School network infrastructure: a buyer's guide for education IT teams

Campus Deals helps K-12 schools, school districts, colleges, and universities buy the network hardware behind a modern campus, from firewalls and switching to Wi-Fi, surveillance, and voice.

Qualifying institutions get an additional 8% off orders of $10,000 or more, and eligible institutions may also qualify for net terms of up to 90 days (subject to approval), so equipment can ship now and be paid within the budget cycle.

This guide is written for the IT and procurement teams who plan these projects together. It walks through how to size a campus network, then how each category of networking equipment fits and which models are commonly used by environment size.

Specifications and performance figures below are vendor "up to" values that vary by model, license, firmware, traffic mix, and configuration. Confirm the exact details on each product page before purchase.

How to size a school or campus network

Before comparing models, gather the numbers that drive every sizing decision. Collect your student count, staff count, number of buildings, internet bandwidth, and the planned counts for access points, cameras, and phones, plus any VPN or multi-site requirements. Those figures point you to a tier.

• Small school (under about 500 users): a desktop firewall, a few PoE access switches, and Wi-Fi 6 usually cover it.
• Mid-size campus (about 500 to 2,000 users): a 1U rackmount firewall, stackable access switches, and a mix of Wi-Fi 6 and Wi-Fi 6E.
• Large campus (2,000+ users): a high-capacity edge firewall, dedicated core and aggregation switching, and Wi-Fi 6E in the densest spaces.
• University environments: often need a dedicated core and aggregation layer with per-building distribution.

For example, a district with three campuses, 2,500 students, 300 staff, and a 2 Gbps circuit sits in the large tier: plan a high-capacity edge firewall, core and aggregation switching per building, and Wi-Fi 6E in lecture halls and common areas. These are starting points, not hard rules, since bandwidth, inspection load, and device density all shift the answer. Share your numbers and our team will size it precisely.

Firewalls for K-12 network security and campus edges

A school firewall (a next-generation firewall, or NGFW) helps support CIPA-aligned content filtering policies, helps enforce segmentation between student, staff, guest, IoT, camera, and voice networks, and inspects traffic in both directions for threats. When comparing a K-12 or campus firewall, pay close attention to inspected (threat-prevention) throughput, the speed sustained with security services such as IPS, application control, and malware inspection enabled, rather than the headline firewall figure measured with inspection off. Match that to your internet circuit, user count, and VPN needs. Campus Deals carries Fortinet FortiGate, Palo Alto Networks, and SonicWall.

Small schools, offices, and branch locations (desktop)

• Fortinet FortiGate FG-40F: a fanless desktop NGFW commonly considered for small schools, offices, and branch sites.
• Fortinet FortiGate FG-60F: a similar desktop class with ten 1GbE ports for sites with more wired drops.
• Fortinet FortiGate FG-90G: a higher-performance desktop unit with two 10GbE ports, for a faster circuit or room to grow.
• Palo Alto Networks PA-440 and PA-450: ML-powered desktop NGFWs, a good fit where the district standardizes on Panorama management.
• SonicWall TZ270, TZ370, TZ570, and TZ670 cover small-site to larger-branch needs, with sizing based on user count, inspected throughput, VPN requirements, and bandwidth. The TZ270 is supplied here as a high-availability pair.

Districts and mid-size colleges (1U rackmount)

• Fortinet FortiGate FG-100F, FG-200F, and FG-400F: midrange 1U appliances with more 10GbE interfaces as you move up the line.
• Palo Alto Networks PA-1410 and PA-1420: the PA-1400 series for a medium campus.
• SonicWall NSa 2700 and NSa 3700: 1U midrange appliances with 10GbE connectivity.

Large universities, district cores, and high-traffic edges

• Fortinet FortiGate FG-600F and FG-601F (1U), plus the high-capacity FG-900G (1U), FG-1000F (2U), and FG-1800F (2U).
• Palo Alto Networks PA-3400 series with higher throughput and high-speed interfaces: PA-3410, PA-3420, PA-3430, and PA-3440.
• SonicWall NSa 4700 and NSa 5700, the top of the NSa line, with 25GbE connectivity on the larger model.

Many FortiGate BDL SKUs bundle the appliance with multi-year FortiGuard security services and support on a single renewal date (the FAQ explains the code numbers). Browse our firewalls.

Switches: the wired backbone and PoE for classrooms

Switches link rooms and buildings and deliver Power over Ethernet to access points, cameras, and phones. Access switches connect end devices in classrooms and offices, aggregation switches connect multiple access closets back to the campus core, and core switches tie the buildings together.

• PoE+ (802.3at): up to 30W per port, for most access points and indoor cameras.
• Cisco UPOE / 802.3bt: up to 60W or about 90W, for PTZ cameras and tri-band Wi-Fi 6E access points.
• Multi-gigabit (mGig): 2.5, 5, or 10G over existing Cat5e or Cat6 copper, so schools can raise wireless speeds without rewiring.

