Airtime is the capacity
Wi-Fi is half duplex and shared. One slow, distant client can use more airtime than ten fast ones, so I design for airtime, not just coverage.
Wireless and mobile
Wireless networks, from the radio to the core
I design enterprise wireless from end to end: the radio, the access points and controllers, how each client connects and stays secure, and how the whole estate is surveyed, supported and kept current. Most diagrams below can be stepped through or played with.
End to end
Wireless is a whole system, not just access points
A good wireless network depends on six layers working together: the radio, the access point and its cable, the controller, identity, IP services and management. When something goes wrong, the fault is in one of these layers, so I design and troubleshoot them in the same order.
Swipe sideways to see the whole diagram.
Laptops, phones and IoT (internet of things) sensors talk to the access point by radio. Radio is a shared medium: only one device on a channel can transmit at a time, so airtime is the real limit on capacity, not the speed printed on the box.
Each access point is powered and connected by an access switch port, using Power over Ethernet (PoE) and a VLAN (virtual local area network) or a trunk. Modern access points need 802.3at or 802.3bt power, and often a multigigabit port.
The access point builds a CAPWAP (Control and Provisioning of Wireless Access Points) tunnel to the controller. The controller pushes the configuration, runs the radios as one system and, in local mode, carries user traffic too.
When a client connects, the controller asks Cisco ISE (Identity Services Engine) over RADIUS (remote authentication dial in user service) whether to let it in. ISE checks the certificate or password and returns the VLAN, access list or security group for that user or device.
The client gets an IP address from DHCP (Dynamic Host Configuration Protocol) and finds services through DNS (Domain Name System). Its traffic then reaches applications and the internet through the core and the firewalls.
Catalyst Center or a cloud dashboard holds the templates and shows client health. NTP (network time protocol), syslog and streaming telemetry tell me what happened, when, and to whom, which is what turns a complaint into a fix.
Design from the weakest client
Scanners, phones and medical devices set the rules. Their bands, security support and roaming behaviour decide the design, not the newest laptop.
Identity, not SSIDs
I keep to a few SSIDs (service set identifiers, the network names) and let identity decide each user's segment. Every extra SSID costs airtime, because each one sends its own beacons.
Radio
The radio basics every design rests on
Enterprise Wi-Fi uses three RF (radio frequency) bands. Each has a different number of channels, a different reach and different rules. Pick a band to see its UK channel plan.
Swipe sideways to see the whole diagram.
2.4 GHz. Long reach and good wall penetration, but only three channels that do not overlap, and the band is shared with Bluetooth, microwave ovens and older devices. I keep it for IoT and legacy clients, and often turn spare 2.4 GHz radios off or switch them to 5 GHz. In Europe some designs use 1, 5, 9 and 13 with 20 MHz OFDM (orthogonal frequency division multiplexing) channels. I still use 1, 6 and 11 where older clients remain.
5 GHz. The workhorse band. The UK allows 24 channels at 20 MHz across three bands. Fifteen need DFS (dynamic frequency selection): the access point listens for radar first and must move if it hears one. Channels 120 to 128 need a 10 minute check, so I keep them away from voice areas. Band A is for indoor use, and Band C allows 200 mW indoors only.
6 GHz. Used by Wi-Fi 6E and Wi-Fi 7, with no older devices to slow it down. The UK lower band gives 24 channels at 20 MHz. Ofcom's July 2026 statement gives Wi-Fi priority in 6425 to 6585 MHz and mobile priority from 6585 to 7125 MHz. Wi-Fi may use the mobile part too, but only under AFC (automated frequency coordination). The new rules apply once Ofcom updates IR 2030, its interface rules for licence exempt radios, and the kit supports them. Only WPA3 (Wi-Fi Protected Access 3) or Enhanced Open is allowed. Clients find networks on the preferred scanning channels, or from a reduced neighbour report (RNR) sent by the access point's 2.4 or 5 GHz radio.
The numbers I work in
Radio power is measured in dBm, decibels compared with one milliwatt. Decibels add up, which makes link maths simple.
| dBm | Power | Rule of thumb |
|---|---|---|
| 0 dBm | 1 mW | The reference point |
| 10 dBm | 10 mW | Plus 10 dB is ten times the power |
| 20 dBm | 100 mW | Plus 3 dB is roughly double |
| 30 dBm | 1 W | Doubling the distance loses about 6 dB in free space |
- RSSI (received signal strength indicator): what the client hears, such as −65 dBm. Closer to zero is stronger.
- Noise floor: background radio noise, often around −95 dBm.
- SNR (signal to noise ratio): signal minus noise. −65 dBm over a −95 dBm floor is 30 dB. SNR, not raw signal, decides the data rate.
- EIRP (effective isotropic radiated power): transmit power plus antenna gain minus cable loss. UK rules cap EIRP, for example 100 mW at 2.4 GHz. Antenna gain reshapes the pattern; it does not create power.
Try it: two access points on 2.4 GHz
Pick a channel for each access point and see how much of their spectrum overlaps.
Channels 6 and 11: no overlap. Each access point has its own clean channel.
Channel width: wider is not always better
Bonding channels gives each client more speed but leaves fewer channels to reuse, so neighbouring access points end up sharing. Counts are for the UK.
| Width | 5 GHz channels | Without DFS | Lower 6 GHz |
|---|---|---|---|
| 20 MHz | 24 | 9 | 24 |
| 40 MHz | 11 | 4 | 12 |
| 80 MHz | 5 | 2 | 6 |
| 160 MHz | 2 | 0 | 3 |
| 320 MHz | none | none | 1 |
My default: 20 MHz in dense areas, 40 MHz on 5 GHz elsewhere, and 80 MHz or wider only where few access points share the space, or on 6 GHz.
What walls cost
Every material between the access point and the client takes away signal. These are indicative values at 5 GHz. A survey always beats a table.
| Material | Typical loss |
|---|---|
| Plasterboard wall | About 3 dB |
| Clear glass | 2 to 4 dB |
| Brick wall | About 10 dB |
| Concrete wall or floor | 12 to 20 dB or more |
| Coated (low emissivity) glass | Can be 20 dB or more |
| Lift shafts, metal racking, fire doors | Can block the signal almost entirely |
People absorb signal too, so a full lecture theatre behaves differently from an empty one.
