A modern office is unimaginable without stable and fast wireless internet access. The proper Wi-Fi network setup directly impacts employee productivity, the quality of video conferences, and the security of corporate data. Haphazardly scattered routers from an electronics store are a recipe for constant connection interruptions and vulnerabilities that can cost a company its reputation.
Professional LAN design requires careful analysis of the room layout, calculation of the number of users, and selection of specialized equipment. Unlike home solutions, corporate solutions require centralized management, seamless roaming, and traffic sharing. In this article, we'll cover all the steps involved in creating a reliable infrastructure that will last for years to come.
Before purchasing equipment, it is necessary to conduct an audit of the territory and determine the potential load. Access point The Access Point should be installed where it's physically needed, not where a free outlet is available. Ignoring this step leads to "dead zones" and signal interference.
Planning begins with a technical specification that takes into account walls, partitions, and sources of interference. Metal structures and thick concrete significantly weaken the signal, requiring denser equipment placement or the use of external antennas. It's important to understand that coverage and network capacity are different parameters, and capacity is often prioritized in high-traffic areas.
Selection of architecture and equipment
For a medium to large office, using a "one router for several rooms" setup is a mistake. The correct solution is an architecture based on controller, which manages all access points as a single unit. The controller can be a physical device, server-based software, or a cloud service, making it easy to scale the network without interrupting operations.
When choosing access points, you should focus on the standard Wi-Fi 6 (802.11ax), which provides high speed and efficiency in conditions of dense airborne noise. Old standards like 802.11n are no longer able to handle the load of dozens of simultaneously connected smartphones and laptops. Technology support is also a key parameter. PoE (Power over Ethernet), which allows power and data to be transmitted over a single cable.
Switches must support the standard 802.3af/at To power access points. If you can't run separate power lines, having PoE ports on your switch is critical. This eliminates the need for extra power supplies hanging in the ceiling and reduces the risk of fire.
⚠️ Attention: Do not attempt to power professional access points using cheap PoE injectors or passive adapters without first checking the voltage. This could damage expensive network equipment and void the warranty.
Network administration often requires access to the controller's console or web interface. A typical login sequence might look like this:
ssh admin@controller_ip_addresspassword:
> system set timezone Europe/Moscow
Coverage design and point placement
Effective Wi-Fi coverage is achieved not by maximizing transmitter power, but by carefully positioning them. High power often causes client devices to lock onto a distant access point with weak signal strength instead of switching to a nearby one. This phenomenon is called a "sticky client" and significantly reduces overall throughput.
When placing access points, consider the antenna pattern. Most office access points have a circular pattern in the horizontal plane, so they are best placed in the center of the coverage area, such as in hallways or on the ceiling in open spaces. Walls and metal cabinets should be kept out of the antennas' direct line of sight, if possible.
Features of installation in suspended ceilings
When mounting access points behind a suspended ceiling (like Armstrong), the signal strength can drop by 30-50%. In such cases, it is recommended to use access points with external antennas or install antennas through special openings in the ceiling tiles.
The distance between access points depends on the wall materials and the required speed. For offices with plasterboard partitions, a radius of 15-20 meters from one access point is considered optimal. If the office has many glass partitions with a metalized coating, the range may be reduced to 10 meters.
Ensuring coverage overlap (approximately 15-20%) is essential for proper roaming operation. However, excessive overlap will lead to channel interference, so balance is crucial. Visualizing coverage using heatmaps during the design phase helps avoid errors.
Setting up channels and frequency ranges
Proper frequency distribution is essential for stable network operation. The 2.4 GHz band has only three non-overlapping channels (1, 6, 11), making it extremely susceptible to interference in office buildings. The 5 GHz band offers significantly more channels and should be used as the primary data transmission band.
Modern controllers can automatically select the least congested channels and regulate transmitter power (RRM – Radio Resource Management). However, relying blindly on these automatic controls is not recommended: in densely populated areas, the algorithms may malfunction, constantly changing parameters and causing short-term connection interruptions.
