Clients

2024 Q2

• Joe Lewis Greenway City of Detroit  Implemented Wireless/Cameras/Phones and Monitoring for the City of Detroit’s 26+ mile Joe Lewis Greenway Walking and Biking Trail. Groundwork0 worked with the City to configure a wireless/phone/camera system along this trail. We designed, configured and implemented Access Points to provide Free WiFi, Axis Cameras (being monitored at Public Safety Headquarters, Emergency Phones (direct line to Public Safety, when called the person answering the call will have the phones location and all local video feeds provided automatically) and industrialized switches implementing Ethernet Ring Protection Switching (ITU G.8032) for redundancy.

• Redundant ISP Implementation  We worked with a large customer to add Comcast Internet services to existing ATT services for redundancy/performance. Groundwork0 worked with the customer to implement a load sharing strategy for outbound traffic so that both ISPs would be used simultaneously. In the event of failure of one ISP, traffic would fail over to the surviving connection within 5 seconds of initial failure. We also worked closely with Comcast and ATT engineers to implement BGP peering to provide redundant paths for the customers private IP address space. DMZ/Inbound traffic primarily utilized ATT, when simulating failure BGP would converge and traffic would be restored to the Comcast connection within 2 minutes.

2024 Q1

• Groundwork0 recently undertook a network design project for a brand-new bar and restaurant located in the heart of Downtown Detroit. The establishment’s requirements posed several challenges, including accommodating a high volume of customers, numerous endpoints, and a range of audio-visual equipment. Our team meticulously crafted a solution that not only met these demands but also ensured seamless connectivity and efficient management.

• The three-story bar and restaurant requested a network robust enough to handle a large crowd, staff devices, and various AV components. Additionally, remote management capabilities were essential for future scalability and adaptability. Key design elements included deploying a Fortigate firewall for security, implementing proper IP scheming and VLAN structure (with separate networks for guests, internal use, and AV equipment), Ubiquiti layer 2 switch implementation, and strategic placement of Ubiquiti AC Enterprise access points, eliminating any dead zones in the building. Another local vendor integrated the Wavecast application for assisted listening which worked alongside our guest network. This allowed patrons to download the Wavecast app, connect to the guest wireless network, and locally access audio streams from nearby TVs using their own headphones. We assisted with the integration of TOAST, a popular payment platform. Customers can now easily make payments using their device or smartphone from anywhere in the building, utilizing the network.

• A public safety customer needed a VLAN extended between VPN sites for Layer 2 communication.  GroundWork0 implemented a VXLAN transport overlay between eight locations and the hub location. This transport network included P2P VPN communication between sites (L3) and VXLAN for L2 communication between sites. We configured a single L3 network spanning a total of nine locations utilizing IPSEC (encryption) and VXLAN (L2 Virtualization over L3 networks).

• A public transport requested we implement a private network that allowed real-time communication with their busses and a central server. GroundWork0 worked with the carrier to implement a private wireless network that provided connectivity between busses and their route server (located onsite). Not only did this provide dispatch with real-time bus location but we also implemented an AP in each bus so passengers would have a public Internet.

• A customer had a redundant network that consisted of six core switches. Two for Building Distribution; each of the 24 remote IDFs are dual homed to these Building Distribution cores for physical redundancy and each VLAN is defined with VRRP for L3 redundancy. Two Cores functioned as Data Center Cores that contained 10Gig connections for Server Farms; again, all devices dual homed (LACP/NNI) and we utilized VRRP for L3 redundancy. The final two cores were WAN cores; Firewalls and outside connections all dual homed to both WAN A and WAN B. The primary cores were soon to be end of support and the customer wanted to upgrade to a hardware platform that supported 100Gig backbone/Server connections. Groundwork0 designed a 72 part migration plan that phased out and replaced every one of these six individual backbone switches. This plan allowed for the cut to this completely new backbone with NO interruption to customer daily operation. We would duplicate a core config, disable the old hardware, connect the new and verify NNI/MLT/VRRP operation/redundancy. We replaced all these core switches with no loss of Contivity (Security, VoIP, Data, etc…). Due to the routing configuration for this specific network we failed over Internet access to our backup link for uninterrupted Internet access while performing the WAN A/B hardware replacements.

