Frequently Asked Questions

Affinity Blue was founded by Simon Hayward and Neon Islam, who set out to make networking simpler, clearer and better value. We began as Aruba specialists and are now a full network and security managed services provider covering multiple vendors. We work with customers in education, healthcare, logistics, retail and hospitality, councils, and charities and not-for-profits.

Our ANZ head office is in Hawthorn East, Melbourne, with offices in Sydney and Brisbane and a warehouse in Nunawading. Your network is engineered in Australia and supported around the clock from our regional Managed Services Hub in Manila. Through our partner network we deliver projects across Australia and New Zealand. See all our offices.

Aruba is our foundation, with six certified engineers holding 20+ certifications between them, including two Certified ClearPass Experts (ACCX). We now also design, deploy and run Cato Networks SASE, a leading cloud platform that brings your site links, firewall, remote access and control of cloud and AI tools together. Cato works alongside your existing Aruba network, not instead of it.

We also hold certifications across Arista, Cisco, Fortinet, Palo Alto Networks and Juniper (where we’re an Elite Partner), and we can support requests for Cisco Meraki, Fortinet, Hamina, Ruckus and carriage managed services.

We follow four steps, from uncertainty to network confidence:

• Discover: we understand where you are now and where you’re going, assess the environment, risks and capability gaps, and clarify what is really needed beyond the initial brief.
• Challenge: we question assumptions, simplify, and recommend the right approach, not the easiest one to sell.
• Deliver: we design a practical, secure solution, deploy it to the agreed scope, then commission it on site and support the go-live.
• Support: we hand over with full documentation, then provide proactive monitoring, support and management to defined SLAs.

We provide turnkey delivery, covering survey, design, procurement, configuration, onsite installation, commissioning and post-sales support. More about how we work.

Every customer gets active monitoring and maintenance, monthly health checks with clear recommendations, Aruba Central maintenance and updates, and defined SLAs backed by a 24x7 help desk. You can then extend your coverage with optional, ITIL-aligned capabilities that match your priorities, such as uptime, preventing recurring issues, governance and smoother changes. We recommend only what your environment needs.

We can also provide customised reporting. Our dedicated Managed Services Division launched in 2025.

Yes. We’ve done this for a major Australian food manufacturer whose warehouses suffered constant Wi-Fi dropouts caused by a previous provider. We cleaned up the legacy issues, put in ongoing monitoring and troubleshooting, and took over their Aruba licensing and support, including Central and ClearPass. The result was a big jump in uptime and reliability.

Yes. We’re the wholesale partner of choice for professional and managed network services in ANZ. Our partner program lets us deliver services to your customers under your banner, doing as little or as much as you need. Good WiFi engineers are expensive and hard to find, so this lets you grow without hiring. See Partners & wholesale or email partners@affinityblue.com.au.

No. Cato brings site-to-site links, firewall, remote access and control of cloud and AI tools into one cloud platform. It works alongside your existing technology, including Aruba, not instead of it. Affinity Blue designs, deploys and runs it, so you keep the same engineers, monitoring and help desk, with one team, one console and one monthly bill. Cato was named a Leader in the 2026 Gartner^® Magic Quadrant^™ for SASE Platforms for the third year running.* Pete Fraser leads our secure networking practice. More on Cato below.

SASE (Secure Access Service Edge) delivers networking and security together from the cloud, instead of from separate boxes at each site. Staff, apps and data are now spread across offices, homes and cloud services, so security needs to follow them rather than sit only at head office. SSE is the security half of SASE (the protection of web, cloud and remote access).

Cato brings the links between your sites, your firewall, remote access, and control of the cloud and AI tools your team uses into one cloud platform. It was named a Leader in the 2026 Gartner^® Magic Quadrant^™ for SASE Platforms for the third year running.* We chose it because it fits how we already work: we design, deploy and run it the same way we run your network today, and our team holds Cato certifications.

No. Cato works alongside the technology you already have, including Aruba. The network we designed and run for you, your support, monitoring and help desk, and the engineers who know your sites all stay as they are. Cato is the security and connectivity layer that sits beyond your network.

Firewalls and VPNs each come up for refresh on their own cycle, and Cato replaces those boxes rather than having you buy them again. The result is fewer appliances to buy, refresh and support, and the same firewall, web security and data protection everywhere your people work.

Cato applies the same security wherever people work, whether at home, on the road, in the office or at a new site. This gives safe remote access without a traditional VPN, and the same protection for cloud apps like Microsoft 365 and other SaaS.

Yes. Insurers, boards and major customers are asking who has access to what, and which AI tools are in use. Cato shows you which AI tools your team uses and lets you control them, including what data goes into them.

Affinity Blue designs, deploys and runs it. You get one team, one console and one monthly bill. Our secure networking practice is led by Pete Fraser, who has 20 years in cyber security, including senior roles at WatchGuard and CrowdStrike. To get started you can:

• Join our online session, “One network, secured”, with Simon Hayward and Pete Fraser: Tuesday 10 November, 10:30–11:30 AEDT, on Microsoft Teams.
• Book an AI security discussion at your office or on a call. If it’s worth going further, our engineers run a free network and security health check with a one-page report.
• Call 1300 22 33 46 or email info@affinityblue.com.au.

