Buildout
The wiring closet checklist we work through before calling a job done
You can tell how a network was installed within ten seconds of opening the closet door. This is the list we go through before we hand one over.
Sam LaMartina··4 min read
Open the closet door and you know within about ten seconds how the job was done. The equipment tells you very little. What tells you is whether anyone can identify what anything is.
We inherit a lot of networks. The painful ones are rarely badly designed. They're badly documented. Someone made good decisions three years ago and wrote none of them down, so every change since has been an excavation.
Here's what we go through before we consider a closet finished.
Physical
Room to work. A rack packed to the last U with no slack means the next change requires undoing three things first. Leave 20 to 30 percent empty, and leave a free U above and below anything that gets swapped often.
Airflow. Closets get hot, and heat kills switches slowly enough that nobody connects the failure to the cause. If the door stays shut and there's no vent, something needs to move air. A switch running at the top of its thermal range works fine for two years and then starts dropping links intermittently in July.
A UPS somebody has tested. A UPS with a dead battery is a heavy shelf. Test it under load, not with the self-test button.
A lock. Not paranoia. Every port in that rack is an unauthenticated path onto your network for anyone who can reach it.
Cable
Everything terminated on a patch panel. Never straight into a switch. Patch panels mean the permanent in-wall cable never moves. Only the short, cheap, replaceable patch cord does. This one habit prevents most of the damage we see to in-wall runs.
Every run tested, results kept. A continuity tester tells you the pairs are in the right order. It doesn't tell you the run will carry 10 Gig at eighty metres. If you're paying for Cat6A, get certification results, one report per drop, filed somewhere findable. Otherwise you're taking the installer's word for it, and when a link negotiates at 100 Mbps two years later nobody can prove whether the cable was ever good.
Service loops. A metre of slack coiled above the rack and at the far end. Costs almost nothing during the pull and saves a full re-pull the day someone moves the rack eight feet.
Velcro, not zip ties. Bend radius respected, nothing cinched tight enough to deform the jacket. Twisted pair is more sensitive to being crushed than most people expect, and the resulting faults are intermittent and horrible to chase.
Labels
This is the part that gets skipped and the part that matters most in year three.
Both ends of every cable. A label on one end is half a label.
Panel matches faceplate matches diagram. If the wall plate says A-14, then port 14 on panel A is that run, and the as-built shows A-14 in that room. Three sources of truth that agree with each other.
Labels that survive. Printed, wrapped, laminated. Sharpie on masking tape will be illegible and falling off inside eighteen months.
A scheme that scales. Room-based numbering breaks the first time someone renames a room. Panel-and-port numbering doesn't. Pick a scheme, write the scheme down, follow it everywhere.
Configuration
Static addressing or reservations for infrastructure. Every switch, access point, gateway, camera, and printer. Nothing you might need to reach during an outage should get its address from a service that might be part of the outage.
Management on its own segment, and that segment unreachable from the guest network. Obvious. Frequently not done.
Default credentials gone. All of them. Including on the UPS, the PDU, and that thing someone installed in 2019 that nobody has logged into since.
A firmware baseline recorded. A known, tested version per device class, and a note of when it was last moved. Chasing latest is its own kind of outage.
The handover pack
If we walked away tomorrow, could a competent stranger pick this up? That means:
- A topology diagram matching what's actually installed
- The addressing plan: subnets, VLANs, DHCP scopes, static reservations
- Panel-to-room cable schedule
- Device inventory with model, serial, and location
- Credentials, in whatever password manager the client actually uses
- Circuit details: provider, account number, support number, contracted speed
We hand this over on every job. Partly because it's the right thing to do and partly because we're usually the ones getting called back, and the version of me that shows up in February will be grateful.
The uncomfortable one
Is the closet actually a closet? We have found core switches in break room cabinets, above ceiling tiles in bathrooms, and once sitting on top of a water heater. If the network matters to the business, it needs somewhere a plumbing failure, a stack of boxes, or a curious employee can't take it down.
None of this is clever. It's all boring, and boring is the point. The goal is a closet where the next person, who might not be you, can work out what's going on without making a phone call.
If you've inherited a closet that doesn't look like this, we do assessments. Often the fix is a day of labelling and a written addressing plan rather than new hardware.
- Cabling
- Buildout
- Standards
Keep reading
Buildout
PoE budget math: the number that quietly wrecks a deployment
A 24-port PoE switch does not power 24 PoE devices. Here's how to work out what you need before the gear shows up on site.
Hardware
Sizing a gateway: what actually decides the model
Most people pick a firewall or gateway off port count. Port count is the least important number on the box. Here's the order we work through instead.