2023 Q1

• EoL Edge Replacement for Enterprise Customer: A customer with over 100 remote sites connected by carrier leased circuits utilized Extreme Switches as core routers at those locations.  The main routing engine (Extreme VSP) at the core of each location was coming to End of Life.  Groundwork0 preconfigured the replacement switches, racked them in parallel with the existing unit and flash cut over 100 locations to the new hardware. The majority of these locations were critical to Public Safety daily operation so downtime was to be avoided at all costs.  Each site had multiple MDF’s, cameras, servers and utilized VoIP technology. Groundwork0 worked with the customer to schedule equipment swaps at the most convenient time with the least impact to the customer. The average downtime for each location was < 5 minutes.

• Firewall: A large utility customer in Michigan wished to make a secure partner connection from its core Firewall to a local partner. Groundwork0 worked with the customers Security Team to develop secure policies limiting access to only specified devices/applications. Due to the criticality of this connection we also implemented a VPN backup so if the primary connection failed the backup VPN connection would become providing immediate application access.

• Implemented redundant fabric (SPB) over public Internet. Customer had a failure of both ATT primary and ATT secondary circuits. Groundwork0 installed and configured a VSP XA1440 that extended the Customer Fabric over the Internet and to both primary and secondary data centers. While ATT restored service, this served as a capable backup.

• Implemented secure network authentication system for a large customer. Configured Network Policy Server and switch/router/firewall infrastructure to authenticate CLI/Web access against local AD user group. Created read-only and read-write groups to limit access according to group. This system included redundant NPS servers for redundancy.

• Consulted with a large municipality on WAN redundancy/DR options. Customer wanted recommendations on options in the event of primary ATT WAN circuit failure. We provided the customer with wireless, provider (ATT/Verizon) and VPN (Comcast, Wide Open West) options. We ended up implementing a VPN backup over Comcast. This system utilized cost based routing so in the event of primary circuit failure traffic would fail over to the VPN with no user intervention (tests showed failover in ~10 seconds). This solution only required the purchase of one piece of hardware (they already had a Comcast connection).

• Network Documentation/Best Practices Audit – A large municipal network requested Groundwork0 to perform an audit of their existing network that included security, best practices and documentation.  We identified several misconfigured switches, switches with no security, and overhauled the network documentation from scratch.

• Migrated a large county municipality from an old obsolete wireless network to a new state of the art Extreme Wireless network including complete documentation of over 350 access points installation locations.

• Configured a beta public park wireless network for a large city municipality to provide underserved citizens with public wireless along with special events.

• VPN: A local sheriff’s department wanted to automate the programming and updates of their (300+) Motorola radios. In the past they would have to go to a specific location to have the unit updated.  Groundwork0 deployed wireless access points across the County at 10 locations where the radios where most prevalent. We connected all 10 of these locations via private VPN network which allows for a single point of management and a single avenue into the secure State Radio Network (via private VPN to MSP in one location). This network saved the County hundreds of hours annually of labor (officers no longer had to drive for their radio updates).

• NAC: Groundwork0 began implementation and testing of a NAC solution for a local County. Working with County IT staff we deployed, installed and did the initial configuration of an Extreme NAC appliance. We worked with County staff defining and testing specific policies for device groups (printers, phones, cameras, authorized PC’s, etc). We deployed Certificates on County’s AD authorized PC’s and configured local switches to utilize 802.1x to verify end station Certificates. Depending on end station identification we could apply filters, VLAN assignment, and various security policies to devices being added to the network.

• Worked with a City to implement Azure Cloud Based MFA (Multi Factor Authentication) for VPN access. Due to Covid as much as 60% of the workforce was working offsite. GW0 implemented a training plan and implementation schedule for the MFA rollout. Worked with the help desk to assist with setup, implementation and end user support. This greatly increased the security of the network and saved the City thousands in insurance fees.