Standards
Each Wi-Fi generation uses airtime better
The headline speeds grab attention, but the real gains in Wi-Fi 6 and 7 come from serving many clients at once. Step through the four ideas that matter most.
Swipe sideways to see the whole diagram.
Wi-Fi 5 and earlier: OFDM (orthogonal frequency division multiplexing). Each transmission uses the whole channel for one client. Everyone else waits their turn, and every turn carries overhead, so lots of small packets, like voice and IoT, waste most of the airtime.
Wi-Fi 6: OFDMA (orthogonal frequency division multiple access). The channel is split into resource units, so one transmission carries data for several clients at once, uplink and downlink. Waiting time falls most in busy areas.
MU-MIMO (multi user, multiple input, multiple output). An access point with several antennas sends separate spatial streams to several clients at the same time. Wi-Fi 5 added it for downlink, and Wi-Fi 6 added uplink.
Wi-Fi 7: multi link operation (MLO). A client joins once but uses links on two or three bands, for more speed or more reliability. MLO runs in two modes: STR (simultaneous transmit and receive) uses several radios at once, and EMLSR (enhanced multi link single radio) listens on several links but sends on one. Most client chips use EMLSR. Wi-Fi 7 also allows 320 MHz channels on 6 GHz and 4096 QAM (quadrature amplitude modulation).
| Standard | Name | Arrived | Bands | Widest channel | Top rate in theory | What it added |
|---|---|---|---|---|---|---|
| 802.11b | 1999 | 2.4 GHz | 22 MHz | 11 Mb/s | The first mass market Wi-Fi | |
| 802.11a and g | 1999 and 2003 | 5 and 2.4 GHz | 20 MHz | 54 Mb/s | OFDM | |
| 802.11n | Wi-Fi 4 | 2009 | 2.4 and 5 GHz | 40 MHz | 600 Mb/s | MIMO, up to four spatial streams |
| 802.11ac | Wi-Fi 5 | 2013 | 5 GHz | 160 MHz | About 6.9 Gb/s | 256 QAM, downlink MU-MIMO |
| 802.11ax | Wi-Fi 6 and 6E | 2019 (6E from 2021) | 2.4 and 5 GHz, plus 6 GHz for 6E | 160 MHz | About 9.6 Gb/s | OFDMA, uplink MU-MIMO, 1024 QAM, BSS (basic service set) colouring, target wake time |
| 802.11be | Wi-Fi 7 | 2024 | 2.4, 5 and 6 GHz | 320 MHz | About 23 Gb/s | MLO, 4096 QAM, multiple resource units per client, puncturing |
Years for 802.11b to 802.11ac are when the IEEE (Institute of Electrical and Electronics Engineers) approved each standard. For Wi-Fi 6, 6E and 7 they are when the Wi-Fi Alliance began certifying products. Top rates are theoretical maximums; a real client gets a fraction of them. Sources: IEEE 802.11 and the Wi-Fi Alliance.
BSS colouring
Wi-Fi 6 tags each network's frames with a colour. An access point can then ignore a distant neighbour on the same channel more often, so channels can be reused more tightly.
Target wake time
The access point schedules when an IoT device wakes to send or receive. Sensors sleep longer and batteries last longer, and fewer devices compete at once.
Higher QAM needs a clean signal
1024 and 4096 QAM pack more bits into each symbol, but only work with a very high SNR, close to the access point. They raise the peak rate, not the rate at the cell edge.
Architecture
Where the brains sit, and where the traffic goes
Every wireless design answers two questions: who controls the access points, and which path user traffic takes. The answer changes with site size, WAN (wide area network) quality and how the estate is run.
Swipe sideways to see the whole diagram.
Autonomous. Each access point holds its own configuration and runs its own radios. It is fine for one or two access points, but roaming, security and changes do not scale beyond that.
Controller based, local mode. Access points build CAPWAP tunnels to a controller, such as a Catalyst 9800 pair in the data centre. The controller holds the configuration, runs radio resource management (RRM) and carries all user traffic. It suits large campuses close to the controller.
FlexConnect. For branches across a WAN. CAPWAP control still goes to the central controller, but user traffic is switched locally onto branch VLANs. If the WAN fails, access points carry on in standalone mode, and local authentication lets new clients join.
Cloud managed. Meraki or Juniper Mist access points are managed from a cloud dashboard over HTTPS (encrypted web traffic), and user traffic stays on site. It is quick to roll out across many small sites; the dashboard, its licences and its internet path become part of the design. Embedded controllers on a Catalyst 9000 switch or access point also suit small sites.
| Model | Control lives | User traffic goes | I use it for | Watch for |
|---|---|---|---|---|
| Controller, local mode | Central controller | Through CAPWAP to the controller | Large campuses and data centre sites | Controller capacity and placement |
| FlexConnect | Central controller | Straight onto local VLANs | Branches across a WAN | WAN latency for control, local VLAN design |
| SD-Access fabric | Controller, control only | VXLAN (virtual extensible LAN) to the fabric edge switch | Campuses that run SD-Access | Fabric design and licensing |
| Cloud managed | Cloud dashboard | Stays on site | Many small and medium sites | Licence renewals and dashboard access |
| Embedded controller | On a switch or AP | Local | Small sites with no controller | Scale limits |
The Catalyst 9800 in brief
- Platforms: the CW9800H1, CW9800H2 and CW9800M appliances, which replaced the 9800-80 and 9800-40 (end of sale since December 2025), the 9800-CL virtual controller for data centres and clouds, the smaller 9800-L and embedded options. It replaces the older AireOS controllers.
- Configuration by tags: a policy tag binds each WLAN (the SSID and its security) to a policy profile, which sets the VLAN, the QoS (quality of service) and the switching mode. A site tag sets local or FlexConnect behaviour and join settings. An RF tag carries the radio profiles. Tag an access point and it inherits everything.
- Resilience: an SSO (stateful switchover) pair in one data centre, plus an N+1 controller elsewhere, with a primary, secondary and tertiary controller set on each access point.
- Mobility: controllers in the same mobility group share client state so users roam between them, over UDP (user datagram protocol) ports 16666 and 16667.
