Wi-Fi CloudAP Deployment Guide

WatchGuard Wi-Fi Cloud & APs

About This Guide
The WatchGuard Wi-Fi Cloud AP Deployment Guide is a guide to help you with your deployment of a
WatchGuard AP with WatchGuard Wi-Fi Cloud. For the most recent product documentation, see theWatchGuard Wi-Fi Cloud Help on the WatchGuard website at http://www.watchguard.com/wgrdhelp/documentation/overview.
Information in this guide is subject to change without notice. Companies, names, and data used inexamples herein are fictitious unless otherwise noted. No part of this guide may be reproduced ortransmitted in any form or by any means, electronic or mechanical, for any purpose, without the express
written permission of WatchGuard Technologies, Inc.
Guide revised: 11/3/2017

Copyright, Trademark, and Patent Information
Copyright © 1998-2017 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names
mentioned herein, if any, are the property of their respective owners.
Complete copyright, trademark, patent, and licensing information can be found in the Copyright andLicensing Guide, available online at http://www.watchguard.com/wgrdhelp/documentation/overview.

About WatchGuard

Address

WatchGuard® Technologies, Inc. is a global leader in network security,
providing best-in-class Unified Threat Management, Next Generation
Firewall, secure Wi-Fi, and network intelligence products and services
to more than 75,000 customers worldwide. The company’s mission is tomake enterprise-grade security accessible to companies of all types
and sizes through simplicity, making WatchGuard an ideal solution forDistributed Enterprises and SMBs. WatchGuard is headquartered in
Seattle, Washington, with offices throughout North America, Europe,
Asia Pacific, and Latin America. To learn more, visit WatchGuard.com.

505 Fifth Avenue South
Suite 500
Seattle, WA 98104

For additional information, promotions and updates, follow WatchGuard
on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company
page. Also, visit our InfoSec blog, Secplicity, for real-time information
about the latest threats and how to cope with them atwww.secplicity.org.

ii

Supportwww.watchguard.com/support
U.S. and Canada +877.232.3531
All Other Countries+1.206.521.3575

Sales
U.S. and Canada +1.800.734.9905
All Other Countries+1.206.613.0895

Wi-Fi Cloud AP Deployment Guide

Contents
Introduction to the Deployment Guide
Overview

1
2

WatchGuard AP Management

2

WatchGuard Wi-Fi Solutions

3

WatchGuard Wi-Fi Cloud Architecture

4

Cloud-based Management with WatchGuard Manage

5

WIPS (Wireless Intrusion Prevention System)

6

WatchGuard Analyze

6

Scalable, Multi-Tenant, Elastic Cloud Architecture

7

Zero Touch Deployment

7

Regulatory Compliance Reports

8

Wireless Network Design

9

Evaluate Requirements

9

Coverage Planning

9

Capacity Planning

10

Wireless Site Survey

10

Channel Capacity Planning

11

Design Wireless Networks for Capacity

11

Requirements Analysis — Clients

12

Requirements Analysis — Applications

13

Use Cases

14

Environment Analysis

14

Wireless Environmental Factors

14

Wireless Regulatory Domain

14

RF Environment

14

Channel Capacity Planning

Wi-Fi Cloud AP Deployment Guide

15

iii

Spectrum Availability in 5 GHz

15802.11ac Wave 1 and Wave 2

16

MU-MIMO

16

WatchGuard AP420

17

Using DFS Channels

17

Channel Width Selection

17

Estimate Channel Capacity

18

Channel Capacity Estimate Considerations

18

Channel Capacity Calculations

19

Maximum Clients For APs

21

Summary of Channel Capacity Planning Recommendations

22

Site Preparation Checklist

23

Deployment Best Practices

25

Wireless Network Best Practices

25

Set a Minimum Unicast Rate

25

Signal Strength, Channel Width, and QAM

26

Channel and Power Settings

27

AP Transmit Power Reduction

27

Fast Roaming29

802.11k and 802.11v

30

SSID Bridge vs. NAT Mode

31

Smart Client Load Balancing

32

Smart Steering

33

Band Steering

34

Broadcast/Multicast Control

35

Bonjour Gateway

35

Reliable Multicast Delivery

36

Multicast, Broadcast and Management Rate Optimization

37

Wi-Fi Cloud AP Deployment Guideiv

Traffic Shaping

38

Wi-Fi Multimedia and Quality of Service

39

End-to-End QoS

40

Application Visibility and Control

41

RF Interference

42

Wi-Fi Interference Sources

42

Non-Wi-Fi Interference Sources

42

Microsoft Xbox Game Controller

42

Microwave Oven

43

Bluetooth43

Smart Spectrum

44

Spectrum Policy

44

WIPS (Wireless Intrusion Prevention System)

45

Summary of Wireless Network Recommendations

47

Wired Network Best Practices

50

AP Power Requirements

50

AP Uplink Capacity

50

AP Cabling

51

Access Network Uplink

51

VLAN Design

52

Jumbo Frames

52

Summary of Wired Network Recommendations

53

Network Services Best Practices

54

AP Placement and Channel Plan Best Practices

55

Wireless Signal Strength and Noise Levels

55

Signal Strength55

Noise Level

55

Signal to Noise Ratio

55

Wi-Fi Cloud AP Deployment Guidev

Predictive Site Survey

56

Indoor Attenuation Reference

56

Indoor Attenuation Reference

57

One-for-One AP Replacement

57

Avoid Self Induced CCI in 2.4 GHz

57

40 MHz Channel Plan

58

80 MHz Channel Plan

58

AP Mounting Recommendations

59

Wall Mount

59

Ceiling Mount

59

Structural Proximity and Electrical Interference60

AP Placement

61

Post-Deployment Validation Survey

63

Summary of Recommendations for an AP Placement and Channel Plan

64

Deployment Use Cases
Use Case 1 — Classroom

66
66

Requirements

66

Environment

66

Channel Capacity Planning

66

Step 1

67

Step 2

67

Solution

68

5 GHz Plan

68

2.4 GHz Plan69

Use Case 2 — Lecture Hall

70

Requirements

70

Environment

70

Channel Capacity Planning

70

Wi-Fi Cloud AP Deployment Guidevi

Step 1

71

Step 2

71

Solution72

5 GHz Plan

73

2.4 GHz Plan74

Use Case 3 — Dormitories

75

Requirements

75

Environment

75

Channel Capacity Planning

75

Step 175

Step 2

76

Solution

76

5 GHz Plan

77

2.4 GHz Plan

78

Channel Capacity Estimates

79

Wi-Fi Cloud AP Deployment Guide

vii

viii

Wi-Fi Cloud AP Deployment Guide

Introduction to the Deployment Guide
This guide provides best practices for network design, deployment, and configuration of enterprise wirelessenvironments with WatchGuard Wi-Fi Cloud.
This guide includes these topics:n

OverviewnWireless Network Designnn

Deployment Best Practiceso Wireless Network Best PracticesoWired Network Best PracticesoNetwork Services Best Practiceso

AP Placement and Channel Plan Best Practices

Deployment Use Cases

This guide is intended for use by engineers with a background in 802.11 concepts and for those involved
with design, installation, and optimization of WatchGuard wireless networks.

Wi-Fi Cloud AP Deployment Guide

1

Introduction to the Deployment Guide

Overview
The WatchGuard AP family of wireless access points provide secure, reliable, wireless communications
while delivering high performance and broad coverage to meet the needs of enterprise-level customers,
small businesses, branch offices, campuses, and hotels.
Internal antennas, slim cases, minimalist labeling, and small LEDs, coupled with wall and ceiling mountoptions and Power over Ethernet (PoE) make these devices ideal for low profile deployment scenarios.
WatchGuard currently offers these AP device models:

WatchGuard AP Management
There are two ways you can manage WatchGuard APs:

WatchGuard Firebox Gateway Wireless Controller
This management solution provides local management, configuration, security, and monitoring ofAPs directly from your WatchGuard Firebox with the Gateway Wireless Controller.

