Enterprise Wi-Fi Planning Ultimate Guide: From Requirements to Acceptance

2026-10-09 | Ultimate Guide

Enterprise Wi-Fi planning guide: requirements, surveys, AP selection and acceptance tests.

Why Enterprise Wi-Fi Planning Cannot Be "Just Stick a Few APs Up"

Enterprise Wi-Fi and home Wi-Fi are two different worlds. A home environment has few devices, little interference and low roaming demand; an enterprise environment is device-dense, application-rich, and cannot tolerate dropped meetings or voice calls. Good planning means seamless roaming everywhere; sloppy planning means daily firefighting. This guide covers the full process — requirements analysis, site survey, access point selection, channel planning, roaming optimisation, security architecture and acceptance testing — explaining at each stage what to do and what counts as passing, and removing every figure from the old article that could not be sourced.

One important note: every acceptance threshold below is a commonly used design target that must be agreed in the contract in advance; none of them is a universal guarantee. Any figure without a stated source should not be written into a contract.

Step 1: Requirements Analysis — More Than Headcount

Before planning, answer the following questions:

• Concurrent devices: not headcount, but the number of devices actually online at the same time. The correct approach is to ask the customer for an actual device list and concurrent-device count; do not estimate from a generic average — the old article's average-devices-per-person claim had no verifiable source and has been removed.
• Application types: plain document editing, video conferencing and large file transfers have completely different bandwidth needs. Plan by the applications that will actually run, not by a single rough multiplier.
• Coverage vs capacity: coverage answers whether there is a signal; capacity answers whether concurrently used devices have enough bandwidth. A meeting room full of people using devices at once is a capacity problem, not a signal problem. Capacity planning starts from the number of devices per area plus the applications they will run, and usually results in more access points at lower power.
• Roaming needs: will staff walk around with laptops? Will VoIP phones be used on the move? If so, roaming design must be handled separately from fixed-seat design.
• Peak hours and high-density areas: meeting rooms, halls and lobbies where many people gather should be listed separately at the planning stage.

Another key concept: PHY rate is not throughput. PHY rate is the raw radio link rate; throughput is the usable payload after overhead and contention are deducted. A strong signal alone does not prove good application performance; SNR, retransmission rate and interference must be checked together.

Application bandwidth: use only officially published figures

Video conferencing bandwidth should not be written as a vague figure. The following are Zoom's officially published bandwidth requirements, usable as planning reference, with the note that they are official minimum requirements and real deployments need headroom:

Note that HD covers both 720p and 1080p, so a single vague figure misleads. Planning should follow the resolution and participant count actually used, check the official figures, and agree headroom arrangements in the contract.

Step 2: Site Survey — Three Types, Do Not Skimp

Predictive Survey

Simulate access point placement and signal coverage in software on the floor plan. For a new fit-out or a not-yet-occupied site, doing a predictive survey first lets access point count, positions, channels and power be set before installation. But a predictive survey cannot replace an on-site survey — things absent from the drawings (later-added concrete walls, metal shelving, lift shafts, insulated ceilings) are invisible to the model.

Passive Survey

The survey equipment only listens without connecting to the network, measuring signal strength, noise, interference and channel overlap. It shows the coverage and interference environment. A passive survey tells you what the RF environment looks like.

Active Survey

The survey equipment actually connects to the network and transmits data, measuring real throughput, roaming behaviour, packet loss and latency. Complaints of slow speed or voice dropouts can only be characterised with active data, because the problem is often at the connection layer rather than the signal-strength layer. An active survey tells you what the user experience feels like. A complete project needs both passive and active surveys together.

Wall Materials: write a qualitative ranking, not a single-number table

Wall materials attenuate signals, and the higher the frequency, the worse the penetration: 2.4 GHz penetrates best, 5 GHz worse, 6 GHz worst. The qualitative ranking is: metal and reinforced concrete attenuate most, Low-E glass next, ordinary brick walls and concrete in the middle, and drywall and ordinary glass least. Metal can form a reflective barrier approximating a Faraday cage. The old article's single-number table (so many dB for brick, so many for glass) has been removed, because sources disagree with each other and the values depend on thickness, frequency, moisture content and reinforcement. Actual attenuation must be measured on site. Also, the dB scale is logarithmic: −3 dB is roughly half the power; −10 dB is roughly one tenth.

