Field Site IT Establishment

Field site IT establishment creates the technical infrastructure enabling programme delivery at locations outside headquarters or regional offices. This task covers the complete sequence from initial site survey through operational handover, producing a functioning IT environment within 2-4 weeks under standard conditions.

The procedures here apply to planned field site deployments where time permits proper assessment and staged implementation. Emergency deployments requiring establishment within hours or days follow the Field Office Rapid Deployment playbook, which accepts higher risk in exchange for speed.

Prerequisites

Before beginning field site establishment, confirm the following requirements are satisfied:

Gather the following information before the site visit:

• Geographic coordinates (latitude/longitude to 5 decimal places)
• Site floor plan or sketch with proposed IT locations
• Number of users and their roles
• Applications required for programme delivery
• Data classification of information to be processed
• Expected internet bandwidth requirements based on user count and applications
• Power consumption estimates for proposed equipment

Site Assessment

Conduct the site assessment in person. Remote assessments miss critical details about power quality, building construction, and environmental factors that affect equipment placement and connectivity options.

1. Document power infrastructure by locating the main electrical panel and measuring voltage at proposed equipment locations using a multimeter. Record voltage readings at 3 intervals across a working day: morning (08:00-09:00), midday (12:00-13:00), and evening (17:00-18:00). Acceptable voltage range for 230V systems is 207-253V. Voltage outside this range requires power conditioning equipment.

   Site: Lokichoggio Field Office
   Date: 2024-11-15

   Power measurements (230V nominal):
   08:30 - 241V (within spec)
   12:45 - 238V (within spec)
   17:15 - 229V (within spec)

   Voltage fluctuation: 12V range - ACCEPTABLE
   Power conditioning: Not required

2. Test socket wiring at each proposed equipment location using a socket tester. Verify earth connection, correct polarity, and absence of faults. Document any sockets requiring electrician attention before equipment installation.

3. Assess power reliability by interviewing site staff about outage frequency and duration. Request utility records if available. Classify power reliability:

   Category	Outage frequency	Typical duration	UPS requirement
   Reliable	Less than 1 per month	Under 1 hour	Standard UPS (30 min runtime)
   Intermittent	1-4 per month	1-4 hours	Extended UPS (2 hour runtime)
   Unreliable	More than 4 per month	Over 4 hours	UPS plus generator or solar

4. Survey connectivity options by testing mobile signal strength at proposed router locations. Use a signal strength app recording dBm values. Signal below -100 dBm requires external antenna. Contact local ISPs to confirm service availability and lead times. Document:

   Connectivity survey: Lokichoggio Field Office

   Mobile networks:
   - Safaricom: -78 dBm (excellent) - 4G available
   - Airtel: -92 dBm (good) - 4G available
   - Telkom: -105 dBm (poor) - 3G only

   Fixed options:
   - Fiber: Not available (nearest POP 45km)
   - DSL: Not available
   - WISP: Bushnet available, 10Mbps, 3-day install

   Satellite:
   - Starlink: Coverage confirmed, equipment in stock
   - VSAT: Quotes requested from 2 providers

   Recommendation: Dual SIM router (Safaricom primary, Airtel backup)
   with Starlink for redundancy

5. Identify equipment locations by selecting positions for:

   • Network cabinet or shelf (ventilated area, away from windows, lockable room preferred)
   • Wireless access point positions (central locations, ceiling mount where possible)
   • User workstation areas (consider power access, natural light, ergonomics)
   • Printer/shared equipment location (accessible to all users)

   Mark locations on floor plan with measurements from fixed reference points.

6. Document environmental factors including temperature range, humidity, dust levels, and physical security of proposed IT areas. Note any construction or renovation planned that could affect installation.

7. Photograph all relevant locations: electrical panel, proposed equipment areas, cable routing paths, exterior for antenna mounting, security features (locks, barriers).

The site assessment produces a completed survey form and photographic record. Review findings with IT operations before proceeding to procurement and installation planning.

Connectivity Installation

Connectivity installation establishes the primary and backup internet connections. Install primary connectivity first and verify operation before configuring backup links.

