Licensing and platform choices for a multi-site clinic network

Treat the request as three separate capabilities, not one SKU.

1. Cloud management: ExtremeCloud IQ Pilot is the practical baseline for AP and switch templates, historical reporting, and API integration in this environment. Navigator only makes sense if the buyer specifically needs the extra features in that tier; do not assume it includes NAC or fabric automation. Confirm the current feature matrix rather than buying the highest tier by default.
2. Device coverage: XIQ licensing is generally counted per managed device, so model the 340 APs plus the switches that will actually be onboarded. The VSP 7400 support and release must be confirmed against the chosen tier; if they are not supported, keep the data-center fabric under ExtremeCloud IQ Site Engine or another supported manager. Do not let the buyer assume one AP license covers a switch or a VSP.
3. Fabric automation: Automated provisioning for VSP fabric nodes is not delivered by an XIQ cloud tier alone. Include XIQ-SE or the appropriate fabric management component, and scope whether it manages only the data centers or also the clinics.
4. NAC: 802.1X with MAC authentication and guest fallback is an access-control function, typically ExtremeControl, not an XIQ management tier. Price it separately and validate that the medical-device vendor supports the chosen EAP or MAB method.

Before signing, verify device support, license counts, renewal dates, bundle contents, and whether the API and templates are included in the quoted tier.

A wholesale replacement is not justified without evidence. The X435 is appropriate for exam-room closets where endpoints are 1 GbE and the PoE budget matches phones, cameras, and standard APs. The X465 becomes justified where you need multigigabit copper for Wi-Fi 6E APs, 10 GbE uplinks, higher PoE, or more headroom for imaging workstations.

Use four criteria per closet: current and projected PoE load, AP uplink speed, uplink utilization, and physical port count. If a clinic has Wi-Fi 6E APs that can exceed 1 GbE or the PoE budget is above 70 percent, replace that closet. If the closet is exam rooms with 1 GbE APs and low utilization, keep the X435 and spend the difference on licensing and NAC.

The recommendation should be a targeted refresh: replace the imaging and admin closets first, leave most exam-room closets on X435, and revisit after a port-and-PoE audit. This preserves budget for the cloud, fabric, and NAC components that the CIO actually asked for.

Sequence the work so that no clinic depends on two management planes at once.

1. Inventory and mapping: Build a device list by site, model, firmware, current manager, and license state. Identify which APs and switches are in XIQ Connect, which are only on-premises, and which are unmanaged.
2. Commercial cutover: Order the target XIQ tier and NAC/fabric components, confirm device counts, and stage the tenant. Do not let the old subscription expire before the new one is active.
3. Pilot: Onboard two low-risk clinics, apply a base template with site overrides, and validate AP health, client authentication, guest fallback, and API tickets to ServiceNow.
4. Templates and policy: Build clinic templates for common SSIDs, VLANs, and switch ports, but allow per-site overrides for imaging and exam-room differences. Apply NAC in monitor mode before enforcement.
5. Wave migration: Move clinics in waves, keeping the on-premises server read-only for rollback. Validate clinical devices after each wave.
6. Decommission: After 30 days of stable operation, remove stale configurations and retire the old manager. Keep a rollback export and a documented escalation path.