Source
r/networking•
BostonHouse

How to best separate guest WiFi from the staff's private network at a small hotel?

Hello r/Networking. I work for a hotel (9 cabins in mountainous terrain) that has decided to finally bite the bullet and invest in its guest wireless network. The current setup is literally a single residential wireless access point in the lobby (to which the reservation computer is also connected). Being the most tech savvy employee on hand I’ve been tasked with implementing a new system and I’m in a bit over my head. To those who will recommend hiring a professional entity to tackle this: you’re right, but it’s not going to happen due to cost and the lackluster results from said available entities in the past. I would eagerly welcome any guidance you might provide.

After some preliminary research my current plan is to purchase a number of Ubiquiti's AP Outdoor+, bulk in-wall rated Cat6 from Monoprice, direct burial Cat6 (not sure where to buy), and a device yet to be determined to separate public and private networks (herein lies my primary gap in knowledge and experience). What would you recommend given our use case to securely separate our reservation system and computers from the guest WiFi? I have seen implemented one router downstream of another, a D-Link Airspot Public/Private Gateway, and managed switches implementing VLANs to accomplish this. I’d not at all be surprised to hear there are options beyond this and I welcome any advice on this question or any element of my intended setup.

In essence, what advice would you give to a technically savvy and motivated guy who can only improve upon the situation, but who lacks the experience to do so by the book?

Posted Jun 5, 2015, 3:02 AM UTC

013
VivaloCCNA•

What kind of budget are you playing with here?

You will need: A small business/branch office router/firewall (sonicwall TZ Series perhaps) With which you can create separate VLANs for the guest and staff networks and act a a central controller for the APs.

Sonicpoint APs that you can distribute around your site depending on the size. Maybe a managed switch if the budget is enough, a Dell Powerconnect N2024P will provide power to those APs so you don't need to worry about running power lines to each AP also.

You can go the other route and setup a mesh network of APs, they don't need to be cabled in and will pass data along each AP. you will still need a Firewall/Router to separate the networks.

Lots of fun options.

I can understand that it is a little scary if you are being thrown at it, and I know that outsourcing the work often leads to a very bad job because the customer doesn't know any better.

I've taken over many office networks that were setup and managed by an external company that charge way too much and make a big mess of everything. (Probably a combination of the office manager telling them to do the cheapest option and a lack of care).

1
BostonHouseOP•

I'd like to keep it around $2000. It was favorable reddit reviews that initially put me on to the Ubiquiti hardware and controller, and that's currently my first choice due to price and their interface for remote management. Could you expand on why you might recommend these components over something like and EdgeRouter LTE which allows for VLAN segregation? I have seen many good things about Sonicwall here as well. How might it create more value for a rather small/basic implementation like ours?

1
DanSheps•

Ruckus has some nice offerings for their outdoor AP line, if you use a ZoneDirector you can mesh them and they will use land lines unless there is a physical break and then some of them will switch to mesh.

As far as router, it depends on what you want. The ZD again has a built in captive portal which is pretty nice, it can do LAN/WAN as well.

Otherwise, you are looking at a SMB router (Sonicwall, etc).

You could also look into the meraki line, which is a cloud managed WiFi

1
PrairieWiFiCCNP•
  • 1 for Ruckus!
3
DanSheps•

I love how everyone got downvoted...

0
BostonHouseOP•

Thank you. I've looked into Ruckus and it looks as though just 2 APs would already exceed the amount of money a full implementation might cost with Ubiquiti. The three big names I continue to see recommended for small business are Meraki, Ruckus, and Ubiquiti. Given our rather small company profile and use case (9 cabins and 1 company computer), could you articulate why you'd recommend the expenditure for Ruckus over Ubiquiti's components and controller software?

1
DanSheps•

We have deployed Ruckus for a number of small businesses.

Honestly, the support from Ruckus is phenomenal, and their wireless mesh setup is pretty damn amazing too.

In very difficult environments luck a remote camp, using the Ruckus mesh in conjunction with a hard line will ensure your Wifi stays online. The beam forming from Ruckus is also going to be useful for you and it supports .11k (neighbour lists, to allow for easier and seemless roaming).

The controller itself is fairly intuitive and you can setup these AP's in a flash. The Ruckus AP's are enterprise grade AP's, so you get what you pay for.

