A general contractor gives every job site the same segmented network, with cellular failover, cameras on their own VLAN and managed tablets
A general contractor of about 140 staff in the Mountain West, running 12 to 16 active job sites at a time.
- Scale
- About 140 staff, 14 active sites, 1 standard site kit, 4 segments per site, 2 uplinks per site, 85 managed tablets
- Engagement
- Eight weeks to design and pilot the site kit, then about a week per site to roll it out
The challenge
Each trailer had been set up by whoever arrived first: a consumer router, one Wi-Fi password written on the whiteboard, security cameras on the same network as the superintendent's laptop and a hotspot as the only backup. Subcontractors, inspectors and delivery drivers all joined the same Wi-Fi. When a fiber line was cut, the site lost its drawing viewer and daily reports until someone drove out with a phone. Nobody at the office could see what was connected to any site.
A construction site is a small office that is rebuilt every few months. The trailer arrives, a crew pulls power and a line, and within a day the superintendent needs drawings, daily reports, safety forms and a camera feed. The people who set it up are not network engineers, so each site becomes whatever the first person to arrive could get working. Over a year a general contractor ends up with a dozen different small networks that the office cannot see, none of which has ever been reviewed, all of which carry the company's drawings and sign-ins.
We built one standard site kit instead. A small firewall and router, a managed switch and access points are installed the same way at every trailer. Each site has four segments: managed company devices, a crew and guest network with client isolation and a rate limit, cameras and sensors on their own VLAN, and a management segment for the network gear. Only the managed segment can reach the office. A visiting inspector or a subcontractor's laptop gets internet access and nothing else, and a compromised camera can reach its recorder and nowhere else.
Each site has two uplinks, the primary wired or fixed-wireless service and a cellular modem on 5G or LTE. The router checks that the internet and the office tunnel are really reachable, rather than trusting the link light, and fails over after missed probes. The tunnel to the office starts from the site outward, so it works behind the carrier's address translation and no inbound port is open. Cameras had their default passwords replaced, UPnP and port forwards removed and a rule that lets them reach only their recorder.
Tablets are enrolled in mobile device management. They require a passcode and disk encryption, join the managed Wi-Fi with a certificate instead of a shared password, receive operating system updates on a schedule and can be locked or wiped remotely. A weekly review shows which uplink each site is using and which new devices have appeared on each segment. A new site is a box shipped with a checklist, which is the point: the same design, the same review and the same recovery, wherever the trailer is.
In this illustrative case the figures are modeled. Cellular coverage varies by site, and segmentation limits what a bad device can reach without removing it. This engagement is illustrative and describes the kind of work our team does; details are composite.
What our team delivered
- One standard site kit: a small firewall and router, a managed switch and access points, installed the same way at every trailer, so a new site is a shipping box with a checklist instead of a custom job
- Four segments on every site: managed company devices, a crew and guest network with client isolation and a rate limit, cameras and sensors on their own VLAN, and a management segment for the network gear itself. Only the managed segment can reach the office
- Two uplinks per site: the primary wired or fixed-wireless service and a cellular modem with a 5G or LTE plan. The router probes the internet and the office tunnel rather than trusting link state, and it fails over on missed probes
- An encrypted tunnel from every site to the office, started from the site outward, so it works behind the carrier's address translation and nothing at the site needs an open inbound port
- Cameras with default passwords replaced, firmware versions recorded, no port forwards or UPnP, and a policy that lets them talk only to the recorder or its cloud service and nothing else
- Tablets enrolled in mobile device management: passcode and disk encryption required, certificate-based sign-in to the managed Wi-Fi, an approved app list, operating system updates on a schedule, and remote lock and wipe for a lost device
- A site dashboard that shows which uplink is active, which devices are connected on each segment and when a new device appears, reviewed weekly and when a site goes quiet
Result
In month three a backhoe cut the fiber at one site. The router moved to cellular after about 40 seconds of missed probes, the superintendent's tablets kept their drawing viewer and daily reports, and the site ran 9 hours on the cellular link before the carrier repaired the line. A tablet left on a scaffold was locked within 20 minutes of the report and wiped the next morning. Over the first six months the weekly review flagged 11 unknown devices on guest networks, and none could reach a camera or the office. That is one illustrative outcome, not a promise: cellular coverage varies by site, and segmentation limits what a bad device can reach, it does not remove it. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 5 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Clayton Communicator seat
Business voice, e-fax and text messaging for each user, with Microsoft Teams integration, from one service and one bill.
Live within 10 business days; porting takes longer
$32 per user, per month
E-fax, HIPAA-ready
Send and receive faxes from email or a web portal, with encryption and access logs. For practices and offices that still must fax.
Live within 5 business days
$19 per fax number, per month
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
One overlay over three very different links
The SD-WAN overlay runs over MPLS, business broadband and LTE or 5G at once. Probes measure latency, jitter and loss on every path, and each application follows its own policy: when the MPLS path degrades, voice moves to the healthier link in moments while backups stay on the cheap one.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Roaming without dropping the call
Time from leaving one access point to the first data frame on the next, split by phase. A full WPA2/WPA3‑Enterprise re-authentication repeats the 802.1X exchange; 802.11r (Fast BSS Transition) reuses cached keys, 802.11k (neighbour reports) removes the blind scan, and 802.11v (BSS transition management) lets the network steer the client. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.