Originally published: November 3, 2020. Last updated: October 25, 2026
Every business runs on a network, but few plan theirs. The typical small or mid-size office network grew by accretion: a router from the internet provider, switches bought one emergency at a time, Wi-Fi access points wherever a dead spot annoyed someone senior. The result works until it does not, usually at the worst moment, and the fix costs more than planning would have. This guide reframes the classic types of computer networks, LAN, WAN, WLAN, VPN, SD-WAN and cloud networking, as what they really are for a business: planning choices with distinct costs, security profiles and management burdens. It closes with two reference designs, one for a single office and one for a multi-site firm, that you can hand to an IT provider as a starting brief.
Start With Requirements, Not Hardware
Network types only make sense against four questions. How many people and devices, including phones, printers, cameras and the growing pile of Internet of Things kit, will connect at once, and how will that number grow over three years? How many sites must behave as one business? Which applications matter most, and how sensitive are they to delay: voice and video calls forgive almost nothing, cloud accounting and file sync forgive more, and backup windows forgive nearly everything? And what must the network prove, for cyber insurance, client contracts or regulators, about who can reach what?
Write the answers down before pricing anything. A 12-person office running cloud software needs a different design from a 60-person firm with an on-premise file server, a warehouse scanner fleet and a client confidentiality clause. The sections below take each network type in turn and judge it the way an owner or office manager should: what it does, what it costs to run, how it fails and what it demands from whoever manages it.
LAN: The Wired Backbone of the Office
A local area network connects devices within one site, an office floor, a building or a small campus, over cabling and switches your business owns. It remains the fastest, most predictable layer of any office design: modern switches deliver gigabit speeds to every desk, with Ethernet cabling categories such as Cat6 and Cat6a supporting those speeds over office-scale distances, and Power over Ethernet lets the same cable run phones, cameras and Wi-Fi access points.
Costs concentrate in the unglamorous parts: the cabling installation, the switch hardware and the cabinet it lives in. That is an argument for doing it once and doing it properly. Structured cabling installed to a plan outlasts several generations of the devices plugged into it, which is why our guide to why structured cabling is better for security systems is relevant reading before any office fit-out. Security on a LAN is about control of the physical and logical perimeter: managed switches let you segment traffic with VLANs, disable unused ports and see what is connected. Management burden is low day to day, but a LAN fails hard when a core switch dies, so a spare or a support contract belongs in the budget for any office that cannot afford a day offline.
WLAN: Wi-Fi as a Planned Service, Not an Afterthought
A wireless LAN is the LAN delivered over Wi-Fi, and in most offices it now carries the majority of day-to-day traffic. Current access points built on Wi-Fi 6, 6E and the newer Wi-Fi 7 standard handle far more simultaneous devices than older kit, but the limiting factor is rarely the standard. It is placement and capacity planning: one access point per open-plan zone is a guess, while a design based on floor plans, wall materials and user density is a service.
For business use, specify centrally managed access points rather than consumer mesh units, because central management gives you one place to set policy, push updates and see problems. Run at least two networks from day one: a staff network and a guest network that can reach the internet and nothing else. Add a third for IoT devices such as printers, TVs and smart building kit, which are frequent weak points. Wi-Fi is where most users judge the whole IT function, so underinvesting here buys daily friction to save a small one-off cost.
VLANs: Segmentation Without Extra Cabling
A virtual LAN divides one physical network into separate logical networks. The finance team’s traffic, the guest Wi-Fi, the VoIP phones and the security cameras can share the same switches and cables while being unable to see or reach each other. For a business, VLANs are the cheapest meaningful security upgrade available, because they are a configuration exercise on managed switches rather than a hardware purchase.
Segmentation limits the blast radius of the most common incidents. A compromised smart TV or a visitor’s infected laptop on its own segment cannot wander into file shares or accounting systems. Segmentation also supports the access evidence that cyber insurers and enterprise clients increasingly request. The management implication is real, though: VLANs must be designed, documented and maintained, and an undocumented segmentation scheme becomes its own risk when the person who built it leaves. Treat the network diagram as a business record, not a personal notebook.
