The Sliema Hotel Wi-Fi Overhaul
A 40-room boutique hotel in Sliema offers free Wi-Fi. The network uses one consumer router on the ground floor, broadcasting a single SSID with WPA2-PSK. The password is the hotel's street name, unchanged for four years. Guests on the third floor report dropped connections and slow video calls. The hotel also has a staff point-of-sale terminal and a back-office PC on the same network. A neighbouring hotel has recently installed access points, and a Wi-Fi survey shows several networks on channel 6. The owner wants to add six ceiling access points and a captive portal, but the electrician says only Ethernet cables are available in corridors, not power sockets. The budget is €3,500. The owner has no technical background and believes a stronger password alone will fix the problems.
1. Explain why the hotel's current wireless setup is likely to produce the reported symptoms and why it is also a security risk. Refer to specific details from the setup.
Read the worked answer
The performance problem has three likely causes. First, a single consumer router on the ground floor cannot provide adequate signal on the third floor; walls and floors attenuate radio waves, especially in the 5 GHz band, so clients either drop or fall back to a weak 2.4 GHz link. Second, 40 rooms share one access point, which means contention for airtime. Video calls need consistent latency and throughput, and a single AP cannot serve many simultaneous streams well. Third, the survey shows other networks on channel 6, so co-channel interference causes retransmissions and further reduces effective throughput.
The security risk is separate and more serious. A single WPA2-PSK with the street name means every guest and every member of staff knows the same key. Anyone who has stayed once can reconnect indefinitely, and the key cannot be revoked without changing it for everyone. More importantly, the guest network is flat: the point-of-sale terminal and back-office PC are on the same network as guests. A compromised guest device could attempt to reach the POS or shared resources. A captive portal would not fix this, because it controls access to the internet, not lateral movement between clients. The correct judgement is that the hotel needs segmentation and better coverage, not just a longer password.
2. Propose a segmented network design for guests and staff using the six new access points. Include VLANs, SSIDs and PoE considerations, and justify how each choice addresses a problem in the setup.
Read the worked answer
A suitable design separates traffic by role and gives each area enough radio capacity.
- Create VLAN 10 for guests, VLAN 20 for staff and the POS, and VLAN 99 for managing the access points. Put the POS on the staff VLAN and apply firewall rules that deny guest-to-staff traffic while allowing guest-to-internet traffic. This directly addresses the flat-network risk.
- Broadcast two SSIDs: 'Hotel-Guest' mapped to VLAN 10, with client isolation and a captive portal for acceptable-use terms and password rotation; 'Hotel-Staff' mapped to VLAN 20, using WPA2-Enterprise with a RADIUS server if the budget allows, or at minimum a long unique pre-shared key known only to staff.
- Mount two access points per floor. Use 5 GHz for video calls and 2.4 GHz for range, and plan 2.4 GHz channels 1, 6 and 11 so that neighbouring networks on channel 6 are avoided where possible. Disable legacy 802.11b rates to reduce airtime waste.
- The corridors have Ethernet but no power sockets, so use a PoE switch or PoE injectors. IEEE 802.3af provides about 15.4 W per port; six access points plus overhead fit within a 120 W PoE budget. This avoids new mains wiring and keeps the installation within €3,500.
The design addresses coverage, contention, interference, guest isolation and staff separation at the same time.
3. The owner believes that changing the Wi-Fi password to a longer one will fix both the performance and security problems. Evaluate this belief and recommend two additional controls that give the greatest risk reduction for the €3,500 budget.
Read the worked answer
The belief is mostly wrong. A longer password improves resistance to offline guessing, but the performance symptoms are caused by weak coverage, too few access points, airtime contention and channel overlap. No password change affects those radio-level problems. On security, a shared PSK remains shared: a guest who knows the new password can still pass it to others, and the hotel cannot revoke one guest without disrupting everyone. The password also does nothing to stop a guest device from reaching the POS on the same flat network.
The two controls with the greatest risk reduction are segmentation and proper access-point coverage. First, put guests and staff on separate VLANs with a firewall and client isolation; this contains any compromised guest device and protects the POS. Second, install the six PoE access points with a planned channel layout; this fixes the coverage and capacity problems rather than masking them. A captive portal is useful for terms and password rotation, but it is not a substitute for segmentation. If money remains, WPA2-Enterprise for staff would give individual accountability. The owner should be advised that the password change is a minor improvement, not a solution.