WatchGuard Wi-Fi Cloud
WatchGuard Wi-Fi Cloud provides a powerful cloud-based enterprise wireless management solution
for AP configuration, security, and monitoring. When managed by our WatchGuard Wi-Fi Cloud,WatchGuard APs deliver fast, reliable wireless access and provide industry-leading wirelesssecurity, guest engagement, and analytic tools. The solution has also been designed from theground-up to focus on ease of deployment and administration, to simplify the most complex aspectsof Wi-Fi management, and to make fast, secure, and intelligent Wi-Fi accessible to organizations of
all types and sizes.
In this guide, we use the powerful features available in WatchGuard Wi-Fi Cloud for the examples and use
cases.

2

Wi-Fi Cloud AP Deployment Guide

Introduction to the Deployment Guide

WatchGuard Wi-Fi Solutions
WatchGuard offers three types of wireless security solutions for WatchGuard APs:n

Basic Wi-Fi — Use the Gateway Wireless Controller on a WatchGuard Firebox to configure, manage,and monitor WatchGuard AP devices directly from the Firebox.

n

Secure Wi-Fi — Use WatchGuard Wi-Fi Cloud for WatchGuard AP device management, security, andmonitoring.

n

Total Wi-Fi — Use WatchGuard Wi-Fi Cloud for WatchGuard AP device management, security, andmonitoring. With Total Wi-Fi, you also get access to additional tools for guest user engagement,
analytics, social media integration, captive portals, and splash page design.

Wi-Fi Cloud AP Deployment Guide

3

Introduction to the Deployment Guide

WatchGuard Wi-Fi Cloud ArchitectureWith WatchGuard Wi-Fi Cloud, all services, such as Wi-Fi, WIPS, monitoring, troubleshooting, and guest
management,are integrated into a single cloud platform. This provides a cost-effective, easy to manage,highly scalable, secure and reliable cloud Wi-Fi solution.

The Wi-Fi Cloud solution is built on a controller-less architecture and only encrypted management traffic issent to the cloud. Customer data traffic is never sent to the cloud.

WatchGuard APs are cloud-managed, but provide full functionality even when Internet access isunavailable. For example, when a WatchGuard AP reboots without access to the Internet, the AP uses a
locally stored configuration to operate.

4

Wi-Fi Cloud AP Deployment Guide

Introduction to the Deployment Guide

Because WatchGuard APs operate without a controller, these features and functionality are performed at
the AP level:n

QoS (Quality of service) and traffic shapingnRF managementnBonjour gatewaynApplication visibilityn

WIPS (Wireless Intrusion Prevention System)nCompliancen

SSID scheduling

Cloud-based Management with WatchGuard Manage
WatchGuard Wi-Fi Cloud and WatchGuard APs eliminate the cost and complexity of traditional controllerbased enterprise wireless network solutions, to simplify deployment. This makes it an ideal solution fororganizations with a limited IT staff, distributed sites, and a tight IT budget.
The WatchGuard Manage interface is designed for cloud applications. The interface is lightweight and canbe used on any Web browser, OS, or device, including Android devices, iPads, and other tablets.
Configurable dashboards enable individual administrators to create their own personal work spaces andoptimize the information display according to their needs and screen sizes. Each user can create multiple
custom dashboards, and can choose from over 25 widgets that provide comprehensive Wi-Fi analytics,
statistics, and security alerts.
The unique hierarchical location-based policy management architecture simplifies management of multiple
locations from a single console. You can define role-based administration, Wi-Fi configurations, WIPS
policies, and monitoring in a logical context and link these settings to specific locations.

Wi-Fi Cloud AP Deployment Guide

5

Introduction to the Deployment Guide

WIPS (Wireless Intrusion Prevention System)
WIPS (Wireless Intrusion Prevention System) is a best-in-class wireless security architecture based on
several patents. The system provides comprehensive protection from wireless threats, such as rogue APs,
ad-hoc networks, client mis-associations, honeypots and evil twin APs, DoS attacks, and BYOD (BringYour Own Device) risks including mobile hotspots.

WatchGuard Analyze
WatchGuarrd Analyze provides enhanced guest management features to enable guest Wi-Fi access withsocial media, SMS, Guest Book, and Web Form plugins. Social media authentication gives guest Wi-Fi
users the option to share their public profile information for social engagement.

6

Wi-Fi Cloud AP Deployment Guide

Introduction to the Deployment Guide

Scalable, Multi-Tenant, Elastic Cloud Architecture
Powered by a mature, elastic cloud technology in development since 2008, Wi-Fi Cloud can scale to any
number of locations. Built-in multi-tenancy enables account information, configurations and data to becompletely segmented for different customers.
The data centers offer 99.9% uptime with local and WAN-based high availability and disaster recovery.
WatchGuard APs are managed from the cloud over a secure AES-encrypted tunnel. APs are capable ofstandalone operation and provide uninterrupted service with full functionality even if the AP loses
connectivity to Wi-Fi Cloud.

Zero Touch Deployment
WatchGuard APs can automatically discover and connect to W-Fi Cloud as soon as they are powered up
and receive Internet access. This simplifies deployment, especially at remote sites without IT staff. WhenAPs are configured in WatchGuard Manage for a location, the policies and configurations assigned to thatlocation are automatically pushed to the device to immediately deploy the AP when it connects to theInternet.

Wi-Fi Cloud AP Deployment Guide

7

Introduction to the Deployment Guide

Regulatory Compliance Reports
WatchGuard Wi-Fi Cloud enables organizations to meet wireless security requirements defined by theirrespective regulatory compliance standards. The audit process is simplified with predefined HIPAA andPCI compliance reports that map wireless vulnerabilities and threats to specific requirements. From
WatchGuard Manage, you can generate reports across many locations. You can generate reports ondemand or schedule reports for automatic generation, and they can be archived or delivered by email.

8

Wi-Fi Cloud AP Deployment GuideWireless Network Design
Before you deploy WatchGuard APs on your network, you must research, design, and plan your wirelessnetwork deployment to make sure it meets your requirements for coverage, capacity and airtime demand,and security.

Evaluate Requirements
When you evaluate your current environment and wireless requirements, make sure to consider:nWhat wireless modes must your access point support (802.11a/b/g/n, 802.11ac Wave 1, Wave 2)?
o What types of wireless clients do you want to allow to connect?
onWhat SSIDs and networks do you want to create?
o Are there groups of wireless users who need wireless access to different network resources?
onWhat wireless modes do they typically support?

Do you want to set up a guest wireless network that only allows Internet access?

Where is the best physical location for each AP?
o What is the physical size of the environments wireless users will connect from?
o

Do you need more than one AP to cover multiple areas?

Coverage Planning
Traditional coverage planning examines the physical environment where the wireless network will be
deployed and the different factors that can affect your wireless signal power, range, and attenuation.
Coverage planning provides:nOptimal frequency usage and access point locationsn

Determination of transmit power levelsnPrevention of channel interferencenExamination of floor plans, physical obstructions, and building materials

Wi-Fi Cloud AP Deployment Guide

9

Wireless Network Design

Capacity Planning
As part of your wireless deployment planning you must also consider capacity and airtime demand. You
must factor in to your plan the expected peak airtime demand amount and type of traffic, and traffic patterns
for your wireless network and the coverage area it serves.
For example, a deployment for a hotel and its conference rooms has very different capacity and airtime
demand criteria than a deployment for a small office, a retail department store, or a school campus. Eachwireless deployment is unique and requires both coverage and capacity planning.
Capacity and airtime demand analysis provides:nOptimal number of clients per access point radio, including idle and active clients. You must factor inslow periods and worst-case usage scenarios.

nAirtime demand and minimum data rates for different types of application traffic.
o Include email, web, video, social media, streaming, and other applications.
onDetermine bandwidth throughput per application and connection, then determine aggregate
bandwidth required in the wireless network coverage area.

