Network Management · San Francisco & Bay Area
We manage the network your business runs on: firewalls, switches, Wi-Fi, internet links and VPNs. Monitored by automated systems, with a senior engineer responding Monday to Friday, 8 AM to 5 PM Pacific. Settings backed up, firmware tracked, everything written down. From $695 per site per month. Network only, so it works alongside your IT team or general MSP instead of replacing them. Not sure what you have? Start with a Network Risk Assessment, fixed price from $3,500.
What Network Management Covers
“Network management”, also sold as managed network services, means different things to different providers. Here is exactly what is in scope with us, and what is not.
The firewall is the box between your office and the internet that decides what gets in and out. We handle its rule changes, remote-access users, the encrypted tunnels between your offices (site-to-site VPNs), firmware planning, security subscriptions and licensing renewals. FortiGate first; we also take over Cisco, Meraki, SonicWall and others.
Port and VLAN changes (VLANs are separate lanes, so a problem in one stays contained), PoE budget (the ports that power phones, cameras and access points), uplink health, loop and error detection. Guest, staff, voice and device traffic kept apart.
Access point health, client counts, channel and power settings, SSIDs and guest access. Coverage problems traced to a cause, not answered with another extender. New space or a refresh: Wi-Fi site survey and design.
Latency, packet loss and speed tracked over time, so when the carrier is the problem you have the evidence to open the ticket. Failover between providers where you have two.
Not in scope: help desk, laptops and printers, Microsoft 365 or Google Workspace, phones and servers. If you need those, keep your IT provider for them; we handle the network underneath.
What You Get Every Month
“Proactive management” is a phrase, not a deliverable. These are the specific things that show up for a managed site.
Every managed device and link watched by automated checks, with alerts tuned to your normal so they mean something. A senior engineer acts on them Mon–Fri, 8 AM–5 PM Pacific. Details on our network monitoring page.
Firewall and switch configs backed up automatically with every change kept, so a bad change or a dead device is a restore, not a rebuild from memory.
A maintained map of sites, devices and links, updated when the network changes. The document a new hire, auditor or insurer will ask for.
A plain-English report: uptime against target, internet performance, anything that changed, anything that needs a decision, and what we are watching next month.
Routine work: a new VLAN, a VPN user, a firewall rule, a new access point. Secure, Compliance and Multi-Site include 1, 2 or 3 hours of it a month. On Essential, changes bill at $225 an hour with a 30-minute minimum, so a small change is billed as a small change.
Firmware versions and support status are tracked. For FortiGates listed under Firmware Care (included on Secure, Compliance and Multi-Site; a $125 monthly add-on per site on Essential), we work to target timelines for Fortinet security fixes and include up to four planned upgrade windows per site a year. Targets, prerequisites, exclusions and recovery charges are on the plans page and in your service agreement, which governs. Switch and access point upgrades are quoted per window. You get a heads-up, once the manufacturer publishes the dates, before hardware or licenses reach end of support (the point where the vendor stops fixing security holes), with reference list prices so you can budget and a replacement quoted by part number.
See It
These are real screenshots from the monitoring portal of a Northern California office we manage, covering 7 days, with the client’s name changed and addresses masked. Every managed plan comes with the same portal, so a San Francisco office sees its own network the same way.
Pricing
None of the San Francisco network management providers we looked at publish a price. We do. Response windows and business hours for each plan are set out in your agreement and on the services page.
Up to 10 managed devices. No change hours included; changes bill at $225/hr with a 30-minute minimum. The fit for a single office that needs the network to just work.
Up to 20 devices, 1 hour of changes a month, faster response. For offices where the network is security-sensitive or busy.
Up to 30 devices, 2 hours of changes a month, with the evidence and reviews HIPAA, PCI and SOC 2 audits ask for. Medical offices: see our HIPAA managed network page.
One standard across every location, 3 change hours a month pooled across sites and named escalation. For a San Francisco HQ with Peninsula, East Bay or out-of-state sites.
Additional managed devices $25 each per month on Essential, Secure and Compliance; Multi-Site extra devices are quoted after scoping, because device mix and management needs vary by site. Hardware, licenses and on-site travel are quoted separately. For how these compare with the market, see managed firewall cost.