I have never touched Ubiquiti, so I can't speak to them. I did check out their datasheet and I noticed their outdoor AP's don't have a heater. I know the Ruckus AP's do, so if you are operating in a cold environment that might be an advantage.

Ubiquiti is "no-frills" vs Ruckus "Enterprise" feature-set

This is what I found so far (1-5: localzuk on EduGeek, 6-8, Tim Harper, Google Groups)

Ubiquity Unifi is not a "full" managed wireless system. As far as I've been able to find out it has the following flaws:
1. Doesn't have dynamic power adjustment based on nearby APs - an absolute must for any managed wireless system
2. It doesn't, as yet, support 802.1x assigned VLANs/RADIUS auth in a stable release
3. The "controller" isn't a true controller - it is a centralised configuration tool, but doesn't do any actual management across access points
4. I've seen quite a few reports of poor customer service, but take that with a pinch of salt - we've all experienced bad service with everyone at some point
5. The Ubiquiti Unifi stuff seems to perform poorly when compared with other equipment - comes bottom or second to last consistently - this document covers it quite well http://wlanpros2.project.ihelphostin...t%20Report.pdf

Ruckus:
6. Ruckus is more expensive but it has been an install and forget system.  Given the remoteness of our schools to anywhere this has been a must.
7. BYOD management has been simple for us.
8. The APs automatically decide on the best frequencies (Channelfly is awesome, I had one problem and that was in a area where they had like a million competing RF singles and it couldn't decide on the channel)

I would checkout these:

https://groups.google.com/forum/#!topic/mle-reference-group/3l3dxSLVDVk

http://mybroadband.co.za/vb/showthread.php/523771-Ubiquiti-Vs-Ruckus

http://community.ubnt.com/t5/UniFi-Wireless/unifi-pro-in-stress-test/td-p/390276

http://www.wlanpros.com/wp-content/uploads/2013/02/Wi-Fi%20Stress%20Test%20Report.pdf

http://community.spiceworks.com/topic/269661-real-world-experience-with-ubiquiti-unifi?page=2

The last one had this which was pretty telling to me:

Which bring me to another point. Besides the cost larger # of Unifi AP adding up to the cost of the fewer better APs to give the same coverage with better performance (Ruckus uses what they call TimeFairness so slower protocols A/B/G do not slow down the faster N devices connected to the same AP) There is a HUGE cost difference if wiring for 30 AP vs 10-15 . This would make a Ruckus or Similar product far cheaper to implement at the end of the day.

1
thebadshepperdVP - Agile Synergy•

The Ubiquiti APs can create and broadcast multiple, separate/VLAN'd SSIDs. Unless you're trying to so something fancy, like charge extra or measure transfer, you don't need to buy anything else extra.

1
BostonHouseOP•

Thanks for bringing that to my attention. The hotel has no need for private, employee wireless access, as sensitive client data is never accessible to employee personal devices. It's just one company desktop that needs to be segregated from the guest WiFi. Am I wrong to think this is better implemented at the router or a managed switch than at the APs? What do you think about a EdgeRouter LTR with one port for the company desktop and the other on a separate VLAN going to a switch for all the guest WiFi APs?

1
JinTanah•

Maybe you can get a new internet line for this project and ask your ISP to propose a solution for you instead of you thinking yourself. Normally they would know who to contact for SME propose. All depends on you budget.

Building a new network + integration + security is not really a home wifi project scale.

1
bad0seedVAR - CCNA R&S CMNA•

I'm just here to recommend Meraki, a single MR 64 will handle all the difficulty and the (required) license means you have their engineering staff on-call to help you 24x7. They'll literally do the config for you.

You can even keep it going by simply buying some of their outdoor APs and create a mesh network = no cabling outages to troubleshoot in the snow.

0
BostonHouseOP•

Thanks for the recommendation. I've also seen many here recommend Meraki, but given our size and rather basic needs, I can't justify the large price disparity between it and Ubiquiti's offerings.

1
bad0seedVAR - CCNA R&S CMNA•

Yeah, I understand the rationale. Honestly I've never worked with ubiquiti but I know they get a lot of love because they're full featured but nearer a consumer price point.

I have heard though that they can have their own issues because of the low end nature of their hardware. Sometimes a higher up-front cost can be worth it when you factor in hardware replacement and servicing.

Good luck getting it all sorted and installed!

1