Plan to the switch's total PoE budget, which varies by model and power supply, not just per-port wattage.

Cisco Catalyst

Across Catalyst, -E is Network Essentials and -A is Network Advantage; avoid mixing license tiers in one stack, since features and management tiers differ.

• Catalyst 1300 (small schools, Layer 2 and basic Layer 3): C1300-48P-4X (48 PoE+ ports, 10G uplinks); C1300-24T-4X and C1300-48T-4G (data-only).
• Catalyst 9200L (stackable access; -4G is 1G uplinks, -4X is 10G): C9200L-24P-4G-E, C9200L-48P-4G-E, C9200L-48P-4X-E; C9200L-48PL-4G-E (partial PoE, lower budget); C9200L-48PXG-4X-E (mGig for Wi-Fi 6E).
• Catalyst 9300 / 9300L / 9300X (stackable access with UPOE and mGig; the HX models support up to 90W 802.3bt): C9300-48P-E, C9300-48U-E, C9300-48UXM-E, C9300L-48P-4X-E, C9300L-48UXG-4X-A, C9300X-48TX-E, C9300X-48HX-E, and C9300X-24HX-E.
• Catalyst 9500 (campus core): C9500-48Y4C-A (25GbE and 100GbE interfaces to link buildings).

Cisco Meraki and HPE Aruba

• Cisco Meraki centralizes management through a cloud dashboard, a fit for multi-site districts (FP is full PoE): MS130-48P-HW (access), MS250-48FP-HW (stacking, Layer 3), MS350-48FP-HW (access-to-aggregation).
• HPE Aruba CX (managed via Aruba Central): 6300M 48-port (multigig PoE++ access), 6300M 24-port SFP+ (fiber aggregation), 6200F 48-port (cost-effective Layer 3 PoE access).

Browse PoE switches for school networks.

Access points: a campus Wi-Fi upgrade that holds up under load

School Wi-Fi is often challenged by density. Modern classrooms often have two to three connected devices per student, so a full room, a packed lecture hall, or a busy dorm floor puts far more clients on the air than an office does. Wi-Fi 6 (802.11ax) uses OFDMA so one access point serves many clients at once instead of one at a time, and Wi-Fi 6E adds access to the 6 GHz band, with additional channels that can reduce congestion in high-density spaces.

• Wi-Fi 6, most classrooms (PoE+): Cisco C9120AXI-B, Cisco Meraki MR46-HW and MR56-HW.
• Wi-Fi 6E, high-density rooms (typically UPOE or 802.3bt power and an mGig uplink): Cisco CW9166I-B, Cisco Meraki MR57-HW, and HPE Aruba AP-655 and AP-635.

Many K-12 designs start by evaluating around one access point per classroom (or one per two rooms in lighter-use areas), with denser placement in halls, gyms, and libraries. Construction materials, ceiling height, client density, and bandwidth per user all affect the final count, so a wireless site survey is the reliable way to confirm it.

School surveillance systems for campus safety

These Axis IP cameras run on PoE and are often placed on a dedicated VLAN behind the firewall. Compare them on resolution, low-light performance (Axis Lightfinder and IR), wide dynamic range, the IK vandal and IP weather ratings, and on-camera analytics. In Axis model names, V indicates vandal resistance, L indicates built-in IR illumination, and E denotes an outdoor (environmental) rating, so an LV model is indoor-rated because it lacks the E, while LVE adds the outdoor rating. Confirm the exact rating on each product page. Match camera type to scene:

• Domes (hallways, entrances, offices, common indoor areas):
  • Indoor: M3085-V, M3086-V, M4218-LV, P3265-LV.
  • Outdoor-ready (LVE): P3268-LVE, P3275-LVE 10mm, P3275-LVE 29mm, P3278-LVE 8MP, P3285-LVE 10mm, P3285-LVE 29mm, M3128-LVE black / white.
• Bullets (perimeter, parking, longer IR reach): P1475-LE, P1488-LE, Q1808-LE, Q1808-LE 150mm, Q1809-LE, 8K Q1809-LE 41MP.
• PTZ (active monitoring of lots, fields, large outdoor areas): 31x-zoom Q6325-LE, Q6075-E, V5925.
• Panoramic (cafeterias, courtyards, wide areas): P3735-PLE, P3738-PLE, P3818-PVE.
• Thermal (perimeter detection in darkness or glare, for detection rather than detailed identification): Q1952-E.
• Recording, storage, mounts: S3008 Mk II 4TB / 8TB recorders, Surveillance microSDXC, TP3205 mount, T8640 bracket / DIN clip.

Browse Axis surveillance cameras for schools.

IP phones for school offices and classrooms

VoIP phones ride the same switches on a voice VLAN with QoS and are powered over PoE, which keeps voice on the network you already manage. Common school uses include front office communications, classroom phones, the nurse's and security offices, district administration extensions, and integration with paging and emergency notification systems.

