Building new network and need 200+ wireless devices

Question

I'm planning the network for my company's new office space. I'm not an expert so I'd like to present my plan and ask y'all nice folk to tell me if and where I'm making mistakes.

Assumptions:

• Office is 300 sq meters on a single floor with mostly drywall walls.
• We currently have 18 workers.
• Due to expected growth, the office should support 50 workstations people comfortably.
• We are a mobile app company so between our dev team and our testers we need wireless support for 200+ devices mostly smart phones.
• Most of our traffic is to and from the internet rather than internal
• Need multiple wireless networks (internal & guest at minimum)
• No on site servers (other than developers running some locally for dev & testing).
• All code, documentation, production servers, etc is cloud. (We use Dropbox for backup, Atlassian for JIRA & confluence, BitBucket for repos, S3 for servers, etc)
• The ISP can provide 30MBps d/l and either 2 or 4 u/l
• workstations are all Apple (network cards all 10/100/1000)

My current plan:

1. 2 LAN drops per workstation, CAT5e wiring to a patch panel, should be around 100 terminations.
2. Modem - Cisco 887. This is included in the ISP's package.
3. Router / Firewall - Soekris 6501 running pfSense (http://soekris.com/products/net6501.html)
4. Switch (wired) - HP 2510-48G, L2 fully managed, Gigabit. I'll start with one and only hook up the workstations in use. If I need more, I can add more.
5. Wireless controller with a few wireless access points.
6. Set up all LANs on the router.
7. Trunk the wired switch to the router and use the wired switch as a dumb switch
8. Connect the wireless controller to the router so it is physically separate from the main LAN.
9. Set up 2 wireless networks with wireless authentication with WPA2

Questions:

1. For the Soekris, there are a bunch of options (RAM, CPU). Can I go with the basic or do I need to get the high end options?
2. For the wireless setup, I don't fully understand the differences between and when to use a wireless controller and a wireless access point. Do I need both, one, none? I've spent a lot of hours reading and talking to folks and I still don't know what to get.
3. My best guess for the above question is to get either the either the Cisco CT-2504-5 wireless controller or Netgear ProSafe 16-AP Wireless Management System along with either the Cisco or Netgear access points. Both controllers are around $1000 and seem to do the same stuff. Are there important diferences?
4. As to the Access points, I'm also confused. Netgear has WNDAP350 and WNDAP360. Again, I can't understand the difference here.
5. Do I really gain by trunking the switch to the router?
6. Am I going overboard here? Did I plan a backhoe when all I need is a spade?

Answer 1

A couple of thoughts. I can go into more detail on any of these if you need me to.

-When it comes to wireless, there are two ways to plan. One is for coverage, the other is for capacity. Based on the number of devices(capacity) and space(coverage) that you describe, I believe that capacity is going to the be the bigger deciding factor. Remember that wireless is like using an old-school hub. Everyone hears everything. That also means that only one client can talk to one AP at a time. This isn't a limitation of a device (Cisco vs. Netgear) this is a limitation of the physical medium (airspace). Since you are programming for mobile devices, which will only support a single stream, you should plan on 1 dual band AP per 50 devices. If you choose to only support 2.4 or 5Ghz (airspace issues with neighbor offices for instance), then plan on 1 AP per 30 devices.

-The Cisco 887 only has a 100Mb connection. If you keep with your current plan, and do all of your L3 routing on the 887, it will become a bottleneck for anything that routes between your internal networks. Examples include: Local replication for Dropbox, Wireless synching between i-devices and itunes, Copying files from machine A to B, Time machine backups, etc. etc. This bottleneck occurs because anytime data must flow from one network to another (wlan to lan) it will need to be routed, and must go out, and then back in, from the same 100Mb interface. This might not be a big deal, but I wanted to mention it, just-in-case.

-The Wireless controllers are a good idea. The initial setup takes a little while longer, but from that point on, it becomes super easy to deploy more AP's or WLAN's. I don't know anything about them from personal experience, but I have heard good things about the Meraki AP's. It is an cloud-based controller solution, which Cisco recently bought. EDIT for clarity: I don't know anything about the Meraki solution. I know A LOT about the Cisco Wireless Controllers :-).

-How are you powering your AP's? Do you plan on using VOIP in the future? Consider both of these when considering whether or not to order a switch with PoE.

-Also, just noticed, you are planning on putting a firewall in-line after the router. That further complicates your plan to route between subnets there. I would plan on purchasing an L3 switch. That would simplify the deployment considerably.

Hope this helps. Good luck.

