Network case study · September 2026
Nepal Office Network, Phase 2: Full Fortinet Migration
In March I split a flat office network into staff and guest networks on the existing Cisco equipment. In September the rest of the Fortinet equipment arrived, and I replaced the Cisco switches and standalone access points, added a camera network, and moved everything under one console.
Finishing what the March upgrade started.
The March upgrade was a stopgap: only the new firewall had arrived, so I segmented the network on the existing Cisco switches and access points. It removed the biggest risk, a flat network shared by staff and guests, months before the full equipment was available.
Phase 2 replaced the remaining end-of-life equipment and brought the office onto the same design as the other country offices.
Read the Phase 1 VLAN case study
Four switches and eight access points, each managed on its own.
Before
After
Separate networks with clear rules between them.
One profile per model, no per-device exceptions.
- One access point profile per model, so there are no individual settings to drift out of date
- 2.4 GHz limited to channels 1, 6 and 11 at 20 MHz
- 5 GHz at 40 MHz with automatic channel selection
- The third radio on each access point used as a dedicated monitor for interference and unknown access points
- Guest Wi-Fi shared with a printed QR-code sign
One afternoon, then checks on a working day.
Moved to the current release before connecting the new switches.
Racked the FortiSwitches, moved every connection, and brought them under the firewall.
Mounted the FortiAPs, powered from the switches, and applied the model profiles.
A peer-to-peer download on a staff computer was stopped with a block page pointing to the IT Service Desk; a blocked social media app was stopped at DNS level.
One access point stayed offline; the cause was a cable damaged by rodents, which was replaced.
Port map, configuration backup and NetBox documentation updated on a working day.
Faster Wi-Fi, with an honest caveat.
| Measure | Before | After |
|---|---|---|
| Wi-Fi download (median) | 5.8 Mbps (4 tests) | 92.9 Mbps (6 tests) |
| Wi-Fi upload (median) | 22.8 Mbps | 49.7 Mbps |
| Wired download | Not measured | 85.8–94.5 Mbps (7 tests) |
What I would keep, and what I changed afterwards.
Segmenting on old hardware in March removed the main risk six months before the full upgrade.
The offline access point looked like a configuration issue and turned out to be a damaged cable.
Comparable before and after tests matter more than the size of the improvement.