A buyer’s guide · Operating since 2002
Ask anyone in an organisation what is wrong with the network and they will describe a room. The training room. The auditorium. The canteen at lunchtime. Almost always the signal is full and almost always the network is unusable, and those two facts together point at the same design mistake.
This page is about the campus layer: how wireless should be surveyed and designed, where access points actually go, and how network access control gets deployed without locking out the building.
The mistake
Coverage design and capacity design are not the same thing
The same floor, the same eighteen users, designed two ways. This is why a network showing full signal bars can still be unusable in the room that matters.
Why signal strength misleads
Every device sharing a radio waits its turn. A strong signal from an access point already serving eighty clients gives you an excellent connection to a congested resource, and the phone still reports full bars while nothing loads.
Overlapping cells make it worse: more clients hear more access points on the same channels, retry rates climb, and retries consume the airtime that was already scarce.
Why turning it up backfires
The instinctive fix for a slow area is more power. More power means larger cells, more overlap and more devices contending for the same airtime — so the usual result is a marginally worse problem over a wider area.
The counter-intuitive answer is more access points at lower power. Smaller cells, fewer clients per radio, more airtime each. It costs more in hardware and cabling, and it is the difference between a network that works in the auditorium and one that does not.
Surveys
Five survey types, and what each one cannot tell you
These are sequential rather than alternative, and quotes rarely say which are included. The last column is the reason to ask.
Scroll the table sideways →
| Type | What it is | What it gives you | The honest limitation |
|---|---|---|---|
| Predictivemodelled, no site visit | A model built from floor plans, with wall materials and attenuation estimated. | Cheap, fast, and genuinely useful for budgeting and for buildings that do not exist yet. | Only as good as the floor plan and the material assumptions. Plasterboard modelled where there is concrete produces a design that fails on day one. |
| Pre-deploymentAP on a stick | A real access point temporarily positioned and measured in the actual building. | Validates the model against physical reality before anything is mounted or cabled. | Takes time on site and needs building access. It is also the step most commonly cut to reduce a quote, and the one that prevents the expensive mistakes. |
| Post-deployment validation | Measurement after installation, against the design targets. | Proves what was designed is what got built, and catches the AP mounted two metres from where the plan put it. | Finds problems when remediation costs the most. Necessary, but no substitute for the earlier steps. |
| Passive survey | Listening only — signal strength, noise, co-channel interference, neighbouring networks. | Shows the RF environment as it actually is, including the tenant upstairs on your channels. | Measures signal, not experience. Strong signal and unusable throughput coexist comfortably. |
| Active survey | Associating to the network and measuring real throughput, retries and roaming. | Measures what a user would actually get, which is the only number that matters. | Slower, and results depend on the client device used. A survey with one laptop model does not describe a phone estate. |
If a quote does not specify the survey type, it is predictive. That is a legitimate, cheaper product and appropriate for budgeting — it is simply not a measured survey, and the difference shows up on the day the access points go live in a building whose walls were not what the model assumed.
Assessment
What a network assessment actually looks at
Six areas, measured rather than read off a diagram. The output is a prioritised list of what to fix and what it costs, not a device inventory.
Wireless capacity, not just coverage
Clients per radio in the rooms that matter, channel utilisation at the busiest hour, retry and association-failure rates. Coverage maps look reassuring and describe the wrong thing.
Switching and uplinks
Per-port errors and discards, uplink saturation, PoE draw against budget, and the access switch that has quietly become a distribution layer because somebody daisy-chained it.
Segmentation reality
What can actually reach what, established by testing rather than by reading the VLAN documentation. These two answers differ more often than not.
Access control
Whether an unknown device plugged into a meeting-room port gets an address and a route, which in most estates it does.
Resilience
Single points of failure that nobody has looked at since commissioning: one uplink, one power feed, one core switch, one very old UPS.
Documentation against reality
The diagram versus the estate. Discovery routinely finds devices nobody remembered, links nobody was paying attention to, and at least one circuit still being invoiced for a site that closed.
The last item is not a criticism of anyone. Documentation drifts because estates change and nobody updates a diagram at 11 p.m. during a cutover. It is simply the reason an assessment starts from measurement.
Straight answers
What buyers get wrong about enterprise networks
Most enterprise Wi-Fi is designed for the wrong question
Coverage design asks whether there is signal everywhere. Capacity design asks whether everyone in the room can use it at once. A coverage-designed network shows full bars and fails in the training room, the auditorium and the canteen at lunchtime — which are precisely the places people notice and complain about.
