Building New Network and Need fast connection to central database between 20 wired and 20 wireless devices

Question

I'm planning the network for my company's new office space. I'm not an expert so I'd like to present my plan and ask y'all nice folk to tell me if and where I'm making mistakes.

Assumptions:

• Office is 7500 sq feet on 2 floors with wood floors and almost completely open space other than a couple of walls (dry wall)
• We currently have 8 wired Computers, 3 wireless printers (that could be wired) 10 BYOD devices mostly mobile phones and 6 VOIP phones.
• All computers must back up to a Central NAS -8 disk Synology Mirrored RAID (I'd like to use this because we have it)
• All Wired computers must Share files Cross platform to Network attached file server. Which I have yet to buy.
• Only one section of workstations transfer large amounts of data to and from file server the rest is mostly to and from internet.
• Need multiple wireless networks Internal and guest.
• Work stations are mostly all Apple but need to be able to have cross platform access to file server.

My current plan:

• Modem cisco provided by ISP
• Router Cisco with WLAN on to cover one end of building (Completely open warehouse space)
• Smart Switch Cisco SG200-24.
• Cisco Aironet 2800 Series Wireless AP to connect middle and other end of building both Up and Down stairs.
• Consumer grade AP probably a netgear router in AP mode for guest network
• All LANS connected to Switch.
• All VOIP connected to switch.
• NAS Backup connected to Switch
• File Server Connected to Switch
• Both APs Connected to switch - Create a VLAN for Netgear Guest WLAN to separate it from internal Network.

Questions:

1. For the wireless setup is the cisco 2800 overkill? And do I need a controller for that AP?
2. Do I really need to assign network priority to the VOIP phones?
3. I've read many documents on Trunking and still not sure about it. Is there an advantage to trunking the Switch to the Router?
4. Do I need to setup a VLAN for the guest AP or can I connect the AP to the router instead and by doing so will that separate it from my internal Network?

Answer 1

I too recommend a Wireless survey. This avoids dead spots and other issues. With 2.4Ghz APs, you only have 3 clear channels that do not overlap. 5Ghz isn't so much of a problem.

You might be able to get sufficient wireless coverage with 3 APs. Omni-directional antennas transmit like a bagel, Directly above and below aren't the best spot. Maybe two on the lower floor on the ceiling at each end and one on the second floor in the middle. Without a survey it'll be a guess, but we can apply some logic anyway. You can always lay it out and use the freebie Ekahau heat mapper to see what it looks like.

I highly recommend isolating your voice traffic from your LAN traffic with a voice VLAN. The SG200 switches are voice aware. A voice aware switch should use QoS to prioritize voice traffic above your other traffic to avoid jitter and lost of frames. Voice traffic uses UDP protocol which isn't reliable (but it's fast). Traffic is dropped if network congestion happens.

Some APs can do a Captive Portal mode where they either have a micro webserver or push the client to an external webserver (external from the AP). I advise you use something like this and have an Acceptable Use Policy that they must accept prior to accessing the internet. This limits your liability in the event they do something illegal.

Regarding the 2800 AP, it's a thin AP and on Cisco's site you will find a bullet that reads "Cisco Mobility Express and controller based". Cisco Mobility Express can be purchased with some of the more expensive switches (such as a 3650). Look for something like the 300 series. They support Captive Portal as well.

Your public network needs to be isolated from your internal traffic so people cannot access your business data. If you use VLAN, it must not have any route to your internal network. I recommend physical isolation so there is no chance of data leakage. Just pull a cable to a router network port (not a switched port but a VLAN or routed port). I also recommend using some kind of guest isolation so public wireless network users are not attempting to penetrate other public users devices.

Your wireless LAN can be on the same subnet as your LAN or on a different one. If different, it needs to be routed by your router. If your internal wireless users are going to have full network access, I'd just flatten it out to make it simple.

Your Router needs to be able to have virtual sub interfaces for VLAN or have multiple physical interfaces so you can send the guest traffic to the router directly. The Cisco RV215W has "Separate "virtual" networks to limit access to sensitive information" in it's description, so look at a router that has that kind of description. Whatever product you might choose, download and read the manuals to see if they will do what you need.

Wireless routers are not really that great. I have a Cisco RV180W at home and I loose a lot. Enough that I want to move it, but that complicates things because I have an AP in the back of the house (for the yard...), a NAS, a wired Blu-ray. Next purchase will be an AP that will be in the living room coat closet...I have it wired already for PoE.

Question - what is your phone system? Something hosted?

Look at web managed switches and APs such as Meraki - They are pretty cool and if you attend a webinar, you can get a switch and an ap for free. However the cost model is a subscription. If you get a subscription model device, buy with the most years you can get up front as the prices increase over time.

It's really a fairly simple network layout. You might need multiple connections to the router for each VLAN if it can't trunk like this:

Answer 2

If you want to do the Wi-Fi correctly, you need to perform a wireless site survey. I recommend you hire someone with expertise to perform this. The site survey will determine the number of WAPs, channels, radio power, sources of interference, and help to eliminate radio shadows. It will likely be the case that having the WAP built into the router is not optimal since router placement is constrained, which limits the WAP placement, and it can't be moved as necessary to respond to new sources of interference or other reasons.

You also need to make sure you don't exceed maximum cable lengths. Cable lengths will be (much) longer that a simple linear measurement. For instance, you need a 10' service loop at each end, and going up and down walls is often forgotten. The horizontal cable (solid-core) is limited to 90 meters, and you can have two 5 meter patch/workstation cables (stranded, one on each end).

If you want to provide seamless Wi-Fi roaming you may want a WLC.

You should probably check the legal problems you may create by allowing guest access to the Internet. Your company could be on the hook for bad things a guest user does from your network. Many companies now outsource this to a vendor which specializes in this to keep it all off the company network.

Trunking the layer-2 switch to a router is necessary if multiple VLANs are involved. You cannot get from one VLAN to another without going through a layer-3 device (router). A layer-3 switch can do it all internally because it has a router inside.