Technology: chosen by the problem, measured by targets
How COREIT chooses technology for business systems: design principles, measurable targets, and only then the specific technologies.
Summary: COREIT chooses technology by the problem and by measurable criteria: layered defense, segmentation, no single point of failure, and measuring before concluding. This page lists the specifications that are often skipped, with reference vendors and product lines by category.
3 linked parts of one technology solution
Notable technology advances
A summary of new directions from leading manufacturers in each solution group, from firewalls to endpoints. Written at technology level so you can look things up and ask better questions when talking with COREIT.
Firewall & intrusion prevention
- Next-generation firewalls embed AI/ML to recognise new threats in-line
- TLS 1.3 decryption and inspection on dedicated silicon, with little impact on speed
- Early support for hybrid post-quantum cryptography in VPN and TLS
What it means: the same edge device handles more encrypted traffic and still keeps control.
SD-WAN & SASE
- SD-WAN with security built into branch devices, managed centrally
- Cloud-delivered security (SSE) extends protection to remote users
- Path selection by application and measured quality, not just cost
What it means: many branches share one policy, and new sites are added quickly and consistently.
Switching & Wi-Fi 7
- Wi-Fi 7 (802.11be) with multi-link operation (MLO) cuts latency where devices are dense
- Multi-gigabit 2.5/5/10G ports and high-power PoE (802.3bt) for new APs and cameras
- Wi-Fi and switching managed from one console, with AI-assisted analytics
What it means: cabling and switches chosen today must be ready for next-generation APs.
Endpoint protection: EDR and XDR
- EDR/XDR correlates endpoint, email, identity and network data to show the whole attack chain
- AI-assisted alert triage reduces the load on analysts
- Managed detection and response (MDR) for teams without an in-house SOC
What it means: earlier detection and faster response, not only blocking known malware.
Identity & secure access
- Zero Trust: verify user, device and context on each access
- Passkeys/FIDO2 replace passwords, with phishing-resistant MFA
- Account anomaly detection and instant revocation of access
What it means: accounts are the new perimeter and deserve protection on par with the firewall.
Backup & recovery
- Immutable backups that ransomware cannot encrypt or delete
- Clean-room recovery to test restores before returning to production
- Scheduled automatic restore tests that measure real recovery time (RTO)
What it means: a backup is only worth what you can restore, proven on a schedule.
Servers, storage & server room
- All-flash NVMe storage and fast storage networking that scales flexibly
- New-generation servers use less power per workload, with GPU/AI-ready infrastructure
- Out-of-band management and remote power and temperature monitoring
What it means: size power and cooling up front so the server room is not rebuilt later.
Data-driven network operations
- AIOps: anomaly detection and root-cause hints from telemetry
- Configuration as code, validated automatically before rollout
- Observability of real user experience (Wi-Fi, applications), not just device status
What it means: less time finding faults and fewer mistakes when changing configuration.
These are reference figures. COREIT provides further detail suited to each system when talking with the customer.
Reference information on trends. The specific solution is decided after the survey, based on your needs, budget and current state.
Key specifications that rushed systems usually skip
COREIT designs from the network core to the whole system. These items are rarely mentioned in quotes, yet they decide whether the system is as stable as promised.
| Specification | How COREIT applies it | If it is skipped |
|---|---|---|
| N+1 power with monitored UPS | Power faults are a leading cause of outages that network designs often overlook. | A power loss takes the whole system down, however well the network is designed. |
| Two carriers with automatic failover | The two lines should follow different physical routes and the switchover time should be measured. | One cut line and the whole office loses Internet. |
| Headroom and uplink oversubscription ratio | Sized for real users and applications, with headroom for growth. | Adding users causes congestion and slowdowns at peak hours. |
| Loop prevention (STP) and port protection | Blocks loops and rogue devices plugged into the network. | One wrongly plugged cable can bring down the whole LAN. |
| Out-of-band management and configuration backup | You can still reach, replace and restore devices when the main network is down. | A failed device without a saved configuration must be rebuilt from scratch. |
| Central logging and time sync (NTP) | Every event carries a consistent timestamp for tracing. | No evidence when an incident or an audit occurs. |
| Firmware lifecycle and regular patching | Track patches and end-of-support dates and schedule updates. | Old vulnerabilities linger for years on edge devices. |
| Earthing, surge protection and certified cable testing | The physical layer is tested route by route and documented. | Intermittent physical faults are hard to find and often blamed on devices. |
Reference vendors and product lines by category
COREIT works with many vendors and chooses by survey. The table lists commonly used product lines with their role and the service plans that go with them. The exact model is fixed after the survey, by users, budget and what the vendor currently sells.
