Wi-Fi Planning for Businesses: Get It Right

Sound Wi-Fi planning for a business does not start with buying access points but with taking stock: who uses the wireless network, with which devices, for which applications and across which areas. Only then follow the site survey, cabling, security and operations.

Gathering requirements

The first step is a conversation, not a measurement. Five points determine the later design:

• Users: How many people work on the Wi-Fi at the same time and where they are located.
• Devices: Notebooks, smartphones, tablets, printers, VoIP phones, sensors, machine controls. Each device class brings its own radio standards and security requirements.
• Applications: Video conferencing, speech recognition and remote access to terminal servers are sensitive to latency and packet loss; plain email traffic is not.
• Areas: Offices, meeting rooms, corridors, outdoor areas, production, warehouse, underground car park.
• Building materials: Reinforced concrete, metal-coated glass, fire walls, shelving with metal goods and lift shafts attenuate radio signals considerably. A floor plan with details of walls and ceilings is the most important document.

The result is a short requirements document with areas, user numbers, device classes, applications and the required minimum throughput per area. It is the benchmark for acceptance.

Site survey: simulation and measurement

The site survey answers how many access points are needed and where. A two-stage approach has proven itself.

First the floor plan is loaded into planning software, walls and materials are given their attenuation values, and the access points are placed virtually. The software calculates signal strength, channel overlap and the expected data rate per area.

The simulation knows neither the metal shelving installed after planning nor the neighbouring Wi-Fi on the same channels. A measurement in the building therefore follows: an access point runs provisionally at the planned position, and a meter records the actual signal strength on a walk-through. After installation, a second measurement documents acceptance against the requirements document.

Wi-Fi 6E and Wi-Fi 7 additionally use the 6 GHz band: more channels, less interference from neighbouring networks, higher data rates. The downside is the shorter range; walls attenuate more strongly. A plan that was sufficient for 5 GHz usually has gaps at 6 GHz, so more access points with smaller cells are needed. The 6 GHz band therefore belongs in the simulation today.

Placement, cabling and PoE

Access points belong on the ceiling or high on the wall, not in cabinets, behind metal panels or in the suspended ceiling. Neighbouring access points transmit on different channels.

Each access point needs its own network cable to the distribution cabinet and is powered over it using Power over Ethernet (PoE). Devices for Wi-Fi 6E and Wi-Fi 7 draw more power and frequently use ports rated at 2.5 gigabits per second or more; the switch must deliver both.

Security, operations and typical mistakes

A business Wi-Fi consists of several logically separated networks broadcast over the same access points. Separation is done by VLAN on the switch and at the firewall:

• Staff Wi-Fi: Access to internal systems, authentication via WPA3-Enterprise with user account or device certificate.
• Guest Wi-Fi: Internet only, no route into the internal network, time-limited access or a captive portal.
• Device Wi-Fi: Printers, sensors and controls get their own network with defined firewall rules. A compromised device then cannot reach the file server.

WPA3-Enterprise with certificates is the state of the art. Each device or user authenticates with an individual certificate that is issued centrally and revoked when someone leaves or a device is lost. A shared password for everyone travels to former colleagues and cannot realistically be changed without touching every device.

Operations decide whether the Wi-Fi stays good over time. In customer projects we rely on the Mist portfolio from HPE Juniper Networking: access points and switches are managed through a cloud console that evaluates the state of every client and every connection, and the Marvis assistant names the cause of connection problems in natural language.

Three mistakes we see often when taking over existing networks:

1. Access points placed by instinct: Dead spots at the desks, overlaps in the corridor.
2. One shared password for everyone: Staff, guests, printers and private smartphones on the same network with the same key.
3. No verification measurement: The installation counts as finished once the lights come on. Nobody checks whether the requirements are met.

Key points

• Requirements document first, then simulation on the floor plan including the 6 GHz band, then on-site measurement and a verification measurement for acceptance.
• Cabling and PoE switches must carry the power demand of Wi-Fi 6E and Wi-Fi 7.
• Staff, guests and devices on separate VLANs, authentication with WPA3-Enterprise and certificates.

How switches, cabling and firewall work together is described on the page Network and IT infrastructure.