Considerations for growth, based on the number of connected clients and application bandwidth usage

Wireless Site Survey
Complete a wireless site survey to analyze your physical environment and existing wireless signals.
Use a wireless site survey utility, such as Ekahau HeatMapper, AirMagnet Planner, or any other similar
tool.
nMeasure before the deployment as part of your planningo Measure any existing wireless signals and interference in your environmentonMeasure after the deployment to see the AP signal strength and rangeo After you install your access points, make another heat map to verify that your current placement
provides adequate coverage and signal strength.
o10Measure wireless signal strength at different locations.

Check for wireless channel congestion and make sure the distance between AP devices does notdegrade the signal to problematic levels

Wi-Fi Cloud AP Deployment GuideWireless Network Design

Channel Capacity Planning
Most wireless networks are designed for capacity rather than coverage, especially in educational
environments where high client densities and high bit rate applications, such as video streaming, arecommon.
To design networks based on capacity, the first step is to define the requirements, which include client
density, client types, applications, use cases, and throughput requirements.
For a successful design, you also need other information related to the environment. This includes factors
such as Wi-Fi spectrum availability, building layouts, building materials used, and neighbor Wi-Fi channel
usage.

Design Wireless Networks for Capacity
The design process includes these analysis and planning stages:nRequirements Analysis (Clients, Applications, Use Cases)n

Environment AnalysisnChannel Capacity Planning

Wi-Fi Cloud AP Deployment Guide

11

Wireless Network Design

Requirements Analysis — Clients
You must determine the number and types of client devices and where they are located on the network.
Channel capacity and overall network capacity are as much a function of the client population as the typesof APs and switches deployed. While it is not always possible to know the exact breakdown of client
capabilities (for example, 802.11n vs. 802.11ac, Wave 1 or Wave 2 802.11ac, 1x1, 2x2, and 3x3) for a given
area of the network, the more details that you know, the more accurate your channel capacity planning willbe. Often you can use monitoring tools in the current Wi-Fi deployment to gather details about the clients in
use on your network.

For example, when you compare the maximum data rate of the 1x1 Samsung Galaxy Tab Pro (433 Mbps) tothat of the 3x3 Apple MacBook Pro (1.3 Gbps), you can see that the MacBook Pro has approximately threetimes the maximum data rate of the Galaxy Tab Pro. A wireless network that has only MacBook Pro clients
could require as much as three times the capacity of a wireless network with only Galaxy Tab Pro clients (ifthe WLAN has deployed 3x3 Wave 1 APs, such as the AP320).

12

Wi-Fi Cloud AP Deployment GuideWireless Network Design

Requirements Analysis — Applications
You must determine which applications are typically used on your wireless client devices. To estimate a
per-client Mbps throughput requirement for a given area of a deployment, use the application with thehighest bit rate. For example, in a classroom the highest bit rate application could be HD video streaming at
5 Mbps. For this use case, we recommend a per-client throughput requirement of 5 Mbps. To determine
which applications are used by your wireless clients, you can use application visibility tools on your current
wireless network.
It is also important to consider the requirements for applications that you plan to use in the future. We
recommend you communicate with IT personnel about proposed future application use.
These are reference approximate bit rates for common applications. You can use these values to calculate
approximate capacity requirements.
Application

Approximate Average Bit Rate

Audio

100–1 Mbps

File Backups

20–60 Mbps

File Sharing

5 MbpsOn-Line Testing

2–4 Mbps

Printing

1–3 Mbps

Video Conferencing: Standard Definition

5–1 Mbps

Video Conferencing: High Definition

2–3 Mbps

Video Gaming*

Requires measurements

Video Streaming: Standard Definition

1 MbpsVideo Streaming: High Definition 720p

3–5 Mbps

Video Streaming: High Definition 1080p

8–12 Mbps

Video Streaming: UHD (4K)

18–25 Mbps

Webinars

1 MbpsWeb Browsing

750 Kbps* We recommend that you complete an over-the-air packet capture or use the Application Visibility feature in WatchGuard WiFi Cloud to measure the application bit rate on your current wireless network.

Wi-Fi Cloud AP Deployment Guide

13

Wireless Network Design

Use Cases
A use case is defined as the number and types of devices and their applications and usage patterns for a
specific location. To learn about use cases for a deployment, we recommend you perform a thorough site
walk-through with IT personnel familiar with the current network. You can also find solutions for several use
cases for a school campus deployment in the Deployment Use Cases section.

Environment Analysis
Wireless Environmental Factors
There are several environmental factors that can affect the range and performance of wireless networks.
You must estimate the path loss and attenuation of your wireless signals because of these factors.
nWalls and ceilings ─ Walls and ceilings between the AP and wireless clients can degrade signal
strength. Wireless signals can penetrate walls and other structures, but the rate of penetration is
directly related to the type of building materials, material thickness, and the distance from the wirelessantenna.

n

Building materials ─ Metal and aluminum doors, glass, concrete, metal studs, brick walls, glass, andother types of building materials can have a significantly negative effect on the strength of wirelesssignals.

n

EMI (Electro-magnetic interference) ─ EMI from other electrical devices, such as microwaves,cordless phones, and wireless headsets can generate significant RF noise and degrade or disrupt
wireless communications.

nDistance ─ Wireless signals degrade quickly past their maximum range. You must plan your network
carefully to provide adequate wireless coverage over the range you require in your environment.

Wireless Regulatory Domain
The number of channels potentially available for a deployment depends on the regulatory domain where thedeployment is located. Some regulatory domains have greater spectrum capacity than others. The amountof spectrum available for a given deployment has a direct impact on the types of uses cases you can
support.

RF Environment
You must assess the RF (radio frequency) environment to identify local sources of Wi-Fi and non-WiFi
interference. For example, RF environments for schools located in dense urban areas have a higher
potential interference than for schools located in rural areas.

14

Wi-Fi Cloud AP Deployment GuideWireless Network Design

Channel Capacity Planning
As part of capacity planning you must review and understand the wireless spectrum availability to help
guide the planning process.

Spectrum Availability in 5 GHz
This diagram describes the current and proposed spectrum for the regulatory regions covered by the FCC(Federal Communications Committee) in the United States.

FCC 5 GHz Frequency Allocation. Source: wlanpros.com

All spectrum is currently available in FCC regions except for the frequencies displayed in pink. Thesefrequencies are not currently available, but may be available to the Wi-Fi spectrum in the future. Even if you
use all channels currently available, including DFS (Dynamic Frequency Selection) channels, it can be achallenge to meet the capacity requirements of some high density and high throughput use cases.
This table shows the number of channels available for the 5 GHz band in the US.
Channel Width

Without DFS

With DFS

20 MHz925

40 MHz4

1280 MHz2

6

160 or 80+80 MHz

1

3

Wi-Fi Cloud AP Deployment Guide

15

Wireless Network Design

Most networks deploy 40 MHz or 80 MHz channels based on use case requirements and spectrum
availability. Some notable exceptions are high density auditorium or stadium and arena deployments where
it is often preferable to use 20 MHz channels because of the ability to reuse channels. We recommend you
consider the use of 80 MHz channel plans only if DFS channels are available, because without DFS
channels only two non-overlapping 80 MHz channels are available. if you use DFS channels, you have six
non-overlapping DFS channels available.

