Office Network Planning for 25, 50 and 100 Employees

By Yogesh Sagale

Planning example: no client floor plan or device models were supplied. The figures illustrate the method; they are not a fixed equipment prescription by headcount.

An office manager is told: “You have 50 people, so buy one 48-port switch, a router and two access points.” It sounds reasonable. Six months later the switch has no free ports because cameras, printers and meeting-room displays were never counted. Video calls stutter at 11 a.m. when everyone joins at once. The guest network shares an address range with finance. And when the single switch fails, the entire office stops.

Headcount is a useful starting point but a poor design input on its own. This article explains how to convert headcount into the numbers that actually size a network: endpoints, ports, uplinks, PoE devices, Wi-Fi clients, internet traffic, address space and power. It then works through 25-, 50- and 100-person examples with every assumption stated, so you can replace the assumptions with your own.

It is written for office owners, facility managers, IT administrators and project consultants. It is a planning guide, not a final design. Final equipment selection should come from a site survey and manufacturer documentation.

Why headcount alone misleads

Two 50-person offices can need very different networks. A design studio moving large files to a NAS has different traffic from a team working mostly in cloud applications. An office with 16 cameras and access control has far more wired devices than one with none. A single-floor open plan can be served from one cabinet; a three-floor layout may not be.

So treat headcount as a proxy and ask what lies behind it:

1. How many devices connect, and how (wired or wireless)?
2. What applications matter most, and what traffic do they generate?
3. How does the building layout constrain cabling and telecom spaces?
4. How much growth must be accommodated without rebuilding?
5. How much downtime can the business tolerate?

Terms used in this guide

• Endpoint: any device that connects to the network: laptop, desktop, phone, printer, camera, access point.
• Access, aggregation and core layers: access switches connect endpoints. An aggregation or core switch joins the access switches together. Small offices often collapse these into one or two switches.
• Uplink: the link from an access switch to the rest of the network.
• Oversubscription ratio: total potential port bandwidth divided by uplink bandwidth. A 48-port gigabit switch with a 10 Gbps uplink has a potential ratio of 48:10, or 4.8:1.
• PoE (Power over Ethernet): power delivered to a device over the same cable as data. Budget calculation is covered in our PoE power budget article.
• VLAN: a logical network segment that separates traffic on shared switches.
• Subnet / CIDR: the size of an address range. A /24 provides 254 usable host addresses; a /23 provides 510; a /25 provides 126.
• Telecom room (MDF/IDF): the room or cabinet where cabling terminates and switches live. An MDF is the main one; IDFs are additional ones on other floors or wings.
• UPS: uninterruptible power supply that bridges short power interruptions.

The planning model and its assumptions

Everything below is a planning estimate using stated assumptions, not a measured result and not a product selection. Change the numbers to match your office.

Step 1: Count the endpoints that need a wired port

Add the wired endpoints:

• 25 staff: 25 + 4 + 2 + 2 + 6 + 2 + 3 = 44
• 50 staff: 50 + 8 + 3 + 4 + 10 + 3 + 5 = 83
• 100 staff: 100 + 14 + 5 + 7 + 16 + 5 + 8 = 155

Add the 20% growth allowance:

• 44 × 1.2 = 52.8, so 53
• 83 × 1.2 = 99.6, so 100
• 155 × 1.2 = 186

Cameras, access points and access controllers are the items most often forgotten in headcount-based sizing. In these examples they account for 10 to 28 of the wired endpoints, which is why “one port per employee” under-counts.

Cabling and pathway design are covered in our structured cabling guide, so only the planning link is repeated here: the cable count sets the patch panel size, and this worked model uses 24-port patch panels; actual products may use different capacities.

Check: 2 panels give 48, which is below 53, so 3 are needed. 4 panels give 96, below 100, so 5. 7 panels give 168, below 186, so 8.