A survey is like a house plan before you build. It shows how many access points you need, where they go and how they should be configured. We can do an offplan (simulated) survey for new builds or an onsite survey for existing networks, using Ekahau. The survey looks at how RF signals behave in your building, what it is made of, the layout of fixtures and fittings, and possible sources of interference.

Because it’s a significant paid engagement, you receive a detailed report with recommendations, simulated performance visuals and a Bill of Materials. You can use that report for tendering or governance requirements.

We can complete an offplan (simulated) wireless survey or an onsite survey. Offplan surveys are typically used when designing a new wireless network from the ground up, either for an existing building or a building that has yet to commence construction. An onsite survey considers existing equipment and site influences such as interference and is commonly used when analysing an existing network for troubleshooting purposes or reviewing expansions and upgrades.

WiFi is becoming the primary connection for businesses, and you need to ensure it is optimised and running at peak efficiency to avoid performance issues. If your network is congested, it is performing beyond its intended design. Latency will likely be an issue that results in pack loss & delays, a significant drop in throughput, session loss and jitter, impacting voice and video operations. It may not be the whole network causing an issue, and it could be limited to certain areas. The root cause could be a faulty access point, incorrect configuration, density issue, incorrect power settings resulting in ‘sticky clients’, channel interference or even noise interference of external factors. All of these can negatively impact your WiFi, resulting in unacceptable performance.

A wireless survey of your facility can spotlight any areas of concern. A detailed report will highlight areas needing improvement and the associated recommendations and optimisation techniques.

A wireless survey considers the building layout, environment, attenuation loss and access point performance.  

Different access points perform differently.  Antenna patterns vary.  Some building materials absorb more signals than others. You may have a source of local interference and need particular channels excluded. You may have a harsh environment and need coverage in areas not within spec of access points. 

A wireless survey factually considers all these items and allows us to produce a network design that will meet your business requirements.

The offplan survey process is quite simple. Firstly, we need you to provide us with accurate floor plans that are scaled and include accurate measurements. From there, we upload the maps into our survey tool, Ekahau, and ‘draw’ on attenuation loss rates for walls, fixtures, fittings, ceiling heights and so forth. 

Next, our certified wireless engineers begin placing access points on the maps, and from the attenuation metrics, we can see the coverage, signal strength, SNR and date rates. We repeat the process until the facility is covered in suitable WiFi coverage. 

An onsite survey follows a similar approach, but the attenuation losses are based on actuals, not estimates, determined by completing a spectrum analysis.  Additionally, site noise (interference) is analysed and factored into the design.

The results of a wireless survey are presented in a detailed report that makes extensive use of visual representations of wireless performance throughout. Technical information is included about current wireless performance, coverage and SNR. A list of recommendations regarding repositioning access points, remove/addition of access points and changes to the configuration is included. A series of simulated visual representations are also included to demonstrate how the network would perform if our recommendations we implemented. The report concludes with a Bill of Materials for any proposed equipment changes and a conclusion of the analysis.

Yes. Before completing any wireless design, we need to know your business use case and requirements. Video and voice applications require a low latency wireless network to avoid the jitters. If you also need location services, we need to factor in triangulation, or If you need public wifi, we need to factor in density. There are many possible use cases to consider when designing a wireless network with video and voice applications in mind.

The consideration here is the type of access point we are allowed to use. If you had areas requiring intrinsically safe equipment, we would need to use a specific type of access point which holds all the relevant certifications. We need to know all pertinent information to ensure that the equipment we propose is suitable for hazardous areas.

We deploy 802.1x network access control, typically with Aruba ClearPass. It ensures only authorised devices and users get access, with a role limiting what each can reach. ClearPass dynamically profiles IoT devices and segments them automatically.

It also provides captive-portal guest access (with sponsor approval) and self-service BYOD onboarding using unique certificates, so access can be revoked quickly. It integrates with dozens of non-Aruba products. Done correctly by an experienced provider, it’s the gold standard of network authentication.

From a high level, 802.1x (or Network Access Control) is the process of introducing an additional level of authentication for network devices known as AAA authentication. Network devices need to have a valid certificate installed before being granted any access to the network. Additionally, based on that device, a role will be assigned to it, limiting access accordingly.  

802.1x ensures the device is authorised, only has access to specific resources, and that the user is authenticated. 

802.1x is the gold standard of network authentication security, and organisations with the highest security requirements use it for their wired and wireless networks.

A key to deploying 802.1x in your organisation is ensuring it is done correctly by an experienced, qualified solutions provider. If 802.1x is not deployed correctly, you can be left vulnerable or in a worse position than before having it.

Virtually, they are the same. You don’t need to have it on both networks if you don’t want to. Most companies tend to start their 802.1x implementation on one network then expand into other networks later.

