relies on cloud software or cloud phones, it's essential.

Options for the backup line:

The firewall monitors the primary connection and switches to the backup when it fails, then switches back when it recovers. Cloud phones and payment terminals typically keep working through the switch.

Our dental practice case study describes exactly this: a practice whose front desk used to stop every time the internet went down, and now switches to cellular automatically. For a more detailed plan, including what to do when even the backup fails, see our EHR downtime and internet failover plan.

Tips:

• Prefer backup paths that don't share the same physical route as the primary.
• Test failover quarterly by unplugging the primary.
• Make sure alerts tell you when you're running on backup, so you don't burn through cellular data for a week without knowing.
• Put the modem, ONT (the fiber box) and cellular router on the UPS too.

Should you choose VoIP or Microsoft Teams Phone?

Both are cloud phone systems that run over your internet connection; the right choice depends on how your front desk works. Most small offices no longer need an on-site phone system at all.

VoIP (voice over internet protocol) simply means phone calls carried over the internet instead of traditional phone lines. In practice, "VoIP" usually refers to a hosted business phone platform with desk phones, mobile and desktop apps, auto-attendants, call queues and voicemail-to-email.

Microsoft Teams Phone adds a phone number and calling features to Microsoft Teams. Staff make and receive calls in the Teams app on their computer or mobile, or on Teams-certified desk phones. Teams Phone needs either a Microsoft Calling Plan or a connection to another carrier (for example, through Operator Connect or Direct Routing).

Comparing them

For a dental front desk juggling three lines, hold queues and intercom to the operatories, a dedicated VoIP platform with good desk phones is usually more comfortable. For a CPA firm where everyone already lives in Teams and works partly from home, Teams Phone is often the cleaner fit. Hybrid setups exist too.

Phone system must-haves

1. Direct 911 dialing and location information. Under the FCC's rules implementing Kari's Law and RAY BAUM'S Act, multi-line telephone systems must let users dial 911 directly, without a prefix like "9," and must convey a "dispatchable location" (street address plus details such as floor or suite) with 911 calls. See the FCC's MLTS 911 requirements. Make sure your provider has your correct address and suite number, and update it if you move.
2. On-site notification of 911 calls (for example, an alert to the front desk) where the system supports it.
3. Failover routing: if the office internet is down, calls should automatically forward to cell phones or another location.
4. Auto-attendant and after-hours schedules, including a holiday and emergency message you can switch on from a phone. In Florida, that "emergency message" is also part of your hurricane preparedness plan.
5. Voice VLAN and QoS on your network so calls get priority.
6. Number porting plan: keep your main number when changing providers; get it in writing.
7. For healthcare: if voicemails, call recordings or texts include patient information, ask the provider whether they'll sign a business associate agreement.

How should a small office be cabled?

Run Cat6 cable from a central closet to every workstation, access point, phone and camera location, test and label every run, and keep it organized in a rack. Good cabling is invisible for 15 years; bad cabling causes intermittent problems that are hard to diagnose.

Cabling checklist

• Cable type: Cat6 is a common, cost-effective choice for new small-office runs. Cat6A is worth considering for access point runs if you expect very high-speed Wi-Fi in future.
• Distance: standard Ethernet runs are limited to 100 meters (about 328 feet), including patch cables.
• Plenum vs. riser: cable run through air-handling spaces (common above drop ceilings) often must be plenum-rated. Follow local code; your cabling contractor should know.
• Drops per location: at least two at each workstation (computer plus phone, or room to grow), one per access point location (two for higher-end APs), and one per camera or specialty device.
• Termination: all runs terminate in a patch panel in the closet, not directly into a switch.
• Testing: every run tested with a certifier or tester, with results provided.
• Labeling: every wall plate and patch panel port labeled to match a floor plan.
• Closet: a lockable space with ventilation, power on a dedicated circuit if possible, and the rack off the floor. In Florida, avoid closets prone to water intrusion.

Physical security

The network closet holds the keys to the kingdom. Lock it, don't use it as a storage room, and keep a record of who has access. For healthcare offices, the HIPAA Security Rule's facility access and technical safeguards (access control, audit controls, transmission security) all touch the network, so a locked closet and a documented network are part of compliance as much as IT hygiene.