Step 3: Access Point Selection — Not "More Expensive = Better"

Generation reference

Wi-Fi 5 is 802.11ac; Wi-Fi 6 is 802.11ax; Wi-Fi 6E is 802.11ax plus the 6 GHz band; Wi-Fi 7 is 802.11be. The Wi-Fi Alliance launched the Wi-Fi CERTIFIED 7 certification programme in January 2024; IEEE published the 802.11be-2024 final specification in 2025.

• Wi-Fi 6 (802.11ax): the current mainstream. Key improvements include OFDMA (dividing spectrum into resource units, with the access point scheduling centrally so multiple devices transmit at once, reducing contention), uplink plus downlink MU-MIMO, 1024-QAM, BSS Coloring and Target Wake Time. Wi-Fi 6's primary goal is efficiency and multi-device performance, not simply top speed.
• Wi-Fi 6E: the same 802.11ax standard, differing mainly in the added 6 GHz band, which provides more and cleaner spectrum. In the 5 GHz band, 160 MHz channels are subject to DFS restrictions; 160 MHz channels in the 6 GHz band are not subject to that restriction.
• Wi-Fi 7 (802.11be): three headline capabilities are 320 MHz channels (only in the 6 GHz band, subject to the regulator opening it), Multi-Link Operation (MLO, mandatory in certification), and 4096-QAM (12 bits per symbol, about 20% higher theoretical transmission rate than Wi-Fi 6's 1024-QAM). IEEE's design target is that at least one operating mode supports a maximum throughput of not less than 30 Gbit/s measured at the MAC SAP; that is a design target, not any single device's measured speed, and must not be written as a fixed Wi-Fi 7 speed figure. For new projects, pricing should be obtained as quotes for specific models from suppliers, not compared with a generic percentage.

MLO Concept

Wi-Fi 7 devices can transmit and receive data simultaneously over multiple bands or links (2.4 / 5 / 6 GHz), for load balancing, bandwidth aggregation, and seamless switching when one band is congested or out of range, improving throughput, reducing latency and increasing reliability. Previous generations locked a connection to a single band. But note: a Wi-Fi 7 label does not mean all features are present. The market includes self-described Wi-Fi 7 products without certification that lack key features; Wi-Fi 7 access points also come in dual-band (2.4 + 5 GHz) and tri-band (2.4 + 5 + 6 GHz) variants. When selecting, check the specific model's band list and certification, not just the generation name.

Antenna Types

• Omnidirectional antennas: radiate in all directions, suitable for ceiling mounting covering the open space below; enterprise indoor access points commonly have built-in omnidirectional antennas.
• Directional antennas: concentrate the signal in one direction or beam width, with higher gain, suitable for corridors, halls, outdoor point-to-point links and warehouse aisles; some enterprise access points can switch between omnidirectional and directional modes in software.

Selection Principles

Set the requirements first (coverage vs capacity, roaming, applications), then choose the generation and bands; environments with many older devices need backward-compatibility checks; the benefit of 6 GHz depends on whether client devices support 6 GHz; do not chase a generation for its own sake. Wi-Fi 7 enterprise deployments may need supporting upgrades: access point throughput can exceed the existing uplink, requiring multi-gigabit Ethernet uplinks; some access points need 802.3bt PoE++; 10GbE needs Cat6a cabling. These supporting requirements must be checked with the supplier for the specific model's uplink and power needs, not written as hard numerical promises. For a more detailed upgrade decision, see this site's enterprise Wi-Fi solutions page.

