This document outlines the procedure for establishing a private Wi-Fi network in a residential multi- dwelling unit property, such as an apartment building or assisted living facility.

For purposes of illustration, the following networks are required.

The requirements for the staff and visitor networks (as well as any other facility-wide networks such as for surveillance, VoWiFi, etc.) are quite straightforward. These networks should be configured in the normal manner, by setting up a regular SSID with VLAN isolation enabled and client isolation / layer 2 isolation enabled or disabled, as appropriate.

For the resident network, a “Private Wi-Fi” service needs to be configured, where each resident can interconnect their own devices in their unit, but cannot access the networks of other resident units. The recommended approach is to install a wall-plate AP (e.g. EWS510AP) in every resident unit requiring Private Wi-Fi, and then enable the “Guest Network” feature on each AP and configure individual SSIDs and passphrases for each residential unit. The AP will act as a Layer 3 router for the “Guest Network”, so no additional VLANs or main router configurations are required, but there will be double-NAT so residents cannot do activities such as hosting their own servers, and certain types of gaming applications may have difficulty because of the double-NAT. Note also that this requires Ethernet cabling to a central location in each residential unit, so that APs can be mounted within residential units.

In a typical in-unit deployment (i.e. not requiring Private Wi-Fi), a wall-plate AP is generally only required every 2-3 units, depending on the layout of the facility and the building materials. For Private Wi-Fi, however, each unit requires its own access point so as to provide a dedicated wireless network within each unit.1 Note that the LAN ports on the wall-plate AP cannot be used as part of the Private Wi-Fi network. The LAN ports on the APs should therefore be disabled, unless specific ports are being used for

1 Note, if the service is being offered as an optional upsell, one could still place APs every 2-3 units, and then mount additional APs in particular units as necessary. This may prove overly labor-intensive, however, and difficult to maintain vs. architecting the network for each unit to have its own access point.

other facility-wide wired network appliances, such as VoIP phones, IPTV, wired patient monitoring appliances, etc.

When placing a wall-plate AP in every unit, the transmit power levels should generally be set to minimum levels (11 dBm on both 2.4 GHz and 5 GHz), so as to minimize the coverage area of each AP to minimize overlap into neighboring units. Transmit power levels can be increased as needed if the residential units are large enough (e.g. >> 1000 sq. ft. with multiple rooms and therefore multiple walls) and/or depending upon room layout and building materials.

The configuration procedure is slightly different than the conventional recommended approach. The AP Group mechanism is still used, but only as a template for the APs to establish the standard network configuration parameters. Once the APs are configured in an AP Group, the APs must be removed from the AP Group so that all of the settings (including the Guest Network) can be modified on each individual AP.

The overall configuration process is as follows:

(recommend the use of a random password generator program or web site)