802.11ac Wave 1 and Wave 2This table provides a high-level comparison between the 802.11ac Wave 1 and Wave 2 standards.
FeatureWave 1

Wave 2Channel Width20, 40, 80

20, 40, 80, 80+80, 160 MHz

QAM Encoding

16, 64, 256 QAM

16, 64, 256 QAM

Spatial Streams

3

4 (as implemented)
Up to 8 (per the standard)

Explicit Beamforming

Some Wave 1 APs

All Wave 2 APs

MIMO

SU-MIMO

SU-MIMO, MU-MIMO

Frame Aggregation

A-MSDU size 11,426 Bytes

A-MSDU size 11,426 Bytes

A-MPDU size 1,048,576 Bytes

A-MPDU size 1,048,576 Bytes

Bands Supported

5 GHz

5 GHz

Forward Error Correction

BCC (Binary Convolutional Code)BCC (Binary Convolutional Code)LDPC (Low Density Parity Check)

LDPC (Low Density Parity Check)

Some Wave 1 APs

Most Wave 2 APs

Dynamic Channel Width

MU-MIMO
MU-MIMO (Multi-User MIMO) can improve performance in several use cases because of its ability toenable simultaneous transmissions from APs to clients. In regular 802.11 communications, AP-to-clienttransmissions are serial communications. With MU-MIMO, up to four AP-to-client transmissions can occur
simultaneously, which can significantly improve performance and capacity in many use cases.
The boost in performance and capacity depends on several factors, such as channel conditions, client
density, client capability, and client mix (SU-MIMO to MU-MIMO ratio). Early MU-MIMO performance
testing has shown that when conditions are optimal, aggregate throughput performance can improve by asmuch as 50%.

16

Wi-Fi Cloud AP Deployment GuideWireless Network Design

For example, if there is a requirement to provide high quality video streaming for up to 40 clientssimultaneously (such as in a classroom) you can compare two solutions:nSolution 1 has all clients that are Wave 2 (for example, an Acer Aspire E/1x1) with a Wave 2 AP
deployed AP420.

n

Solution 2 has the same clients but uses Wave 1 APs (non MU-MIMO APs such as an AP120 andAP320).

The MU-MIMO solution may be able to support HD video, while the Wave 1 solution may only be able tosupport standard definition video.
MU-MIMO helps in deployments with high-density areas such as auditoriums and classrooms where
aggregate throughput demands can be high. Both of these use cases primarily support 1x1 and 2x2 clients.
These types of clients are well suited to take advantage of MU-MIMO. Both APs and clients must support
Wave 2 to realize the benefits of MU-MIMO.

WatchGuard AP420
The WatchGuard AP420 is an 802.11ac Wave 2 access point, and supports up to four spatial streams inboth SU-MIMO and MU-MIMO modes. Earlier generations of Wave 2 APs support up to three spatial
streams in MU-MIMO mode. The additional spatial stream for MU-MIMO with the AP420 helps improve
wireless network performance and capacity. The AP420 simultaneously supports up to 64 MU-MIMO
clients that are dynamically combined for optimal MU-MIMO transmissions of up to 4 MU-MIMO clients at atime.
The AP420 is the recommended platform for most large educational environments, such as classrooms,
cafeterias, auditoriums, libraries, and lecture halls.

Using DFS Channels
In the past, wireless network designers were reluctant to deploy DFS channels because of concerns aboutlack of client support and network instability caused by radar event detection. However, many networks
today rely on DFS channels to meet higher scalability requirements. Because radar events are not as
common as once thought (for most deployments), and newer Wi-Fi devices support DFS channels, DFSenabled wireless networks are now more common.
We recommend you enable DFS channels if they are available, and that you provision both 5 GHz and 2.4
GHz bands. You can also enable 2.4 GHz coverage throughout the deployment as a best practice to provide
access for clients that use both bands.

Channel Width Selection
To design an 11ac wireless network for maximum capacity with the minimum number of APs, deploy
80MHz channels. If you use DFS channels, most regulatory regions around the globe provide enoughspectrum availability to support 80 MHz deployments. If you cannot use DFS channels, we recommend you
use 40 MHz channels for most regions, including the US.

Wi-Fi Cloud AP Deployment Guide

17

Wireless Network Design

Ultimately, channel width selection depends on several factors including use case requirements, spectrum
availability, RF environment, and budget for the number of APs required. In a deployment in which you
cannot use DFS channels (and must therefore use 40 Mhz channels), you might need to reconsider yourrequirements. For example, you might need to decrease the bit rate at which video is streamed for 2.4GHzonly clients and for dual band clients that do not support DFS channels. Deploy 2.4 GHz throughout yournetwork to provide some additional capacity.

Estimate Channel Capacity
Capacity planning must be use-case specific and must consider these factors:nTotal active devicesnTypes of devicesnUsage patternsnApplications in use

nArea of coverage

Estimated throughput capacities for different channel widths and spatial streams are provided in this table,
which you can use as a point of reference.
Maximum Data Rates
20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

87 Mbps

200 Mbps

433 Mbps

867 Mbps

2 Spatial Streams

173 Mbps

400 Mbps

867 Mbps

1.73 Gbps

3 Spatial Streams

289 Mbps

600 Mbps

1.33 Gbps

2.34 Gbps

4 Spatial Streams

347 Mbps

800 Mbps

1.73 Gbps

3.47 Gbps

These rates are maximum data rates and not throughput capacity rates. Throughput capacity rates aremuch lower because of factors such as protocol overhead, contention loss, and loss due to signal strength
degradation.
See Channel Capacity Estimates for a series of tables that estimate channel capacities for different rates ofcontention loss and loss caused by signal strength degradation for different channel widths and spatial
streams. You can reference these tables to simplify the channel capacity planning process.

Channel Capacity Estimate Considerations
The channel throughput capacity estimates provided here and in Channel Capacity Estimates are derived
from single AP and multi-AP competitive performance testing. The estimations factor in contention loss
seen in tests for 5, 10, 20, 30, 40, 50 and 60 clients per radio where all clients are located within 20 feet
(6.096 meters) of the AP under test.
To estimate loss caused by rate adaptation because of lower signal strength, clients are placed from 10 to
60 feet (3.048 – 15.24 meters) away from an AP.

18

Wi-Fi Cloud AP Deployment GuideWireless Network Design

While capacity loss from wireless interference such as co-channel interference (CCI) and adjacent channelinterference (ACI) can be substantial, it is not factored into this test data.
This table shows the maximum throughput rates for different channel widths and spatial streams estimatedto be 60% of the maximum data rate. This is a conservative number. For example, in certain circumstances,a three spatial stream client (for example, a MacBook Pro) connected to a three spatial stream AP
configured for 80 MHz can achieve total throughput of 850 Mbps, which is higher than the listed value of 798
Mbps.
Estimated Max Throughput Capacity - 60 % Max Data Rate
Client Active

20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

52 Mbps

120 Mbps

260 Mbps

520 Mbps

2 Spatial Streams

104 Mbps

240 Mbps

520 Mbps

1.04 Gbps

3 Spatial Streams

173 Mbps

360 Mbps

798 Mbps

1.40 Gbps

4 Spatial Streams

208 Mbps

480 Mbps

1.04 Gbps

2.08 Gbps

Actual use cases are unlikely to have a single client active so the table above is useful only as a benchmark
to measure AP performance. When you factor in higher client densities common to large deployments,
throughput capacity of a radio declines. You can reference the tables in Channel Capacity Estimates forplanning examples, as well as for the use cases presented later in this guide.

