I'm planning the network for my company's new office space. I'm not an expert so I'd like to present my plan and ask y'all nice folk to tell me if and where I'm making mistakes.


  • Office is 300 sq meters on a single floor with mostly drywall walls.
  • We currently have 18 workers.
  • Due to expected growth, the office should support 50 workstations people comfortably.
  • We are a mobile app company so between our dev team and our testers we need wireless support for 200+ devices mostly smart phones.
  • Most of our traffic is to and from the internet rather than internal
  • Need multiple wireless networks (internal & guest at minimum)
  • No on site servers (other than developers running some locally for dev & testing).
  • All code, documentation, production servers, etc is cloud. (We use Dropbox for backup, Atlassian for JIRA & confluence, BitBucket for repos, S3 for servers, etc)
  • The ISP can provide 30MBps d/l and either 2 or 4 u/l
  • workstations are all Apple (network cards all 10/100/1000)

My current plan:

  1. 2 LAN drops per workstation, CAT5e wiring to a patch panel, should be around 100 terminations.
  2. Modem - Cisco 887. This is included in the ISP's package.
  3. Router / Firewall - Soekris 6501 running pfSense (http://soekris.com/products/net6501.html)
  4. Switch (wired) - HP 2510-48G, L2 fully managed, Gigabit. I'll start with one and only hook up the workstations in use. If I need more, I can add more.
  5. Wireless controller with a few wireless access points.
  6. Set up all LANs on the router.
  7. Trunk the wired switch to the router and use the wired switch as a dumb switch
  8. Connect the wireless controller to the router so it is physically separate from the main LAN.
  9. Set up 2 wireless networks with wireless authentication with WPA2


  1. For the Soekris, there are a bunch of options (RAM, CPU). Can I go with the basic or do I need to get the high end options?
  2. For the wireless setup, I don't fully understand the differences between and when to use a wireless controller and a wireless access point. Do I need both, one, none? I've spent a lot of hours reading and talking to folks and I still don't know what to get.
  3. My best guess for the above question is to get either the either the Cisco CT-2504-5 wireless controller or Netgear ProSafe 16-AP Wireless Management System along with either the Cisco or Netgear access points. Both controllers are around $1000 and seem to do the same stuff. Are there important diferences?
  4. As to the Access points, I'm also confused. Netgear has WNDAP350 and WNDAP360. Again, I can't understand the difference here.
  5. Do I really gain by trunking the switch to the router?
  6. Am I going overboard here? Did I plan a backhoe when all I need is a spade?
  • What's the size of your budget for all of this? Sounds like this is leaning toward the low-end and your budget may force you to not implement an ideal solution. May 30, 2013 at 1:09
  • You are correct that I'm leaning towards low cost. I still need to pull together a final shopping list and present it to the ceo for budget approval. No initial budget was given. Obviously, the less spent the better but he understands that he needs to pay a stable network. I'm guessing that's not uncommon. :)
    – SAR622
    May 30, 2013 at 3:48
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 3, 2021 at 1:40

7 Answers 7


A couple of thoughts. I can go into more detail on any of these if you need me to.

-When it comes to wireless, there are two ways to plan. One is for coverage, the other is for capacity. Based on the number of devices(capacity) and space(coverage) that you describe, I believe that capacity is going to the be the bigger deciding factor. Remember that wireless is like using an old-school hub. Everyone hears everything. That also means that only one client can talk to one AP at a time. This isn't a limitation of a device (Cisco vs. Netgear) this is a limitation of the physical medium (airspace). Since you are programming for mobile devices, which will only support a single stream, you should plan on 1 dual band AP per 50 devices. If you choose to only support 2.4 or 5Ghz (airspace issues with neighbor offices for instance), then plan on 1 AP per 30 devices.

-The Cisco 887 only has a 100Mb connection. If you keep with your current plan, and do all of your L3 routing on the 887, it will become a bottleneck for anything that routes between your internal networks. Examples include: Local replication for Dropbox, Wireless synching between i-devices and itunes, Copying files from machine A to B, Time machine backups, etc. etc. This bottleneck occurs because anytime data must flow from one network to another (wlan to lan) it will need to be routed, and must go out, and then back in, from the same 100Mb interface. This might not be a big deal, but I wanted to mention it, just-in-case.