Most 802.1x solutions have some degree of integration with other security solutions. Clearpass, for example, integrates with dozens of non-Aruba products and solutions, including but not limited to Cisco, Palo Alto, Juniper, AirWatch, SOTI, Fortinet, IBM, Aplunk, McAfee, ArcSight, F5, MaaS360, SAP and MobileIron.

Integrating Clearpass with other vendors in your network allows you to use it to its full potential.

Most customers are shocked when we install 802.1x solutions like Clearpass and see what devices are actually on their network. Leading 802.1x solutions dynamically profile devices and assign predefined access policies to those devices.

Once a device is profiled, that device would be appropriately segmented. The switch port it is connected to would automatically have a VLAN or ACL applied to it to restrict access to what is required. It won’t have the same access as a phone or notebook.

Leading 802.1x solutions, such as Clearpass, have this covered. Clearpass comes with Guest and BYOD capabilities.

For guest access, a captive portal is used. Guests can connect to the network via wired or wireless and be directed to a portal to register for guest access. Options are numerous, but most commonly, the guest user needs to nominate a ‘sponsor’ who can authorise temporary guest access for the short term.

BYOD functionality comes with Clearpass, allowing self-service onboarding of devices via unique certificates. This allows prompt revoking of access to any devices as required.

In short, guest and BYOD access will continue to operate as expected and be enhanced with a system like Clearpass.

Device Insight provides you with the visibility of all devices on the network. From there, you can efficiently run a visual check to ensure no devices have been compromised and only authorised devices have access.

Addition functionality exists where, prior to being granted corporate access, a series of checks can be completed against the device. Hotfixes and antivirus definitions, for example, can be checked before access is granted.

Through these key functionality items, you can ensure your network and its devices (Windows, Mac, Linux and IoT) are secure, and access is authorised.

SD-WAN is a way of delivering secure connectivity to remote/branch offices using a combination of hardware, software and cloud‐based services compared to the traditional MPLS based network.

MPLS is a connection type based on a centralised model. All your remote and branch offices come back to a central point (typically HQ). Before cloud services became mainstream, this was a perfect fit. It provided fast connections across the enterprise and multiple branches. MPLS does, however, have limitations in today’s environment. With more and more remote workers, mobile devices and cloud-based applications, MPLS networks can struggle to suit modern-day requirements and network topology.  

With cloud service becoming mainstream, not all data from your remote offices need to come back to HQ, and some can be directed straight to the internet directly from that branch office.  

SD-WAN as a concept identifies which traffic needs to go to HQ and which traffic can go straight to the internet. Through multiple consumer-grade links, costs can be reduced, bandwidth requirements are lowered, and businesses can enjoy zero-touch provisioning to bring them up and running in hours, not months.

Not necessarily. It comes down to your unique business requirements. If your company no longer needs low latency direct links between HQ and branch offices, then yes, it is highly probable we can remove your MPLS link and replace it with an SD-WAN solution. Utilising multiple consumer-grade links can provide far higher bandwidth, more download quotes, and redundancy.  

If you need a direct low latency connection, SD-WAN can work with your MPLS network. It is highly probable via its intelligent routing that your MPLS link speeds can be reduced and a second connection (such as consumer-grade ADSL/NDN/4G/5G/etc) be introduced.  Only data destined for HQ can travel over the MPLS network, and everything else can go direct to the internet.

No. SD-WAN can make use of your existing carrier. SD-WAN brings options to your business with the ability to have a mix of carriers and technologies all seamlessly working together. SD-WAN is built for modern, fast-moving and dynamic networks.

Absolutely! SD-WAN gives you more control and visibility of your business network. It allows you to accurately determine what infrastructure is needed, where it is required and provides you with the ability to deliver it rapidly.

SD-WAN allows you to combine multiple consumer-grade services to provide higher speeds, stronger performance and a modernised network topology your business can benefit from. All for a far lower cost than traditional MPLS.

Yes. SD-WAN providers use high-level encryption to secure all network traffic. Each provider does it a little differently, but all enterprise SD-WAN providers have a secure and mature solution.

Your security will not be compromised by using an SD-WAN solution.

Yes, SD-WAN can be self-managed without needing to go through your carrier or provider. One of SD-WAN’s best features is the management portals. Each vendor has a different portal, but all the leading providers have easy to use platforms that can be integrated with your existing WAN solutions.

Some vendors couple their management platforms with their wireless and switching platforms to have a single cloud-based platform for their entire network infrastructure.

SD-WAN uses multiple connectivity options from multiple providers to deliver a resilient and redundant network. You can have a combination of all the connection types from multiple providers.  

If one provider was to have an issue, your SD-WAN will automatically failover to another connection to provide you with uninterrupted service. LTE connections provide great redundancy for physical cabling issues, and SD-WAN can use such connections in tandem with the traditional services delivered over cable.

So through multiple connections from multiple providers, SD-WAN as a solution provides high‐performance connectivity to your corporate network and cloud services.