I'm planning the network for my company's new office space. I'm not an expert so I'd like to present my plan and ask y'all nice folk to tell me if and where I'm making mistakes.


  • Office is 7500 sq feet on 2 floors with wood floors and almost completely open space other than a couple of walls (dry wall)
  • We currently have 8 wired Computers, 3 wireless printers (that could be wired) 10 BYOD devices mostly mobile phones and 6 VOIP phones.
  • All computers must back up to a Central NAS -8 disk Synology Mirrored RAID (I'd like to use this because we have it)
  • All Wired computers must Share files Cross platform to Network attached file server. Which I have yet to buy.
  • Only one section of workstations transfer large amounts of data to and from file server the rest is mostly to and from internet.
  • Need multiple wireless networks Internal and guest.
  • Work stations are mostly all Apple but need to be able to have cross platform access to file server.

My current plan:

  • Modem cisco provided by ISP
  • Router Cisco with WLAN on to cover one end of building (Completely open warehouse space)
  • Smart Switch Cisco SG200-24.
  • Cisco Aironet 2800 Series Wireless AP to connect middle and other end of building both Up and Down stairs.
  • Consumer grade AP probably a netgear router in AP mode for guest network
  • All LANS connected to Switch.
  • All VOIP connected to switch.
  • NAS Backup connected to Switch
  • File Server Connected to Switch
  • Both APs Connected to switch - Create a VLAN for Netgear Guest WLAN to separate it from internal Network.


  1. For the wireless setup is the cisco 2800 overkill? And do I need a controller for that AP?
  2. Do I really need to assign network priority to the VOIP phones?
  3. I've read many documents on Trunking and still not sure about it. Is there an advantage to trunking the Switch to the Router?
  4. Do I need to setup a VLAN for the guest AP or can I connect the AP to the router instead and by doing so will that separate it from my internal Network?
  • (2) Meraki MR53 AP's and (1) Meraki MS350-24x Sep 12, 2016 at 1:31
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7, 2017 at 21:27

2 Answers 2


I too recommend a Wireless survey. This avoids dead spots and other issues. With 2.4Ghz APs, you only have 3 clear channels that do not overlap. 5Ghz isn't so much of a problem.

You might be able to get sufficient wireless coverage with 3 APs. Omni-directional antennas transmit like a bagel, Directly above and below aren't the best spot. Maybe two on the lower floor on the ceiling at each end and one on the second floor in the middle. Without a survey it'll be a guess, but we can apply some logic anyway. You can always lay it out and use the freebie Ekahau heat mapper to see what it looks like.

I highly recommend isolating your voice traffic from your LAN traffic with a voice VLAN. The SG200 switches are voice aware. A voice aware switch should use QoS to prioritize voice traffic above your other traffic to avoid jitter and lost of frames. Voice traffic uses UDP protocol which isn't reliable (but it's fast). Traffic is dropped if network congestion happens.

Some APs can do a Captive Portal mode where they either have a micro webserver or push the client to an external webserver (external from the AP). I advise you use something like this and have an Acceptable Use Policy that they must accept prior to accessing the internet. This limits your liability in the event they do something illegal.

Regarding the 2800 AP, it's a thin AP and on Cisco's site you will find a bullet that reads "Cisco Mobility Express and controller based". Cisco Mobility Express can be purchased with some of the more expensive switches (such as a 3650). Look for something like the 300 series. They support Captive Portal as well.

Your public network needs to be isolated from your internal traffic so people cannot access your business data. If you use VLAN, it must not have any route to your internal network. I recommend physical isolation so there is no chance of data leakage. Just pull a cable to a router network port (not a switched port but a VLAN or routed port). I also recommend using some kind of guest isolation so public wireless network users are not attempting to penetrate other public users devices.

Your wireless LAN can be on the same subnet as your LAN or on a different one. If different, it needs to be routed by your router. If your internal wireless users are going to have full network access, I'd just flatten it out to make it simple.