Step 4: Channel Planning — 2.4 GHz Is the Disaster Zone

2.4 GHz: only channels 1, 6 and 11 are non-overlapping

Channel spacing in the 2.4 GHz band is 5 MHz, but 802.11 needs about 20 MHz of bandwidth, so adjacent channels overlap; only channels 1, 6 and 11 are mutually non-overlapping. Enterprise design should reuse only these three channels; using other channels causes adjacent-channel interference, which is worse than co-channel interference because devices cannot coordinate with CSMA/CA. As a strategy, reserve 2.4 GHz for low-speed devices such as IoT and printers, set the width to 20 MHz, and do not greedily enable 40 MHz.

5 GHz and DFS

The number of 5 GHz channels depends on channel width: about 25 non-overlapping channels at 20 MHz, about 12 at 40 MHz, about 6 at 80 MHz. For DFS (Dynamic Frequency Selection), parts of the 5 GHz band are shared with weather and military radar; access points using DFS channels must continuously listen for radar signals, and on detecting radar must vacate the channel and move to another. DFS channels benefit from less congestion and more available channels; the risk is that a radar event causes channel switching and connection interruption. Some older client devices do not support DFS channels, and critical applications should avoid DFS channels.

Transmit Power: bigger is not better

High access point transmit power does not mean good two-way communication. The access point can be very loud, but phones or laptops are limited by battery and radio design to lower transmit power. The result: the client shows full bars, but the access point cannot hear the client's return transmission, causing retransmissions, latency and drops. The correct approach is to set access point power to a level symmetrical with client capability, shrink cell size, and encourage clients to roam early, rather than turning access points up to maximum power. Oversized cells cause sticky clients (clients clinging to a distant access point), co-channel access points hearing each other and waiting for long periods, reduced usable airtime, and lower overall throughput. Lowering power improves spatial reuse. The old article's fixed dBm recommendation for access point power has been removed — power settings depend on the site, cell size and client types, and must be decided by on-site survey and acceptance measurement.

Step 5: Roaming Optimisation — "Seamless" Is What Makes It Enterprise-Grade

Three key protocols:

• 802.11k: access points give clients a neighbour access point list, so clients do not have to scan the full spectrum, only the channels of known neighbouring access points, shortening scan time and speeding up discovery of roaming targets.
• 802.11v: the network can suggest a better access point to clients, guiding sticky clients to a less congested or nearer access point and helping load balancing.
• 802.11r (Fast BSS Transition / fast roaming): pre-authentication or cached encryption keys remove the full 802.1X / RADIUS or 4-way handshake during roaming, shortening authentication time. Traditional roaming re-authentication can take hundreds of milliseconds or more, enough to break VoIP audio or delay video. The greatest benefit of 802.11r is in WPA2 / WPA3-Enterprise environments, while the benefit in WPA2-Personal environments is smaller, and some older client drivers do not support 802.11r.

k / v / r only work when both the access point and the client support them; if either side does not, a slower traditional roaming flow is used. The roaming decision is ultimately made by the client; different clients behave differently, so do not assume all devices roam identically. Misconfigured roaming features can be worse than none at all. As for 50 ms: 50 ms is a commonly used voice-grade roaming design target, and actual performance must be verified by on-site roaming tests — do not write that roaming completes within 50 ms or that 50 ms is guaranteed. Actual results depend on the client, the authentication method and the RADIUS location.

Step 6: Security Architecture

• Staff network: WPA3-Enterprise with 802.1X (RADIUS authentication), per-user accounts, disabled on departure. Stop sharing one password across the whole company. WPA3-Enterprise mandates Protected Management Frames, encrypting authentication management frames to prevent forged deauthentication attacks; it mandates client verification of the RADIUS server certificate, preventing rogue access points from stealing credentials. Default encryption is 128-bit; an optional 192-bit security suite is available, limited to EAP-TLS, for high-security environments.
• Guest network: separate VLAN plus captive portal, internet-only, isolated from the internal network. The guest SSID must be isolated from the enterprise network via VLAN; the guest VLAN must not route to the enterprise network, and must be separated by default-deny firewall rules; enable Layer 2 client isolation to prevent guest devices from communicating directly with each other. Rate-limit so guests do not slow staff. Where a guest portal collects personal data, it needs a privacy notice and a retention policy, and must comply with Hong Kong's Personal Data (Privacy) Ordinance.
• IoT network: printers, IP cameras and CCTV on a separate VLAN, never on the same segment as office PCs. If an IoT device is compromised, the attacker is trapped in that segment and cannot easily move laterally. Firewall rules between VLANs are required — VLAN separation alone is not isolation.