Answer 2

1. I've run similar devices to the Soekris with PFSense and M0n0wall. I can push quite a bit of traffic through them with fairly low specs. (On the order of 100Mbps)
2. Wireless controllers gain you two big things. The first is centralized management. You can manage all your APs from one single interface. Need to add an SSID? Easy. Add it to the controller and it gets pushed to the APs. The second thing is centralized ACL enforcement. Typically (though not always) Wireless controllers tunnel the traffic back to itself and have a single egress point into the corporate network. This allows you to apply things like security zones at a single location instead of every place your AP is plugged in. It also allows you to have a single subnet for wireless clients across a larger network.
3. Because of the size of your network I would recommend you look into Ubquiti Networks. They offer you the same gains of having a controller based network but without a controller and at a much lower price point. I've used them successfully in various single building deployments. If you're dead set on using one of your two options here you've selected the correct ones for your size.
4. As far as specs these look almost identical from a brief scan of the tech specs. Perhaps one is to be ceiling mounted the other is a desktop version?
5. The main thing you gain is being able to create different egress points from different VLANs. You can use the router to set up different sub interfaces per VLAN. So for your guest wireless network you could put them on VLAN 50 while the rest of your internal clients are on VLAN 10. You could then apply security policies about what traffic is allowed between the two VLANs.
6. Nope.

Edit: From a wireless perspective if you have all 200 devices trying to access resources at the same time you might find yourself in a bit of a jam if you've only got a handful of APs handling the traffic. I would recommend you keep a close eye on your usage when you finish your deployment and see if you need to add more density to your wireless infrastructure. Now only having 18 employees and mobile devices it would be hard to have them all push enough traffic to matter, but as you grow I would keep an eye on it so you don't run into any problems. Only one client can talk at a time on a wireless network (per AP/Frequency). So ensuring you've got enough available bandwidth is of the utmost importance.

Answer 3

Disclaimer: Answer appears to come from an HP PreSales Solution Architect. (Discuss this on meta).

OK. I spotted one issue straight away. you want to use a 2510-48G Switch, and you want WLAN AP's. How are you going to power those AP's? I guess you could use power adaptors and plug them into the wall sockets, but you really want to be looking at a PoE switch to power them up. Secondly, HP announced the 2530 series in December and with that the EOL of the 2510 series.

So, as an HPN PreSales Solution Architect here is my recomendation:

1. You could use your Cisco 877 as your local router as well. Its only got 4x100Mb connectivity to the LAN. If your ISP offers a wires only service, then investigate other routers as well. The Cisco 877 is now EOL, and no longer being sold. HP has the MSR930 series with 4x GbE uplinks, and an embedded firewall.
2. Wireless. Consider coverage versus capacity first. You require 200x devices to connect, but only 18x users today. So assuming that not every device is on the network at any one time, you could probably get away with clustered AP's. This allows a single AP to control other AP's as well. From HP you could look at the M220 Access Point where up to 10x AP's could be controlled as one.
3. If you want a managed WLAN solution, have you considered the MSM720 WLAN controller ? Lifetime warranty and support for up to 40x AP's (10 out of the box), then use the MSM430 Access Points
4. Looking at the Netgear page for the WNDAP360 it seems that the only difference is, "Easy ceiling mounting/wall mounting". It makes no mention of Dual Spatial Stream, so I assume that the maximum support per radio is 150Mbps.
5. Define Trunking? Assuming you mean Link Aggregation, and not the Cisco term with regard to multiple VLANs on same link? Link aggregation offers more performance and greater resilience should one of the links fail.
6. Nope. Remember, at the end of the day, whatever you provide has to weigh up the will it make me money? Will it save me money? Will it reduce our risk? You have to weigh them up against each other.

Answer 4

Wireless controllers are intended to coordinate the rf of access points and enable client roaming between the access points. You can check out the Cisco design zone to help with your design.

Answer 5

Personally I would not go with simple WPA2 but with EAP, also make sure you disallow communication between clients.

Answer 6

I echo bigmstone 's suggestion of Ubiquiti Networks for your WLAN. I've deployed them at multiple sites, and they work really well. They offer multiple versions, but I would really recommend the UAP-PRO because it uses true 802.3af (versus passive POE in the lower end models) (see the difference here)

If you go with ubiquity APs, you might also want to look into their EdgeSwitch. It supports 802.3af POE as well as passive POE (which as I mentioned, their cheaper APs use.) the support for passive POE is great, because then you don't need all those gangly POE adapters.

Like bigmstone said, you don't need a controller to use the APs, but you do need one to set the APs up initially. Luckily, the controller software is free and very easy to use, and if you're ambitious, for a cheap permanent controller, the Raspberry Pi works very well!

Answer 7

You need a wired network (Ethernet switches) and a wireless network along with a security appliance / multilayer gateway (ALG). The ISP/WAN is Ethernet handoff.
BYOD, LAN Management, IPS/NGFW

Controller-based WLANs are outdated.

(Biased answer from a Cisco-centric integrator)
Get a Meraki MX100, Cisco WS-C2960X-48TS-LL, and (3) Meraki MR32 APs.