• Implemented redundant connections for a medical provider.  Customer had traditional ATT circuits for communication between sites.  Groundwork0 implemented a Firewall/VPN at each location and connected to a local ISP for Internet service. We configured the network to automatically failover to the VPN connection when the ATT ASE circuit went down.

• Setup a dual-homed connection for the Water Department to Oracle Cloud. We configured the primary connection to advertise the Oracle routes as a /16 network and the secondary connection to advertise as a /15 (less specific). When the primary connection failed traffic would resume over the secondary connection in less than 2 seconds. This project involved route redistribution and policy maps to avoid routing loops.

• Groundwork0 engineers worked closely with a city to re-route multiple sub-optimal network daisy chain connections to provide improved network reliability and reduced data segment congestion. With these improvements, network availability and performance has significantly increased due to LAN segments now being independent of one another and taking optimal layer 2 paths.

• Deployed a remote access solution that would allow Public Safety Officers to securely access recorded voice and radio communications related to 911. Groundwork0 implemented a VPN solution/Firewall solution that would allow PS Officers secure access to the NICE recording system. Groundwork0 implemented, tested and trained the customer’s staff on the use and operation of this system.

• Implemented redundant paths to Oracle Cloud. Our Engineers implemented a secondary VPN connection to the Oracle Cloud for additional performance and redundancy. We implemented a primary and secondary connection both using SR/OSPF for routing. We utilized route maps/filters to avoid issues with asynchronous and out-of-sequence routing.

• Implemented a Palo Alto FW solution for a networking company in Detroit. Customer required a complete security solution that included remote access with AD authentication, content filtering, and virus protection. This solution included deep-packet inspection that moved beyond traditional port/protocol inspection and blocking; we implemented application-level inspection, intrusion prevention and implemented protections against a variety of attacks.

• Emergency upgrades of VMware platforms at multiple clients with zero downtime or interruption in service.

• Replaced large county Metropolitan Area Network that consisted of 10Gig links between six hub sites in a large ring format (spanning tree for redundancy). We replaced this design with a new Extreme VSP backbone with all core switches dual homed to the primary and secondary data centers. New design provided redundancy at L1/L2 (sub second failover in SPB v. 60 seconds utilizing STP), L3 (implemented VRRP and ISIS routing protocol). This new design also provided significant improvements in performance (dedicated 40Gig for each location v. 10Gig shared between them all).

• Implemented dual factor authentication for VPN authentication for a number of customers. We worked with the customer, testing and deploying the new procedures/policy. Customer saved hundreds of thousands in insurance charges by implementing this simple security procedure for its remote access customers.

• Custom notification system. Customer wanted to have custom alerts associated with their Solarwinds network management platform. GW0 created custom alerts for high temperature, UPS battery status, and generator operating status (an alert was sent out whenever the generator was activated).

• Implemented a remote access solution for a Sheriff’s Department. Sheriff wanted to be able to share local online interviews with authorized personnel. We implemented a remote access solution (authenticated by AD) that allowed remote users to access these archived interviews.

• Saved local municipality thousands of dollars a month by managing their ATT ASE OnDemand network and fine tuning speeds.

• Move customer from cable to fiber to allow for online streaming of events.

• Deployed Motorola Radio Programming SSID for multiple clients to allow for over the air radio updates.

• Developed and deployed Windows-based RDP/Thin-client remote work solution.

• Stood up two vaccination site networks in less than 12 hours.

• Immediately remedy FortiNet vulnerabilities as found by CISA for multiple clients.

• Project managed and replaced over 130+ sites from ASE Classic to ASE OnDemand for customer to have more control over VLANs and circuit speeds and overhaul routing.

• Replaced and configured customers critical public safety communications switch in less than one hour after notification that site was down.

• Police InCar Video Precinct access point refresh.

• Installed indoor WiFi to over a dozen precincts.

• Set up of multiple COVID testing centers with wireless Internet.

• Firewall consolidation project. Moved interfaces/policies off an outdated Firewall and moved them to our NAT FW.

• Designed, configured, and installed network for 30+ satellite election locations for wireless and security encompassing early in-person absentee voting and ballot drop boxes consisting of cellular and wired internet.