What about printers, cameras and smart devices?

Treat every connected device as a computer that could be attacked, because it is. Printers, copiers, security cameras, smart TVs, door controllers and thermostats are the devices most often forgotten, rarely updated and frequently left with default passwords.

Practical rules:

• Put them on their own VLAN (often called IoT, for "internet of things"), with only the access they need. A security camera needs to reach its recorder or cloud service; it doesn't need to reach your practice-management server.
• Change default passwords on every device's admin page, and record the new ones in your password manager.
• Update firmware on a schedule. Many printers and cameras never get updated after installation.
• Turn off features you don't use, like a printer's built-in web services or a camera's remote access through the manufacturer's cloud if you don't need it.
• Copiers store documents. Many multifunction copiers have internal storage that keeps copies of scanned and printed pages. When you return a leased copier, make sure the storage is wiped or the drive is removed, and get written confirmation. For a medical or dental office, those pages may include patient information.
• Scan-to-email should send through your Microsoft 365 account securely, not through an old, unauthenticated mail relay.
• Smart TVs in waiting rooms belong on the guest or IoT network, never on the staff network.
• Card terminals should follow your payment processor's network requirements; many recommend their own isolated segment.

When you add a new device, ask two questions: what does it need to talk to, and who's responsible for keeping it updated? If nobody can answer the second question, that's a problem to solve before it goes on the network.

How do you keep the network secure and running over time?

A network isn't a one-time project. Firmware updates, monitoring, configuration backups and periodic reviews keep it secure and reliable. Most network-related incidents we see trace back to something that was set up well once and then never touched again.

Ongoing maintenance checklist

Remote access for staff and vendors

Two kinds of remote access need attention:

1. Staff working from home. With Microsoft 365 and cloud applications, most staff don't need a VPN into the office at all. Their laptops are managed by Intune, protected by Defender for Business, and sign in with MFA. A VPN is only needed for systems that still live on an office server. When you do use one, protect it with MFA and keep its software updated, because internet-facing VPNs are a frequent target.
2. Vendors supporting equipment. Imaging, phone and practice-software vendors often need remote access. Don't leave an always-on remote access tool installed with a shared password. Use a method you control, where you approve each session, and log it. Ask vendors about this before they install anything.

Logging and monitoring

Firewall logs show what tried to come in and what left. For a small office, you don't need a full security operations center, but someone should be collecting logs, alerting on obvious problems, and able to pull records if there's an incident. If you work with a managed IT provider, ask how network monitoring and alerting are handled, and who responds outside business hours. Our article on how to choose a managed IT provider covers what to ask.

What does a small office network cost?

For a typical 10–20 person office, a properly built network is a moderate one-time investment plus modest ongoing subscriptions. The table below shows typical ranges we see for business-grade equipment; actual prices vary by brand, size and features, so always get quotes.

Business-grade equipment typically lasts five to seven years, with firewalls and access points sometimes replaced sooner as security support ends or Wi-Fi standards move on. Budget for a refresh cycle rather than waiting for a failure. If you're comparing managed service options that include network management, our managed IT services cost guide and Managed IT Cost Calculator can help.

Scenario walk-throughs

Here's how these pieces come together in three typical offices. These are illustrative designs, not specific client projects.

Dental office: four operatories, imaging and a busy front desk

Needs: imaging in every operatory, a panoramic or CBCT unit, a practice-management server or cloud system, a front desk taking many calls, guest Wi-Fi in the waiting room, card terminals.

Design:

• Business firewall with fiber primary and cellular failover.
• 24-port or 48-port PoE+ managed switch, on a UPS.
• VLANs: staff, guest, voice, imaging, payments (if the card terminal vendor recommends isolation), and IoT for the TVs and cameras.
• Three ceiling-mounted Wi-Fi 6E access points: front/waiting area, operatory hallway, back office and lab.
• Every operatory computer and imaging device wired, with two drops per operatory.
• Hosted VoIP with desk phones at the front desk (with line-key sidecars), intercom paging to operatories, and automatic forwarding to cell phones if the internet fails.
• Guest Wi-Fi rate-limited and isolated.