More power is usually the wrong fix
Turning access points up makes cells overlap more, which increases co-channel interference and means more clients contend for the same airtime. The counter-intuitive answer to a busy area is usually more access points at lower power, producing smaller cells.
“Was this survey predictive or on-site?”
A predictive survey is a model built from a floor plan. It is useful, cheap and appropriate for budgeting. It is also only as accurate as the assumptions about wall materials, and it is quietly sold as though it were a measured survey more often than it should be.
The oldest client sets the floor
A network is only as fast as the devices on it can negotiate, and a fleet always contains something old — a barcode scanner, a medical device, a machine controller with a radio from a decade ago. Designing for the newest laptop in the building describes an experience most users will not have.
“What happens when the NAC server is unreachable?”
Fail-open lets unknown devices onto the network during an outage. Fail-closed locks out legitimate users. Both are defensible choices and one of them must be made deliberately, documented, before deployment rather than discovered at the worst moment.
The documentation is wrong
Not through negligence — through time. Every estate accumulates undocumented changes, and discovery routinely finds devices nobody remembered, links nobody was watching, and at least one circuit still being invoiced for a site that closed. Assessment begins from measurement rather than from the diagram for exactly this reason.
Before you sign
Ten questions for any networking quote
Use these on us and on everyone else. Question two decides whether you are buying a design or a coverage map with prices on it.
Which survey types are included — predictive only, or on-site validation?
Predictive-only is a legitimate cheaper product and it is not the same thing. If the quote does not say, it is predictive.
Is the design targeting coverage or capacity, and what client density did you assume?
Ask for the number of concurrent devices per area the design assumes. Without that figure, the design is a coverage map with prices on it.
Which client devices were surveyed with?
A survey conducted with one modern laptop does not describe a fleet of phones, scanners and older tablets, and the oldest client sets the floor for everyone.
How is band steering and 6 GHz handled given our device mix?
Newer bands are only useful to clients that support them. The design must work for the devices you actually own, not the ones in the brochure.
What is the PoE budget per switch after the new access points?
Access points draw more with every generation. This is arithmetic that can be done before delivery and frequently is not.
Who is doing the cabling, and is it in this price?
Cabling and containment are commonly a separate contractor and a separate invoice, and they are the long pole in the schedule.
For network access control, what is the failure mode?
Ask what happens when the authentication server is unreachable. Fail-open and fail-closed are both defensible and the choice must be deliberate, because discovering it during an outage is the wrong time.
How does NAC get introduced without locking anyone out?
The correct answer is monitor mode first, for long enough to find every device that will fail authentication — and there are always more than expected, mostly printers and machinery.
Is post-installation validation included, against the design targets?
Otherwise nobody establishes that what was designed is what got built, and access points do get mounted where the ceiling allowed rather than where the plan said.
What documentation do we receive, and in what format?
Heat maps, channel and power plan, port maps, VLAN and addressing. If it arrives only as PDF screenshots, the next engagement starts from scratch.
Working with us
How we run this
We have designed and built enterprise campus networks since 2002, and we run the operations centre that watches them afterwards. Monitoring what we designed is a useful discipline — it is difficult to ignore a capacity problem you have to answer the phone about.
Designed for capacity
We ask what each space is for and how many devices will be in it at once, then design to that. A coverage map is an output, not a design.
On-site validation
Pre-deployment measurement where it matters and post-installation validation against the design targets, so what was designed is what got built.
NAC in monitor mode first
Long enough to find every device that would have been blocked. That list always contains surprises, and finding them before enforcement is the whole game.
Documentation you can reuse
Heat maps, channel and power plans, port maps, VLAN and addressing — in a form the next engineer can work from rather than PDF screenshots.
Multi-vendor
Fortinet and Cisco across switching and wireless, and mixed estates containing both — see technology partners.
Watched afterwards
Wireless monitored at the client layer, not just AP up/down — channel utilisation, retries, association failures. See NOC as a Service.
Questions we get asked
Enterprise networking, answered
What is a wireless site survey?
A structured measurement of the radio environment used to decide how many access points are needed, where they go, at what power, and on which channels. There are several types — predictive modelling from floor plans, pre-deployment measurement with a real access point in the actual building, and post-installation validation — and they answer different questions at different costs. The comparison table above sets out what each one does and does not tell you.