Channel Capacity Calculations
This section provides a method to manually calculate channel capacity.
To calculate channel capacity, you must:nDetermine the percentage of airtime or channel utilization that an individual client requires to meet a perclient throughput requirements for a particular use case.

n

Determine the total channel capacity needed to accommodate all clients in the use case.

For example, a use case has 150 MacBook Pros (or other 11ac 3x3 clients) active concurrently. Each client
has a throughput requirement of 2 Mbps. DFS channels are not available so we must use a 40 MHz channel
plan.

Wi-Fi Cloud AP Deployment Guide

19

Wireless Network Design

Before you start your calculations, you must know the estimated channel capacity per radio and an
estimated density per radio. This information is required to find the estimated channel capacity in Channel
Capacity Estimates. This use case will likely fall into the very high client density category as there will be
150 concurrently active clients.

Use
Case

DeviceType

Library

MacBook
Pro/3ss

Number of
ActiveDevices/Density

App orThroughput Requirement
Bit Rate

150 / Very High

2 MbpsChannelCapacity
120
Mbps /
40 MHzPer Device
Airtime /ChannelCapacity
1.67%

The very high client density table in Channel Capacity Estimates shows that for 11ac 3x3 client with a 40
MHz channel, the estimated throughput capacity is 120 Mbps. To determine the percentage of airtime orchannel utilization an individual client requires to meet a per-client throughput requirement, divide thethroughput requirement by the estimated channel capacity and multiply by 100.
n(Application Bit rate or Throughout Requirement) / (Channel Capacity) x 100 = Per Device Airtimen(2 Mbps / 120 Mbps) x 100 = 1.67%

n

Per Device Airtime = 1.67%

You can use this number to calculate the total number of channels/radios required to meet the use caserequirements.
Use
Case

DeviceType

Number of Active
Devices / Density

Per Device
Airtime

Total
AirtimeEstimated Channels /Radios Required

Library

MacBook
Pro/3ss

150/Very High

1.67%

250%

3

You must multiply the per-client airtime required and the total number of clients active concurrently.

20

nNumber of Active Devices x per Device Airtime = Channels/Radios Requiredn

150 Active Devices x 1.67% per Device Airtime = 250%n

Estimated Channels/Radios Required = 3 (Rounding up)

Wi-Fi Cloud AP Deployment GuideWireless Network Design

Maximum Clients For APs
This table lists the recommended maximum number of clients for WatchGuard APs.
Maximum
Clients

5 GHz / 2.4
GHz

Low density / throughput
areas

50

30 / 20

Dual radio, 11ac Wave 1,
3x3, Indoor

Moderate density /throughput areas

75

45 / 30

AP420

Tri radio, 11ac Wave 2 , 4x4,
IndoorHigh density / throughput
areas

150

100 / 50

AP322

Dual radio, 11ac Wave 1,
3x3, Outdoor

Outdoors

75

45 / 30

Model

Description

Recommended Use

AP120Dual radio, 11ac Wave 1 ,2x2, Indoor

AP320

Wi-Fi Cloud AP Deployment Guide

21

Wireless Network Design

Summary of Channel Capacity Planning Recommendations
This table summarizes the channel capacity planning recommendations for wireless networks.
Recommendations

Notes

Design wireless network for capacity.
Focus design on specific use cases.

Use Case = Number of devices + types of devices +set of applications + usage patterns + for a given area.

Use most demanding application (per usecase) to determine throughput requirement.

If application information is unknown, design for a perclient throughput requirement of 5 Mbps.

Use current wireless network to determine
type and number of devices per use case.
Use current wireless network tools todetermine application bit rates.

Alternatively, packet capture tools can be used todetermine application bit rates.

Select the correct APs for the use cases.

Refer to the recommended maximum clients per AP
table for AP selection.

Use predictive planning tools to estimate thenumber of APs required to meet use casethroughput requirements.

22

Design for 5 GHz capacity.

Deploy both 2.4 GHz and 5 GHz pervasively.

Use DFS channels.

Discover if any DFS channels cause interference withlocal radar and remove those channels from thepotential operating channel pool.

Use 80 MHz channels.

If several DFS channels cannot be used, then plan touse 40 MHz channels.

Wi-Fi Cloud AP Deployment Guide

Site Preparation Checklist
For a successful deployment, you must prepare the installation site. This section provides a checklist to
help the implementation team with site preparation.
Preparation Checklist

Notes

Installation Preparation
POE or AC power

See the AP Power Requirements table.

Cable plant (CAT5e or greater)

See the Cable Category Reference table.

Ladder/Scissor Lift
Special AP mounting

AP mounting instructions are available in the WatchGuard AP

requirements

Hardware Guides.

Internet availability
Tools (for mounting APs)
Implementation Preparation
Switch ports
DHCP
RADIUSDNS IPs
VLAN IDs
Firewall rules:nPort 3851 (UDP) outboundnPort 80 (TCP) outbound /stateful inboundnPort 443 (TCP) outbound /stateful inboundThese ports are required for APs to communicate with WatchGuard
Wi-Fi Cloud.

Proxy bypass rule for AP

Bypass rule is for management traffic from the AP IP address tomanagement traffic

WatchGuard Wi-Fi Cloud.

Wi-Fi Cloud AP Deployment Guide

23

Site Preparation Checklist

Preparation Checklist

Notes

Verification Preparation
Wi-Fi clients

These clients are required .for acceptance testing.

Acceptance test plan

The acceptance test plan should verify client and application
functionality.

24

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices
This section describes deployment best practices for these network factors:nWireless Network Best PracticesnWired Network Best Practicesn

Network Services Best Practicesn

AP Placement and Channel Plan Best Practices

These recommendations are based on successful wireless deployments. Because each wirelessdeployment has its own unique environment, client use cases, and network architecture, these bestpractices are intended as guidelines.

Wireless Network Best Practices
This section provides suggestions on how to deploy a wireless network that can support large high-density
use cases. The recommended settings are based on the features available in WatchGuard Wi-Fi Cloud.

Set a Minimum Unicast Rate
The default minimum unicast rate for 802.11n 2.4 GHz and 802.11ac 5 GHz is most suitable for networks
designed to optimize coverage, as opposed to client capacity. We recommend that you design enterprise
wireless networks for capacity with the goal to improve the throughput and client capacity of each cell andreduce cell sizes so that channels can be reused more frequently. This results in an increase in the overall
capacity of the network, given a fixed amount of frequency spectrum to use.
One technique that can help reduce cell size is to increase the minimum data rate at which clients can
associate to a wireless network. We recommend that you set the minimum unicast data rate to 24 Mbps.
You can configure the minimum unicast data rate in the Traffic Shaping & QoS section of an SSID Profile.

Wi-Fi Cloud AP Deployment Guide25

Deployment Best Practices

Signal Strength, Channel Width, and QAM
This table shows the approximate signal strengths required to support MCS rates for various channel
widths. 256-QAM requires higher signal strengths than 64-QAM because of the greater constellation
density required to support 256-QAM. However, wider channels also require higher levels of signal strengthcompared to narrow channels to support a given modulation scheme.
For example, 64-QAM/MCS-7 requires -62 dBm for 40 MHz channels, but the requirement jumps to -58 dBm
for 80 MHz channels. To design a network to support 256-QAM/MCS-9 with 80 MHz channels pervasively,
requires a signal strength of -52 dBm or higher throughout the deployment. This means that APs should belocated every 30 to 50 feet, depending on the environment, clients, and AP capabilities. While there may behigh density and high /throughput use cases (such as an auditorium) where designing for 256-QAM isrecommended, most high density deployments are designed to support 64-QAM pervasively.
Signal Strengths Required to Support MCS Rates for Various Channel Widths
Modulation Scheme

20 MHz40 MHz80 MHz80+80 MHz

160 MHz11ac 64-QAM/MCS-7-64 dBm-62 dBm-58 dBm-55 dBm-55 dBm

11ac 256-QAM/MCS-8-59 dBm-56 dBm-53 dBm-50 dBm-50 dBm

11ac 256-QAM/MCS-9-58 dBm-54 dBm-52 dBm-49 dBm-49 dBm

Higher density modulation requires higher levels of signal strength, and wider channels require higher signal
strength compared to narrower channels. As a result, the cell size for an AP that supports 256-QAM is muchsmaller than that of an AP that supports 64-QAM, as shown in this diagram.