+------------------------------------------------------------+
|                  FIELD SITE CONNECTIVITY                   |
+------------------------------------------------------------+
|                                                            |
|    PRIMARY PATH                      BACKUP PATH           |
|                                                            |
|    +-------------+                   +-------------+       |
|    | ISP/Mobile  |                   | Satellite   |       |
|    | Connection  |                   | Terminal    |       |
|    +------+------+                   +------+------+       |
|           |                                 |              |
|           v                                 v              |
|    +------+------+                   +------+------+       |
|    | SIM Router  |                   | Satellite   |       |
|    | or Modem    |                   | Modem       |       |
|    +------+------+                   +------+------+       |
|           |                                 |              |
|           +----------------+----------------+              |
|                            |                               |
|                            v                               |
|                     +------+------+                        |
|                     |   Primary   |                        |
|                     |   Router    |                        |
|                     | (failover)  |                        |
|                     +------+------+                        |
|                            |                               |
|                            v                               |
|                     +------+------+                        |
|                     |   Switch    |                        |
|                     +------+------+                        |
|                            |                               |
|           +----------------+----------------+              |
|           |                |                |              |
|           v                v                v              |
|     +-----+-----+    +-----+-----+    +-----+-----+        |
|     |    AP     |    |    AP     |    |  Wired    |        |
|     | (office)  |    | (meeting) |    |  Ports    |        |
|     +-----------+    +-----------+    +-----------+        |
|                                                            |
+------------------------------------------------------------+

1. Install the primary router in the designated network cabinet location. For cellular connectivity, position the router where signal survey indicated strongest reception, or connect an external antenna if signal strength requires. Mount the antenna outside the building with clear sky view, running coaxial cable to the router.

   Configure the router with organisational standard settings:

   # Router base configuration (example: Mikrotik hEX)

   /system identity set name="FIELD-LOK-RTR01"

   /ip address add address=10.45.1.1/24 interface=bridge1

   /ip pool add name=dhcp-pool ranges=10.45.1.100-10.45.1.200

   /ip dhcp-server add name=dhcp1 interface=bridge1 \
     address-pool=dhcp-pool lease-time=8h

   /ip dhcp-server network add address=10.45.1.0/24 \
     gateway=10.45.1.1 dns-server=1.1.1.1,8.8.8.8

   /ip firewall filter add chain=input action=drop \
     in-interface=ether1 connection-state=new

   /ip firewall nat add chain=srcnat action=masquerade \
     out-interface=ether1

2. Configure the primary WAN connection. For cellular connections, insert the SIM card and configure APN settings per carrier requirements. Test connectivity by pinging an external host and measuring throughput:

   # Test basic connectivity
   ping -c 10 8.8.8.8

   # Measure download speed (requires speedtest-cli)
   speedtest-cli --simple

   # Expected output:
   # Ping: 45.23 ms
   # Download: 12.34 Mbit/s
   # Upload: 3.21 Mbit/s

3. Install backup connectivity. For satellite installations, follow Satellite Deployment procedures. For secondary cellular, configure the second SIM in the dual-SIM router or install a separate device.

4. Configure automatic failover between primary and backup connections. The router monitors primary link health and switches traffic to backup when primary fails:

   # Failover configuration (Mikrotik example)

   /ip route add dst-address=0.0.0.0/0 gateway=primary-wan \
     distance=1 check-gateway=ping

   /ip route add dst-address=0.0.0.0/0 gateway=backup-wan \
     distance=2 check-gateway=ping

   # Ping check ensures dead gateway detection
   /tool netwatch add host=8.8.8.8 interval=30s \
     down-script="/log warning \"Primary WAN down\""

5. Test failover by disconnecting primary connectivity and verifying traffic routes through backup within 60 seconds. Reconnect primary and verify traffic returns to primary path within 60 seconds.

6. Configure VPN connectivity to headquarters. The site-to-site VPN encrypts all traffic between field site and central infrastructure:

   # WireGuard VPN configuration

   [Interface]
   PrivateKey = <generated-private-key>
   Address = 10.200.45.1/32
   DNS = 10.0.0.10

   [Peer]
   PublicKey = <hq-public-key>
   AllowedIPs = 10.0.0.0/8, 172.16.0.0/12
   Endpoint = vpn.example.org:51820
   PersistentKeepalive = 25

7. Verify VPN connectivity by accessing an internal resource from a device connected to the field site network. Test both DNS resolution and actual application access.

