Everything on
the networkand where it plugs in

You don't need the full CCNA to run a property, but every outage you'll ever troubleshoot lands on one of these six layers. Learn to name the layer first, then fix it.

The stack, and what breaks at each layer

Addressing, in the terms you'll actually use

• IP address + subnet mask — the address is the room number, the mask says which rooms are on the same floor. 10.10.20.15/24 means the first three octets are the "floor" (10.10.20.x), leaving 254 usable hosts.
• Gateway — the elevator off that floor. No gateway, or a wrong one, means the device talks locally but can't leave.
• Broadcast domain — everyone who hears a shout. A VLAN is one broadcast domain. Put 400 guest devices and your PMS in the same one and the PMS gets to hear every guest device's chatter.
• DHCP — hands out address, mask, gateway, DNS, and vendor options. Guest VLANs need huge pools and short leases; infrastructure needs reservations or statics.
• DNS — name to address. Internally: your domain controller. Externally: your ISP or a public resolver. A hotel with no working DNS looks exactly like "the internet is down" to everybody.
• NAT — many private addresses behind one public. Consumer routers hide this; on a property you must know your public IPs because vendors will whitelist them.
• ARP — IP to MAC on the local segment. Duplicate IP conflicts and "it works for 30 seconds then dies" symptoms are usually ARP.

Speed, and why "we have a gig" isn't the answer

• Bandwidth is the pipe width. Latency is how long a packet takes one way. Jitter is variation in that delay. Loss is packets that never show up.
• Guests complaining about "slow Wi-Fi" are usually reporting latency and loss on the radio, not a saturated WAN. A 1 Gbps circuit behind an over-subscribed 2.4 GHz radio still feels terrible.
• Voice tolerates almost no jitter: keep it under 30 ms, loss under 1%, one-way delay under 150 ms. Video streaming tolerates a lot of jitter but hates loss.
• Half-duplex mismatches still exist on old analog gateways and legacy printers, and produce the classic "slow but not down" symptom with rising CRC errors on the switch port.

Select-service properties (100–200 rooms, 3–6 floors) almost always land on the same shape. Know the shape and you can walk into any property and predict where everything is.

# Physical path, street to guest room
INTERNET  ──▶ Primary circuit (fibre, at the demarc / ONT)
          ──▶ Backup circuit (cable or LTE/5G, different carrier & path)
                        │
                  EDGE FIREWALL  ← public IPs, NAT, ACLs, VPN, failover
                        │
                  HSIA GATEWAY   ← guest portal, bandwidth shaping, PMS billing
                        │
                  CORE / L3 SWITCH ← every VLAN's gateway lives here
                   ╱    │    ╲
        MDF access sw IDF-2 IDF-3   ← fibre uplinks, one closet per floor/wing
              │        │      │
   ┌──────────┴───┐    └──────┴────────────┐
   APs · phones · cameras · TVs · locks · POS · back-office PCs

The closets

• MDF (main distribution frame) — the main room. Carrier demarc, firewall, core switch, servers, NVR, phone controller, UPS. Usually behind the front desk or in a back-office. It should lock, be cooled, and not double as dry storage. It always does.
• IDF (intermediate distribution frame) — one per floor or wing. Access switches plus patch panels for that floor's room drops. Fibre or Cat6A back to the MDF. Often a wall-mounted 12U cabinet in a housekeeping closet.
• Horizontal runs from an IDF to a room jack must stay under 90 m of solid cable plus 10 m of patch cords. On a long wing, that's the constraint that decides where the second IDF goes.

Traffic patterns worth knowing

• Guest traffic is almost entirely north–south (out to the internet) and should never go east–west. Client isolation on, inter-guest traffic dropped.
• PMS traffic is east–west inside the property (front desk workstations → PMS server → interfaces to voice, HSIA, locks, POS) plus a link out to the brand's central reservation system.
• Camera traffic is heavy, constant, and one-directional (cameras → NVR). Keep it on its own VLAN so it never competes with guests, and keep NVR and cameras on the same switch where possible.
• Voice is small in bandwidth but merciless about delay. It needs QoS marking end-to-end.

Switch roles

• Core / distribution (L3). Holds the SVI (gateway) for each VLAN, does inter-VLAN routing at wire speed, aggregates fibre from the IDFs. One box on a small property, two stacked if budget allows — the core is your biggest single point of failure.
• Access (L2, PoE). Everything plugs in here: APs, phones, cameras, TVs, printers. Buy PoE+ on every port and count your budget properly.
• Stacking gives you one management plane and cross-stack link aggregation. Worth it. Don't daisy-chain unstacked switches with copper uplinks — that's how you get a 100 Mbps bottleneck feeding a whole floor.

PoE, in numbers

• Typical draw: Wi-Fi 6 AP 15–25 W · wall-plate AP 10–15 W · fixed dome camera 6–12 W · IR/PTZ camera 15–40 W · IP desk phone 3–7 W.
• A 48-port switch advertising 370 W of PoE budget cannot power 48 APs. Do the arithmetic before you order, and leave 30% headroom.
• PoE runs are still 100 m. Beyond that you need a fibre run and a local switch, or a PoE extender (which halves your reliability).