Why it works: imaging traffic is wired and isolated, phones get priority, and an internet outage no longer stops check-in or calls.

Medical office: cloud EHR, telehealth and exam rooms

Needs: cloud EHR on laptops and tablets moving between exam rooms, telehealth video, e-prescribing, lab interfaces, vaccine fridge monitoring, guest Wi-Fi.

Design:

• Firewall with dual wired providers where available, plus cellular as a third path.
• Wi-Fi designed for roaming between exam rooms without dropping the EHR session, with access points placed to cover each room strongly. Staff Wi-Fi uses certificate-based authentication tied to Intune-managed devices.
• Voice VLAN with QoS; telehealth video prioritized.
• Medical device and IoT VLAN for the fridge monitor and any connected diagnostic equipment.
• Internet sized for simultaneous telehealth visits: using Microsoft's figure of about 1.5 Mbps per one-to-one HD video call as a reference, several concurrent visits plus normal traffic fit comfortably on a symmetrical fiber line.

CPA firm: 15 staff, hybrid work, tax season peaks

Needs: secure access to client files and tax software, video meetings, hybrid staff, a conference room, client guest Wi-Fi.

Design:

• Business firewall with web filtering and logging, which support the FTC Safeguards Rule's expectations; see our IT security guide for CPA firms.
• Teams Phone, since staff already work in Teams; a couple of Teams-certified desk phones at reception.
• Two access points plus one in the conference room for meetings.
• VLANs for staff, guest, voice and printers/IoT.
• Internet sized for tax-season peaks with plenty of upload for cloud backups and large file transfers.

Mistakes we see most often

These are the problems we find again and again when we look at an existing small office network.

1. Guest Wi-Fi on the same network as office computers. The most common and most important fix.
2. Consumer routers and mesh kits running a business.
3. Unmanaged switches daisy-chained under desks.
4. No backup internet, so every outage closes the front desk.
5. Firewall firmware years out of date, or the security subscription lapsed.
6. Default admin passwords on the firewall, switches or access points.
7. No UPS on network gear, so a two-second flicker reboots everything.
8. Wi-Fi extenders instead of wired access points.
9. No documentation: nobody knows what's plugged in where or what the passwords are.
10. Phones without correct 911 location information.

Questions to ask your IT provider or network installer

1. Is our guest Wi-Fi completely separated from our office network? Can you show me?
2. Which VLANs do we have, and what's on each?
3. When was our firewall's firmware last updated, and is its security subscription current?
4. What happens if our primary internet fails? When did we last test it?
5. Are our firewall, switches and modem on a UPS, and when were the batteries last replaced?
6. How many access points do we have, and is every room covered well?
7. Is our phone system's 911 address correct, including suite number?
8. Do we have a current network diagram and an inventory of devices?
9. Who gets alerted when a network device goes offline?
10. When does our network equipment reach end of support, and what's the replacement plan?

A practical upgrade path

You don't have to replace everything at once. If your current network grew organically, here's a sensible order:

1. Separate guest Wi-Fi from office devices. Often possible with your existing equipment.
2. Add a UPS to the network closet.
3. Install a business firewall with failover and a backup internet connection.
4. Replace unmanaged switches with a managed PoE switch; create staff, voice and specialty VLANs.
5. Replace consumer Wi-Fi with ceiling-mounted business access points.
6. Clean up cabling and label everything.
7. Move phones to the cloud if they're still on an aging on-site system.
8. Document the whole thing and set a refresh schedule.

Steps 1 to 3 deliver most of the security and reliability benefit, and they're also the items cyber insurers and auditors ask about first. The cyber insurance readiness tool is a quick way to see where else you stand.

The bottom line

A small office network that runs reliably for years isn't complicated: a business firewall, managed PoE switches, VLANs that keep guests, phones and specialty devices apart, well-placed business Wi-Fi, an internet connection sized for real use with automatic failover, a cloud phone system, clean cabling and a UPS. Done once and done properly, it fades into the background, which is exactly what a network should do.

If your network grew one extender at a time and you'd like a clear picture of what you have and what to fix first, we can review it and give you a prioritized plan. See our IT services and healthcare IT pages, or contact us to set up a walk-through.