26

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Channel and Power Settings
RF environments are dynamic and reliable wireless networks must adapt real-time at the RF layer to makesure high quality service throughout is provided for an entire deployment.
ACS/DCS (Auto Channel Selection and Dynamic Channel Selection) enable WatchGuard APs to adapt to
RF conditions in real-time. If a device that causes interference (Wi-Fi or non-Wi-Fi), such as a microwave
oven or a neighbor AP, is sensed by a WatchGuard AP, APs near the interference source can dynamicallychange channels to avoid the interference.

AP Transmit Power Reduction
When you reduce AP transmit power, it helps to decrease the cell size. Smaller cells enable network
designs to maximize channel reuse that can increase aggregate throughput and capacity for a wirelessnetwork.
Classroom:n

5 GHz — 8–16 dBm

n

2.4 GHz — 4–10 dBm

Auditorium or Lecture Hall:n

5 GHz — 5–12 dBm

n

2.4 GHz — 3–10 dBm

We recommend that you set AP transmit power levels for 2.4 GHz lower than those for 5 GHz. This is tocompensate for better propagation of 2.4 GHZ signals as compared to 5 GHz.
You can configure the Transmit Power in the Radio Advanced Settings of a Device Template.

Wi-Fi Cloud AP Deployment Guide27

Deployment Best Practices

28

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Fast Roaming
WatchGuard APs support 802.11r fast roaming. The 802.11r standard significantly improves roaming times
and can significantly improve streaming quality while roaming. The 802.11r feature is enabled per SSID. We
recommend you enable 802.11r with mixed-mode support so that SSIDs support both 802.11r and non802.11r clients.
You can configure 802.11r fast roaming settings in the Security settings of an SSID Profile.

Wi-Fi Cloud AP Deployment Guide29

Deployment Best Practices

802.11k and 802.11v
The wireless network infrastructure can influence client roaming decisions with features such as loadbalancing, however, the final roaming decision is decided by client devices. The IEEE amendments
802.11k and 802.11v define enhanced information exchange that enables clients to make more informed
roaming decisions.
Radio Resource Measurement (802.11k) and Wireless Network Management (802.11v) help measure,report and manage resources on a wireless network. With 802.11k, APs and clients share RF environment
information. With 802.11k enabled, clients can make more informed roaming decisions with respect to the
RF environment, such as channel load, link measurement, noise histogram, and neighbor reports. With
802.11v enabled, some RF information is exchanged, such as channel usage, but many other types of
information are also shared, such as BSS transition management, Flexible Multicast Service (FMS), QoS
traffic capability, and location services capabilities.
We recommend you enable both 802.11k and 802.11v, and with backwards compatibility mode enabled, sothat devices that do not yet support these newer specifications can still join the wireless network.
You can configure 801.11k and 802.11v options in the RF Optimization settings of an SSID Profile.

30

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

SSID Bridge vs. NAT Mode
WatchGuard APs can operate in bridge mode or NAT (Network Address Translation) mode. For most use
cases other than small remote sites we recommend you use bridge mode. With bridge mode, traffic isbridged between the wireless interface and the wired interface. When you use NAT mode, the AP supplies
clients with IP addresses from the built-in DHCP service on the access point and performs NAT for traffic
between the wireless interface and the wired interface.
You can configure bridge or NAT mode in the Network settings of an SSID Profile.

Wi-Fi Cloud AP Deployment Guide31

Deployment Best Practices

Smart Client Load Balancing
In high-density environments, such as auditoriums, lecture halls, and libraries, APs are usually deployedclose to each other to support a large number of devices in a small space. Because they are close inproximity, a client device at any given location can often detect multiple APs with good signal strength.
Unless the client and the AP both support 802.11k (very few clients support 802.11k), the client typically
picks the AP that it detects with the strongest signal strength. This can cause some APs in the network to
be over-used while the other APs have capacity to spare. You can use Smart Load Balancing to distributethe clients across APs and across bands within an AP. This can increase per-client throughput, improveapplication performance, and increase the overall capacity of the wireless network.
Load balancing is also useful in moderately dense environments common to classrooms where clientsrequire high bandwidth to support applications such as HD video streaming.
You can enable load balancing in the RF Optimizations settings of an SSID Profile.

32

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Smart Steering
Clients that prefer to remain connected to distant APs rather than roam to closer APs are a common
wireless network issue. These clients not only experience poor performance, but because they operate at
low data rates, they lower the capacity of the AP.
Smart Steering is a client-to-AP association optimization that enables the wireless network infrastructure tocontrol client connectivity and roaming. Smart Steering monitors clients and automatically steers them tothe optimal AP. This improves the performance for the steered client, and improves the performance for the
AP from which the client disconnects. Smart Steering works with all types of clients and client operating
systems.
You can enable Smart Steering in the RF Optimizations settings of an SSID Profile.

You can configure advanced Smart Steering options in the Radio Advanced Settings of a Device
Template. We recommend you use the default settings.

Wi-Fi Cloud AP Deployment Guide

33

Deployment Best Practices

Band Steering
While most devices tend to associate to 5 GHz radios, there are some clients that must be directed towards
the 5 GHz band. Band steering enables you to steer clients towards the 5 GHz band, and distributes theclients across both bands so that the channel capacity in the 2.4 GHz band can be used.
You can enable Band Steering in the RF Optimizations section of an SSID Profile. Advanced parameters
are configured in the Radio Advanced Settings in a Device Template.

34

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Broadcast/Multicast Control
A large VLAN creates a large broadcast domain. Unnecessary broadcast and multicast traffic can consume
valuable airtime. To prevent this, we recommend you configure broadcast/multicast control.
You can configure Broadcast/Multicast Control in the RF Optimizations settings of an SSID Profile.

Alternatively, you can restrict VLAN sizes. WatchGuard Wi-Fi Cloud’s controller-less architecture does not
require tunneling all traffic back to a wireless controller located in the core of the network. This enables you
to bring the VLANs out to the access switches. With VLANs at the edge of the network, the size of each
VLAN can be controlled per building or per floor. VLAN size limiting helps you control broadcast andmulticast bandwidth consumption.

Bonjour Gateway
In many educational environments, multicast-based services such as Apple Bonjour are common. To
enable Bonjour service advertisements, which use non-routable multicast addresses, to be transmitted
across VLANs, a Bonjour gateway is required. WatchGuard APs have built in Bonjour Gateways thatenable access to Bonjour services, such as Apple TVs and printers, across VLANs.