Your Router needs to be able to have virtual sub interfaces for VLAN or have multiple physical interfaces so you can send the guest traffic to the router directly. The Cisco RV215W has "Separate "virtual" networks to limit access to sensitive information" in it's description, so look at a router that has that kind of description. Whatever product you might choose, download and read the manuals to see if they will do what you need.

Wireless routers are not really that great. I have a Cisco RV180W at home and I loose a lot. Enough that I want to move it, but that complicates things because I have an AP in the back of the house (for the yard...), a NAS, a wired Blu-ray. Next purchase will be an AP that will be in the living room coat closet...I have it wired already for PoE.

Question - what is your phone system? Something hosted?

Look at web managed switches and APs such as Meraki - They are pretty cool and if you attend a webinar, you can get a switch and an ap for free. However the cost model is a subscription. If you get a subscription model device, buy with the most years you can get up front as the prices increase over time.enter image description here

It's really a fairly simple network layout. You might need multiple connections to the router for each VLAN if it can't trunk like this:enter image description here


If you want to do the Wi-Fi correctly, you need to perform a wireless site survey. I recommend you hire someone with expertise to perform this. The site survey will determine the number of WAPs, channels, radio power, sources of interference, and help to eliminate radio shadows. It will likely be the case that having the WAP built into the router is not optimal since router placement is constrained, which limits the WAP placement, and it can't be moved as necessary to respond to new sources of interference or other reasons.

You also need to make sure you don't exceed maximum cable lengths. Cable lengths will be (much) longer that a simple linear measurement. For instance, you need a 10' service loop at each end, and going up and down walls is often forgotten. The horizontal cable (solid-core) is limited to 90 meters, and you can have two 5 meter patch/workstation cables (stranded, one on each end).

If you want to provide seamless Wi-Fi roaming you may want a WLC.

You should probably check the legal problems you may create by allowing guest access to the Internet. Your company could be on the hook for bad things a guest user does from your network. Many companies now outsource this to a vendor which specializes in this to keep it all off the company network.

Trunking the layer-2 switch to a router is necessary if multiple VLANs are involved. You cannot get from one VLAN to another without going through a layer-3 device (router). A layer-3 switch can do it all internally because it has a router inside.

  • Thank you. This is a small business. There has been a site survey and cables CAT5e are already in place throughout the building. I should have mentioned I'm picking up where someone left off and did not leave a network map or any info. time was spent tracing wires and building a map. building is isolated in part of town that has only 2 other Wireless signals showing up very weak. I've scanned frequencies and adjust radio power/channel accordingly. Doesn't have to be seamless. Is router before switch best for file transfers LAN-WLAN or should I use VLAN for WAN connected to switch-Routers? Mar 13, 2016 at 22:47
  • Questions about "best" are broad and lead to opinion-based answers which are off-topic here. Only you can decide what is best for your particular situation. We can help provide guidance, but we would need to know a lot of information which is currently missing. Normally, it doesn't make much sense to put the switch between the WAN and the WAN router, but there may be legitimate reasons for doing so.
    – Ron Maupin
    Mar 13, 2016 at 23:07
  • Completely understood. I'll ask more direct questions. In the configuration I have outlined will the LAN Packets be sent to Switch then router back to switch for internal data (non internet)? And do you see any major bottlenecks in my config. Mar 13, 2016 at 23:23
  • With a single layer-2 switch, multiple VLANs, and a single router, all inter-VLAN traffic will need to go through the router. This is often handled with a layer-3 switch. By the way, you didn't detail what firewall you are going to use to protect the network. Some firewalls can also route, and you need to think about how you want that to work. Normally, that would be what connects direct to the WAN from the ISP.
    – Ron Maupin
    Mar 14, 2016 at 0:17
  • Yes forgot to put down firewall which I have. If I do not use multiple VLANs will the traffic still go through router? Does that create a noticeable bottleneck? If so what configuration would you suggest to get better speeds for file transfer between the WLAN and LAN? Mar 14, 2016 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.