Six categories, and within them the work is almost always one of two things: building something new that has to be right the first time, or taking something that already exists and making it behave.
A network that grew site by site stops being one network: overlapping address space, static routes layered over partial dynamic routing, and a core that quietly became a single point of failure. I read the estate as it actually is before changing a line of it, then design the routing, addressing and segmentation it should have had and cut over in stages that can be reversed. When something is already broken, the same discipline finds it.
You get: an audit of what is actually running rather than what the documentation claims, a design document, a configuration set and a migration plan with a rollback.
Cisco IOS / IOS-XEMikroTik RouterOSJuniper JunosOSPFBGPVLAN & VRFQoSPacket capture
Site-to-site and remote-access designs that hold up on networks that fight back — symmetric and carrier-grade NAT, proxies that inspect traffic, captive portals, IPv6-only segments. IPsec or WireGuard decided on evidence rather than habit, overlay and mesh networks on a control plane you own instead of a service that can change its terms, and the routing and DNS inside the tunnel done properly, which is usually the part that actually broke. Keys and peers handled as a normal operation, not an event.
You get: a tunnel and overlay design, split-horizon DNS that resolves correctly on both sides of it, a peer and key process you can run yourself, and the failure modes written down.
Read the case study →
IPsecWireGuardOverlay & mesh VPNRemote accessNAT & CGNAT traversalSplit-horizon DNSKey management
A network is only as useful as what answers at the other end, and an estate that grew by accident is where the next outage is already waiting. I specify, build, harden and then actually maintain the service tiers: web, mail with the authentication records that decide whether anyone receives what you send, authoritative and recursive DNS, databases, and the virtualisation or containers underneath them.
That includes the edge in front of it all: a reverse proxy doing TLS termination and certificate renewal that nobody has to remember, routing rules that are written down rather than discovered, and a way to change them that does not need somebody with a shell standing by. I build these to be operated by the people who own them, not only by me — which is why the Traefik Configurator exists.
You get: services built and hardened to a documented standard, a rebuild path that has been followed rather than assumed, and a backup that has been restored from at least once.
LinuxWindows ServerDNSMail (SPF/DKIM/DMARC)SQLVirtualisationContainersBackup & DR
Vendor tools stop exactly where your problem starts, and a fault nobody can see is a fault nobody can argue about. I build the missing piece: monitoring for devices of mixed capability, history and reporting, a packet capture for when counters stop being enough, and automation for configuration work that is too repetitive to do by hand and too risky to do carelessly.
You get: a tool built to your environment and handed over with source and documentation, with no per-device licence and nothing that stops working when the internet does.
NetMonMcastToolRmDeskTunnelCheckConfigAuditStartWiseC# / .NETPythonPowerShellAutomation
Voice is where the real quality of a network shows — data forgives jitter, conversation does not. I deploy, migrate and repair Cisco Unified Communications Manager from the dial plan down to the handset, with gateways, SIP trunks and inter-site call routing. Including the unglamorous part: the call-quality complaint that turns out to be a queue on a switch three hops from anything anyone calls a voice system.
You get: a dial plan structured to survive growth, a QoS path proven end to end, and the trust boundary documented so the next change does not undo it.
CUCMSIPVoice gatewaysDial planQoSCall-quality diagnosis
On a satellite path the round trip is measured in hundreds of milliseconds, the weather is part of the topology, and a visit to the far end costs a day. I ran a hub station and the remote terminals working through it for six years: commissioning remotes, carrier and bandwidth allocation, link budgets, and fault-finding where there is no second route to fail over to. Also the terrestrial side of hybrid designs, where satellite is the backup and the failover has to be believable.
You get: remotes commissioned and documented, bandwidth planned against the link budget, and a failover tested by switching the primary off rather than by drawing it twice.
VSAT hub operationsRemote commissioningLink budgetBandwidth managementHybrid failover