- Across a WAN: Cisco's FlexConnect guide allows up to 300 ms round trip for data and 100 ms for data with voice. I mark CAPWAP control for priority and size branch links for control and RADIUS traffic.
Cisco and Aruba, side by side
| Cisco | Aruba |
|---|---|
| Catalyst 9800 controllers | Mobility Conductor and Controllers (AOS 8), or Aruba Central (AOS 10) |
| Policy, site and RF tags | Configuration hierarchy and AP groups |
| Local mode and FlexConnect | Tunnel and bridge forwarding |
| SSO pair plus N+1 | Controller clusters with a standby controller per client |
| RRM | AirMatch, with ClientMatch steering |
| ISE returning a VLAN, an ACL (access control list) or an SGT (security group tag) | ClearPass returning a user role |
| CAPWAP on UDP 5246 and 5247 | PAPI (Aruba's control protocol) on UDP 8211 and GRE (generic routing encapsulation), secured by CPsec (control plane security) |
Finds its controller by DHCP option 43 or DNS CISCO-CAPWAP-CONTROLLER | Finds its controller by ADP (Aruba discovery protocol), DHCP options 43 and 60, or DNS aruba-master |
Staying up when things fail
Swipe sideways to see the whole diagram.
Campus access points in local mode tunnel everything to the active controller. Branch access points send only CAPWAP control across the WAN, and their user traffic stays on branch VLANs. Each access point has a primary, secondary and tertiary controller set, so failover is predictable.
Controllers 1 and 2 run as an SSO (stateful switchover) pair over a redundancy port. When the active fails, the standby takes over with access point and client state already copied, so users stay connected.
If both controllers are lost, access points rejoin the N+1 controller in the second data centre using their configured backup. This is not stateful: each access point restarts its CAPWAP session and clients reconnect, typically within a minute or two.
FlexConnect access points lose their controller and go into standalone mode. Connected clients keep working on local switching. With local authentication or a local RADIUS server, new clients can still join.
When the primary data centre is back, access points on the N+1 controller fall back to the SSO pair. I run that fallback in a planned window, because every access point that moves restarts its session. Inside an SSO pair there is no fallback: the repaired unit rejoins as the hot standby.
AP join
How an access point finds its controller
An access point arrives with no configuration. It finds a controller, proves who it is, checks its software and downloads its settings. Knowing each step tells me where to look when one will not join.
Swipe sideways to see the whole diagram.
The access point powers up over PoE and asks DHCP for an IP address. DHCP option 43 can carry the controller's address. Other ways to find it are the DNS name
CISCO-CAPWAP-CONTROLLERin the domain that DHCP gives the access point, or a broadcast on the local subnet. It also tries controllers it remembers, a controller primed on the access point itself (capwap ap primary-base), and Plug and Play through Catalyst Center.The access point sends a CAPWAP discovery request to every controller it found. Each replies with its name and how many access points it has room for. The access point picks its configured primary, then secondary, then tertiary, and otherwise the least loaded.
Control traffic is always encrypted. The access point and controller set up a DTLS (Datagram Transport Layer Security) session on UDP 5246 and check each other's certificates. A wrong clock or an expired certificate breaks this step.
The access point sends a join request. If its software differs from the controller's, it downloads the matching image and reboots, then joins again. Over a slow WAN, I pre stage images so this step does not time out.
The controller sends the configuration from the access point's policy, site and RF tags. The radios come up, keepalives start, and user data uses UDP 5247 where the controller carries it.
What option 43 looks like
For Cisco access points, option 43 is a type, length, value field. The type is f1, the length is four bytes per controller, then each controller's management address in hex. For 10.10.10.5 and 10.10.10.6 the value is f1 08 0a 0a 0a 05 0a 0a 0a 06. On a Cisco IOS DHCP pool that is option 43 hex f108.0a0a.0a05.0a0a.0a06.
Three paths for user traffic
Swipe sideways to see the whole diagram.
Central switching. In local mode the access point wraps every user frame in CAPWAP and sends it to the controller, which places it on the right VLAN in the data centre. Policy sits in one place and roaming is simple, but every frame crosses to the controller.
FlexConnect local switching. The access point's switch port is a trunk, and user traffic goes straight onto a local VLAN. Only control traffic goes to the controller. This saves WAN bandwidth and keeps the branch working if the WAN fails.
SD-Access fabric wireless. The controller handles control only. The access point sends user traffic in VXLAN to its fabric edge switch, so wired and wireless users share the same segments and group policy. More on the SD-Access page.
Ports a wireless network needs open
| Traffic | Protocol and port | Between |
|---|---|---|
| CAPWAP control (always DTLS) | UDP 5246 | Access point and controller |
| CAPWAP data | UDP 5247 | Access point and controller |
| Mobility between 9800 controllers | UDP 16666 and 16667 | Controller and controller |
| RADIUS authentication and accounting | UDP 1812 and 1813 | Controller and ISE |
| RADIUS change of authorisation (CoA) | UDP 1700 on Cisco, 3799 in RFC 5176 | ISE and controller |
| ISE guest portal | TCP (transmission control protocol) 8443 by default | Guest browser and ISE |
| Aruba control (PAPI) and tunnels | UDP 8211, GRE (IP protocol 47) | Aruba access point and controller |
| Cloud management | HTTPS outbound, plus NTP on UDP 123 (Meraki also uses UDP 7351) | Access point and cloud dashboard |
| Device management | SSH (secure shell) 22, SNMP (simple network management protocol) 161 and 162, syslog 514 | Devices and management tools |
I confirm the exact list against the vendor's guide for the software in use before writing firewall rules.
Connecting
What happens when a laptop joins the network
Joining an enterprise SSID takes six steps and around a second. Every connection fault sits in one of them, which is why I learned them in this order.
Swipe sideways to see the whole diagram.
Access points send beacons, about ten a second, for each SSID. A client listens (a passive scan) or sends probe requests (an active scan), then picks an access point by signal and capability. The client decides, not the network.
Open system authentication is a formality kept from early Wi-Fi. The real step is association: the client asks to join, stating its capabilities and the security it wants. In local mode the controller answers.
The client proves who it is to Cisco ISE with EAP (extensible authentication protocol), inside a TLS (transport layer security) tunnel. With EAP-TLS both sides use certificates. With PEAP (protected EAP) the client checks the ISE certificate, then sends a password. ISE returns an access accept with the VLAN, access list or security group and the key material. The controller then sends EAP success to the client.
