Enterprise Wi-Fi Design: Coverage Is Only the Beginning

Why coverage maps mislead

A heat map that shows strong signal everywhere can still hide a network that fails in practice. Signal strength says nothing about how many devices share an access point's airtime, whether neighboring access points interfere on the same channel, or whether devices move to a better access point as people walk. Most "the Wi-Fi is slow" complaints come from capacity, interference and roaming, not from a lack of signal.

Start with requirements

• Devices: laptops, phones, tablets, handheld scanners, IP phones, wireless displays, sensors and cameras. Note the Wi-Fi standards and bands each supports.
• Applications: video meetings, voice calls, cloud applications, file transfers, scanning and point-of-sale.
• Density: how many devices are active at once in each area, especially meeting rooms, training rooms and cafeterias.
• Peak times: town halls, shift changes, lunch breaks and events.
• The building: wall materials, glass, lift cores, ceiling heights and ceiling types for mounting.
• Growth: expected headcount and new device types over the life of the equipment.

Plan capacity, not just coverage

Devices connected to one access point on one channel share its airtime. Estimate concurrent devices per area and the throughput their applications need, then plan enough access points and channels to carry that load with headroom. Treat high-density rooms as separate design zones rather than letting a corridor access point serve them.

Bands and channels

• 2.4 GHz has only three non-overlapping channels (1, 6 and 11) and more interference. Keep it for devices that need it.
• 5 GHz offers many more channels and should carry most enterprise traffic. Some of its channels are DFS channels that must move if radar is detected; test how your devices behave on them.
• 6 GHz, used by Wi-Fi 6E and Wi-Fi 7, adds clean spectrum. Confirm its local regulatory status and whether your devices support it before counting on it.
• Channel width: in dense environments, 20 MHz or 40 MHz channels usually give more reliable performance than 80 MHz or wider, because more access points can use separate channels.
• Transmit power: more is not better. Oversized cells make devices cling to distant access points and increase interference.

Predictive design and surveys

A predictive design uses accurate floor plans and wall attenuation values to model access point placement and channels. In difficult environments, such as heritage buildings, warehouses or spaces with unusual materials, a pre-installation survey with a temporary access point confirms the model. After installation, a validation survey checks the result against the design criteria.

Roaming

Devices, not access points, decide when to roam. Good roaming needs consistent overlap between access points, sensible minimum data rates and support for 802.11k, 802.11v and 802.11r where devices handle them well. Voice and video calls are the most sensitive. Vendors commonly recommend a signal of around -67 dBm or better with enough overlap for voice. Test roaming with the real devices people use, while walking.

Security and segmentation

• Use WPA3-Enterprise with 802.1X for corporate devices; certificate-based EAP-TLS avoids reusable passwords.
• Where 802.1X is impractical, WPA3-Personal is stronger than WPA2 pre-shared keys. Rotate keys when people leave.
• Map each SSID to a VLAN and filter traffic between them. Keep the number of SSIDs small; each one adds management traffic on every access point.
• Isolate guests from each other and from internal networks, and limit their bandwidth.
• Enable rogue access point detection and protect management access to controllers and access points.

The wired side

• Check the PoE budget of every switch against the access points' power requirements.
• Provide multigigabit uplinks where Wi-Fi 6E or Wi-Fi 7 access points can use them.
• Keep copper runs to access points within Ethernet distance limits.
• Size DHCP scopes for peak device counts and short lease times in busy guest areas.
• Make authentication servers redundant, or nobody connects when one fails.

Validation and operations

• Run a post-installation survey and compare signal, signal-to-noise ratio and channel overlap with the design criteria.
• Test real applications: a video call while walking the floor, a large file transfer in a full meeting room.
• Monitor client health, failed authentications, retry rates and channel utilization.
• Keep firmware current through a planned process, and resurvey after major layout changes.