Port configuration defaults

# Access port — AP (trunk, because APs carry multiple SSIDs/VLANs)
switchport mode trunk
switchport trunk native vlan 10          # AP management
switchport trunk allowed vlan 10,50,55,80
spanning-tree portfast trunk

# Access port — desk phone with a PC behind it
switchport mode access
switchport access vlan 20                # PC is untagged
switchport voice vlan 40                 # phone tags itself
spanning-tree portfast
spanning-tree bpduguard enable

# Access port — camera
switchport mode access
switchport access vlan 60
storm-control broadcast level 2.00
spanning-tree portfast; spanning-tree bpduguard enable

Protect the switch from the building

• BPDU guard + PortFast on every access port. A guest plugging a home router into a lobby jack becomes a non-event instead of a property-wide outage.
• Loop protection / loopback detection on room and meeting-room jacks. Someone will eventually patch a jack into another jack.
• DHCP snooping with trusted uplinks only — stops a rogue router handing out addresses to your guests.
• Storm control on access ports, especially camera and guest ports.
• Port security where it makes sense (POS terminals, key encoder) — limit to one or two MACs.
• STP root bridge should be your core, explicitly configured. Never let an access switch win the election by accident.

Rules that don't bend

• 90 m horizontal maximum for the permanent link, plus up to 10 m total of patch cords. Measure the cable path, not the floor plan straight line — risers, trays, and corners add 30% or more.
• T568B throughout, on both ends, on every jack. Pick one standard and never mix.
• Untwist no more than 13 mm at the termination. Sloppy terminations pass a link light and fail under PoE load and 1 Gbps.
• Bend radius — four times cable diameter for copper, ten times for fibre. Zip-tied bundles crushed against a rack rail cause errors you'll chase for weeks.
• Plenum (CMP) vs riser (CMR) — if the cable runs through a return-air ceiling space, it must be plenum-rated. This is a fire code issue, and inspectors do check.
• Separate from electrical. Minimum 300 mm parallel separation from unshielded power lines; cross at 90° when you must cross.
• Test and certify new runs with a real certifier and keep the reports. When a contractor says "it works", ask for the certification file.

Labelling — the TIA-606 habit

# One scheme, used on every jack, panel port, patch cord and switch port
IDF2-PPA-14   →  SW1-Gi1/0/14   →  RM214-A
 closet panel port      switch  port          room  jack

# Every AP gets one too
AP-2-07  = floor 2, seventh AP  → IDF2-PPB-07 → SW1-Gi1/0/31

• Label both ends of every cable, printed not handwritten, and re-label after any move.
• Keep a port map spreadsheet: jack, panel port, switch port, VLAN, device, MAC, and date. This one file saves more hours than any tool you'll buy.
• Photograph the front and rear of every rack after work is complete. Future-you will thank present-you.

• 1U = 1.75 inches (44.45 mm) in a standard 19-inch EIA-310 rack. An MDF is usually 42U floor-standing; IDFs are typically 12U–24U wall-mount cabinets.
• Four-post for anything with weight — servers, NVRs, UPS. Two-post is fine for switches and patch panels only. Never rest a server on the cable of the device below it.
• Depth matters more than height. Measure your deepest device plus 150 mm for cable bend behind it before buying a cabinet.

Stacking order, top to bottom

1. Carrier demarc and WAN gear at the top — it's where the service entrance cable lands, and it's rarely touched.
2. Firewall, then HSIA gateway — short, clean runs downstream.
3. Core switch, then access switches, with a horizontal cable manager between every switch and its patch panel. Patch panel directly above or below its switch, always.
4. Voice — call controller and analog gateway, grouped so the 25-pair or FXS cabling stays contained.
5. Servers, NVR, appliances in the middle-lower section on proper rails.
6. UPS at the very bottom. It's the heaviest thing you own and it belongs at the centre of gravity.

Details that separate a good closet from a bad one

• Blanking panels in every empty U. Without them, hot exhaust recirculates to the intakes and everything runs 10°C hotter.
• Front-to-back airflow respected — don't mount a switch backwards because the ports face the wrong way; buy the right port orientation instead.
• Patch cords in the right length. A rack full of 3 m cords looped into a nest is a rack you can't work in. Stock 0.3 m, 0.5 m, 1 m, 2 m in your VLAN colours.
• Velcro, never zip ties on network cable. Zip ties deform the jacket and you'll never re-dress the bundle.
• Vertical managers on both sides of a 42U rack. The cost is trivial next to the time it saves.
• Grounding — bond the rack and the ladder rack to building ground per code, especially in a property with outdoor cameras or a rooftop antenna.
• Lock the door and control who has the key. Log entries if you can. The MDF is the single point where the entire property can be taken down by hand.
• No storage. Housekeeping will put boxes in front of the rack the moment you stop looking. Get the GM to back you on this in writing once, and it holds.

Monitor these, alert on these

Alerts must reach you on your phone, and must be quiet enough that you don't learn to ignore them. Tune out the noise ruthlessly in the first month.

The documentation set — eight files, kept current

Ports you'll meet on a property

Glossary