Wi-Fi network with on-site survey
We build enterprise wireless networks based on an on-site survey carried out with our own measurement equipment, with separate networks for guests, employees, and devices.
When you need it
When your current Wi-Fi can no longer keep up
A wireless network usually needs to be redesigned when the building, the number of users, or the security requirements change.
New building, rearranged office
After a move, an expansion, or new partition walls, the existing access points are no longer where people actually work.
Weak signal, unstable connection
Video calls drop in some meeting rooms or corridors, while elsewhere the signal is strong but the network is still slow.
Many devices at once
Guests, visiting speakers, conferences, and events: at times like these, far more devices connect at once than on an ordinary workday.
The same password for years
In many places a single shared password still protects the network, the same one that was set years ago and that everyone has learned since.
How the work runs
Measurements before and after installation
Walls, floor slabs, metal surfaces, and neighboring networks all affect how the signal travels, so Wi-Fi cannot be planned reliably from a floor plan.
-
On-site survey
We walk through the building and turn the measurements into a coverage map, which also shows how far the signal reaches outside the building.
-
Capacity plan
We work out how many devices have to be served at the same time and where the most people gather. That determines how many access points are needed and where they go.
-
Installation
We mount the access points, which draw power from PoE-capable switches, and connect them to a central management interface. This is also where we set up the separate networks.
-
Final measurement
We measure again on the finished network and compare the results with the plan. The configuration is handed over with documentation.
Deliverables
What you get at the end
items handed over
- On-site survey and coverage map
- Capacity plan
- Installation, central management, and separate networks
- Final measurement and documentation
Separate networks
Guests, employees, devices
The three networks run on the same physical infrastructure, each in its own VLAN. The firewall filters traffic between the VLANs, because with unfiltered routing a guest can reach the internal network too.
Employees
We recommend individual authentication based on 802.1X, with a certificate or a domain account. Internal resources are reachable from this network.
Guests
Internet access only, with client isolation so that guests cannot reach each other's devices either. Sign-in uses a time-limited or single-use code.
Devices
Printers, IP cameras, building automation, and meeting room equipment that do not support 802.1X. They go into a segment of their own, with restricted outbound traffic.
Related services
What sits behind the wireless network
The access points connect to the wired network, so Wi-Fi works together with the switches, the segmentation, and the firewall.
Network segmentation
Splitting a flat corporate network into zones so that one infected device cannot reach the entire network.
Network access control (NAC)
Only known, compliant devices can connect. Unknown devices are placed in an isolated zone.
Switching and routing
Design and build of the switching and routing infrastructure of the local network, with redundancy.
Firewall and VPN
Design, installation, and configuration of next-generation firewalls, together with VPN for site-to-site and remote access.
Frequently asked questions
The questions we hear most
Why isn't one shared Wi-Fi password enough?
Because you cannot tell who connected with it, and it cannot be revoked for a single person: when someone leaves, it would have to be changed for everyone, so in practice it never gets changed. What fifty people know, outsiders will learn within a few months. With individual authentication, every user connects with their own credentials, and the traffic key is unique to each session. We covered this in our article on Wi-Fi security in the enterprise.
What does central management mean?
The access points are configured and monitored from one place, through a controller. In our reference projects the firewall fills this role, and it also acts as the switch controller. If an access point loses its connection, you see it in real time.
Is traffic over the Wi-Fi protected as well?
Yes. In our reference projects, traffic on the Wi-Fi networks is protected by web filtering, antivirus scanning, DNS filtering, file filtering, application control, and SSL/SSH inspection. IPS and WIDS profiles monitor connections to the SSIDs that can be seen from outside the building. Certificate-based authentication protects against rogue access points, because the client verifies the server's certificate.
Which vendors' equipment do you work with?
Our designs are vendor-independent: we choose the solution to suit the environment and the equipment already in place. In our reference projects, the Wi-Fi access points were Fortinet devices (FortiAP). At the Hungarian Dance University, the network serves several thousand devices in real time, and the Municipality of Gödöllő had to serve several hundred devices at the same time.