☑️ Checking the frequency plan
Channel width also plays an important role. For the 5 GHz band in office environments, a channel width of 40 MHz is often recommended instead of 80 MHz. This allows for more non-overlapping channels and reduces noise, resulting in a more stable, albeit slightly slower, connection under ideal conditions.
| Parameter | 2.4 GHz band | 5 GHz band | 6 GHz band (Wi-Fi 6E) |
|---|---|---|---|
| Number of channels | 3 (non-intersecting) | 19-25 (depending on the region) | 59+ (very wide) |
| Penetration | High | Average | Low |
| Maximum speed | Low | High | Extreme |
| Recommendation | Only for IoT and legacy devices | The main range for work | For VR/AR and high-speed transmission |
Please note that settings may vary depending on the legislation of your country. In some regions, the use of certain channels in the 5 GHz band (DFS channels) requires mandatory support from meteorological service radars. If the access point detects radar, it is required to immediately change the channel, which may cause a brief connection interruption.
Security organization and segmentation
Corporate network security begins with traffic segregation. Employees, guests, and IoT devices (printers, cameras, smart kettles) shouldn't be kept in the same space. A separate network is created for each user type. VLAN (Virtual Local Area Network), which logically isolates data flows from each other.
It is best to use a protocol to authorize employees WPA2-Enterprise or WPA3-Enterprise with server integration RADIUSThis allows access to be granted using individual logins and passwords, as well as automatically disabling access for terminated employees, without changing the shared encryption key for everyone.
The guest network should be completely isolated from the company's internal infrastructure. Firewall rules should block all incoming connections from the guest network to the corporate network, allowing only internet access. It's also a good idea to limit the speed of guest users to prevent them from sabotaging the work of key employees.
⚠️ Attention: The WEP encryption protocol and even WPA-Personal (with a single shared password) are considered obsolete and unsafe for corporate use. Upgrading to WPA3-Enterprise is mandatory to comply with modern information security standards.
Setting up seamless roaming
Employees in the office are constantly moving: from their office to the conference room, the kitchen, or the break area. If a video call drops or freezes for a few seconds when moving between access points, it means roaming is configured incorrectly. 802.11r (Fast BSS Transition) allows devices to quickly switch between points without re-authorization.
For roaming to function correctly, all access points must operate in a single mobility domain and have synchronized time. It's also important to properly configure the Minimum Data Rate thresholds. If a device detects a signal weaker than the set threshold, the controller forcibly disconnects it, forcing it to search for a point with a better signal.
A common problem is the client getting stuck on a distant point. This can be solved by setting up a function known as Band Steering or Client SteeringThe controller actively "pushes" dual-band devices (supporting 5 GHz) to switch to the less crowded band, leaving 2.4 GHz only for legacy devices.
Network monitoring and maintenance
The administrator's work doesn't end once the network is up and running. Constantly monitoring access point status, channel load, and error rates is essential to prevent failures. Modern management systems allow you to receive notifications via Telegram or email if any access point goes down.
Security audits and firmware updates should be performed regularly. Manufacturers frequently release patches that address vulnerabilities in encryption protocols. It's best to perform updates automatically at night, after backing up the configuration.
Documentation is another critical aspect. The point-to-point diagram, VLAN map, and IP address and password list must be up-to-date. This will save hours of troubleshooting in the event of a disaster. Use network documentation systems (DCIM) or at least up-to-date Visio diagrams.
How often should I change my hardware administrator passwords?
Passwords for accessing network equipment (controllers, switches) should be changed at least quarterly and immediately after the termination of any employee who had access to them. Use complex character sets and two-factor authentication where possible.
Can Mesh systems be used in an office?
Mesh systems are only suitable for very small spaces or as a temporary solution in an office. For permanent operation, they are inferior to traditional wired architecture in terms of stability, backhaul speed (connection between nodes), and fine-grained security settings.
What to do if employees complain about slow Wi-Fi?
First, check to see if the 2.4 GHz band is overloaded. This can often be resolved by simply disabling this band on access points or reducing its power to force devices to switch to 5 GHz. Also, check to see if anyone is downloading torrents or running a background OS update on a dozen machines simultaneously.
Setting up a Wi-Fi network in an office is a complex task that requires balancing performance, security, and budget. Investments in high-quality equipment and proper design pay off in reduced downtime and increased team productivity. Don't skimp on infrastructure, which is the lifeblood of your business.