Campus Site Router — Technical Reference

This reference holds the deeper technical detail for network engineers. For the overview and what your team needs to provide, see the Campus Site Router Setup Guide.

Cloud Infrastructure

Migrating Devices That Already Have IP Addresses

If your BAS devices are currently on a different VLAN with static IPs, we migrate them one at a time using a coordinated process. This avoids any bulk outage.

How the migration works

1. Your team creates the new BAS VLAN and delivers an access port to our router. We verify connectivity before touching any devices.
2. We schedule a migration window — typically one hour with one of our engineers and one of your network engineers on a call together.
3. We migrate devices one at a time:
   • Our engineer connects to a device through the existing solution and changes it from static IP to DHCP. The device loses connectivity at this point.
   • Your network engineer moves that device's switch port to the new BAS VLAN.
   • The device picks up a new IP from our router via DHCP and reconnects through our tunnel. We confirm connectivity.
   • Repeat for the next device.

Each device takes 2–5 minutes. A site with 10 devices typically completes in under an hour. Only the device being migrated is offline at any given time — everything else continues operating normally.

Zero Trust Network Controls (Optional)

For organizations with strict zero-trust security requirements, the campus deployment model gives your IT team full control over BAS network traffic at the switch and firewall level. These are optional hardening measures you can apply to the BAS VLAN.

VLAN Egress ACL

Restrict what the BAS VLAN can reach. Apply an egress ACL on the BAS VLAN interface that permits only:

This guarantees the BAS VLAN can only communicate with our cloud endpoint. No lateral movement to corporate resources is possible, even if a device is compromised.

Inter-VLAN Routing Block

Deny all traffic between the BAS VLAN and your corporate VLANs at the Layer 3 switch or firewall. The BAS VLAN should be a dead end — traffic either goes to our cloud or stays local.

DHCP Snooping

Enable DHCP snooping on the BAS VLAN and trust only the port where our router is connected. This prevents rogue DHCP servers and ensures only our router assigns addresses in the 10.50.X.0/24 range.

Port Security / MAC Limiting

Limit MAC addresses on BAS VLAN access ports to known BAS devices. Combined with DHCP snooping, this ensures only authorized equipment can join the VLAN.

IP Source Guard

Bind IP-to-MAC-to-port mappings on the BAS VLAN. This prevents IP spoofing — a device can only use the IP assigned to it by our router's DHCP server.

Static IP Mode (No DHCP)

For maximum control, we can disable DHCP on our router and manage all BAS device IPs as static assignments. In this mode:

• Every device gets a pre-assigned static IP in the 10.50.X.0/24 range
• No DHCP server runs on the BAS VLAN — unknown devices cannot obtain an address
• Your IT team has a complete inventory of every IP and what device it belongs to
• Combined with port security, only known devices on known ports with known IPs can communicate

We provide and maintain the IP assignment list. This option is ideal for environments that require a documented asset inventory for every connected device.

What This Gives You

• Known IP range: all BAS devices use 10.50.X.0/24 only
• Known destination: traffic can only reach one cloud IP
• Known protocol: only UDP, no TCP, no inbound
• No lateral movement: BAS VLAN is fully isolated from corporate network
• Full auditability: your firewall logs show exactly what leaves the VLAN

These controls are optional. The deployment works without them. But for organizations that require zero-trust segmentation, this gives your security team verifiable enforcement at your own infrastructure layer.

Questions?

Contact us at any time. We're happy to schedule a call with your IT team to walk through the deployment.

Contact Us