Document final connectivity configuration including IP addresses, credentials (stored in password manager), and ISP support contacts.

Power Configuration

Power configuration ensures equipment operates reliably despite local power quality issues. The configuration varies based on site assessment findings.

+------------------------------------------------------------------+
|                      POWER ARCHITECTURE                          |
+------------------------------------------------------------------+
|                                                                  |
|  MAINS INPUT                                                     |
|       |                                                          |
|       v                                                          |
|  +----+----+     +------------+                                  |
|  | Surge   |     | Generator  |-----+  (sites with unreliable    |
|  | Protect |     | or Solar   |     |   power only)              |
|  +----+----+     +-----+------+     |                            |
|       |                |            |                            |
|       +-------+--------+            |                            |
|               |                     |                            |
|               v                     |                            |
|        +------+------+              |                            |
|        | Transfer    |<-------------+                            |
|        | Switch/ATS  |                                           |
|        +------+------+                                           |
|               |                                                  |
|               v                                                  |
|        +------+------+                                           |
|        |    UPS      |                                           |
|        | (line-int.  |                                           |
|        |  or online) |                                           |
|        +------+------+                                           |
|               |                                                  |
|    +----------+----------+                                       |
|    |          |          |                                       |
|    v          v          v                                       |
| +--+---+  +---+--+  +----+---+                                   |
| |Router|  |Switch|  |Server/ |                                   |
| |      |  |      |  |NAS     |                                   |
| +------+  +------+  +--------+                                   |
|                                                                  |
| Workstations and APs on separate non-UPS circuits                |
+------------------------------------------------------------------+

1. Install surge protection on the circuit supplying IT equipment. Use a Type 2 surge protection device (SPD) rated for the local voltage. This protects against voltage spikes from lightning or grid switching that could damage equipment.

2. Position the UPS in the network cabinet or adjacent to network equipment. Connect UPS input to the surge-protected circuit. The UPS provides:

   • Battery backup during outages
   • Voltage regulation during sags and surges
   • Clean power output for sensitive equipment

   Size UPS capacity based on connected load:

   Load calculation example:

   Router: 15W
   Switch (8-port PoE): 65W
   Access point x2: 25W (powered via PoE, included in switch)
   NAS/local server: 80W

   Total load: 160W

   UPS sizing:
   - Runtime target: 30 minutes (reliable power) or 120 minutes (unreliable)
   - 30-min runtime at 160W requires ~400VA UPS (80Wh battery)
   - 120-min runtime at 160W requires ~1500VA UPS (320Wh battery)

3. Connect network infrastructure to UPS output ports. Priority order for limited UPS capacity:

   • Router (maintains connectivity)
   • Switch (maintains local network)
   • Access points (maintains wireless)
   • Local server/NAS (if present)

   Workstations connect to standard mains power, not UPS. Users save work when power warning occurs.

4. Configure UPS monitoring. Connect the UPS to the router or a monitoring device via USB. Install monitoring software that:

   • Logs power events (outages, voltage excursions)
   • Sends alerts on battery operation
   • Triggers graceful shutdown when battery depletes

   # NUT (Network UPS Tools) configuration
   [fieldups]
     driver = usbhid-ups
     port = auto
     desc = "Field Office UPS"

   # /etc/nut/upsmon.conf
   MONITOR fieldups@localhost 1 admin password master
   SHUTDOWNCMD "/sbin/shutdown -h +0"
   POWERDOWNFLAG /etc/killpower

5. For sites with unreliable power requiring generator or solar backup, coordinate with logistics for generator installation or follow Solar and Off-Grid Power procedures. Configure automatic transfer switch (ATS) to switch between mains and backup power.

6. Label all power connections clearly. Create a power circuit diagram showing which devices connect to which circuits and UPS outlets.

Network Installation

Network installation creates the local network infrastructure connecting user devices to connectivity and organisational systems.