• Overhauled 36 firehouse networks including wireless, routing, drops, and phones across large municipality.

• Designed new network for field cameras and equipment that separated data from the rest of the customers network based on Extreme virtual routing and FortiGate firewall filtering.

• Redesigned/deployed backup solution for large healthcare customer.

• Configured user-based web filtering for large healthcare customer.

• Network Documentation/Best Practices Audit – A large municipal network requested Groundwork0 to perform an audit of their existing network that included security, best practices and documentation. We identified several misconfigured switches, switches with no security, and overhauled the network documentation.

• Network Management: Created custom notifications (page/email) for customer who wanted notification of when one of their UPS’s went on battery. We also created reports including battery health, run time averages, and power forecasts.

• Deployed a 16 AP solution designed for a classroom environment including 70 new tablets/devices on the network. We limited user traffic, increased performance for instructor projectors and planned for growth (in capacity and client density).

• Installed a Cisco wireless solution to provide coverage for a COVID-19 testing center for a large municipality.

• Migrated a customer’s backend from a hosted mail solution to Office 365. This included migrating user mailboxes in conjunction with Rackspace and shifting users data to O365. All users now have easy access to their mail and Office apps from wherever they need to work.

• Worked with current customer to evaluate existing shares and migrate their entire system to the cloud using Sharepoint and OneDrive. Users now have access to their critical files as if they were on the local network, enabling VPN-less work from home.

• Deployed a WAN load balancing ISP solution to figure skating club for use streaming events where higher upload speeds was not an option.

• Designed a completely redundant core network solution for large expo hall to prevent outages.

• Migrated essential (non-dispatch) personnel to work from home. Groundwork0 worked with the customer to deploy an MFA solution leveraging our new partnership with DUO Security to secure their remote desktop sessions.

• Replaced single firewall with new HA FortiGates, audited configuration, make recommendations on clean-up.

• Assist customer in finding root cause of VRRP issues on the network.

• Help customer solve a routing issue with their network vendor in establishing switch/UPS management networks.

• Install 23 IDF fiber runs for a large warehouse facility.

• Install 500+ network drops for a large office building rehab.

• Created DR in a box! Setup and tested a new SPB node for client that allows immediate deployment of all applications/VLAN’s accross public medium (Cable modem, wifi hotspot, etc.).

• Created custom Solarwinds monitor to notify SQL Applications team when SQLServer/SQLClient processes were unloaded/stopped.

• Implemented NAC via. 802.1x authentication for switches located in ‘public’ places. This ensured that authorized clients were put in the customer secure VLAN, non-authorized clients were put in a ‘public’ VLAN with no access to local secured resources.

• Planned implemented and trained customer on new phone system.

• Continued fiber network build out for client bringing four new sites online connecting to headend with 10G optics.

• Consulted on temporary WiFi deployment for major outdoor events on the riverfront. Proposed network will provide public and private internet service to vendors and attendees for two weeks.

• Migrated web and email domains to new names with zero interruption in service for the customer. (TCF Center).

• Turned up BGP with multiple ISP to propagate public IP Addresses to the internet and add provide redundancy of publicly accessible systems.

• Revamped network and server alerting to alert specific groups of people on outages and service interruptions.

• Planned and executed an email migration from Groupwise to Office 365, including reconciling the two user account bases into one Azure-AD implementation. For 10,000 user accounts.

• Enabled 2-Factor authentication for VPN access.

• Enabled 2-Factor authentication for firewall management.

• Designed and deployed a network and VPN in a box solution for building outages and emergency turn-ups.

• Deployed 40+ access points for large municipality maintenance facility to provide updates to smart busses.

• Supported local ice arena for national championship figure skating.

• Installed outdoor Extreme access points to provide public WiFi at Rosa Parks bus station. 

• Designed and implemented 10Gig redundant backbone between primary and secondary data centers.  

• Implemented vendor VPN and security policies for sharing applications/data between government agencies. This included but was not limited to real-time video, security access and public Internet. 