Wi-Fi Cloud AP Deployment Guide

35

Deployment Best Practices

Reliable Multicast Delivery
Many universities have multicast video streams on their network for entertainment and educational
purposes. Streaming multicast video over wireless is inherently challenging, as multicast traffic overwireless is not acknowledged by the receiving client. With no acknowledgments for multicast packets,
multicast over wireless is essentially unreliable. Unicast packets must be acknowledged by the receiving
client. If unicast packets are not acknowledged by the receiver, the sender resends the original packet.
For reliable delivery of multicast video, WatchGuard APs can convert multicast video traffic to unicast
traffic at the 802.11 layer. Traffic is sent to the multicast address at the IP layer. If these unicast packets
are not acknowledged by the receiver (for example, a client that has joined the multicast group) the AP
resends the packet. This feature enables unicast traffic to be more reliable than multicast traffic. In addition
to the reliable delivery feature of unicast packets, there is the additional benefit of the packets being sent at
unicast data rates, which are typically much higher than multicast data rates, even when multicast rate
optimization is enabled.
Multicast to unicast conversion is only part of the solution. You must enable IGMP snooping for optimal
multicast video delivery. IGMP (Internet Group Management Protocol) enables WatchGuard APs to listen
for multicast group join messages sent by wireless clients. The IGMP feature builds multicast groupforwarding tables on the APs so that multicast traffic (now converted to unicast traffic) is transmitted to only
those clients that have joined multicast groups.
You can configure IGMP Snooping in the RF Optimizations settings of an SSID Profile.

36

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Multicast, Broadcast and Management Rate Optimization
This optimization feature enables you to configure the rate at which broadcast, multicast, and management
packets are transmitted by the AP. You can increase the data rate for multicast, broadcast, andmanagement traffic to improve wireless network performance. This feature can reduce the channel
utilization consumed by these types of packets. This feature can also help reduce the effective network cellthat enables greater channel reuse.
In addition to configuring management rate optimization, you can also restrict the number of SSIDs tosignificantly reduce the total airtime consumed by management traffic.
You can configure the unicast and multicast data rates in the Traffic Shaping & QoS section of an SSID
Profile.

In this example, the rate has been set to 24 Mbps. Configure the Multicast, Broadcast and Management
rate to be equal to or greater than the Minimum unicast data rate.

Wi-Fi Cloud AP Deployment Guide

37

Deployment Best Practices

Traffic Shaping
Most wireless networks offer guest access to clients. The Guest SSID may be available in limited areas ofthe deployment or it may be available across the entire network. If you offer guest wireless access, youmust prevent guest traffic from adversely affecting your internal wireless network. To prevent guest users
from disrupting wireless performance for non-guest users, you can configure rate limiting at the SSID level
and client level .
You can configure rate limits in the Traffic Shaping & QoS section of an SSID Profile.

In this example, the throughput rate for the Guest SSID has been limited to 10 Mbps upstream and 20 Mbps
downstream.

38

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Wi-Fi Multimedia and Quality of Service
Wireless networks are a shared medium, and you must make sure that critical latency-sensitive
applications, such as voice traffic or video streaming, have priority over other applications.
Quality of service (QoS) prioritizes different classes of traffic throughout the wireless network. Wi-Fi
Multimedia (WMM) tags different types of traffic and maps them to different queues with custom WMM
parameters. The WMM Access Categories, together with their corresponding identifying values, aredescribed in this table.
WMM Access Categories
Binary802.1p Priority

WMM Access Category

Traffic Type

001

1

AC_BK

Background

010

2

AC_BK

Background

000

0

AC_BE

Best Effort

011

3

AC_BE

Best Effort

100

4

AC_VI

Video

101

5

AC_VI

Video

110

6

AC_VO

Voice

111

7

AC_VO

Voice

While some applications and devices can correctly tag packets for prioritization as they travel through the
network, most traffic is transmitted as best effort (AC_BE). With a large amount of available capacity, thisdoes not create an issue. But in enterprise wireless networks there are many use cases where channels
operate at high levels of utilization, and you must correctly prioritize traffic for latency-sensitive applications
such as voice and real-time video for solid application performance and a high quality user experience.
Inbound traffic from the Internet is transmitted as best effort, even if it originally was tagged as voice (AC_VO) before traversing the Internet, and network components, such as switches, routers and APs, must beable to identify, tag, and prioritize traffic.

Wi-Fi Cloud AP Deployment Guide

39

Deployment Best Practices

End-to-End QoS
For optimal QoS, you must implement it end-to-end throughout the entire network. All components along thepath must apply packet tagging.
WatchGuard APs use WMM on the wireless side, and DSCP (DiffServ Code Point) and 802.1p tagging for
traffic destined for upstream networks on the wired side. DSCP/802.1p tagging guarantees appropriatedelivery on the wired side of the network. We recommend that you enable QoS if you support voice or realtime video applications on your network.
You can configure QoS settings in the Traffic Shaping & QoS section of an SSID Profile.

40

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Application Visibility and Control
Application Visibility provides real-time, Layer 7 application classification and metadata extraction for
network traffic. Application Visibility uses a combination of application classification and inspection
techniques to deliver industry leading scope and accuracy. Application Visibility automatically classifies
thousands of popular applications:
n

VOIP

n

Video streamingnPeer-to-peernSoftware updatesnFile sharingnFile backupsnVideo gamingnSocialnMusic streaming

n

Email

n

Video conferencing

Application Visibility enables you to see the applications used by each client and provides a global view ofwhat applications are used on the network. You can block, rate limit, or prioritize (tag) individual
applications.
You can enable Application Visibility in an SSID Profile. By default, it is disabled. We recommend you
enable Application Visibility on all SSIDs that could be used for voice or video traffic. This can improveapplication performance and can enhance the quality of experience for end users.

Application Visibility is only supported on AP420 access points.

Wi-Fi Cloud AP Deployment Guide

41

Deployment Best Practices

RF Interference
Interference caused by Wi-Fi or non-Wi-Fi devices can greatly reduce performance of wireless networks. To
optimize the performance of your wireless network you must be able to identify, locate and avoid sources ofinterference. To help you to identify sources of interference, you can perform a spectrum analysis during the
pre-installation and post-deployment phases .

Wi-Fi Interference SourcesnPersonal hotspotsnMalfunctioning clientsnPoorly designed wireless network or misconfigurationn

Neighborhood APs and clients external to your network

Non-Wi-Fi Interference SourcesnVideo game controllersnMicrowave ovensnSecurity camerasn

ZigBee devicesnCordless phonesnBluetooth devices

Microsoft Xbox Game ControllerGame controllers for the Microsoft Xbox use non-Wi-Fi 2.4 GHz wireless technology. Game controllers use
their own frequencies and use frequency-hopping. Though the channel utilization of these devices is quite
low, these controllers can adversely affect Wi-Fi performance in the 2.4 GHz band.

Xbox game controller frequency spectrum chart. Source: Metageek

42

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Microwave Oven
Microwave ovens operate in the upper channels of the 2.4 GHz band. Microwave ovens have been known
to have severe impacts on performance for nearby APs and clients operating on channels 6 to13. Do not put
APs near microwave ovens, but when it is unavoidable, we recommend you use channel 1 for the 2.4 GHz
radio.

Microwave oven frequency spectrum chart. Source: Metageek

BluetoothBluetooth devices are frequency hoppers that can affect all channels in the 2.4 GHz band. Fortunately,
Bluetooth devices do not stay on a single frequency for very long and they operate with relatively low power,so their impact is limited.

Bluetooth frequency spectrum chart. Source: Metageek

Wi-Fi Cloud AP Deployment Guide

43

Deployment Best Practices

Smart Spectrum
The Smart Spectrum feature detects and identifies interference sources, both Wi-Fi and non-Wi-Fi. Theinterference data is collected by the DCS (Dynamic Channel Selection) algorithm for more informed AP
channel changes that result in improved overall network performance and user experience.

Spectrum Policy
When you enable ACD/DCS (auto channel) selection, APs select channels to avoid both Wi-Fi and non-WiFi interference. It is preferable that wireless networks not routinely change their channel plan because
channel plan changes can be disruptive to the wireless network.
Unwanted sources of interference from devices such as rogue APs, cordless phones, and non-Wi-Fi
cameras can reduce wireless network performance. To mitigate this issue, provide a spectrum policy that
informs all users about the types of devices that are not permitted at your deployment site.
Additional sources of interference are even more of a problem for static channel plans, (where auto channel
selection is disabled), because manual intervention is required to locate and remove the source of theinterference or to change the channel plan to avoid the interference.
We recommend you have a spectrum policy to help minimize wireless network disruptions caused bysources of interference introduced into your network.