WAN: Connecting Sites, and What It Costs
A wide area network links sites across distance: branches, warehouses and head office, carried over infrastructure you lease rather than own. The traditional corporate answer was a private leased line or MPLS service, which offers predictable performance at a price per site that makes owners wince. The modern answer for most mid-size firms is to build the WAN from business broadband or fibre connections at each site and stitch them together with software, the SD-WAN model covered below.
Whichever model you choose, the planning questions are the same. What happens when a site’s connection fails: is there a second line, ideally from a different provider on a different physical route, and does the business stop or merely slow down? Where does internet traffic leave the network, centrally or at each site, and what does that mean for security inspection? Fibre availability decides much of this before you start, and the performance case is set out in our overview of the benefits of fibre optics internet for business premises. WAN decisions are the most financial decisions in this guide: they recur monthly, scale with site count and are painful to unwind, so model them over three years, not three months.
VPN: Secure Access for People and Sites
A virtual private network creates an encrypted tunnel across a public network. Businesses use it in two patterns. Site-to-site VPNs join offices so staff reach shared systems as if they were local, and remote-access VPNs let individual staff connect from home or the road. The technology is mature and inexpensive, often built into the firewalls a business already owns, and for a small firm with one office and a handful of remote workers it may be all the WAN strategy required.
The planning caveats are about behaviour, not cryptography. A traditional VPN gives a connected laptop broad reach inside the office network, which made sense when threats were mostly outside. Modern practice limits that reach: per-user access to specific applications, multi-factor authentication on every connection, and no VPN at all from unmanaged personal devices. VPN performance also depends on the head-end connection and firewall capacity at the office, so a firm whose whole team works remotely on Fridays can discover that its office internet line, not the staff’s home connections, is the bottleneck. If remote access is core to how your business works, design for it explicitly rather than inheriting whatever the firewall default offers.
SD-WAN: The Multi-Site Default, With Conditions
Software-defined WAN applies a management layer over multiple ordinary connections, broadband, fibre, 4G or 5G backup, and steers traffic between them by application and by real-time link quality. Voice calls take the cleanest path, bulk backups take the cheapest, and a failed line stops being an outage because traffic reroutes automatically. For a firm with three or more sites, SD-WAN usually delivers better resilience than a single premium circuit at each site, at a lower total cost, and it centralises policy so every branch runs the same rules.
The conditions matter. SD-WAN is a subscription and a platform commitment, so the comparison is three-year cost against the leased-line alternative, including the management time each model consumes. It also shifts skills: someone, in-house or at a managed service provider, must own the policy design and the vendor relationship. Very small firms with one site gain little; the technology earns its keep exactly where the traditional WAN hurt most, multiple locations, cloud-heavy application mixes and a low tolerance for downtime.
Cloud Networking: When the Office Is Partly Elsewhere
Cloud networking completes the shift. When the applications live in cloud platforms rather than a server in your office, the network’s job changes from connecting desks to a server room to connecting people to services, securely and fast. In practice this means strong site internet with backup, security controls that travel with the user instead of sitting only at the office edge, and often a secure access service or cloud firewall standing between staff and applications wherever the staff happen to be.
Most mid-size firms land in a hybrid position: cloud email and documents, some line-of-business software still on a local or hosted server, and a gradual migration path. Plan the network for the hybrid state you will actually inhabit for the next three years, including how backups cross the network, how large design or media files move, and what happens to cloud access when the office connection degrades. The right question is not whether to use cloud networking, but which parts of your traffic pattern it should carry now.
The Other Types, in Business Terms
Four more terms from the classic taxonomy appear in vendor conversations and are worth placing. A PAN, or personal area network, covers a single person’s devices over Bluetooth or USB: headsets, docks and peripherals. It matters to planners mainly as a security policy question about what may pair with work machines. A CAN, or campus area network, links several buildings on one site, such as a school, hospital or distribution park, usually over your own fibre between buildings: think of it as a large LAN with outdoor runs and their costs. A MAN, or metropolitan area network, spans a city and today is mostly something you buy as a service from a carrier rather than build. A SAN, or storage area network, is a dedicated high-speed network between servers and shared storage inside a data centre or server room; only businesses running their own virtualised server estates will meet one, and for them it is specialist infrastructure to be designed with the storage it serves.
