Building an isolated network for a new clinical suite

The challenge

What needed fixing

A new clinical suite needed its own network, Wi-Fi, cameras, and computers, kept separate from the main office as an isolated tenant network.

My approach

What I did, in order

1. Designed the isolated network

   A dedicated, isolated VLAN with its own DHCP scope and its own Wi-Fi network.

2. Deployed the hardware

   A 24-port PoE switch, a Wi-Fi 7 access point, and an NVR with IP cameras, with PoE power and cabling planned up front.

3. Sourced and prepared the endpoints

   Researched and bought business-grade all-in-one PCs, upgraded RAM and storage, and registered them in Windows Autopilot so they enroll into Intune automatically.

4. Troubleshot a real outage

   After an access point firmware auto-update, wireless clients stopped getting IP addresses while wired devices were fine. I traced it to a management-VLAN collision on the AP.

Architecture

Sanitized diagram

What I learned

Takeaway

Firmware auto-updates can change network behavior. Keep AP management on a dedicated management VLAN and never on a client VLAN, and schedule updates.