Both sides now hold the pairwise master key (PMK), from 802.1X or from the passphrase with SAE (simultaneous authentication of equals). Four EAPOL (EAP over LAN) key messages swap random numbers (ANonce and SNonce) and prove both sides hold the key with a MIC (message integrity code). They derive the session key (PTK) and deliver the group key (GTK) for broadcast traffic.
Now trusted and encrypted, the client asks for an IP address. The gateway or controller relays the request, and the client gets its address, gateway and DNS servers. A client stuck at this step is usually on the wrong VLAN.
Frames are encrypted over the air with CCMP or GCMP, the counter mode and Galois counter mode ciphers of AES (the advanced encryption standard). In local mode they travel inside CAPWAP to the controller and out to the network. The controller sends RADIUS accounting to ISE, so I can see who connected, where and for how long.
| Method | The client proves itself with | Server certificate | Where I use it |
|---|---|---|---|
| EAP-TLS | A client certificate | Yes, checked by the client | Managed laptops, phones and capable IoT. My default. |
| PEAP with MSCHAPv2 (Microsoft's challenge handshake protocol, version 2) | A username and password inside TLS | Yes, and the client must check it | Older estates, moving towards EAP-TLS |
| TEAP (tunnel EAP) | The machine and the user together | Yes | Windows estates that need both checks |
| MAB (MAC authentication bypass) | Its MAC address only | No | Devices with no 802.1X, kept in a tight segment |
| iPSK (identity pre shared key) | A key tied to that device or group | No | IoT and headless devices on one SSID |
What ISE sends back
An access accept can carry a VLAN, a downloadable access list (dACL), a security group tag (SGT) or a redirect for a portal. The same policy works for wired and wireless users.
Certificates are the usual weak point
Most failed connections come down to a client that does not trust the ISE certificate, or a client certificate that has expired. Both belong in device management, never set by hand.
Time matters
Certificates, DTLS and logs all depend on the clock. Every access point, controller and ISE node points at the same NTP source.
Security
One radio, three kinds of user, three different paths
Corporate users, IoT devices and guests share the same access points. I give each its own way in and its own segment, and identity decides who goes where. Pick a type of user to follow its path.
Swipe sideways to see the whole diagram.
Corporate. Managed laptops and phones use WPA3 Enterprise with EAP-TLS. ISE checks the certificate, and can check device posture, then returns the VLAN or security group tag (SGT) that decides what the device can reach.
IoT. Most sensors cannot do 802.1X. I give them iPSK, a key per device or per device type held in ISE, or MAB with profiling. They land in an IoT segment that reaches only their own platform. One shared key on a flat VLAN is the thing I remove first.
Guest. Visitors join an Enhanced Open (OWE) SSID, so their traffic is encrypted without a password, then accept terms or get a sponsor's approval on a portal. Their traffic is anchored in the DMZ (demilitarised zone) and reaches only the internet.
The security ladder I move estates up
| Where an estate often starts | Where I move it | Why |
|---|---|---|
| Open guest network | Enhanced Open (OWE, opportunistic wireless encryption) | Each client is encrypted, with no password to share. |
| WPA2 (Wi-Fi Protected Access 2) Personal, one shared passphrase | WPA3 Personal (SAE, simultaneous authentication of equals) | Captured traffic can no longer be used to guess the passphrase offline, and past sessions stay safe if it leaks. |
| WPA2 Enterprise | WPA3 Enterprise | Protected management frames (PMF) become mandatory. The cipher stays CCMP-128; the stronger suite comes with 192 bit mode. |
| WPA3 Enterprise | WPA3 Enterprise 192 bit mode | GCMP-256 encryption, SHA-384 hashing (secure hash algorithm) and EAP-TLS, for high assurance environments. |
| One shared key for all IoT | iPSK or MAB with profiling | A key per device or group, so one stolen key does not open everything. |
On 6 GHz the Wi-Fi Alliance allows only WPA3 or Enhanced Open, so older security has to be retired before an estate can use the band. Mixed WPA2 and WPA3 transition modes help during migration, but I set an end date for them. In transition mode PMF is optional, so older clients still join; WPA3 only mode makes it required. On 6 GHz SAE must use hash to element (H2E), which some older WPA3 clients lack. For guests, OWE transition mode pairs a hidden OWE network with an open one until every device supports OWE.
Protected management frames
PMF (802.11w) signs disassociation and deauthentication frames, so an attacker cannot knock clients off by spoofing them. WPA3 makes it mandatory.
MAC randomisation
Phones and laptops now use a private MAC address per network. That breaks designs that rely on MAC addresses, such as MAB and DHCP reservations, so I base policy on identity instead.
Rogues and WIPS
Access points scan for rogue access points and attacks, and a wireless intrusion prevention system (WIPS) alerts on them. I contain only rogues proven to be on our own wired network, with sign off, because jamming other people's Wi-Fi is illegal.
The management plane
Controllers and access points are managed over SSH and HTTPS only, with TACACS+ (terminal access controller access control system plus) for admin logins, a separate management network and no default credentials left anywhere.
Guest access
Guests get the internet, and nothing else
A guest's traffic never touches the internal network. It is tunnelled from the campus controller to an anchor controller in the DMZ, checked by an ISE portal, then sent out through the DMZ firewall.
Swipe sideways to see the whole diagram.
The visitor joins the guest SSID on any campus access point. I use Enhanced Open where devices support it, so the visitor's traffic is encrypted over the air even without a password.
The campus controller, called the foreign controller, tunnels the guest's traffic to an anchor controller in the DMZ. The guest gets an address from the DMZ, so guest traffic never touches an internal VLAN.
The controller checks the guest's MAC address with ISE, which answers with a redirect. The guest's first web request is sent to the ISE portal for terms, a sponsor's approval or a self registration.
When the guest accepts, ISE sends a RADIUS change of authorisation (CoA) to the controller. The session is authorised again, now with internet access and a time limit.
Guest traffic leaves through the DMZ firewall to the internet. There is no route to the corporate network, client isolation stops guests reaching each other, and rate limits stop one guest using the whole link.