Security and Management Across Every Choice
Network type decisions are security decisions. The recurring controls are the same whatever you buy: a business-grade firewall at each internet edge, segmentation by VLAN so a breach starts contained, multi-factor authentication on all remote access, central logging so incidents can be reconstructed, and firmware and configuration kept current under a named owner. These sit inside the wider discipline covered by our guide to cyber security measures for businesses, and the network plan should be written as one chapter of that discipline, not a separate world.
Management is the cost owners underestimate. Every design in this guide needs monitoring, documentation, change control and a support route when something breaks at 8 p.m. For most small and mid-size firms the honest options are a managed service provider contract with defined response times, or a named member of staff with networking genuinely in their role and time protected for it. The expensive option is the default one: nobody owns it, the documentation is in one person’s head, and every incident becomes an archaeology project. Price ownership into every comparison, because a cheaper design that nobody can run is not cheaper.
Two Reference Designs
A single office of 25 people. Fibre internet with a 4G or 5G failover on the same router, a business firewall, one or two managed switches, Cat6 cabling to desks and ceiling points, three or four centrally managed Wi-Fi 6 access points, and three segments: staff, guest and IoT. Remote access by VPN with multi-factor authentication for named staff only. Cloud applications used directly over the internet, backups scheduled off-hours. This design covers most professional offices, costs are dominated by the fit-out and the monthly connectivity, and it scales to roughly double the headcount before the switching or Wi-Fi layer needs redesign.
A firm of 80 people across three sites. Fibre at every site with diverse backup, SD-WAN joining the sites and steering voice and the line-of-business application by priority, site firewalls under one policy, VLAN segmentation extended consistently across sites so a device class behaves identically everywhere, and a managed service provider monitoring the estate with a documented escalation path. Each site keeps enough local resilience to trade through a WAN outage in a degraded mode. The design conversation at this size is about operating model as much as technology: who watches the dashboards, who approves changes, and what the business has agreed it can tolerate losing.
Frequently Asked Questions
What type of network does a small office actually need?
A well built LAN with planned Wi-Fi is the core: managed switches, Cat6 cabling, business grade access points and a segmented design with separate staff, guest and IoT networks. Add a VPN for remote staff and a backup internet connection. Most single site businesses need nothing more exotic until they open a second location.
What is the difference between a LAN and a WAN for a business?
A LAN connects devices inside one site over equipment and cabling your business owns, delivering the fastest and most predictable performance. A WAN connects separate sites across distance over leased carrier services, costs more per month, and is where performance, failover and contract decisions concentrate.
When is SD-WAN worth paying for?
SD-WAN earns its cost when a business has three or more sites, depends on cloud applications and voice, or cannot tolerate a single connection failing. It steers traffic across multiple cheaper links and reroutes automatically during outages. A single small office with one connection usually gains little from it.
Is Wi-Fi enough, or does an office still need cabling?
Both. Wi-Fi carries most daily work, but fixed devices such as desktops, printers, phones, cameras and the access points themselves perform best and most securely on cable. Cabling installed once during a fit-out supports several generations of wireless equipment, so skipping it is a false economy.
How should a business secure remote access to the office network?
Use a VPN or a modern secure access service with multi-factor authentication, limit each user to the applications their role needs, refuse connections from unmanaged personal devices, and log access centrally. Broad, always on network access for every remote laptop is the pattern most likely to turn one compromised machine into a company wide incident.
What does office network management involve day to day?
Monitoring connection and equipment health, applying firmware and security updates, maintaining the network diagram and configuration records, managing user and device access, and responding to faults under an agreed support route. Most small and mid-size firms buy this as a managed service rather than staffing it in-house.