1. Install the network switch in the cabinet, connecting it to a UPS-protected power outlet. Connect the switch uplink port to the router’s LAN port using a Cat6 patch cable. Configure VLANs if the site requires network segmentation:

   # VLAN configuration (managed switch)

   VLAN 10 - Staff (10.45.10.0/24)
   VLAN 20 - Guest (10.45.20.0/24)
   VLAN 30 - Devices/IoT (10.45.30.0/24)

   Port assignments:
   Ports 1-4: VLAN 10 (staff wired connections)
   Ports 5-6: VLAN 10 tagged + VLAN 20 tagged (for APs)
   Port 7: VLAN 30 (printers, IoT)
   Port 8: Trunk to router (all VLANs tagged)

2. Install wireless access points at locations identified during site assessment. Ceiling mounting provides better coverage than wall or desk placement. Run Cat6 cable from the PoE switch to each AP location. Configure APs with organisational standard SSIDs:

   SSID: OrgName-Staff
   Security: WPA3-Enterprise (802.1X)
   VLAN: 10
   Authentication: RADIUS to HQ IdP

   SSID: OrgName-Guest
   Security: WPA3-Personal
   VLAN: 20
   Passphrase: <rotated quarterly>
   Isolation: Client isolation enabled
   Bandwidth limit: 5 Mbps per client

3. Test wireless coverage by walking the site with a device connected to the staff network. Signal strength should exceed -70 dBm in all work areas. Document dead spots and adjust AP placement or add APs as needed.

4. Run network cabling to fixed workstation locations. Terminate cables at wall plates or surface-mount boxes. Test each cable run using a cable tester to verify continuity and correct wiring (T568B standard). Label both ends of each cable with location identifier.

5. Configure network monitoring. The router or a dedicated monitoring agent reports connectivity status to central monitoring:

   # SNMP configuration for central monitoring

   /snmp community add name=monitoring addresses=10.0.0.0/8 read-access=yes
   /snmp set enabled=yes contact="it-ops@example.org" location="Lokichoggio"

6. Document the network configuration including IP addressing scheme, VLAN assignments, wireless configuration, and physical cable plant.

+---------------------------------------------------------------+
|                STANDARD FIELD SITE TOPOLOGY                   |
+---------------------------------------------------------------+
|                                                               |
|                         INTERNET                              |
|                            |                                  |
|              +-------------+-------------+                    |
|              |                           |                    |
|        +-----+-----+               +-----+-----+              |
|        | Primary   |               | Backup    |              |
|        | (Cellular)|               | (Starlink)|              |
|        +-----+-----+               +-----+-----+              |
|              |                           |                    |
|              +-------------+-------------+                    |
|                            |                                  |
|                     +------+------+                           |
|                     | Router      |                           |
|                     | 10.45.1.1   |                           |
|                     | VPN to HQ   |                           |
|                     +------+------+                           |
|                            |                                  |
|                     +------+------+                           |
|                     | PoE Switch  |                           |
|                     | 8-port      |                           |
|                     +------+------+                           |
|                            |                                  |
|       +-----------+--------+-----------+-----------+          |
|       |           |                    |           |          |
|  +----+----+ +----+----+          +----+----+ +----+----+     |
|  | AP      | | AP      |          | Printer | | NAS     |     |
|  | Office  | | Mtg     |          |         | | (opt)   |     |
|  | .45.2   | | .45.3   |          | .45.50  | | .45.60  |     |
|  +---------+ +---------+          +---------+ +---------+     |
|       |           |                                           |
|       v           v                                           |
|  +---------+ +---------+                                      |
|  | Staff   | | Guest   |                                      |
|  | Devices | | Devices |                                      |
|  | VLAN 10 | | VLAN 20 |                                      |
|  +---------+ +---------+                                      |
|                                                               |
+---------------------------------------------------------------+

Endpoint Deployment

Endpoint deployment prepares and installs user devices at the field site.

1. Prepare devices at headquarters or regional hub before shipping to field site. Pre-configuration reduces on-site time and ensures consistent setup:

   • Install operating system with latest patches
   • Join device to MDM/management platform
   • Install standard applications
   • Configure VPN client
   • Apply security baseline (encryption, firewall, antivirus)
   • Create local admin account for field IT support
   • Label device with asset tag and site identifier

2. Ship devices using tracked courier service with appropriate insurance. Pack devices in original packaging or protective cases. Include:

   • Power adapters (correct for destination country)
   • Peripheral devices (mouse, keyboard if required)
   • Network cables
   • Device documentation
   • Asset handover forms

3. On arrival at field site, verify device inventory against shipping manifest. Report any missing or damaged items immediately.

