Vendor access
Vendors see their own installation and the device reference they need to build it: device types, setup guides and models. Everything else stays with Aigna.
Go to your installationModule
Device types, units, models, setup guides, standards, IT stores and cables. This demo has the Assets module switched off in Organisation settings.
9 rules every install follows, in the order of this page. 2 more rules are the default with a written exception.
Every office's network looks the same, so a technician who knows one knows them all. Devices go on the VLAN for their purpose, not the VLAN of the room they are in. The IT network is UniFi (comms rooms, gateway, Wi-Fi and home offices); the in-room AV switch stays Netgear AV Line, because it is tested and set up for Dante and Q-SYS.
A device goes on the VLAN for what it is. Rules between VLANs live in the firewall, so a room device can reach its cloud service without reaching a laptop.
Reaches the internet
Reaches only its own services
Stays in the space
| VLAN | Name | What goes on it | Reaches |
|---|---|---|---|
| 10 | Management | Switches, access points, gateways, power strips and the UPS, by their management address | Only the network team's tools and the controller |
| 20 | Corporate | Staff wired desks and the staff Wi-Fi | Internal services and the internet |
| 30 | Room systems | Video bars, codecs, touch controllers, cameras, microphones and scheduler panels | Their cloud services, device management and the booking service |
| 31 | Displays and signage | Display network ports (control and fleet management) and signage players | The display and signage management platforms, NTP and the room control system |
| 40 | AV | Dante and Q-SYS audio and AV over IP, on the in-room AV switch only | Nothing outside the room (not routed) |
| 50 | Building | Sensors, meters and building management | The building management platform only |
| 60 | Security | Door access and cameras | The security platforms only |
| 70 | Printers | Printers and multifunction devices | The print service |
| 90 | Guest | Visitors on the guest Wi-Fi | The internet only, clients cannot see each other |
Subnets are set per site from the address plan. VLAN 1 carries nothing.
Put every device on the VLAN for its purpose from the VLAN plan, set on the switch port or the Wi-Fi network, never on the device itself.
Leave VLAN 1 unused, and shut down or park unused switch ports on an empty VLAN.
Keep the AV VLAN (Dante, Q-SYS, AV over IP) on the in-room AV switch with its own IGMP querier, and do not route it.
Authenticate staff desk ports with 802.1X, and room device ports by MAC address against the device's record.
Source IEEE 802.1X
Give every fixed device its address by a DHCP reservation, not by typing a static address on the device.
Name every device site-room-prefix and number, for example dub-321-sw01: the site code, the room number without its dot, the device class's prefix and its number in the room.
Point every device at the site's NTP servers (handed out by DHCP), and set its time zone to the site's.
Plan PoE per port from the device's class (802.3at for access points, video bars and panels; 802.3bt where a device needs it) and keep the switch within its budget with 20% spare.
Source IEEE 802.3bt
Set PoE priority high for access points and room systems, and low for anything that can wait.
Connect every access switch to the core with two fibre uplinks of at least 10 Gb/s, bundled as one link (LACP).
Source IEEE 802.1AX
Turn off automatic firmware updates and apply the release the Lab has passed, in a change window.
Type the way you would ask a colleague. Keia Atlas picks out what you want, where, which model and which status, and shows each as a chip you can remove or change.