Network Design
VLAN architecture, subnet planning, redundancy, and capacity sizing based on your current and projected usage.
Network Services · Vancouver, BC
Network Support Vancouver
Hexafusion designs, installs, and manages business networks in Vancouver. Firewalls, wireless, VPN, monitoring, and internet circuit management for small and medium businesses across the Lower Mainland.
Network Design, Support, and Monitoring in Vancouver
Business networks fail in ways that are expensive and hard to diagnose. Hexafusion designs, installs, and manages the full network infrastructure for Vancouver businesses: internet connectivity, firewalls, switches, wireless access points, and VPN.
Firewall Management
Fortinet, SonicWall, WatchGuard, Meraki, and Palo Alto, with unified threat management policies, intrusion prevention, web filtering, and VPN configuration.
Wireless Networks
Cisco Meraki, Ubiquiti UniFi, Aruba. Site surveys, access point placement, guest network isolation, and roaming configuration.
Switching and Cabling
Managed switches, VLAN tagging, PoE planning, structured cabling coordination with trade partners.
VPN and Remote Access
Site-to-site VPN, SSL VPN for remote workers, Zero Trust Network Access (ZTNA), and split-tunnel configuration.
24/7 Monitoring
Bandwidth utilization, latency, packet loss, and device health monitoring with automated alerting.
Internet Connectivity and ISP Management
We act as your interface with Telus, Shaw, Rogers, and other carriers. Circuit design, failover configuration, service level agreement negotiation, and issue escalation when something goes wrong.
Network Security
Every network we deploy ships with multiple layers of security: next-generation firewall with intrusion prevention, web filtering, DNS filtering, network segmentation, and continuous monitoring. Security is part of every network engagement, not a separate line item.
Our baseline segmentation for any office of 10 or more users: separate VLANs for workstations, servers, guest Wi-Fi, point-of-sale, and Internet of Things (IoT) devices (cameras, printers, HVAC controllers, door access readers). Each segment has explicit inter-VLAN rules and its own outbound policy. This containment model means a compromised camera or guest laptop cannot access your servers or business data. It also maps cleanly to what cyber insurance underwriters now ask for on their network-diagram questionnaires.
Our network design process
Network projects fail most often because of bad discovery, not bad gear. We spend the first week understanding your actual traffic, not your assumed traffic.
Step 1 · Site survey
Physical walkthrough. Document building type (concrete, brick, drywall), cable runs, existing rack locations, power, cooling. For heritage buildings common in Gastown and Mount Pleasant, this step saves real money.
Step 2 · Wireless heat map
Passive and active site survey with a professional heat-mapping tool. We measure actual signal and interference before quoting access point counts, not afterwards.
Step 3 · Traffic analysis
Where existing network exists, we run a one-week traffic capture. Peak utilisation, busiest applications, client-device distribution. This is how we catch the shadow IT or misconfigured backup job that is saturating your uplink.
Step 4 · Design doc
VLAN map, IP address plan, firewall rule base, wireless radio plan, power and PoE budget, cable run list. You sign off before any equipment is ordered.
Step 5 · Install
Swap windows are scheduled for weekends or evenings. We stage and pre-configure equipment offsite so cutover time on-site is minimised. For retail and hospitality we often split the install across two short windows to avoid missing service hours.
Step 6 · Tune & document
Wireless roaming tuned against real user patterns. Monitoring baselines captured. Documentation handed over. Network goes into managed operations under your monthly plan.
What we hand over
Every network we install comes with documentation you own. This is the single most common gap we find in networks built by other providers. If you leave, you take it with you.
- Network diagram with VLANs, subnets, and inter-segment rules
- IP address management (IPAM) spreadsheet with every static allocation
- Rack elevation drawings and cable labelling scheme
- Firewall rule base with comments explaining the business reason for each rule
- Wireless radio plan, SSID (network name) purpose list, and guest network policy
- Change log of every modification from go-live onwards
- Vendor contact list with account numbers and support PINs
Common Vancouver building considerations
Metro Vancouver's building stock creates repeatable network-design patterns we've worked through many times:
- Downtown towers (Burrard, Howe, Seymour). Good cabling, multiple carrier fibre options, but shared risers that need coordination with building management for any new pulls.
- Gastown and Railtown heritage brick. Signal penetration is poor. Expect more access points than a modern office of the same size. Cable routing needs creative planning.
- Mount Pleasant and Main Street. Mix of converted warehouses and new construction. High ceilings are great for wireless; concrete floors between suites can block uplink.
- Kitsilano and West End low-rise. Older electrical infrastructure sometimes limits PoE budget. Plan access-point count accordingly.
- East Van industrial. Large footprint, metal-framed buildings, forklift and heavy-equipment interference. Outdoor-rated access points for yards and loading bays.
Frequently asked questions
How long does a network refresh take?
A typical office of 10 to 50 users takes two to four weeks end-to-end. Site survey and design in week one. Equipment procurement and staging in week two. Install window is usually one weekend or two evenings to swap core equipment. Wireless tuning and final documentation follow the week after.
Which firewall brands do you support?
Fortinet, Cisco Meraki, SonicWall, WatchGuard, and Palo Alto. We do not lock clients into a specific brand and will recommend based on use case, budget, and existing skill set. For most Vancouver businesses we recommend Meraki for simplicity or Fortinet for deeper control. Palo Alto for regulated environments that need advanced threat prevention.
Do you manage our internet service provider?
Yes. We act as your single point of contact with Telus, Shaw (Rogers Business), TekSavvy, and other Vancouver-area carriers. Circuit design, failover, service-level agreement review, issue triage, and escalation when something breaks.
What is zero-trust network access (ZTNA)?