Roaming
Moving between access points without dropping the call
Every time a phone moves to a new access point, it has to reconnect. How long that takes decides whether a call carries on or breaks up. The timings below are indicative.
Swipe sideways to see the whole diagram.
Full 802.1X on every roam. Without key caching, the phone repeats the whole EAP exchange with ISE at each new access point. That can take from a few hundred milliseconds to over a second, depending on the RADIUS round trip, so calls break up.
PMK caching and OKC. The controller keeps the pairwise master key, so a roaming client skips the EAP exchange and only runs the 4 way handshake. OKC (opportunistic key caching) shares the key across access points. Client support varies, so I test it with the real devices. CCKM (Cisco centralised key management) did the same job for older Cisco compatible clients.
802.11r fast transition (FT). Keys are derived in advance, so authentication and the 4 way handshake fold into the reassociation. Roams take tens of milliseconds, well inside a voice budget. Fast transition runs over the air, the default, or over the DS (distribution system) through the current access point, which is rarely needed. Older clients may need a mixed mode SSID during the move.
Layer 3 roam. When the new access point is on another controller with a different VLAN, the controllers keep the client's IP address by tunnelling its traffic back to the first controller, the anchor. Mobility groups share client state. I keep voice floors on a Layer 2 roam where I can.
The client decides
Roaming is always the client's choice. The network can only help, so I test every design with the real devices, not just a laptop.
802.11k
Neighbour reports tell the client which access points and channels are nearby, so it scans less and roams sooner.
802.11v
BSS transition management lets the network suggest a better access point, for example when the client's signal is falling or its access point is busy.
Sticky clients
A client that clings to a distant access point is usually caused by access points set too loud and low data rates left on. I fix it with 15 to 20% overlap, sensible minimum rates and 802.11k and v, never by turning power up.
Design
Coverage gets people connected, capacity keeps them happy
I design each area to a target, then size it for the number of clients and what they do. These are the targets I start from. Every one is checked later in a validation survey.
| Area needs | Signal at the edge | SNR | Overlap | How I design it |
|---|---|---|---|---|
| Data and browsing | −70 dBm or better | 20 dB or more | Some | Most offices and meeting rooms |
| Voice and video calls | −67 dBm or better | 25 dB or more | 15 to 20%, a second AP heard at the edge | Low retries, 802.11r, voice marked EF (expedited forwarding) |
| Location services | −75 dBm from three or more APs | As for data | Heavy | Placement matters more than power |
| High density | −67 dBm, in small cells | 25 dB | Controlled | 20 MHz channels, low power, more APs |
Indicative targets drawn from vendor design guides. Each organisation agrees its own.
Try it: will this client get a good signal?
A simple link budget: transmit power plus antenna gain, minus the loss over distance and through walls. Free space maths is optimistic indoors, which is why I always survey.
- EIRP
- 18 dBm
- Free space loss
- 70.8 dB
- Wall loss
- 6 dB
- Signal at the client
- −59 dBm
- SNR
- 36 dB
- Likely rate
- Top rates close in (1024 QAM)
Good for voice and data. Above −67 dBm with at least 25 dB SNR.
Phones transmit at around 15 dBm, so an access point much louder than its clients creates a one way link. I keep AP power close to client power.
Capacity is airtime
I count devices per area, what each does and how often, then size access points by airtime. As a working envelope, about 30 to 50 active clients share one radio well.
Turn off slow rates
A client sending at 1 Mb/s uses many times the airtime of one at hundreds of Mb/s. I disable 1, 2, 5.5, 6 and 9 Mb/s, which also shrinks cells and helps roaming.
RRM is a good janitor
Radio resource management sets channels (DCA) and power (TPC) for each RF group, converts spare radios (FRA) and finds coverage holes. Controllers in one RF group elect a leader that runs the channel and power plan for every access point in the group. I override it in high density areas, warehouses, voice floors and DFS heavy areas.
Multicast and mDNS
Multicast goes at the lowest basic rate and eats airtime. I convert multicast to unicast where it matters and use an mDNS gateway so screens and printers can be found across VLANs.
QoS: from the air to the wire
WMM (Wi-Fi Multimedia) gives each frame an access category over the air. The controller maps it to and from DSCP (differentiated services code point) on the wired side, so a call keeps its priority end to end.
| Traffic | DSCP | 802.11 user priority | WMM category |
|---|---|---|---|
| Voice | EF (46) | 6 | Voice |
| Interactive video | AF41 (34) | 4 | Video |
| Best effort | DF (0) | 0 | Best effort |
| Low priority (scavenger) | CS1 (8) | 1 | Background |
Mapping as recommended in RFC 8325.
Busy places
- Lecture theatres and stadiums: many small cells on 20 MHz channels, directional antennas under seating or overhead, low power, and 5 and 6 GHz only for the main SSID.
- Open plan offices: access points spread for capacity rather than reach, with band steering to 5 and 6 GHz.
- Healthcare and retail: devices with their own rules, such as medical carts and handhelds, tested before the design is signed.
- Outdoors: weather rated access points, the right antennas, and UK outdoor channel rules checked.
Warehouses: aim the energy where the scanners are
Swipe sideways to see the whole diagram.
Omni antennas on a high ceiling. Above about 10 metres an omni access point spreads much of its energy sideways into the roof space, and metal racking blocks the aisles. Coverage also changes as stock levels change, so last week's survey may not match today.
Directional antennas down the aisles. Patch antennas aim the energy down each aisle, where the scanners are. I design for the weakest handheld, often a 2.4 GHz scanner or a voice badge, then prove it with a walk test using the real devices. Large outdoor yards are where private 5G often wins.
Surveys
Measure, design, then measure again
A wireless design is a prediction until it is measured. A wireless project should run as a survey led lifecycle, and the survey project stays the living record of the RF.
Swipe sideways to see the whole diagram.
Every area gets a profile: who uses it, which devices, which applications, and the signal, SNR and overlap targets. The worst client in the area sets the targets.
The building is modelled in Ekahau AI Pro or Hamina with scaled plans and the real wall materials. Virtual access points get their actual antennas, and channels and power are planned.
For hard areas, such as lift lobbies, atriums and racking, a real access point goes on a stand at the planned spot and is measured. The design is adjusted before anything is ordered.