How much does a wireless site survey cost?
It depends on the type and on the area. A predictive survey is modelling work priced from floor plans and square footage. An on-site pre-deployment survey adds engineer time in the building, which scales with floor area, the number of distinct environments, and how much of it is accessible only outside working hours. Post-installation validation is usually the smallest piece. Send us floor plans and we will price the types separately so you can see what each one buys.
What is the difference between coverage and capacity design?
Coverage design ensures signal reaches everywhere. Capacity design ensures enough radios exist for the number of devices that will use a space simultaneously. They produce very different designs: coverage might place two access points in a hall, capacity might place six at lower power. Almost every complaint about enterprise Wi-Fi — the training room, the auditorium, the canteen at lunchtime — is a capacity problem in a network that was designed for coverage and shows full signal bars throughout.
Why is our Wi-Fi slow when the signal is full?
Because signal strength and available airtime are different things. Every device sharing a radio waits its turn, so a strong signal from an access point already serving eighty clients gives you a good connection to a congested resource. Add co-channel interference from cells overlapping too much and retry rates rise, which consumes still more airtime. Full bars and poor throughput coexist comfortably, and this is the single most common wireless complaint.
Would turning the access points up help?
Usually the opposite. Higher power makes cells larger and overlap more, so more clients hear more access points on the same channels and contend for the same airtime. The counter-intuitive fix for a busy area is more access points at lower power, producing smaller cells that each serve fewer devices. Raising power is the instinctive response and it commonly makes the problem worse.
How do you decide access point placement?
From the survey and from what each area is for. Placement follows expected client density and the physical environment — walls, ceiling height, materials, metal racking, lift shafts — rather than a uniform grid. Mounting matters too: an access point installed above a false ceiling or behind a metal duct performs nothing like the same unit mounted where the design put it, which is why post-installation validation exists.
What is network access control and do we need it?
NAC decides what happens when a device connects: which network it is placed on, or whether it is admitted at all, based on identity and posture. The practical test for whether you need it is simple — plug an unknown laptop into a meeting-room port and see whether it gets an address and a route to your servers. In most estates it does. Whether that matters depends on who can reach your meeting rooms.
What is 802.1X?
The standard for port-based network access control. A device connecting to a switch port or wireless network must authenticate — typically with a certificate or credentials via EAP — before it is placed on a network. It is the mechanism most NAC deployments use, and it works identically on wired and wireless, which is why doing both together is usually less work than doing them separately.
How do we roll out NAC without locking people out?
Monitor mode first, for long enough to be boring. In monitor mode the system reports what would have been blocked without blocking anything, and that list always contains surprises — printers, machine controllers, cameras, a conference room system nobody can identify. Build the exception and profiling policy from that real list, then enforce in stages by area. Enforcing from day one is how a NAC project becomes politically unrecoverable in a single morning.
What does a network assessment cover?
Wireless capacity and RF conditions, switching health including per-port errors and PoE headroom, what can actually reach what, access control, single points of failure, and documentation measured against reality. The output is a prioritised list of what to fix, in what order, with what it costs — not a device inventory. The assessment checklist above lists the areas we work through.
Do you handle structured cabling?
We design and specify it, and coordinate installation with cabling contractors. It is worth flagging early in any project because cabling and containment are usually a separate contract and are frequently the longest lead time in the schedule — access points cannot be mounted where there is no cable to them.
Which vendors do you work with?
Fortinet and Cisco primarily, across switching and wireless, and we manage mixed estates. See technology partners, FortiSwitch, FortiAP and Cisco networking. What your team can already operate confidently usually matters more than a feature comparison.
Do you monitor the network afterwards?
Yes, and wireless monitoring specifically — channel utilisation, client counts per radio, retry rates and association failures, not merely whether the access point is reachable. That is where user-reported problems actually originate and it is the layer most monitoring skips. See NOC as a Service.
What do we need to give you to start?
Floor plans if they exist, a rough device count per area, what each space is used for, and any places where people already complain. That last item is the most useful thing on the list — the rooms people complain about are almost always the rooms where capacity was designed as coverage.
Next step
Tell us which rooms people complain about
Floor plans if you have them, a rough device count per area, and the list of places where people already complain. That last one is the most useful thing you can send — those rooms are almost always where capacity was designed as coverage, and they tell us more in a sentence than a site visit does in a morning.