• Moving and granting access to various AD-enabled resources such as printers, file servers, and application servers.

• Implemented a large-scale wireless solution that included AD authentication, guest wireless and micro segmentation.

• Rebuilding the Wide Area Networking to support a multi-site Active Directory design.

• Rebuilding the DNS environments for both organizations to facilitate the migration.

• Redesigning Active Directory structure and Group Policy to reflect the needs to both organizations residing under one parent.

• Setup multiple VPN’s between customer servers and networks to resolve PCI compliance issues. 

• Replaced over 100 Access points in 14-story building. Configured and tested new system and provided customer with heat maps to document signal strength.  

• Designed/Implemented CAD Dispatch virtual environment for healthcare provider.

• Performed trouble shooting & diagnostics for Polycom video arraignment system for local Courthouse.

• Documented/Labeled private fiber network multiple WAN locations.

• Cleaned up active directory to eliminate invalid email addresses in advance of a Azure implementation.

• Help to price install & test new ISP circuits for multiple sites throughout organization.

• Created sandbox test environment to preview capabilities & best configuration options in advance of firmware upgrade core enterprise switches.

• Designed new WAN solution for local healthcare provider.

• Designed/Implemented 75 seat VoIP phone system for local manufacturing company.

• Designed/Implemented CAD Dispatch virtual environment for healthcare provider.

• Installed Cradlepoint modem cellular VPN solution for a customer that was working out of a construction trailer at a remote construction site. Leasing a temporary circuit was not an option in this situation & our Cellular modem was a perfect alternative. 

• Designed/Implemented new network monitoring/management platform for local manufacturing company.

• Expanded/Upgraded a Cisco wireless solution for a local manufacturing company.

• Migrated JunOS firewall to a Fortigate solution. This new firewall implemented remote access (VPN Services), content filtering, application control & site-to-site VPN’s.

• Installed Cradlepoint modem to provide cellular WiFi for a customer that was working out of a construction trailer at a remote construction site. Leasing a temporary circuit was not an option in this situation & our Cellular modem was a perfect alternative. 

• Replaced 15+ handset legacy phone system with new Avaya  IP Office Cloud phone system at a local ice skating/training facility.

• Installed over 60 Axis 1080p HD cameras, for 11 new Project Green Light Customers, throughout the City of Detroit.

• Designed, tested & implemented test bed for 802.1x NAS solution for a local County. This included certificate based authentication, VLAN assignment depending on credentials. Devices that failed authentication would be isolated to a ‘vendor’ VLAN with no access to County resources (Internet only).

• Migrated JunOS firewall to a Fortigate solution. This new firewall implemented remote access (VPN Services), content filtering, application control & site-to-site VPN’s.

• Replaced 15+ handset legacy phone system with new Avaya IP Office Cloud phone system at a local ice skating/training facility.

• Installed over 60 Axis 1080p HD cameras, for 11 new Project Green Light Customers, throughout the City of Detroit.

• Installed over 50 Avaya access points at recreation centers throughout City to allow free WiFi access to citizens that use the centers.

• Consulted/Installed over 50 new Extreme switches throughout at multiple locations throughout City. The new Extreme switches replaced & existing Cisco infrastructure. 

• Installed/Configured managed SolarWinds monitoring & alerting for network & server equipment at local exhibition hall (NPM, Netflow & Configuration Manager).

• Designed/Installed QNAP NAS server to backup surveillance video for a local police department.

• Installed/Configured new domain controller including active directory, file, & print server for local ice skating facility.

• Complete network overhaul for Local Manufacturing Co. Replaced the seven year old core switch with Extreme solution. This added redundancy (MLT, VRRP, SPB & dual run IDF’s) & performance (10Gig). We also replaced the old Motorola wireless solution with a Cisco Wireless solution. Configured Solarwinds for network monitoring & capacity planning.

• Designed, tested, & implemented test bed for 802.1x NAS solution for Washtenaw County. This included certificate-based authentication, VLAN assignment depending on credentials. Devices that failed authentication would be isolated to a ‘vendor’ VLAN with no access to Washtenaw resources (Internet only).