4. Position devices at designated workstation locations. Connect power and network (wired or verify wireless connectivity). Boot each device and verify:

   Deployment verification checklist:

   [ ] Device powers on normally
   [ ] Connects to staff wireless network
   [ ] Receives IP address via DHCP
   [ ] VPN connects to headquarters
   [ ] Can access internal applications
   [ ] Can access internet
   [ ] Prints to local printer
   [ ] MDM shows device as compliant

5. Configure device-specific settings for the user who will use it:

   • Set device name to standard format (e.g., LOK-PC-001)
   • Configure time zone
   • Connect to local printer
   • Set power management for local conditions (disable sleep on desktop devices)

6. Deploy shared devices (if applicable) following Shared Device Configuration procedures.

User Account Provisioning

Provision user accounts before staff arrive at the field site. Users should have working credentials on their first day.

1. Obtain the list of users deploying to the field site from HR, including:

   • Full name and preferred display name
   • Job title and department
   • Start date at field site
   • Manager name
   • Applications required for role

2. Create user accounts in the identity provider following User Onboarding procedures. Assign users to the field site group for appropriate access:

   Group membership for field site users:

   All field staff:
   - grp-field-lokichoggio (site-specific group)
   - grp-field-all (all field staff)

   Role-based additions:
   - Programme staff: grp-programme-delivery
   - Finance staff: grp-finance-users
   - Logistics staff: grp-logistics-users

3. Generate initial credentials. For organisations using single sign-on, users receive a temporary password and MFA enrollment link. Document credentials securely for handover:

   User credential record (for secure handover):

   Name: Jane Smith
   Username: jane.smith@example.org
   Temporary password: [generated, stored in password manager]
   MFA: Enrollment required on first login
   Account created: 2024-11-20
   First login deadline: 2024-12-01

4. Test account access by logging into a field site device with each new account. Verify access to required applications.

5. Prepare user welcome documentation including:

   • Login credentials (delivered securely)
   • MFA enrollment instructions
   • VPN usage guide (if connecting from personal devices)
   • IT support contact information
   • Acceptable use policy acknowledgment requirement

System Configuration and Testing

Complete system configuration integrates all components and verifies end-to-end functionality.

1. Configure local services that operate independently of headquarters connectivity:

   • Local DNS caching on router (reduces latency, provides resilience)
   • Local time server synchronisation
   • Printer sharing

2. Configure bandwidth management to ensure critical applications perform adequately on limited connectivity:

   # Traffic shaping configuration (Mikrotik example)

   # Create queues for traffic types
   /queue type add name=voip-queue kind=pcq pcq-rate=2M pcq-classifier=src-address
   /queue type add name=default-queue kind=pcq pcq-rate=1M pcq-classifier=src-address

   # Priority queues
   /queue tree add name=voip parent=global packet-mark=voip-traffic \
     queue=voip-queue priority=1
   /queue tree add name=business parent=global packet-mark=business-traffic \
     queue=default-queue priority=3
   /queue tree add name=default parent=global packet-mark=other-traffic \
     queue=default-queue priority=5

3. Test critical application workflows from field site devices:

   Application	Test scenario	Expected result
   Email	Send and receive message	Delivered within 5 minutes
   File storage	Upload 10MB file	Completes within 2 minutes
   Programme system	Create and save record	Saves without error
   Video conferencing	Join test call	Audio clear, video functional
   VPN	Connect from personal device	Connects within 30 seconds

4. Test failover scenarios:

   • Disconnect primary internet: traffic should route via backup within 60 seconds
   • Disconnect mains power: UPS should maintain network equipment
   • Disconnect VPN: internet access should continue, internal applications unavailable

5. Run load testing if multiple users will be present simultaneously. Connect the expected number of devices and verify acceptable performance under load.

6. Configure monitoring alerts for the field site:

   # Monitoring configuration example

   field_site_alerts:
     - name: connectivity_down
       condition: ping_loss > 90%
       duration: 5m
       severity: critical
       notify: it-ops@example.org

     - name: high_latency
       condition: ping_latency > 500ms
       duration: 15m
       severity: warning
       notify: it-ops@example.org

     - name: ups_on_battery
       condition: ups_status == "on_battery"
       duration: 1m
       severity: warning
       notify: site-manager@example.org

Documentation and Handover

Documentation captures the site configuration for ongoing support and future reference. Handover transfers operational responsibility to local staff.