-The Wireless controllers are a good idea. The initial setup takes a little while longer, but from that point on, it becomes super easy to deploy more AP's or WLAN's. I don't know anything about them from personal experience, but I have heard good things about the Meraki AP's. It is an cloud-based controller solution, which Cisco recently bought. EDIT for clarity: I don't know anything about the Meraki solution. I know A LOT about the Cisco Wireless Controllers :-).

-How are you powering your AP's? Do you plan on using VOIP in the future? Consider both of these when considering whether or not to order a switch with PoE.

-Also, just noticed, you are planning on putting a firewall in-line after the router. That further complicates your plan to route between subnets there. I would plan on purchasing an L3 switch. That would simplify the deployment considerably.

Hope this helps. Good luck.

  • 1
    Jonathan, regarding the Cisco 887 I was planning on just using it as a modem and the Soekris box will do all my routing. Going out to the internet I am not going to have anything faster than 100Mb and the Soekris is gigabit. As to the APs, why is VOIP a consideration? Also, PoE on my switch would only help if I'm running the APs off the switch and not the controller - correct?
    – SAR622
    May 29, 2013 at 21:20
  • 1
    Sorry, I was referring to PoE in regards to VOIP. The phones will require PoE if you implement VOIP. The AP's will plug into the switch, not the controller (at least for the Cisco solution). For that reason, you need to either plan on purchasing an injector and power supply for each AP, or buy a switch that supports PoE. If it were me, I would just purchase the switch. I'm not familiar with the Soekris box, but your plan makes sense to me now. May 29, 2013 at 21:31
  1. I've run similar devices to the Soekris with PFSense and M0n0wall. I can push quite a bit of traffic through them with fairly low specs. (On the order of 100Mbps)
  2. Wireless controllers gain you two big things. The first is centralized management. You can manage all your APs from one single interface. Need to add an SSID? Easy. Add it to the controller and it gets pushed to the APs. The second thing is centralized ACL enforcement. Typically (though not always) Wireless controllers tunnel the traffic back to itself and have a single egress point into the corporate network. This allows you to apply things like security zones at a single location instead of every place your AP is plugged in. It also allows you to have a single subnet for wireless clients across a larger network.
  3. Because of the size of your network I would recommend you look into Ubquiti Networks. They offer you the same gains of having a controller based network but without a controller and at a much lower price point. I've used them successfully in various single building deployments. If you're dead set on using one of your two options here you've selected the correct ones for your size.
  4. As far as specs these look almost identical from a brief scan of the tech specs. Perhaps one is to be ceiling mounted the other is a desktop version?
  5. The main thing you gain is being able to create different egress points from different VLANs. You can use the router to set up different sub interfaces per VLAN. So for your guest wireless network you could put them on VLAN 50 while the rest of your internal clients are on VLAN 10. You could then apply security policies about what traffic is allowed between the two VLANs.
  6. Nope.

Edit: From a wireless perspective if you have all 200 devices trying to access resources at the same time you might find yourself in a bit of a jam if you've only got a handful of APs handling the traffic. I would recommend you keep a close eye on your usage when you finish your deployment and see if you need to add more density to your wireless infrastructure. Now only having 18 employees and mobile devices it would be hard to have them all push enough traffic to matter, but as you grow I would keep an eye on it so you don't run into any problems. Only one client can talk at a time on a wireless network (per AP/Frequency). So ensuring you've got enough available bandwidth is of the utmost importance.


Disclaimer: Answer appears to come from an HP PreSales Solution Architect. (Discuss this on meta).

OK. I spotted one issue straight away. you want to use a 2510-48G Switch, and you want WLAN AP's. How are you going to power those AP's? I guess you could use power adaptors and plug them into the wall sockets, but you really want to be looking at a PoE switch to power them up. Secondly, HP announced the 2530 series in December and with that the EOL of the 2510 series.

So, as an HPN PreSales Solution Architect here is my recomendation:

  1. You could use your Cisco 877 as your local router as well. Its only got 4x100Mb connectivity to the LAN. If your ISP offers a wires only service, then investigate other routers as well. The Cisco 877 is now EOL, and no longer being sold. HP has the MSR930 series with 4x GbE uplinks, and an embedded firewall.
  2. Wireless. Consider coverage versus capacity first. You require 200x devices to connect, but only 18x users today. So assuming that not every device is on the network at any one time, you could probably get away with clustered AP's. This allows a single AP to control other AP's as well. From HP you could look at the M220 Access Point where up to 10x AP's could be controlled as one.
  3. If you want a managed WLAN solution, have you considered the MSM720 WLAN controller ? Lifetime warranty and support for up to 40x AP's (10 out of the box), then use the MSM430 Access Points
  4. Looking at the Netgear page for the WNDAP360 it seems that the only difference is, "Easy ceiling mounting/wall mounting". It makes no mention of Dual Spatial Stream, so I assume that the maximum support per radio is 150Mbps.
  5. Define Trunking? Assuming you mean Link Aggregation, and not the Cisco term with regard to multiple VLANs on same link? Link aggregation offers more performance and greater resilience should one of the links fail.
  6. Nope. Remember, at the end of the day, whatever you provide has to weigh up the will it make me money? Will it save me money? Will it reduce our risk? You have to weigh them up against each other.
  • oh, and don't forget you really should be keeping a close eye on monitoring and managing any network of any size.
    – Jez
    May 29, 2013 at 18:07
  • You suggestion of clustered APs sounds great and almost too good to be true. Large, easy to manage wifi network, without a controller. It means that the first one is wired to my switch or router and the rest are physically independant but extend my network and as I add more APs, extend the network's carrying capacity. Did I get that right? Wouldn't this create a bottleneck for wireless traffic?
    – SAR622
    May 30, 2013 at 8:49

Wireless controllers are intended to coordinate the rf of access points and enable client roaming between the access points. You can check out the Cisco design zone to help with your design.

  • So I wire the APs to the wireless controller or they are all wired in parallel to the switch?
    – SAR622
    May 30, 2013 at 3:50
  • Direct connections are not required in most cases. They just need to have connectivity to the controller. A Cat 3850 as the controller functionality is built into the switch. It does require the AP to be directly connected.
    – henklu
    May 31, 2013 at 18:45

Personally I would not go with simple WPA2 but with EAP, also make sure you disallow communication between clients.


I echo bigmstone 's suggestion of Ubiquiti Networks for your WLAN. I've deployed them at multiple sites, and they work really well. They offer multiple versions, but I would really recommend the UAP-PRO because it uses true 802.3af (versus passive POE in the lower end models) (see the difference here)

If you go with ubiquity APs, you might also want to look into their EdgeSwitch. It supports 802.3af POE as well as passive POE (which as I mentioned, their cheaper APs use.) the support for passive POE is great, because then you don't need all those gangly POE adapters.

Like bigmstone said, you don't need a controller to use the APs, but you do need one to set the APs up initially. Luckily, the controller software is free and very easy to use, and if you're ambitious, for a cheap permanent controller, the Raspberry Pi works very well!


You need a wired network (Ethernet switches) and a wireless network along with a security appliance / multilayer gateway (ALG). The ISP/WAN is Ethernet handoff.
BYOD, LAN Management, IPS/NGFW

Controller-based WLANs are outdated.

(Biased answer from a Cisco-centric integrator)
Get a Meraki MX100, Cisco WS-C2960X-48TS-LL, and (3) Meraki MR32 APs.

  • "Controller-based WLANs are outdated." Really? So no one (like Cisco) sells, manufacturers or is planning to release new controller platforms? Meraki has it's strengths, but it also has some serious flaws as a solution and I for one will not install it anywhere personally as it stands today.
    – YLearn
    May 31, 2015 at 4:35
  • The controller-based architecture, namely LWAPP/CAPWAP tunnels, is outdated - especially when one considers the planning and design of 802.11ac (gigabit wireless) coupled with advanced functionality requiring L7 visibility. You will find that a new architecture is desired, namely an SDN fashioned system (such as Meraki) with true separation of control and data planes. Be sure and reverse your down vote in the future when you see the light. May 31, 2015 at 15:41
  • So the assumption is that controllers can't provide L7 visibility or SDN capabilities? And that Meraki provides the full functionaltiy of a controller based solution? Sorry, can't image seeing that light for a while.
    – YLearn
    Jun 1, 2015 at 1:31
  • Read up on Cisco Clean Access. Why do they require customers to install costly 3850 switches? To terminate the CAPWAP tunnel local. Why? Have you ever actually done your homework and thought about it? Jun 1, 2015 at 1:57
  • Just did a 100+ AP PoC with Cisco Clean Access 802.11ac APs. Didn't require 3850 switches at all. There are reasons to run 3850s, but they aren't required. And the annual operational costs on Meraki are so inexpensive? This is not the forum for this discussion, and I am well versed in wireless solutions from a number of vendors so you are unlikely to convince me Meraki is the future of wireless since I know so many of it's flaws.
    – YLearn
    Jun 1, 2015 at 3:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.