| Scope | Vendor · reference line | Role | Accompanying plans |
|---|---|---|---|
| Edge firewall in an HA pair | Fortinet FortiGate (70G–200G for offices and branches, 400F and above for the core); Palo Alto Networks PA-400 / PA-1400 | Intrusion prevention, VPN and content filtering, run as a pair so losing one device does not stop the network. | Starter, Basic Layer, Advanced |
| Core, distribution and access switches | Cisco Catalyst 9200 / 9300 / 9500; HPE Aruba CX 6200 / 6300 / 8325; Juniper EX | Tiered Core, Distribution and Access; PoE for APs and cameras; stacking or VSX for redundancy. | Basic Layer, Advanced |
| Enterprise Wi-Fi and controller | HPE Aruba (AP-735 Wi-Fi 7, managed with Aruba Central); Cisco Catalyst 9100 / Meraki; Ubiquiti UniFi; EnGenius | Smooth roaming, guest and staff networks kept apart, all access points managed in one place. | Basic Layer, Advanced |
| Servers | Dell PowerEdge R-series; HPE ProLiant DL360 / DL380 Gen12; Lenovo ThinkSystem | Virtualization, databases and file servers, with out-of-band management (iLO, iDRAC) for when the main network is down. | Equipment and IT infrastructure, Care |
| Storage and backup | Synology RackStation, QNAP; Veeam Backup & Replication | 3-2-1 backups with an immutable copy and regular recovery tests against RPO and RTO. | Add-on package (Legacy Backup), Care |
| Power and server room | APC by Schneider Electric Smart-UPS; Eaton 9PX / 5P | N+1 UPS redundancy, remote monitoring and capacity sized to the real load. | Equipment and IT infrastructure, Care |
| Endpoint protection | Bitdefender GravityZone; Kaspersky | Malware and ransomware protection, with EDR at the advanced level and XDR at the full level. | Starter, Basic Layer, Advanced |
| Identity and access | Microsoft Entra ID / Active Directory; RADIUS 802.1X on switches and APs | One identity for network, Wi-Fi, VPN and devices; MFA; access revoked the moment someone leaves. | Consulting and design, Basic Layer, Advanced |
6 principles COREIT applies to every system
Technology changes over time, principles do not. Every choice below traces back to these principles.
Layered defense
No reliance on a single device. Edge (firewall), network (segmentation), endpoints (EDR) and data (backup) all protect, so one breached layer does not lose the whole system.
Segmentation by trust level
Separate users, servers, DMZ and guests. Zero trust by default, so an incident in one zone does not spread to another.
Eliminate single points of failure
Core devices run as an HA pair, with lines from two independent carriers and UPS-backed power. Failover takes seconds, not hours.
Measure before concluding
Decisions rest on measurements: latency, packet loss, backbone load, server room temperature and Wi-Fi coverage. The same criteria are used for the survey and for operations.
Observable end to end
Centralized monitoring of devices, lines and servers, with threshold alerts to catch problems before users are affected.
Verified recovery
Backup under the 3-2-1 rule (3 copies, 2 media types, 1 off-site), with RPO and RTO targets and periodic restore tests.
From business requirement to technology choice
| Business requirement | Technical target | Typical technology |
|---|---|---|
| The system must not stop | Availability, RTO | HA firewall and core switch, 2 ISPs, UPS, 24/7 monitoring |
| Data must not be lost | RPO, RTO, number of copies | 3-2-1 backup, off-site copy, restore tests |
| Meet partners' security requirements | Segmentation, access control, logs | VLAN/DMZ, Zero Trust (ZTNA), MFA, EDR |
| Add sites and people | Scalability, time to stand up a new site | Layered architecture, Ring, SD-WAN, central management |
| Invest right, no excess | Lifecycle cost of ownership | Chosen from the survey, vendor-neutral, phased implementation |
Availability level and maximum downtime per year
| Availability | Maximum downtime/year | Typical architecture |
|---|---|---|
| 99% | about 3 days 15 hours | Single devices and one line |
| 99,9% | about 8 hours 46 minutes | HA device pair with UPS |
| 99,99% | about 52 minutes 34 seconds | HA, 2 independent ISPs, power redundancy, proactive monitoring |
The commitment in practice also depends on carrier lines and mains power, and is determined through the survey.
How COREIT chooses technology
1. Define the problem and the acceptable level of risk
2. Measure the current state with the 6-category criteria
3. Choose the architecture model and technology that meet the targets, with no vendor lock-in
4. Test and accept against the targets that were set
Terms used on this page
- HA (High Availability)
- Two devices run as a pair, and if one fails the other takes over at once, usually within seconds.
- ISP
- Internet service provider (the carrier).
- SLA
- A written service commitment: response, resolution and monitoring times for each package.
- RPO
- The maximum amount of data you accept losing, measured in time (for example 4 hours).
- RTO
- The maximum time to restore the system after an incident.
- VLAN
- A virtual network that splits one physical infrastructure into separate zones.