• Cisco Desk Phone 9841 and 9851: DP-9841-K9 and the larger-display DP-9851-K9 for front offices, reception, classrooms, and administration. Add the DP-9800-KEM-WMK key expansion module at a reception or operator station that handles many lines.
• Cisco ATA 191 and 192: ATA191-3PW-K9 and ATA192-3PW-K9 bring analog devices such as fax machines, paging, and intercoms onto the IP system. Emergency, elevator, and life-safety phone use cases should be validated against local code and carrier requirements.

Browse Cisco IP phones for schools.

How the five categories work together

These are one system, not five buys. The firewall segments traffic at the edge, the switches form the backbone and deliver PoE, and access points, cameras, and phones are powered endpoints on their own VLANs. Sizing the set together (firewall throughput, switch ports and PoE budget, access point density, and camera and phone counts) helps you avoid a firewall that struggles once inspection is on or a switch that runs short of PoE budget mid-deployment.

Frequently asked questions

What is the Campus Deals discount, and are payment terms available?

Educational institutions get an additional 8% off orders of $10,000 or more across firewalls, switches, access points, surveillance cameras, and IP phones. Eligible institutions may also qualify for net terms of up to 90 days, subject to approval.

What firewall does a small school need?

A desktop NGFW is the common starting point, such as the Fortinet FortiGate FG-40F or FG-60F, the Palo Alto Networks PA-440 or PA-450, or a SonicWall TZ-series model (TZ270 through TZ670). Size it on inspected (threat-prevention) throughput against your internet circuit, user count, and VPN needs, not the headline firewall figure.

What firewall is right for a district or large university?

Districts commonly use 1U models like the Fortinet FortiGate FG-100F, FG-200F, or FG-400F, the Palo Alto Networks PA-1410 or PA-1420, or the SonicWall NSa 2700 or 3700. Large campuses step up to the Fortinet FortiGate FG-900G, FG-1000F, or FG-1800F, the Palo Alto Networks PA-3400 series, or the SonicWall NSa 4700 or 5700.

Do we need Wi-Fi 6E, or is Wi-Fi 6 enough?

Wi-Fi 6 access points such as the Cisco Catalyst 9120AXI or Meraki MR46 and MR56 suit most classrooms. Wi-Fi 6E models like the Catalyst 9166I, Meraki MR57, and HPE Aruba AP-655 and AP-635 add the 6 GHz band for the densest rooms and typically need UPOE or 802.3bt power with an mGig uplink.

How many access points does a classroom building need?

Many designs start by evaluating around one access point per classroom (or one per two rooms in lighter-use areas), with denser placement in halls, gyms, libraries, and cafeterias. Materials, ceiling height, client density, and bandwidth per user all matter, so confirm with a wireless site survey.

Should we choose Cisco Catalyst or Meraki switches?

Catalyst offers traditional local management and keeps switching traffic even if its DNA license lapses. Meraki centralizes everything in a cloud dashboard, which fits districts with a small central team, though it requires an active subscription to operate. Both deliver the PoE and multi-gig ports a campus needs.

What is the difference between PoE+ and UPOE for schools?

PoE+ (802.3at) supplies up to 30W per port for most access points and indoor cameras. Cisco UPOE supplies up to 60W and 802.3bt up to about 90W for PTZ cameras and tri-band Wi-Fi 6E access points. Plan to the switch's total PoE budget, which varies by model and power supply, not just per-port wattage.

Which Axis cameras suit indoor versus outdoor areas?

Indoor areas typically use fixed domes such as the M3085-V, M3086-V, M4218-LV, and P3265-LV. Outdoor areas use outdoor-ready LVE domes (P3268-LVE, P3275-LVE, P3278-LVE, P3285-LVE), bullets (P1475-LE, P1488-LE, Q1808-LE, Q1809-LE) for perimeter and parking, and PTZ (Q6075-E, Q6325-LE) for fields and lots. Panoramic models (P3735-PLE, P3738-PLE, P3818-PVE) cover wide open areas. Confirm ratings on each product page.

How do Cisco Desk Phones and ATAs fit a school phone system?

The Cisco Desk Phone 9841 (DP-9841-K9) and 9851 (DP-9851-K9) are IP handsets for offices, reception, classrooms, and administration, with a key expansion module for busy stations. The ATA 191 and 192 bring analog devices such as fax, paging, and intercoms onto the same IP system. Validate emergency and life-safety use against local code.

What do the Fortinet BDL bundle codes mean?

In a FortiGate BDL part number, 950 typically indicates the Unified Threat Protection (UTP) bundle and 809 the Enterprise Protection bundle, while 60 indicates a five-year term and 36 a three-year term. For example, FG-90G-BDL-950-60 is a FortiGate 90G with five years of UTP. Confirm the exact services on the product page.

How do I get help sizing a full campus order?

Share your building count, student and staff counts, device count, internet bandwidth, and budget target, and our team can build a right-sized bill of materials across all five categories, with project pricing so the 8% education discount and any approved net terms apply to the whole order.