Step 2: Decide how many telecom spaces you need

For fixed horizontal cabling, a commonly used twisted-pair limit is 90 m for the permanent link and 100 m for the channel. Fluke describes these conventional boundaries; application, cord gauge and temperature conditions may impose further constraints. [1] Confirm the selected design and test limits. Importantly, the limit applies to the cable route, not the straight-line distance on the drawing.

A single cabinet can serve an office only if the longest route to any outlet stays inside the limit with some margin. A rough test: draw the cable route (up the wall, along the tray, down to the outlet) for the farthest outlet. If it approaches the limit, add a second telecom space and connect it to the first with fibre or a high-speed link.

Typical outcomes for these three sizes (subject to your floor plan):

• 25 staff: one wall-mounted cabinet is common.
• 50 staff: one floor or wall cabinet if the floor is compact; a second location if the floor plate is large or split.
• 100 staff: often one main rack plus at least one remote cabinet, especially across floors.

Step 3: Size switching and uplinks

Switch ports should cover the day-one connections plus spare capacity:

• 25 staff: 53 ports needed, so 1 × 48-port + 1 × 24-port = 72 ports
• 50 staff: 100 ports needed, so 2 × 48-port + 1 × 24-port = 120 ports
• 100 staff: 186 ports needed, so 4 × 48-port = 192 ports

Check: 48 + 24 = 72 ≥ 53; 96 + 24 = 120 ≥ 100 (96 alone is not enough); 4 × 48 = 192 ≥ 186.

These are nominal endpoint-port capacities. This example assumes independent SFP/SFP+ uplink interfaces that do not consume the stated copper endpoint ports. If your model uses shared/combo interfaces or copper uplinks, subtract every occupied uplink, firewall and server port before claiming spare endpoint capacity. The optional separate core switch, its ports, optics and power are additional to the access-switch counts below. You may not buy every switch port on day one, but leave the rack space and power for them.

Oversubscription: a planning figure, not a pass/fail rule

Uplink sizing depends on traffic patterns, so treat these ratios as a way to see risk rather than as a limit.

Link aggregation distributes traffic across member links using the switch’s load-balancing algorithm. A single flow ordinarily remains on one member, so two 10 Gbps links do not guarantee a 20 Gbps file transfer; the table shows aggregate nominal capacity, not single-flow throughput. [2] Real traffic is rarely all ports at full speed at once, so a higher ratio can be acceptable for browsing and cloud use. It becomes a concern when many users move large files to a local server or NAS at the same time, or run backups. In that case, place the server close to the core and give it a faster link.

Whether a particular switch offers 10 Gbps uplinks, and which optics or cables it uses, is model-specific. Confirm it on the datasheet.

Step 4: Count PoE devices and check the budget

This hypothetical model assumes all listed access points, cameras and access controllers are PoE powered. Confirm the real controller power method: many use a separate supply for electronics or locks, which must be included in the power design. PoE port counts here are:

• 25 staff: 2 + 6 + 2 = 10; with 20% spare, 12 PoE ports
• 50 staff: 4 + 10 + 3 = 17; with 20% spare, 20.4, so 21 PoE ports
• 100 staff: 7 + 16 + 5 = 28; with 20% spare, 33.6, so 34 PoE ports

A 24-port PoE switch has enough nominal PoE ports for the first two examples, and a 48-port unit for the third, if all devices can be served from that location. With multiple cabinets, distribute PoE ports and power budgets by cabinet rather than putting every PoE device into one distant rack. These are port counts only. Whether the switch can power all of them depends on its total PoE power budget and each device’s power class, which is a separate calculation (see our PoE power budget article). A port count that fits does not prove the power budget fits.

If you choose Wi-Fi access points with 2.5 Gbps or faster ports, the switch ports serving them must support those speeds and the PoE class the access point needs. Supported distances at multigig speeds depend on the cable category and the standard, so verify before assuming existing Cat6 will carry them to 100 m.

Step 5: Plan Wi-Fi by capacity and by coverage

Placement is covered in our WiFi access point placement guide. Here the question is how many access points the load requires, because coverage and capacity can give different answers.