- DMZ
- A buffer zone that hosts externally reachable services, separated from the internal network.
- Zero Trust / ZTNA
- Trust nothing by default: every person and device must authenticate and can access only what they are permitted.
- SD-WAN
- Software that steers traffic across several lines between branches, picking the best path and failing over automatically.
- EDR / XDR
- Detection and response to threats on endpoints (EDR), extended to network and cloud (XDR).
- SOC
- A security operations center that watches alerts continuously.
- BOQ
- A bill of quantities and materials list with counts, used to set a budget.
- PoE
- Power over Ethernet: powers APs and cameras through the network cable.
- Backbone
- The main trunk connection between core switches and areas.
Firewall, switching, wireless, data center
These are individual components. How COREIT combines them into a complete architecture is covered on the neighboring Architecture models and Backbone & management pages.
Firewall / perimeter security
| Technology | Role |
|---|---|
| Centralized, multi-layer policy management and synchronization | Synchronizes policy across firewalls, switches and APs on one platform, reducing manual per-device configuration |
| Dedicated, separate processors (ASIC/NPU) | Network and content processing is offloaded from the main CPU, so deep inspection (IPS/SSL) does not bottleneck bandwidth and throughput stays at wire speed |
| Behavior-based application recognition (app-aware inspection) | Controls the actual application in use, not just ports and protocols, recognizing thousands of applications through Deep Packet Inspection (DPI) |
| Cloud malware analysis (cloud sandboxing) | Detects zero-day malware and updates protection signatures in near real time |
| Global threat intelligence + identity-based access control | Combines continuously updated threat data with per-user and per-device access control (NAC) |
Common standards: IPsec/SSL VPN, Zero Trust Network Access (ZTNA), Active/Passive or Active/Active High Availability (failover is typically within 1–3 seconds, without dropping sessions).
Switching / network core
| Technology | Role |
|---|---|
| Unified network operating system | One operating system across access, distribution and core, with consistent operation as you scale |
| Merging several switches into one control plane (virtual stacking) | Managed as a single logical device with higher redundancy, typically merging 4–8 physical switches |
| HSRP / VRRP | Layer-3 gateway redundancy: when one switch or router fails, the remaining device takes over immediately with no interruption (can be tuned to under 1 second) |
| STP / RSTP | Loop prevention when the network has multiple redundant paths |
| LACP | Bundling several physical links (typically up to 8 ports) into one logical channel with greater bandwidth |
| OSPF / BGP + ECMP | Dynamic routing that automatically balances load across parallel paths when several routes exist |
How these technologies are organized into a vertical backbone or a peer-to-peer network for each model is covered on the Backbone & management page.
Enterprise wireless
| Technology | Role |
|---|---|
| Smart roaming / steering | Automatically moves devices to the best access point as they move, without dropping the connection (typically under 50 ms) |
| AI/ML-driven RF optimization | Automatically tunes channels and transmit power to real radio conditions |
| Wi-Fi 6 / 6E / 7 (802.11ax/be) | Higher bandwidth and less interference when many devices are active at once. Wi-Fi 6 reaches a theoretical maximum of about 9.6 Gbps per channel |
| 802.11r (Fast Roaming) + WPA3 | Fast roaming without interrupting calls or applications, and WPA3-SAE encryption that resists offline password guessing |
In Vietnam, the 6 GHz band for Wi-Fi 6E/7 is license-exempt only in the 5925–6425 MHz range (500 MHz, under Circular 01/2025/TT-BKHCN, effective 15 May 2025). That is narrower than the full 6 GHz band in some other countries. Devices must be set to the Vietnam regulatory domain so they transmit only in this range.
Data center & equipment room
| Technology | Role |
|---|---|
| Spine-Leaf network architecture | Each Leaf switch connects to every Spine switch through Layer-3 routing (BGP/OSPF) with ECMP, giving even bandwidth between racks and avoiding a single bottleneck as in the traditional 3-tier design. Used when there are many racks or network cabinets. |
| Availability standards (Uptime Institute) | Tier III (concurrently maintainable: multiple independent power and cooling paths, maintenance without stopping the system) is the recommended level for most businesses. Tier IV (fault-tolerant: withstands any single failure without interruption) is for extremely demanding systems |
| Redundant power & cooling | N+1 (one spare unit) or 2N (full redundancy) for UPS and generators, with real-time monitoring of equipment-room temperature and humidity |
How server infrastructure is centrally managed (HCI) and how the whole system is monitored is covered on the Backbone & management page.
The technology and protocol names above follow vendor publications and regulations in force at the time of writing (August 2026). COREIT selects specific equipment models at the time of the survey and actual implementation.
Need a deeper technical discussion?
If you are a CTO or IT Manager and want to discuss the architecture directly, send a request and COREIT's engineering team will respond.
A technology or outsourcing company? See the dedicated solution page →