University Campus Wi-Fi 6E Upgrade with Legacy Client Constraints
A university with 12,000 students and 3,000 staff plans to upgrade its campus wireless from Wi-Fi 5 to Wi-Fi 6E. The current network uses 450 access points (APs) across 60 buildings, with a mix of 802.11ac laptops, IoT devices (HVAC sensors, security cameras), and a growing number of Wi-Fi 6E smartphones and laptops. The university wants to enable 6 GHz spectrum to reduce congestion, but many legacy devices only support 2.4/5 GHz. The buildings have a mix of construction types: some with drywall, others with concrete walls and metal studs. The IT team proposes a full rip-and-replace of all APs with tri-radio Wi-Fi 6E APs and enabling 6 GHz on all of them. The budget is limited, and they need to prioritize. Additionally, the university has a policy that all wireless traffic must be encrypted with WPA3-Enterprise, but some older IoT devices only support WPA2-PSK. The network must also support seamless roaming for VoIP calls and location services. The campus has a central data center and two distribution switches per building. The university is also considering a private 5G network for outdoor coverage.
1. Evaluate the proposed full rip-and-replace strategy for Wi-Fi 6E. What factors should the university consider to optimize the upgrade, and what alternative approach would you recommend?
Read the worked answer
The full rip-and-replace is likely overkill and cost-inefficient. Key factors: 1) Client mix: only a fraction of devices support 6 GHz; legacy 2.4/5 GHz devices still need coverage. 2) Building construction: concrete/metal walls attenuate 6 GHz more than 5 GHz, requiring more APs or careful placement. 3) Budget constraints: prioritize high-density areas (lecture halls, libraries) and buildings with modern construction for 6 GHz. 4) IoT devices: many only support 2.4 GHz and WPA2-PSK, so a separate SSID or VLAN with WPA2 may be needed, but that conflicts with the WPA3-Enterprise policy. Alternative approach: a phased upgrade where tri-radio APs are deployed in high-density and modern buildings first, while legacy APs remain in low-density or challenging RF areas. Use 6 GHz primarily for high-throughput, low-latency applications and offload legacy devices to 2.4/5 GHz. For IoT, implement a dedicated SSID with WPA2-PSK and network segmentation (VLANs) to isolate traffic, and use a wireless intrusion prevention system (WIPS) to monitor. For roaming, ensure APs support 802.11r/k/v and configure 6 GHz with preferred scanning channels. Location services require APs with built-in GPS or Bluetooth, so select APs accordingly. Private 5G could complement outdoor coverage but requires spectrum licensing and integration; evaluate cost vs. Wi-Fi 6E outdoor APs.
2. How should the university address the WPA3-Enterprise policy conflict with legacy IoT devices while maintaining security?
Read the worked answer
The conflict arises because some IoT devices only support WPA2-PSK, which is less secure. Options: 1) Isolate IoT devices on a separate SSID with WPA2-PSK, but segment the traffic using VLANs and firewall policies to prevent lateral movement. 2) Use a dedicated IoT network with MAC authentication or certificate-based authentication if devices support it. 3) For devices that cannot be upgraded, consider a overlay network with a wireless controller that supports WPA2-PSK but enforces strict ACLs. 4) Implement a WIPS to monitor for rogue devices and attacks. 5) Gradually replace legacy IoT devices with WPA3-capable ones. 6) Use a network access control (NAC) solution to profile devices and apply policies. The key is to maintain the WPA3-Enterprise for user devices while providing a secure, segmented path for IoT, and document exceptions with compensating controls.