School Network (Primary and Secondary Schools)

A school network (primary school, middle school, high school, or private school group) must support 200-2,000 students and 30-200 teachers, with strict filtering for child protection, ENT authentication, Wi-Fi coverage across all buildings, and GDPR-compliant security. 2026 school architecture guide.

School requirements

• Mandatory web filtering (PEDT, ENT): protection of minors
• Authentication: ENT (Pronote, Kaliweb, Educartable)
• Wi-Fi coverage: classrooms, specialized rooms (IT, laboratories), and schoolyard
• Tablets: 1:1 or 1:2 throughout the school (PNM — Digital Technology Plan)
• Budget: €30-200k excl. VAT, all-inclusive (often funded by the region/department)
• Maintenance: often no local IT staff; an MSP is essential

Typical primary school architecture (5 classrooms)

• 1× FortiGate 40F/60F + UTM Bundle: €1,800 excl. VAT
• 1× FortiSwitch-124E (24 PoE+ ports): €1,690 excl. VAT
• 5× FortiAP-231F (1 AP per classroom): €1,750 excl. VAT
• Educavox or Octopuce filtering + DNS content filtering
• Optional local caching server
• Total: ~€7,000 excl. VAT + FTTH

Middle/high school architecture

• 2× FortiGate 80F/100F in active-passive HA
• 4-8× FortiSwitch-148F-FPOE switches
• 20-40× FortiAP-231F or 431F (classrooms + schoolyard)
• Mandatory web filtering (Olfeo, Ucopia, Pronote Internet Access Control)
• Basic NAC: 802.1X with FortiAuthenticator or ENT integration
• Budget: €30-80k excl. VAT

Mandatory web filtering

School responsibility: block websites that are inappropriate for minors:

• Categories: pornography, violence, drugs, P2P, bandwidth-intensive gaming
• Allowlist: educational and ENT websites
• Products: Olfeo (French education market leader), Educavox, FortiGuard Web Filter, Cisco Umbrella
• GDPR: anonymized logs for minors; annual CNIL audit may be required

Segmentation

• VLAN 10: ADMIN (school leadership, administrative office)
• VLAN 20: TEACHERS (teacher laptops)
• VLAN 30: STUDENTS (tablets, computer workstations)
• VLAN 40: GUEST-WIFI (parents attending meetings)
• VLAN 50: PRINT (network printers)
• VLAN 60: CAM (security cameras)
• VLAN 99: MGMT

Wi-Fi: classrooms

• 1 AP per classroom (or 1 per 2 classrooms, depending on size)
• Density: 30 students × 2 devices = 60 clients per AP at peak load
• FortiAP-231F is generally sufficient (WiFi 6 2×2 1.7 Gbps)
• For 1:1 tablets in every classroom → FortiAP-234F (4×4)

Digital Learning Environment (ENT)

• Pronote Internet Access Control: filtering + student/teacher SSO
• Kaliweb / Educartable / OZE (primary schools)
• LDAP/SAML integration with Wi-Fi APs (automatic 802.1X)
• Access from home: SSL-VPN or ZTNA to internal resources

French regional programs

• ENSI (Digital School): Île-de-France
• Hauts-de-France Region: 1 tablet/student
• CD 78: 1:1 middle school deployment
• CD 91: 'One Tablet One Pupil'
• Funding: region/department + central government

Recurring issues

• Wi-Fi drops during lessons: insufficient AP capacity, interference from cafeteria microwave ovens
• Overly strict filtering: teachers cannot access educational YouTube content → an allowlist is required
• Saturation between 8:00 and 9:00 a.m. (300 students connecting simultaneously)
• School holidays: maintenance/upgrades must be completed during this period

Order from OPTINOC

Turnkey school network. FortiGate/FortiSwitch/FortiAP + Olfeo/FortiGuard filtering. ENT integration. Expertise in public-sector procurement for local authorities. Quote within 48 hours.