The common industry practice is at least three SSID / VLAN segments: enterprise (802.1X), guest (captive portal), IoT (isolated VLAN). This is a recommendation, not a regulation. WPA2 also has known weaknesses such as KRACK; new deployments should use WPA3.

Step 7: Acceptance Testing — Do Not Take Anyone's Word

Set a baseline before acceptance: record a clean baseline before tuning, otherwise you cannot tell whether a change improved or worsened things. The baseline should include: a wired reference throughput on the same network path, static tests at key locations, walking tests across expected roaming boundaries, authentication tests for each SSID / login method, and multi-device spot checks. Test items include: signal strength (RSSI), signal-to-noise ratio (SNR), throughput, latency and jitter, roaming, channel utilisation, retransmission rate, interference / spectrum analysis, and authentication and login flows.

RSSI is not everything: a strong signal with high channel utilisation or a high retransmission rate is still slow; acceptance must also look at SNR, retransmission rate, channel utilisation, spectrum analysis and application performance. A heatmap is a design aid, not proof — a heatmap shows expected overlap and weak spots, but does not prove the user experience is normal. Get the test reports before sign-off. Saying it feels fast does not count. Do not write a specific number of devices or Mbps as a stress-test pass threshold, because thresholds depend on the customer contract and the applications; write that acceptance thresholds must be agreed in the contract in advance.

Hong Kong Regulation: 6 GHz — Lower Half Only

Hong Kong permits only the lower half of the 6 GHz band. Wi-Fi 6E (802.11ax) and Wi-Fi 7 (802.11be) can operate in 5.925–7.125 GHz (the 6 GHz band) in addition to 2.4 / 5 GHz; but Hong Kong permits only the lower half, 5.925–6.425 GHz (the designated 6 GHz band); 6.425–7.125 GHz is not covered by the Device Class Licence and is not permitted for use in Hong Kong. HKCA 1081 sets the maximum output power for 6 GHz WLAN equipment at 24 dBm EIRP indoors and 14 dBm EIRP outdoors; the guard band is 5.925–5.945 GHz and the operating band is 5.945–6.425 GHz. For mandatory certification: Wi-Fi 6E and Wi-Fi 7 access points must pass OFCA technical specification certification and carry the CA label — this is mandatory; when purchasing, confirm the access point has the CA label and the Hong Kong band version. Do not present global specifications as Hong Kong rules: Hong Kong's designated band is only 500 MHz, and the operating band is narrower still after the guard band is deducted. For overall office network planning, see this site's office network page.

Common Planning Mistakes

1. Access point mounted centre-ceiling directly above a metal duct — the signal is blocked by metal. Metal attenuates signals severely; check above-ceiling conditions before installing.
2. One access point per floor partitioned into ten rooms — the signal is heavily attenuated after passing through walls. Divide coverage by area / room, with an access point per area.
3. Same SSID for 2.4 / 5 GHz without band steering — devices stick to slow 2.4 GHz.
4. No channel planning, all access points on auto — automatic algorithms frequently choose wrong, causing mutual interference. Channel planning should be set at the design stage.
5. PoE switch underpowered — the access point count exceeds the switch's PoE budget, and later access points will not power on. PoE budgets must be added up item by item, not guessed.
6. Mixing access point brands and expecting identical roaming — roaming performance can differ greatly between brands; use one brand with unified controller management for a single site.

Good planning means enterprise Wi-Fi can run for years without trouble. Sloppy planning means firefighting every month. Book a free on-site survey to have the existing network assessed with professional instruments and receive a practical improvement proposal.

免費上門勘查及報價 | 收費指南