Zero-trust network access replaces legacy virtual private network (VPN) with an identity-aware per-application access model. Users get access to specific apps after device and identity checks rather than joining a flat network. We deploy Cloudflare Access, Zscaler, or Palo Alto Prisma depending on existing stack.
Can you install wireless in heritage buildings?
Yes. Heritage brick common across Gastown and Railtown blocks signal more than modern drywall. We do proper site surveys with heat mapping before quoting. Cable runs often need creative planning around exposed brick, plaster, and limited ceiling access.
Can you support multi-site networks?
Yes. Site-to-site virtual private network (VPN), software-defined wide-area network (SD-WAN), or multiprotocol label switching (MPLS) depending on requirements. Most multi-site Vancouver clients land on SD-WAN with dual carriers for resilience.
Ready to talk?
A Hexafusion consultant will review your environment and respond within one business day with a scoped proposal.
Request a free assessmentRelated services
Managed IT VancouverCybersecurity VancouverIT ConsultingCloud ServicesMicrosoft 365Google WorkspaceBackup & DRIT Supplier / Dell
Service areas across Metro Vancouver
Hexafusion at a glance. Vancouver-based since 2020 · downtown office at 997 Seymour Street · Dell authorized reseller · Microsoft Solutions Partner · founder is a former PCI DSS Internal Security Assessor · on-site service across 14 Lower Mainland municipalities · flat-rate managed plans with a 60-second initial ticket response and a 15-minute engineer reply during business hours.
Compliance baseline behind every Hexafusion engagement
Business network design and firewall management is delivered against a documented baseline aligned to the Canadian Centre for Cyber Security baseline controls and current cyber-insurance underwriting expectations. The same baseline applies whether you are a five-person clinic or a 200-seat manufacturer.
- Identity and access: Microsoft Entra ID with Conditional Access, multi-factor authentication (MFA) enforced on every account, compliant-device sign-in.
- Endpoint protection: Endpoint Detection and Response (EDR) on every device, deployed before the user receives the laptop.
- Disk encryption: BitLocker on Windows, FileVault on Mac, with central key escrow.
- Backup and recovery: Managed backups with documented retention and quarterly restore tests.
- BC PIPA and PIPEDA aware: Audit logging, role-based access, and breach-notification process kept current with the Office of the Privacy Commissioner of Canada guidance.
Hardware lifecycle and responsible disposal
Hexafusion is a Dell authorized reseller with Canadian distribution channels for Lenovo, Apple, Microsoft Surface, and networking gear. At end-of-life, drive sanitization follows NIST Special Publication 800-88, every retired device generates a serial-numbered certificate of destruction for your PIPEDA records, and devices are recycled through programs accredited by the Electronic Products Recycling Association (EPRA Canada).
Who you actually work with
Hexafusion is led by founder Alex Barari, a former PCI DSS Internal Security Assessor with 15+ years in enterprise IT and cybersecurity. Every engagement is supported by the same Vancouver-based team that designs the security baseline, reviews the alerts, and shows up on-site when remote troubleshooting reaches its limit. Our quarterly business review (QBR) turns the relationship into a real strategic conversation with cited numbers, not a marketing newsletter.
What our network support engagement actually looks like
Every new network support client follows the same documented onboarding. Day one is an environment discovery call where we map every account, device, license, and dependency. By the end of the first week we have a written security baseline diff (what is currently in place, what is missing, what gets remediated in which order). By day 30 you have a complete documentation bundle: network diagram, asset register, license inventory, MFA coverage report, backup test results, and incident response runbook. None of that is sold as an extra; it is the starting condition for every managed engagement.
During steady-state operations you can expect a 60-second initial ticket response and a 15-minute engineer reply during business hours, with after-hours emergency coverage available on Professional and Enterprise plans. Every quarter we deliver a Quarterly Business Review (QBR) as a PDF: engagement health score, financial recap, onboarding progress, renewal calendar, and an AI-summarized executive paragraph. The QBR makes drift impossible to hide: if a metric slides for two quarters in a row, you see it before we do, and we are already working on it by the time you read it.
Commitments we make in writing
- Flat monthly pricing. No hourly billing for in-scope work. The price you sign for is the price you pay until annual renewal.
- Documented service level agreements (SLAs). Initial response, engineer engagement, and resolution targets in writing for every plan tier.
- Transparent offboarding. If the relationship ever ends, you receive 30 days of transition support and full documentation handover. No hostage data, no exit fees.
- No surprise project invoices. Work outside scope is quoted in advance, with the option to approve, defer, or decline before any billable time accrues.
- Vendor-coordinated escalations. When the issue is on Microsoft, Telus, Rogers, Veeam, or any other vendor we manage on your behalf, we own the support case from open to resolved, not you.
- Continuity of the same team. The engineer who onboards you is the engineer who answers your tickets in month 12, barring unusual staff changes that are communicated in writing in advance.
Network questions Vancouver businesses ask us
How long until we are fully migrated to the new network support setup? Most network support engagements complete environment discovery, security baseline, and the bulk of remediation work within the first 30 days. Larger or more regulated environments (legal, healthcare, financial services) may stretch baseline tasks into a 60- or 90-day window so audit-quality documentation is built alongside the changes.
What if our existing IT person stays involved? Co-managed engagements are common. We document the boundary in your Statement of Work (SOW): which tickets we own, which they own, what escalation looks like, and which systems we both have administrative access to. The split shows up in your monthly invoice as named workstreams so nobody pays twice for the same coverage.
How do you measure whether network support is actually working for our business? The engagement health score on every QBR rolls up signal from invoice payment timing, ticket response adherence, backup test pass rate, MFA coverage, patch latency, and renewal cadence into a 0-100 indicator. Green is above 80, yellow is 60 to 79, red is below 60. If your score drops below 80 for two consecutive quarters we trigger an internal review and reach out before you do.