Wi-Fi devices (3 devices per employee, 60% on Wi-Fi):

• 25 staff: 25 × 3 × 0.6 = 45
• 50 staff: 50 × 3 × 0.6 = 90
• 100 staff: 100 × 3 × 0.6 = 180

For a conservative preliminary calculation, treat all Wi-Fi devices counted here as active at the same time and suppose about 40 active clients per access point. Connected-client count and concurrently active-client count are different: measure both and replace this assumption after survey. This is an illustrative planning figure, not a universal rule: the supportable number depends on the access point model, the band, the channel width, the traffic type and the interference.

• 45 ÷ 40 = 1.125, so a capacity minimum of 2 access points
• 90 ÷ 40 = 2.25, so 3 access points
• 180 ÷ 40 = 4.5, so 5 access points

The example assumes a hypothetical layout needing 2, 4 and 7 access points. Those are assumed coverage counts, not findings from a supplied floor plan or a universal ratio. The larger number is the one that matters, and a site survey or predictive model should confirm it.

Step 6: Estimate internet bandwidth

A simple model avoids buying by guesswork. It uses these stated assumptions:

• 25% of staff on video calls at peak, at 3 Mbps per call in each direction
• 1 Mbps per employee as a general allowance for browsing, email, cloud and sync
• 25% headroom on the total

The 3 Mbps per call figure is illustrative; actual rates depend on the conferencing application, resolution and settings. Microsoft publishes different rates for different Teams call and meeting modes; the 3 Mbps value here is a planning assumption, not Microsoft’s universal requirement. [3]

The planning targets are therefore roughly 60, 115 and 220 Mbps, rounded up to whatever tiers your provider offers.

In this model the call allowance is symmetric: 21, 39 and 75 Mbps before headroom. For conservative upload planning apply the same 25% headroom plus the actual general upload load; if you assume the general allowance is symmetric too, use the full 60, 115 and 220 Mbps targets in both directions. Real send/receive rates can differ, especially with screen sharing and conferencing settings. Many business plans are asymmetric, so verify the upload speed and whether it is committed or “up to”. If downtime cannot be tolerated, see our dual ISP failover guide.

Measure real usage after go-live and adjust. A model like this is a starting point, not a measurement.

Step 7: Plan addresses and segmentation

The next counts cover employee devices only, not all cameras, controllers, printers, management interfaces or visitors. Plan each VLAN separately, add growth and infrastructure reservations, and account for the chosen subnet’s usable addresses. The /25, /24 and /23 counts here use conventional IPv4 LAN subnetting, not /31 point-to-point exceptions. With 3 devices per employee:

• 25 staff: 75 devices, which fits a /25 (126 usable) or a /24
• 50 staff: 150 devices, which fits a /24 (254 usable)
• 100 staff: 300 devices, which exceeds a /24; use a /23 (510 usable) or split by VLAN

Choose segmentation from the access policy, application dependencies and operational capability, rather than address capacity alone. A starting VLAN plan:

Use private address ranges defined by RFC 1918 and keep them clear of ranges used by remote sites or VPN partners, so you do not need to renumber later. Size each DHCP pool for expected devices and growth while reserving gateways and infrastructure addresses, and set sensible lease times for guest networks, where devices come and go.

Step 8: Firewall and resilience

Firewall configuration is covered in our business firewall guide. VLANs alone do not enforce access policy: define inter-VLAN routing and firewall or ACL rules and test permitted and denied paths. For planning, the questions are throughput and resilience:

• Throughput: firewall datasheets quote figures measured under specific conditions. Throughput with inspection, VPN or other security features enabled is usually lower than the headline number, and the figures are manufacturer-specific. Pick a model against your internet speed with the features you will actually switch on.
• Single points of failure: one firewall, one aggregation device and one ISP can each become a single point of failure. At 25 staff many offices accept that and keep a spare. At 100 staff, a second firewall, redundant uplinks or a second ISP are worth pricing against the cost of an hour of downtime.

