PoE Budget and Cross-Floor Roaming in an Office Retrofit

Do the per-switch arithmetic first. Four APs at 25.5 W is 102 W; 20 phones at 12.9 W is 258 W; floor 1 adds roughly two cameras at 15.4 W, about 31 W. That is 360 W typical, 391 W on floor 1, and 411 W if a switch later carries two more APs - all under the 740 W budget, so the PoE allocation itself is fine. Note the hidden dependency: 740 W is only delivered with 208 V input, which is what the closet has. The real constraint is upstream. At full PoE load, seven switches would draw 7 × 740 W = 5.18 kW, plus roughly 100 W of switch electronics each, about 5.9 kW, or 6.5 kVA at 0.9 power factor, against a 30 A × 208 V = 6.24 kVA circuit. The closet is therefore marginally overloaded in the worst case even though it is comfortable today at roughly 2.9 kW actual. Remedies in order of cost: cap per-port PoE allocation and inventory the true worst case, add a second 30 A circuit before the seventh switch is installed, or split the closet. Do not size UPS runtime from nameplate PoE budgets; size it from measured draw plus the AP count you will actually deploy.

The DHCP re-run at the moment of the drop is the giveaway: each floor has its own voice VLAN and subnet, so walking from floor 3 to floor 2 is an inter-subnet roam. The client must get a new address, re-authenticate, and re-register with the call server, which is where the seconds go. Roaming within a subnet is invisible; roaming across one is not. The fix is to make the voice SSID map to a single subnet across all three floors, so every AP-to-AP move inside the building is a Layer 2 roam. Practically, that means trunking one mobility VLAN to all IDFs with a loop-free topology - a stacked or MLAG pair at the core rather than a plain redundant triangle - and anchoring it on the WLC or a mobility group. Size the subnet for the whole building: 1,100 devices is well within a /23, and you should not stretch a broadcast domain past roughly 500 active clients, so a /23 for voice plus per-floor data VLANs is the sane split. Data does not need this treatment because a data roam does not drop a call. Also enable 802.11r/k/v and confirm DHCP is reachable with low latency from every IDF, since fast roam still depends on fast address assignment.

Three broadcast domains with three different trust levels. Guest gets its own VLAN and its own SSID, terminated on the firewall or a DMZ anchor rather than bridged locally, with a deny to all RFC 1918 space, client-to-client blocking on the WLC, a rate limit, and the corporate DNS servers hidden behind a resolver that only answers public names. Bridging guest onto the corporate VLAN is a flat-out breach: an infected guest laptop can reach SMB on the same segment, which is precisely how the last incident spread. Corporate keeps per-floor data VLANs - no reason to stretch them - with 802.1X on the wired edge and the voice VLAN protected by a DHCP snooping and dynamic ARP inspection pair. Building IoT (cameras, badge readers, HVAC) goes on its own VLAN with no default gateway to the internet and allow-lists only to the NVR and the badge controller, because these devices ship with default credentials and no patch path. Enforce with a firewall zone pair between guest and everything, and with ACLs on the Layer 3 switch between IoT and corporate. With six switches per closet and two engineers, keep the policy count small: default deny, a handful of named permits, and log the denies so the next incident is visible in minutes.