Network Management vs Managed IT
If your San Francisco company has an IT person or a general MSP who is great with laptops and Microsoft 365 and stretched thin on firewalls and switching, keep them. We take the network layer and coordinate with them. That model is co-managed network support.
If nobody owns the network today, we own it: design, changes, monitoring and the relationship with your hardware vendors. ISP escalation is included on Secure and up. On Essential it costs extra, $225/hr during business hours (30-minute minimum, then 15-minute increments), and starts only when you authorize it in writing. When you need project work instead of a retainer, our San Francisco network engineer page covers that. If your stack is Fortinet, see our Fortinet MSP in San Francisco page.
Getting Started
We recover access, inventory every device, audit the firewall and switching, and check firmware and support status. You get a written report you keep, whether or not you continue. Fixed price from $3,500 for a single small site; larger networks are priced on the assessment pricing page.
Anything risky gets fixed first: exposed management interfaces, missing backups, expired support, firmware with known vulnerabilities. Quoted at a fixed price before we start.
Monitoring and backups switched on, documentation and diagram built, and the network brought to a standard configuration we can manage consistently from then on.
After You Sign
This is the sequence we run for every new managed site in San Francisco. Dates assume you hand over credentials on day one; if access takes longer, the rest shifts with it.
By then you already have the written report and a 60-minute readout of the findings. Anything urgent from it is quoted and fixed as its own project. The managed plan starts from that known state.
You give us admin credentials for the firewall, switches and access points, your ISP account and escalation contacts, any existing diagrams, and the names of who can approve changes. We agree the alert channel (Slack or Teams) and the maintenance window.
A small monitoring appliance goes in at your site and connects back to our stack. Every managed device is discovered and polled, alert thresholds are set for your plan, and firewall configuration snapshots start on an hourly schedule. We trigger a harmless test change to prove a backup actually captured it.
Your status portal goes live at your own address on ambioedge.com, locked to the email addresses you name. We sign in as you from a clean browser to confirm it works before we tell you it does.
Every device in scope is recorded with model, serial, firmware version and support status. Anything we cannot see gets found or declared out of scope in writing. The first network diagram is drawn from that inventory and shared with you.
A kickoff email with how to reach us, a short PDF explaining what each panel in your portal means, and an optional 15-minute screen-share. We also ask for a second contact at your company so one person being out of office is not a single point of failure.
We look back at anything that surprised either side in the first month and fix it: a device that was missed, an alert that fires too often, a contact who should be on the list.
Delivered on the first business day of the following month: uptime, internet performance, what changed, what needs a decision. It arrives every month after that. Between summaries, we contact you when something needs attention or a decision.
Automated monitoring runs from the day it is switched on. Human response during onboarding and after follows the plan’s business-hours window in your agreement.
Where We Work
Day-to-day network management is remote, which is how it is done well. On-site visits are scheduled for onboarding, hardware swaps, cabling and Wi-Fi surveys, and anything that needs hands on the equipment. We work with offices across San Francisco, including the Financial District, SoMa, Mission Bay, Dogpatch, the Mission and the Presidio, and across the Peninsula, East Bay and South Bay. Sacramento-area offices are also covered; see Sacramento MSP and network management in Sacramento.
Who Runs Your Network
Jeff Johnson runs Ambio Edge Networks and leads the engineering. There is no account manager between you and the person who changes your firewall.
A career spent on firewalls, switching, Wi-Fi and WAN and nothing else: architecture, security and operations, including networks at Fortune 500 scale. Cisco certified, Fortinet certified, CompTIA certified.
The engineer who did your assessment is the engineer who onboards you, is the primary engineer for your alerts, your changes and writes your monthly summary. No tiers, no ticket hand-offs, no re-explaining the problem to a second person.
Every production change is recorded with what, why, when and how to roll it back. Your configurations and diagram are version-controlled, credentials are stored in a vault, and you always keep your own admin access. If you ever change providers, your next engineer would start from current documentation and change history, not a blank page.
If You Leave
Switching network providers is painful when the old one held the only copy of everything. Our agreement is written so that cannot happen.
You retain administrative access to your firewall, switches and access points for the whole engagement. We hold our own separate credentials so we can work, but we never hold the only key.
When the agreement ends we return your documentation and credentials within 30 days and remove our access. The network diagram, the device inventory and the written record of changes are yours.