1. Complete the site documentation package:

   Network documentation:

   • IP addressing scheme with all static assignments
   • VLAN configuration
   • Wireless SSIDs and security settings (passwords in password manager, not in document)
   • Physical cable plant diagram
   • Equipment inventory with serial numbers and asset tags

   Power documentation:

   • Circuit assignments
   • UPS configuration and runtime
   • Generator/solar details if applicable

   Connectivity documentation:

   • ISP/carrier details and account numbers
   • Support contact numbers
   • SIM card numbers and PINs
   • Bandwidth allocations and costs

2. Create the site runbook covering common operational tasks:

   ## Daily checks
   - Verify internet connectivity (check speed test)
   - Check UPS status indicator (green = normal)
   - Review any user-reported issues

   ## Weekly tasks
   - Restart router (Sunday evening)
   - Verify backup connectivity by switching to backup
   - Check for and install device updates

   ## Responding to issues

   ### Internet down
   1. Check router power and status lights
   2. Restart router (unplug, wait 30 seconds, reconnect)
   3. Check cellular signal on phone (same network)
   4. If still down, switch to backup connection manually
   5. Contact ISP support if primary remains down

   ### User cannot connect to wireless
   1. Verify wireless is enabled on device
   2. Confirm correct SSID selected
   3. Re-enter password (staff network: see password manager)
   4. Restart device
   5. Check if other devices can connect
   6. Restart access point if no devices can connect

3. Conduct handover training with designated local IT contact and site manager:

   • Tour of all IT equipment locations
   • Demonstration of basic troubleshooting
   • Review of runbook procedures
   • Explanation of support escalation path
   • Contact information exchange

4. Transfer access credentials:

   • Router admin credentials (stored in organisational password manager)
   • UPS monitoring access
   • ISP account portal access
   • Local admin account on devices (for designated support person only)

5. Complete handover sign-off documenting:

   • Date of handover
   • Name of person accepting responsibility
   • Confirmation of training completed
   • Outstanding issues or known limitations
   • Support arrangements

Ongoing Support Arrangements

Define support arrangements before completing the establishment project.

Support tiers:

Local support (site-based staff) handles:

• Basic troubleshooting (restart devices, check connections)
• User password resets via self-service portal
• Hardware swaps with shipped replacement equipment
• Coordination with ISP for connectivity issues

Central IT support handles:

• Remote configuration changes
• Account provisioning and access issues
• Security incidents
• Monitoring and alerting response
• Complex troubleshooting via remote access

Support channels:

Provide local staff with clear escalation paths:

Spare equipment:

Maintain minimum spare inventory at the field site:

• 1 spare laptop (configured, ready for deployment)
• 1 spare router (pre-configured for site)
• Power adapters for common device types
• Network cables (assorted lengths)
• Spare keyboard and mouse

Replenish spares when used. Include spare equipment requests in regular logistics shipments.

Verification

Confirm successful establishment by verifying:

1. All network equipment is operational (router, switch, access points showing normal status indicators).

2. Primary and backup connectivity both function and failover operates correctly:

   # Verify primary connectivity
   ping -c 5 8.8.8.8

   # Verify VPN connectivity
   ping -c 5 10.0.0.10  # HQ internal address

   # Failover test: disconnect primary, verify backup takes over
   # Reconnect primary, verify traffic returns to primary

3. All user accounts can authenticate and access required applications.

4. Wireless coverage meets requirements throughout work areas (signal strength greater than -70 dBm).

5. UPS maintains equipment during 5-minute simulated power outage.

6. Monitoring alerts reach central IT (trigger test alert and confirm receipt).

7. Local staff can perform basic troubleshooting tasks documented in runbook.

8. Documentation package is complete and accessible to support staff.

Troubleshooting

See also

• Field Office Rapid Deployment for emergency establishment requiring faster timelines
• Satellite Deployment for satellite connectivity installation procedures
• Solar and Off-Grid Power for sites requiring alternative power
• Field Hardware Selection for equipment specifications and selection criteria
• User Onboarding for standard user account provisioning
• Low-Bandwidth Optimisation for optimising performance on constrained connections
• Network Architecture for network design principles
• Field Security Hardening for security configuration requirements