Cabling, PoE and switch ports are ready before the access points arrive. Each access point is mounted, named and tagged to the AP schedule, with configuration from templates.
After the install, a passive survey of every area, active throughput tests and a roaming walk test with the real devices prove the design. The validation report is the acceptance evidence.
Building works, new racking, new device types or drift in the assurance data trigger a fresh survey. Keeping the survey project current makes every later change faster.
From day 0 to handover
- Day 0: low level design from the survey: AP schedule, channel and power plan, VLAN and SSID matrix, NAC (network access control) policy. Cat 6A to every AP, multigigabit ports where needed, PoE budgets checked, DHCP and DNS ready, certificates and NTP in place.
- Day 1: configuration as code, access points staged and named by location, SSIDs brought up in order: corporate, IoT, then guest. Access control starts in monitor mode and is enforced once the logs are clean.
- Pilot: one floor with the real device fleet.
- Day 2: validation survey and roaming walk test, then handover with as built records, runbooks, monitoring and spares.
Power over Ethernet for access points
| Standard | Classes | At the switch | At the device | Typical use |
|---|---|---|---|---|
| 802.3af (PoE) | 0 to 3 | Up to 15.4 W | Up to 12.95 W | Older APs and phones |
| 802.3at (PoE+) | 4 | Up to 30 W | Up to 25.5 W | Many Wi-Fi 6 APs |
| 802.3bt Type 3 | 5 and 6 (45 and 60 W) | Up to 60 W | Up to 51 W | Wi-Fi 6E and 7 APs |
| 802.3bt Type 4 | 7 and 8 (75 and 90 W) | Up to 90 W | Up to 71.3 W | The largest APs and other devices |
An access point on too little power often runs with radios or ports turned off. I check the model's power needs and the switch's total budget.
Mobile and private 5G
When Wi-Fi is not enough, cellular fills the gap
Private 5G, cellular backup and cellular IoT sit alongside Wi-Fi, not against it. A site is split by what each area needs, and both join the same segments and policy.
Swipe sideways to see the whole diagram.
Private 5G. Devices use a SIM (subscriber identity module), so identity is built in. Small cells (gNodeB) carry the radio. The core's control plane, the AMF (access and mobility management function) and SMF (session management function), can sit on site or in the cloud. The user plane function (UPF) usually stays on site, so machine traffic never leaves the building. Traffic hands over at the N6 interface into a VRF (virtual routing and forwarding instance) behind a firewall, like any other segment. Typical users are MES (manufacturing execution system) terminals, cameras and AGVs (automated guided vehicles).
Wi-Fi and private 5G together. Wi-Fi 6E stays the best fit for dense indoor laptops and phones. Private 5G suits wide outdoor areas, fast moving vehicles and machines that need predictable performance in licensed or shared spectrum. The site is split by use, with identity and policy kept the same across both.
Cellular for branches. A 4G or 5G link is the quickest way to get a new site live, and a good backup for fibre. Satellite adds a third path for remote sites. SD-WAN steers traffic onto whichever link is healthy, and keeps bulk traffic off metered links. Cloud managed cellular routers, such as Cradlepoint with NetCloud, add SIM and data plan visibility.
Wi-Fi or private 5G?
| Wi-Fi 6E or 7 | Private 5G | |
|---|---|---|
| Best for | Dense indoor laptops and phones | Wide areas, vehicles, machines |
| Spectrum | Licence exempt | Licensed or shared access |
| Identity | 802.1X and certificates | SIM or eSIM |
| Mobility | Roaming, client led | Network led handover |
| Devices | Almost everything | Must support the band, such as n77 |
| Cost | Lower per device indoors | Fewer radios over large areas |
UK spectrum for private networks
Ofcom's shared access licences cover four bands:
- 1800 MHz (a small paired slice)
- 2300 MHz (2320 to 2340 and 2390 to 2400 MHz)
- 3.8 to 4.2 GHz, used as 5G band n77
- 26 GHz (24.25 to 27.5 GHz)
Local access licences can also reuse a mobile operator's spectrum where it is not in use. Most UK private 5G networks use 3.8 to 4.2 GHz.
| Generation | Radio (RAN) node | Core | What it means for an enterprise |
|---|---|---|---|
| 2G (GSM) | BTS | Circuit core, with GPRS (SGSN and GGSN) for data | Old alarm lines and IoT, due to go by 2033 |
| 3G (UMTS) | NodeB | As 2G, with packet data | Already switched off in the UK |
| 4G (LTE) | eNodeB | EPC: MME, S-GW and P-GW, HSS | Branch backup, temporary sites, LTE-M and NB-IoT |
| 5G (NR) | gNodeB | 5G core: AMF, SMF, UPF and others, built from services | Private 5G, slicing, RedCap devices |
Key: BTS is the base transceiver station. GPRS is the general packet radio service, and SGSN and GGSN are its serving and gateway support nodes. EPC is the evolved packet core. MME is the mobility management entity, S-GW and P-GW are the serving and packet gateways, and HSS is the home subscriber server. NB-IoT is narrowband IoT, LTE-M is LTE for machines, and RedCap is reduced capability 5G.
UK operators have switched off 3G, the last in 2025 and early 2026. The government expects 2G to go by 2033 at the latest, so any alarm line or IoT fleet still on 2G needs a plan now.
| NB-IoT | LTE-M | 5G RedCap | |
|---|---|---|---|
| Data rate (indicative) | Tens of kb/s | Up to about 1 Mb/s | Up to about 150 Mb/s down |
| Movement | Fixed or slow | Handover between cells | Full mobility |
| Voice | No | Yes | Yes |
| Battery | Years | Years | Days for wearables, up to years for sensors |
| Fits | Meters and sensors deep indoors | Trackers, alarms, wearables | Cameras, industrial sensors |
Satellite connectivity is also arriving inside the 3GPP standards, from Release 17 onwards, as another path for remote sites. Network slicing and massive machine type communications (mMTC) are 5G features to plan for, rather than defaults today.
Troubleshooting
Find the step that fails, then fix that step
Wireless complaints sound vague, but each one maps to a step in the connection. Pick a fault to see where it sits, what I check, and how I fix it.
Swipe sideways to see the whole diagram.
Cannot connect: 802.1X fails. Users see "cannot connect to this network", or are asked for a password again and again.
