Cognitive Campus Workspace Rollout in a Mixed-Device Hospital
A 600-bed hospital is deploying a cognitive campus workspace across 12 floors. Requirements: clinical staff roam between floors with voice-over-Wi-Fi badges and tablets; guest Wi-Fi is separate; medical device VLANs must be isolated; and the security team wants identity-based access rather than PSK. The hospital has 1,800 access points, mostly Wi-Fi 6, with a mix of 802.1X-capable and legacy devices. During a pilot on two floors, clinical badges drop calls when staff move between floors, and some legacy infusion pumps fail 802.1X authentication entirely. The CIO wants zero disruption to clinical workflows and a single policy plane across wired and wireless.
1. How should the architect design identity and segmentation to satisfy clinical roaming, guest isolation, and medical device isolation simultaneously?
Read the worked answer
The architect should separate the problem into identity, segmentation, and mobility, because each has a different failure mode.
- Identity plane. Use 802.1X with EAP-TLS for capable clinical devices (badges, tablets) backed by a certificate authority, and integrate with the identity provider for user context. For legacy devices that cannot do 802.1X (the infusion pumps), use MAC authentication bypass (MAB) with profiling - but only as a fallback, and place those devices in a restricted VLAN with tight ACLs. Never fall back to PSK for clinical gear.
- Segmentation. Define separate segments: clinical staff, guest, medical devices, and management. Medical device VLANs get isolation policy that permits only required flows (e.g., to the EHR and device management servers) and denies lateral movement. Guest gets internet-only with client isolation.
- Single policy plane. Use a centralized policy engine (SD-Access-style fabric or equivalent) so wired and wireless share one policy definition, expressed as group-based policy rather than per-VLAN ACLs. This satisfies the CIO's single-policy-plane requirement and reduces drift.
- Roaming. For badges dropping calls between floors, ensure the wireless design supports fast roaming (802.11r or equivalent) and that the mobility domain spans floors so the session and policy follow the device. Verify the badge vendor supports the roaming standard in use.
The trap is treating segmentation as VLANs alone. The exam tests whether you connect identity, group policy, and mobility into one coherent design.
2. What is the likely cause of clinical badge call drops during floor-to-floor roaming, and how should it be diagnosed and fixed?
Read the worked answer
Floor-to-floor call drops usually come from roaming latency and session continuity, not from coverage gaps alone. Likely causes, in order of probability:
- Slow or failed fast roaming. If 802.11r (or the vendor's fast-roaming equivalent) is not enabled or not supported by the badge, each roam triggers a full authentication, and voice tolerates only tens of milliseconds of disruption. Check whether the badge supports fast transition and whether it is enabled on all APs.
- Layer 3 mobility gaps. If floors are on different subnets and the mobility domain does not span them, the session breaks on roam. Confirm the fabric/mobility configuration covers all 12 floors, not just the pilot floors.
- Policy re-evaluation on roam. If group policy is re-applied on every roam and the policy engine is slow, the call drops. Check policy engine latency and whether sessions are cached.
- RF issues at floor boundaries. Sticky clients or coverage holes at stairwells and elevator lobbies can cause long roam times.
Diagnosis:
- Capture client roam events and authentication timing from the wireless controller analytics.
- Run synthetic voice probes that roam between floors and record disruption duration.
- Compare roam times on pilot floors versus a control floor.
Fixes:
- Enable fast roaming consistently across all APs and confirm badge support.
- Extend the mobility domain to all floors.
- Tune RF (power, minimum RSSI) at floor boundaries to encourage timely roams.
- Cache policy decisions for the session so roaming does not re-trigger slow evaluation.
The judgement: distinguishing authentication latency, mobility/session continuity, and RF coverage as separate causes, and measuring roam disruption rather than guessing.