Router from the operator and managed corporate network

It's not a choice between two devices from the same shelf. A router from the company's operator provides the Internet to the building, and the managed network allows you to control what is happening inside. This article shows what exactly the management layer changes, when the operator's equipment is completely sufficient and how to know when it stops.

Two different questions that sound like one

The question of whether a router from the operator is enough actually covers two separate issues.

• The first is whether the device provides internet to the building in acceptable quality, and in this respect it is usually sufficient.
• The second is whether it allows you to manage what is happening in the internal network, because this layer determines whether the environment can be maintained, developed and secured.

When you mix these questions, it's easy to make two opposite mistakes: replacing functional equipment that did exactly what was expected of it, or sticking with a device that no longer meets your needs because "but the internet works."

What the device does from the operator

The equipment provided as part of the service performs several functions at once, terminating the link, assigning addresses to devices on the local network, performing address translation so that multiple devices can use a single public address, and most often, providing a wireless network.

For an office of several people using one printer and laptops, such a set may be completely sufficient.

The limitations start elsewhere as visibility, control and maintenance needs increase:

• configuration is shallow. Usually you can change the network name and password, sometimes port forwarding. It is impossible to build separate network segments or describe traffic rules between them.
• has no history. Device shows status now. It will not answer the question of what happened at 2:30 p.m. last Tuesday, when the connection dropped.
• one device, one location. In the case of a second office or warehouse, each facility is a separate island with a separate password and separate configuration.
• the equipment belongs to the operator. Replacing the model when changing the tariff may delete settings that no one remembered existed.

What is the management layer

A managed network doesn't simply mean a "better router," but adds a layer that sees all network devices at once, lets you configure them from one place, and records what's happened to them.

Manufacturers do this through software running on a device at the company's headquarters or through a panel in the cloud, with Zyxel runs a cloud model through Nebula Control Centre, a Ubiquiti provides both local controller and remote access to the UniFi Network. Both routes perform the same function, providing one view instead of several independent panels.

It's worth distinguishing two things because management layer does not carry traffic, and data continues to flow through the building's switches and gateway. The panel is used for configuration and observation, not for sending, so losing access to it does not cut off the company from the Internet, although intuition may suggest otherwise.

What's actually changing

Segmentation

Segmentation allows you to divide your network into separate parts and describe what is allowed between them, so that cameras cannot see accounting, guests only use the Internet, and warehouse terminals operate in their own segment.

This is a function that operator equipment practically never has, although it changes the level of security the most, which we describe in more detail in the material about basics of corporate network security.

Visibility instead of guesswork

The panel answers questions that no one can answer reliably without collected data: which device occupies the bandwidth, when it lost the connection, at what speed the port operates and whether the access point was restarted.

Without this visibility, diagnostics become guesswork that often results in purchasing equipment that does not solve the actual problem.

Changes without on-site visit

Adding a new employee or printer, changing the password to a guest network or correcting a traffic rule becomes a remote panel operation in a managed network, whereas without this layer, every minor change requires physical access to the device.

This is why remote networking is even possible, because the MSP doesn't gain access "magically" but uses a controlled management layer.

Updates with control

Network device software receives patches, including security patches, and the managed network shows the version of each device and can schedule an update for a selected time. Without this control, equipment often remains at the version it was installed on because no one has been assigned responsibility for maintaining it.

Multiple locations as one whole

With the second and third objects, the difference is no longer a matter of convenience, because Zyxel provides a separate MSP Pack licence in Nebula Control Centre, assigned to the administrator account, which includes management between organisations. This solution is intended for situations in which one team takes care of the environments of many clients or companies.

When the router from the operator in the company is completely enough

Despite what many sales materials suggest, there are situations where such equipment is sufficient:

• several people in one room, without systems critical to business continuity,
• no guests using the network or guests on a separate connection,
• no cameras, terminals and devices that need to be separated,
• no one reports network problems,
• the company is not planning a second location in the near future.

If the list describes your company, the investment in the management layer will not have a measurable return, so the honest answer then is: don't change anything.

Signals that enough is no longer enough

It is worth reacting to facts, not to the calendar, by observing signals resulting from the company's operations:

• there are devices on the network that should not see each other: cameras, terminals, guest equipment, accounting computer,
• "network is slow" reports keep coming back and no one can pinpoint the reason,
• a second location has been added,
• employees need access to company resources outside the office,
• no one knows what's connected to the network or who has the administrative passwords,
• the company processes data whose leakage would be a real problem.

The first three points are technical, while the last three are organisational in nature and usually determine the decision.

What the management layer doesn't do

To be candid, because this is where many offers overpromise:

• does not speed up the link. If the operator's service has a certain bandwidth, no panel will increase it.
• does not replace computer protection. Segmentation reduces the impact, but does not protect the workstation from malware.
• does not repair wiring. A damaged track will remain damaged, although it will finally be visible in the panel.
• does not run alone. The panel shows the status. Someone has to look at it and draw conclusions. A managed network that no one looks at is an unmanaged network with a nicer interface.

This last point is important in your decision-making because purchasing manageable equipment without knowing who is actually watching it means cost without effect.

How to make this decision

1. List the devices on the network and select those that should not be able to see each other.
2. Check whether there have been reports of network issues in the last six months and whether the cause has been determined.
3. Determine who has administrative access to network devices today and whether the company has full rights to them.
4. Check if a second location or employment increase is planned.
5. Answer who will maintain this network after purchase.

If point 1 gives a longer list and point 5 remains unanswered, the problem is not the equipment but the lack of assigned environmental responsibility.

How we do it

We can design and implement a managed network, providing as-built documentation and full administrative rights, so that the company can maintain it on its own or with its own IT specialist. We can also provide the environment with constant care, monitoring the condition of devices, conducting updates in agreed service windows, handling notifications and maintaining documentation in a state consistent with reality, while the scope and response times are recorded in the contract.

We are in corporate networks Zyxel Networks Partner and we implement it as well Ubiquiti UniFi, and we choose the platform according to the facility, scale and who will operate the network, not the other way around.

We do most of the work remotely, arranging work on site separately, and the practical model is described in the article about remote and on-site IT support.

If you're not sure which side of this decision you're on, building and maintaining corporate networks we start with an overview of what already works.

Book a free IT review and let's check it together before you buy anything.