Step 9: Power and cooling

Network equipment is only as available as its power:

• Add the load of the firewall, switch input power with the required PoE allocation and power-supply losses accounted for; avoid adding PoE power twice if the datasheet already states an input rating including PoE and any NAS, and check the watt rating of the UPS as well as its VA rating.
• Choose the runtime target deliberately, for example enough to ride through short outages and shut down cleanly. Runtime depends on the load and the battery, so use the UPS manufacturer’s runtime charts rather than estimates.
• Keep cabinets ventilated. A wall cabinet with no airflow in a closed room is a common cause of unexplained instability.

Three reference designs

These summarise the model. They are conceptual designs, not equipment recommendations.

Trade-offs worth deciding explicitly

• Managed versus unmanaged switches. For the segmentation and monitoring proposed here, select managed switches supporting the required features. Do not assume all unmanaged products lack every protective feature; check the product, while recognising that a fixed-feature unit may not support this design’s configurable VLANs and administration.
• Cloud-managed versus locally managed. Cloud management simplifies multi-site and remote support but may carry recurring licence costs and depend on the vendor’s service. Check what happens to the network if the licence lapses or the cloud is unreachable.
• One flat network versus segmentation. Segmentation adds configuration work but limits the effect of mistakes and compromises.
• Gigabit versus multigig to the edge. Multigig adds cost at both the switch and the access point. Choose it where the devices can use it.
• Buying ports now versus leaving space. Cabling is expensive to add later; switch ports are not. Cable for growth, and buy switch ports as needed.

Installation and configuration considerations

• Document the VLAN IDs, subnets and port map before configuring.
• Configure spanning tree or an equivalent loop protection, and use the vendor’s edge-port and BPDU protection recommendations only on true endpoint ports; do not mark inter-switch links as edge ports.
• Set the management VLAN, disable unused services and change default credentials.
• Back up the configuration of every device after commissioning and store it outside the device.
• Label cables, ports and devices consistently with the documentation.

Common failure modes

• Port exhaustion because cameras, access points and shared devices were not counted.
• Uplink saturation when a file server or backup shares a congested link.
• Broadcast storms and loops from an unmanaged switch plugged into two wall ports.
• DHCP exhaustion or duplicate addresses, especially on guest networks and static-IP devices inside the DHCP range.
• PoE overload, where the port count is fine but the power budget is not.
• Misconfigured trunks, where a VLAN is missing on one link.
• Wi-Fi congestion from too few access points or overlapping channel plans.
• UPS runtime shorter than assumed because the load grew after sizing.

Troubleshooting sequence

Work from the bottom up and change one thing at a time.

1. Power and physical: device on, link light, cable seated, cabinet temperature.
2. Cable and port: try a known-good patch cord and port; check for errors on the switch port.
3. VLAN and addressing: confirm the port’s VLAN and that the device received a valid address from the right scope.
4. Gateway and DNS: can the device reach its gateway, then an external IP address, then a hostname?
5. Uplinks and utilisation: check error counters and utilisation on uplinks during the problem period.
6. Wi-Fi specifics: check signal, channel utilisation and the number of clients on the access point.
7. Firewall: check logs, rules and session counts for the affected traffic.
8. Change history: compare with the last saved configuration and recent changes.

Acceptance tests and evidence

Cabling certification is covered in our Fluke testing article and applies here as well. Beyond cabling:

Handover checklist

• Endpoint count and port map reconciled with the plan
• Cabling test reports delivered
• Switch, firewall and access point firmware and configurations recorded and backed up
• VLAN and IP plan documented
• DHCP scopes sized and static ranges excluded
• Management access restricted and default credentials changed
• PoE load recorded against budget
• Wi-Fi validation results recorded
• UPS load, runtime and alarm settings recorded
• Failover tests performed and logged
• Spare ports and rack space noted for growth
• Support contacts, licence dates and warranty terms recorded