Backups are kept in version-controlled storage with change history while we manage the site. Within 30 days of the end of the agreement you get the configuration backup and change history along with the documentation and credentials, so the next provider starts from a known configuration rather than a running device.
If you bought a Network Risk Assessment first, the report and roadmap are yours on payment, whether or not you ever signed a managed plan.
Equipment is yours unless a project statement of work says otherwise. The only exception is transitional hardware we lend during a migration, which stays ours and goes back when the project ends.
Credentials, configurations, diagrams, logs and business information are confidential both ways. Your data is held only in systems we control; nothing stays on a subcontractor’s systems after an engagement closes.
Term: you can give notice in the first 90 days and leave 30 days later without an early-termination fee; onboarding fees are non-refundable. After that, managed plans run an initial 12, 24 or 36-month term and renew for 12 months at a time unless either side gives 60 days’ written notice before the term ends. After the initial term, either side can end the agreement on 60 days’ written notice. Any project in flight finishes or stops at a documented point, your choice, and is billed to that point.
FAQ
Managed IT covers people and endpoints: help desk, laptops, Microsoft 365, passwords. Network management covers the infrastructure everything else rides on: the firewall, switches, Wi-Fi, internet links and VPNs. We only do the network. If you already have an IT provider or an internal IT person, we take the network layer off their plate and work alongside them.
Yes. We standardize new builds on Fortinet, but we take over what you already have: Cisco, Meraki, Aruba, Arista, SonicWall and others. The assessment tells you what is worth keeping, what is end of life, and what a migration would cost if one makes sense.
Every plan includes automated monitoring and alerting. Human response is business hours, Monday to Friday, 8 AM to 5 PM Pacific, with the response target for your plan written into your agreement. Outside business hours, emergency work is available at the after-hours emergency rate when an authorized contact requests it and we accept, subject to engineer availability. Response means a senior engineer investigating and starting mitigation, not a ticket number.
That is a fine starting point: an inherited network, a previous provider who left, or an office you moved into with equipment already on the wall. The first step is a Network Risk Assessment: we recover access, inventory and audit the gear, and give you a written report you keep. The assessment is a fixed price from $3,500 for a single small site, prepaid. Onboarding to monthly management is quoted at a fixed price after that.
Monthly management plans run on a written agreement with a 12-, 24- or 36-month term. You can give notice in the first 90 days and leave 30 days later without an early-termination fee; onboarding fees are non-refundable. The assessment is a one-time fixed fee with no obligation to continue.
No. We manage networks across the Bay Area and California, and remotely nationwide for multi-site organizations. San Francisco, the Peninsula, the East Bay, the South Bay and Sacramento are within our on-site footprint.
A managed device is a firewall, switch, access point, or a server we monitor for reachability only; we do not administer servers, laptops or user accounts. Each plan includes a set number per site; extra devices are $25 per month each, except on Multi-Site, where they are quoted after scoping. From you we need admin credentials for those devices, your ISP account and escalation contacts, any diagrams you have, and the names of who may approve changes and request emergency work. You also keep your ISP service, vendor support contracts and firewall security licensing current; those are not something we can carry for you.
Routine requests inside your included hours, such as a VLAN, a VPN user or a firewall rule, are scheduled during business hours once an authorized contact approves them. Firmware updates and anything that could interrupt service go into the maintenance window, which defaults to Friday 6 p.m. to Sunday 6 p.m. Pacific and can be moved with notice. Emergency changes outside the window happen only when the alternative is an outage, and you are told the same day. Every production change is documented with what was done, why, when, and how to roll it back.
Published plans run $695 to $2,495 per site per month. Edge Essential is $695 for up to 10 managed devices with no change hours included; Secure is $1,295; Compliance is $1,795; Multi-Site is $2,495 for the first site plus $995 for each additional site. Extra managed devices are $25 per month each on Essential, Secure and Compliance. Every Edge plan starts with an assessment: the Network Risk Assessment is a fixed price from $3,500 for a single small site, and the report is yours to keep. Hardware, licenses and on-site travel are quoted separately.
Start Here
Tell us about your office: how many people, what equipment, and what is giving you trouble. A senior engineer replies, not a salesperson. If you want the full picture first, the Network Risk Assessment is $3,500 for a single small site; larger networks are priced on the assessment pricing page. The report is yours to keep. See a sample report (PDF).