- Check: the ISE live log for the client's MAC address shows the policy set and the exact failure reason. Then
show wireless client mac-address <mac> detailon the controller, and a RadioActive trace withdebug wireless mac <mac>. - Usually: the client does not trust the ISE certificate (12321 for PEAP, 12520 for EAP-TLS, often followed by 5440). Other causes are a client certificate that has expired (12516) or comes from an unknown authority (12514), a user missing from the identity store (22056), or a wrong RADIUS shared secret or clock.
- Fix: push the trust chain and the supplicant profile from device management, renew certificates or correct the policy, then retest with the same device.
Connected, but no IP address. Full signal, but no internet. The device shows a 169.254 address or keeps "obtaining an IP address".
- Check: the client detail shows it stuck in the IP learn state. Then the VLAN on the policy profile or the one ISE returned, the DHCP relay (
ip helper-address) on the gateway, the trunk to a FlexConnect AP, and free addresses in the scope. - Usually: a wrong or missing VLAN, no DHCP relay, a VLAN not allowed on the AP trunk, or a full scope, common on guest networks with long leases.
- Fix: correct the VLAN or relay, shorten guest leases, and add the check to the build test plan.
Slow. Connected, but pages crawl and calls break up, often at busy times.
- Check: channel use and retries per radio (
show ap dot11 5ghz summaryand assurance), the client's band and data rate, and a survey of co channel interference. - Usually: too many access points on one channel at high power, 80 MHz channels in a dense area, low data rates left on, a slow legacy client, or clients held on 2.4 GHz.
- Fix: lower power and narrow channels, disable low data rates, steer clients to 5 and 6 GHz, and add capacity where the survey shows it.
Calls drop when people walk. Audio gaps or dropped calls between areas.
- Check: roam times in the RadioActive trace, whether 802.11r is on and supported, how many full 802.1X authentications ISE sees for the phone, overlap in the survey, and DFS channel changes on that floor.
- Usually: no fast roaming, so every roam repeats 802.1X; too little overlap; a Layer 3 roam with no mobility peer; or voice not marked EF (expedited forwarding) end to end.
- Fix: turn on 802.11r (in mixed mode if older clients need it), fix the overlap, keep voice floors off DFS channels, and run a roaming walk test with the real phones.
Sticky client. A device holds a weak link to a distant access point while a closer one is free.
- Check: the client's signal and data rate in the client detail, the access point's transmit power, and the lowest data rates allowed.
- Usually: access points set too loud, so the client never sees its signal fall, and low data rates that let it hang on.
- Fix: bring AP power down towards client power, disable 1, 2, 5.5, 6 and 9 Mb/s, and turn on 802.11k and v. Never fix it by turning power up.
Access point will not join. A new or moved access point never appears on the controller, or keeps rebooting.
- Check:
show wireless stats ap join summaryon the controller for the failed stage, then the AP console withdebug capwap client events. Confirm DHCP option 43 or the DNS nameCISCO-CAPWAP-CONTROLLER, the clock and certificates, and that UDP 5246 and 5247 pass any firewall. - On Aruba:
show ap databaseandshow ap activefor access points, andshow user-tablefor clients. - Usually: no controller address, a firewall blocking CAPWAP, a clock or certificate problem breaking DTLS, a country code mismatch, or an image download timing out over a slow WAN.
- Fix: fix discovery, open the ports, set NTP, prime the access point with its controllers, and pre stage images for remote sites.
Interference. Wi-Fi drops or slows in one area, often at certain times, even with good signal.
- Check: CleanAir air quality and interferer reports, channel changes and radar events in
show ap auto-rf dot11 5ghz, then a spectrum analyser on site. - Usually: video senders, microwave ovens, wireless cameras, Bluetooth on 2.4 GHz, or radar pushing access points off DFS channels.
- Fix: remove or move the source, change channels, keep critical floors off DFS channels, and move clients to 5 or 6 GHz.
The same method, applied to wired and WAN faults, is on the troubleshooting page. Terms are spelled out in the glossary.
Engagement
How I run a wireless programme, from survey to refresh
Wireless projects succeed or fail on the requirements and the survey. I agree what each area needs, make sure the RF is proven with real measurements, then build, validate and hand over an estate the support team can keep healthy.
Swipe sideways to see the whole diagram.
I start with what people do in each space: offices, meeting rooms, warehouses, yards or public areas. I agree success measures with the business, such as calls that never drop on a walk round, and who signs off each stage (a RACI: responsible, accountable, consulted, informed).
I write a requirement profile for each type of area: signal and SNR targets, clients per area, applications and roaming needs. The device list matters most, because the weakest client sets the design. Security needs become the SSID and identity matrix.
I collect scaled floor plans, wall materials, ceiling heights and racking, and the existing RF is surveyed for coverage and interference. I audit cabling, PoE budgets and switch ports, and read the service desk history to find where users already struggle.
A predictive design is built in Ekahau or Hamina, and the hard areas are confirmed with an access point on a stick. I choose the controller, resilience and switching mode. The design authority reviews the high and low level designs, and every decision is logged.
Access points go in to the AP schedule, with configuration from templates. A pilot floor runs with the real device fleet, then a validation survey and a roaming walk test prove the design. The validation report is the acceptance evidence.
I hand over runbooks for the faults users raise most, assurance dashboards with tuned alerts, spares and a returns process. Hypercare ends when the exit criteria are met: clean alerts, no open priority faults and a proven escalation path.
I keep controllers and access points on a supported software release and track end of life dates. Building changes trigger a fresh survey, and access points are refreshed by generation, usually to add 6 GHz and newer security.
Functional requirements
What it must do.
- Cover every agreed area for its use: data, voice, scanners, location or guests.
- Give corporate, IoT and guest users separate SSIDs or roles, each mapped to its own segment.
- Authenticate corporate users and devices with 802.1X and certificates through Cisco ISE.
- Let phones and handheld devices roam between access points without dropping a call.
- Give guests internet only access through a portal, with no path into the business network.
- Keep branch sites working through a WAN outage.
Non functional requirements
How well it must do it, with a number wherever one can be agreed.
- Coverage
- Minus 67 dBm with an SNR of 25 dB where voice is used, minus 70 dBm with 20 dB elsewhere.
