Isolated site network, Algeria

The brief

A major highway construction project in Algeria needed a complete IT capability on site: computers, phones, file storage, surveillance. Nothing existed. There was no internet at the location and no cloud service was going to be part of the answer.

Everything had to work with the connection down, because for meaningful periods the connection would be down.

Designing for isolation

Building for an isolated site inverts a habit. The normal instinct is to put services where they are managed for you and reach them over a link. Here the link is the least reliable component, so every service that people depend on daily lives on site, and the link is only used for things that can wait.

Phones work when the site is cut off. Files are reachable when the site is cut off. Cameras record when the site is cut off. What the outside connection adds is remote access for headquarters, and losing it degrades the site rather than stopping it.

Network

The site runs a multi-VLAN design on a D-Link DGS-1210-52MP L2+ managed switch, separating workstations, VoIP phones, IP cameras, the NAS and management traffic.

Segmentation here is not a security formality. Cameras produce constant traffic that has no reason to reach workstations. Voice needs predictable treatment and suffers when it competes. Management should not be reachable from a general purpose PC. Putting all of that on one flat network works on the day it is installed and degrades from there.

Inter-VLAN routing runs router-on-a-stick on a D-Link DI-SR2900-10, with a dedicated DHCP scope per VLAN. Underneath it is a 48-port CAT6 patch panel with structured cabling terminated across the site, which is the part nobody photographs and the part that determines whether the next person can work on it.

Voice, and the part that took longest

A Grandstream UCM6302 IP PBX with twenty GRP2602P PoE handsets across the departments. Extensions 1001 to 1020, voicemail, auto-dial timeout, caller ID.

The interesting problem was SIP registration across VLANs. Grandstream's Zero Config provisioning relies on the PBX discovering phones on the local segment, and once phones sit on a different VLAN from the PBX that discovery does not happen. The convenient path was unavailable precisely because the network was designed properly.

So registration was configured explicitly rather than discovered, which took longer and produced a system that is easier to reason about afterwards. Every extension is where somebody decided it should be, and a phone that fails to register fails for a reason you can find, rather than because a broadcast did not arrive.

Later the deployment was extended with Grandstream Wave, so staff can make internal calls from off site over the internet. Internally that means people on rotation stay reachable on their extension.

Files

A QNAP TS-462 with 24 TB, serving twenty-four users across fifteen departmental shared folders with role-based access control and read and write separated per role.

Fifteen folders for twenty-four people is deliberate. Construction sites have real separation between what commercial, engineering and site management should see, and the alternative to designing it up front is one shared drive that everybody can write to and nobody will reorganise later. Remote access for off-site personnel runs over VPN rather than by exposing the NAS.

Surveillance

Fourteen Milesight 5MP bullet cameras onto a Dahua DHI-NVR5416 sixteen channel PoE NVR over ONVIF, with live view and playback available to headquarters remotely.

Cameras and recorder are from different manufacturers, which is a deliberate position rather than a compromise. ONVIF is what makes it possible, and keeping the camera choice independent of the recorder choice means neither decision locks in the other at replacement time.

Bridging the isolated network out

VPN, port forwarding and DDNS on the router connect the site to headquarters for remote phones, file access and camera feeds.

The ordering matters. The site was designed to work alone and then connected, rather than designed around a connection and hardened afterwards. Systems built the second way have a habit of quietly acquiring dependencies on the link, and you discover them the first time it fails.

Physical

Everything rack mounted in a 42U D-Link cabinet, with critical systems on an APC 2000VA online UPS and the PoE budget planned across the forty-eight switch ports.

Online rather than line-interactive is worth the difference at a construction site, where mains quality is not a given and the load includes a PBX and an NVR that neither tolerate dirty power nor appreciate a transfer delay. PoE budget planning is the other half: twenty phones and fourteen cameras drawing from one switch is a number you calculate before purchase, not something you discover when the last camera refuses to power on.

Result

A construction site with the IT capability of a permanent office, that keeps working when the outside connection does not, built from nothing on a network that owes no service to anyone.