- Capacity
- Clients per area and throughput per client agreed, with headroom for growth.
- Roaming
- Fast enough that calls do not drop: typically under 150 ms, and tens of milliseconds with 802.11r.
- Availability
- Controller failover with no client impact, and no single access point failure leaving an area without service.
- Security
- WPA3 where devices allow it, protected management frames on, rogue detection, and logs sent to the SIEM (security information and event management).
- Operability
- Configuration from templates, assurance dashboards and alerts, and a resurvey after building changes.
- Cost
- Access points, licences and cabling per square metre agreed and tracked.
These are typical starting targets. Each area gets its own numbers, and each number is checked in the validation survey.
Who I talk to
- Estates and facilities, for plans, ceilings and building works
- Workplace teams, for how each space is used
- Device owners: scanners, phones, medical or IoT kit
- Security, identity and the ISE team
- The service desk, for the complaints history
How I find out
- Walk rounds of every area type with the people who use it
- A survey of the current RF and the spectrum
- A cabling, PoE and switch port audit
- Device testing: bands, security support and roaming behaviour
- Reading the controller, ISE and assurance history
Discovery tools
| Tool or source | What it tells me |
|---|---|
| Ekahau AI Pro or Hamina, with a survey adapter | Signal, SNR, channel overlap and data rates on the real floor. |
| Spectrum analyser (Ekahau Sidekick) | Non Wi-Fi interference such as video senders, microwave ovens and radar. |
| Controller and Catalyst Center assurance | Client counts, channel use, retries and the failures users already see. |
| Cisco ISE live logs | Which devices authenticate, how, and why some fail. |
Switch audit: show power inline, show interfaces status | PoE budget, port speed and spare ports at each AP position. |
| Over the air packet capture (Wireshark) | How a client really associates, authenticates and roams. |
I trace a wireless fault by following the client through each step it takes to connect: radio, association, authentication, keys, IP address and traffic. The first step that fails is where the fault is.
My approach
- Scope. One client, one device type, one area, one SSID or everyone? Since when, and what changed?
- Radio. Check signal, SNR, channel use and retries where the client is, and whether the access point is up.
- Association. Check the client reached the run state, and which access point, band and data rate it uses.
- Identity. Read the ISE live log for the client: the policy matched, or the exact failure reason.
- IP and traffic. Check DHCP, the VLAN or policy profile, DNS and any access list applied to the client.
- Fix and record. Fix through change, retest with the same device, and update the survey if the RF changed.
Faults I see most
- Clients that do not trust the ISE certificate
- Clients stuck waiting for an IP address because of a VLAN or DHCP relay error
- Sticky clients holding on to a distant access point
- Over powered access points causing co channel interference
- Roams that drop calls because 802.11r is off or overlap is too low
- Access points that cannot join because of DHCP option 43, DNS or a firewall
Layer by layer
| Layer | What I check |
|---|---|
| 1 · Physical and RF | AP power and uplink (show power inline), channel, power and interference (show ap dot11 5ghz summary). |
| 2 · Data link | Association and run state (show wireless client mac-address <mac> detail), 802.1X, the 4 way handshake and roam history. |
| 3 · Network | Client IP address and VLAN, DHCP relay on the gateway, and AP join (show wireless stats ap join summary). |
| 4 · Transport | CAPWAP on UDP 5246 and 5247 through firewalls, RADIUS on 1812 and 1813, and the MTU (maximum transmission unit) on long WAN paths. |
| 5 to 7 · Application | DNS, captive portal redirects, application QoS (WMM to DSCP) and what the user really sees. |
For a step by step trace I use a RadioActive trace on the controller (debug wireless mac <mac>). My general method is on the troubleshooting page.
Wireless faults reach the service desk as "the Wi-Fi is slow", so I give the first line team simple checks and give engineers the right data.
Service model
Who owns access points, controllers, ISE, cabling and the building, with escalation times for each.
Assurance
Dashboards for client health, onboarding failures, channel use and AP status, with alerts tuned so each one matters.
Runbooks
Step by step guides for the top faults: cannot connect, no IP address, slow, roaming and an access point down.
Spares
Spare access points in stock, pre staged where possible, and a returns process with the vendor.
Change
Configuration changes through change control, tested on a pilot floor first, with RF changes recorded in the survey.
Problem management
Repeat faults, such as one floor that keeps dropping calls, get a root cause and a known error record. The lasting fix is often a design change or a resurvey, not another reboot.
Wireless has three clocks: software, RF and hardware. I plan for all three from the first design.
- Software. Controllers and access points stay on a recommended release, with rolling AP upgrades and in service software upgrades on controller pairs where supported.
- Security. Cisco advisories for the 9800 and access point images are triaged by risk. Critical fixes go through an emergency change, and the rest join the next upgrade window.
- RF. Building works, new racking or new walls trigger a resurvey. RRM history shows where coverage has drifted.
- Capacity. Quarterly reviews of client counts, channel use and airtime, area by area.
- Hardware. Access points and controllers are replaced before end of support. Older AireOS controllers move to the Catalyst 9800.
- Refresh. Each refresh adds what the business needs next, such as 6 GHz, Wi-Fi 7 or location services.
Projects
Where I have built and run it
Wireless runs through my work, from my own lab to public sector modernisation and telecoms design.
Nine access points across three sites
Three access points per site on their own VLAN, managed by a virtual Cisco wireless LAN controller, with Cisco ISE running as a virtual machine. It is my bench for proof of concept work and fault finding.
Public sector network modernisation
A public sector modernisation on Meraki, Nexus, FortiGate and Check Point, leading 7 engineers and third party suppliers.
Mobile network design
High level designs for Virgin Media O2 across the radio access network, core, transport, and the operations and business support systems (OSS and BSS), using TM Forum frameworks.
Multi vendor architecture
Architecture for enterprise clients that included Aruba, alongside Nexus, Viptela, Palo Alto and F5.
Backed by CCNP Enterprise, whose core exam covers RF, wireless architecture, roaming and wireless security, and by the Cisco Enterprise Core and Enterprise Design specialist certifications. See all credentials
Explore
More areas I design and deliver
Every page follows the same idea: how it works, the choices that matter, and where I have used it. The foundations pages explain the basics the others build on.