44

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

WIPS (Wireless Intrusion Prevention System)
WatchGuard APs can run in these modes:nWi-Fi Access point onlyn

Wi-Fi Access point with background scanningnFull-time WIPS sensor

In most cases, network administrators deploy their APs in Wi-Fi access point mode with backgroundscanning. This option provides robust protection for most types of Wi-Fi threats and enables a deployment
with fewer APs than in a mixed deployment where often for every three to five Wi-Fi only APs there is one
dedicated WIPS sensor deployed. For comprehensive protection, we recommend a mixed deployment with
WIPS sensors. For instance, if you need to prevent client devices from connecting to a personal hotspot,
your deployment must include a WIPS-only device.
Video streaming and voice application performance are another important consideration. APs that havebackground scanning enabled must periodically scan all channels. This means that the AP must temporarily
leave the channel where the AP is servicing clients. For typical data traffic, such as web browsing or email,the latency that results from channel scanning does not create issues. However, for real-time applications,this latency is not acceptable. We recommend you deploy a mixed mode model where, for every three tofive APs, you deploy a dedicated WIPS sensor.

Wi-Fi Cloud AP Deployment Guide

45

Deployment Best Practices

You can configure Background Scanning and WIPS Sensor settings in the Radio Settings of a Device
Template.

46

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Summary of Wireless Network Recommendations
This table provides a summary of the recommendations for a wireless network deployment.
FeatureDefault

Recommended

Notes

Min Unicast(Association) Data
Rate

2.4 GHz - 1
Mbps

24 Mbps

Removing supported data rates
can cause client interoperability
issues.

Min Broadcast,Multicast andManagement Data
Rate

2.4 GHz - 1
Mbps

24 Mbps

This rate should be equal to or
greater than Min Unicast(Association) Data Rate.

SSIDs

0

Limit number ofSSIDs toWatchGuard APs support up to 8
SSIDs per radio, or 16 SSIDs per
AP.

5 GHz - 6
Mbps

5 GHz - 6Mbps

6 per AP
Spectrum Load
Balancing

EnabledEnabledThresholds:

Thresholds:

AP120 = 10

AP120 = 20

AP320 = 10

AP320 = 30

AP322 = 10

AP322 = 30

AP420 = 10AP420 = 40

11ac Channel Width

20/40/80
MHz

20/40/80 MHz

Use 20/40 MHz if DFS channels
are not available.

AP ModeWi-Fi only

Wi-Fi only

Deploy one full-time WIPS
sensor for every 3 to 5 Wi-Fi only
APs for maximum AP
performance and WIPS
effectiveness.

SSID Network Mode

BridgeBridgeConsider NAT only for small
remote site deployments.

Smart Steering

Disabled

Enabled with default
settings

Consider leaving Smart Steering
disabled in environments that
support voice traffic.

Wi-Fi Cloud AP Deployment Guide

47

Deployment Best Practices

FeatureDefault

Recommended

Notes

11r Fast Roaming

Disabled

EnabledWith mixed mode support.

Traffic Shaping

Disabled

Enable for Guest
wireless network

Minimum Association
RSSI-65 dBm-65 dBm

Proxy ARP

Disabled

EnabledACS/DCS (AutoChannel Selection /Dynamic Channel
Selection)

EnabledEnabledAP Power

Auto Poweror

Wireless network should bedesigned for -62 dBm or greater
throughout the entire
deployment.

Depends on the environment andpreference of your network
deployment engineers.

Disabled with a
Static Channel Plan
Auto Poweror

Depends on the environment andpreference of network
deployment engineers.

Static Power PlanClassroom:
5 GHz: 8 - 16 dBm
2.4 GHz: 4 - 10 dBm

Auditorium/LectureHall:
5 GHz: 5 - 12 dBm
2.4 GHz: 3 - 10 dBm

48

Broadcast andMulticast Suppression

Disabled

Enabled

Bonjour Gateway

Disabled

EnabledReliable Multicast
DeliveryDisabled

EnabledA function of the WatchGuard
AP layer 2 Firewall.

AP converts multicast to unicast
and uses IGMP Snooping tobuild multicast group forwarding
tables at the AP.

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

FeatureDefault

Recommended

Smart Load Balancing

Disabled

EnabledApplication Visibility

Disabled

Enabled802.11k and 802.11v

Disabled

EnabledSmart Spectrum

Disabled

EnabledEnabled when auto channel(ACS/DCS) is enabled.

Tunneling

Disabled

EnabledTunnel guest traffic back to DMZ
network.

Wi-Fi Cloud AP Deployment Guide

Notes

You must also enable QoS in
your end-to-end switching
infrastructure.

49

Deployment Best Practices

Wired Network Best Practices
This section provides suggestions on how to deploy a wired network infrastructure to support a highperformance 802.11ac wireless deployment for enterprise environments.

AP Power Requirements
Not all WatchGuard APs have the same power requirements. Some models, such as the AP120 andAP320, are fully functional with standard Power over Ethernet (PoE, 802.3af). For most deployments, werecommend you install switches that support PoE+ (802.3at), even if you currently do not have plans to
deploy an AP420 or AP322 that require PoE+. The use of PoE+ switches enables you to support Wave 2
APs.
AP Power Requirements
Model

Description

Recommended Use

Power

Notes

AP120

Dual radio, 11ac Wave 1, 2x2,
Indoor

Low density / throughput
areas

PoE

Fully functionalwith PoE

AP320

Dual radio, 11ac Wave 1, 3x3,
IndoorModerate density /throughput areas

PoE

Fully functionalwith PoE

AP420

Dual radio, 11ac Wave 2, 4x4,
IndoorHigh density / throughput
areas

PoE+

Requires PoE+

AP322

Dual radio, 11ac Wave 1, 3x3,
Outdoor

Outdoors

PoE+

Requires PoE+

AP Uplink Capacity
In lab tests, the dual band throughput of 802.11ac Wave 1 APs has exceeded 1 Gbps. The maximum
theoretical data rate in the 5 GHz band is 1.3 Gbps (802.11ac 3x3). In the 2.4G Hz band (802.11n 3x3) it is
450 Mbps.
In production, throughput rarely exceeds the 1 Gbps barrier. With Wave 2 APs, such as the AP420, which
supports 4 spatial streams and has a combined maximum data rate of 2.3 Gbps (1.7 Mbps for 5 GHz and
600 Mbps for 2.4 GHz), it is likely that throughput in a production environment can exceed the 1 Gbps
throughput barrier in some use cases.
We recommend that you use link aggregation and connect two Ethernet cables to each AP420. The AP canload balance upstream traffic across an aggregated 2 Gbps connection.

50

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

AP Cabling
At a minimum, 802.11ac APs require Cat5e cables.
For Wave 2 deployments, we recommend that you deploy Cat6a cables. The AP420 and future Wave 2
APs will have Ethernet ports that support rates greater than 1 Gbps.
Cable Category Reference
Cable Category

Max Data Rate

Bandwidth

Max Distance (Meters)

Max Distance (Feet)

Cat 5

100 Mbps

100 MHz

100 Meters

328 Feet

Cat 5e1 Gbps100 MHz

50 Meters

164 Feet

Cat 6

10 Gbps

250 MHz

50 Meters

164 Feet

Cat 6a

10 Gbps

500 MHz

100 Meters

328 Feet

Cat 7

10 Gbps

600 MHz

100 Meters

328 Feet

Access Network Uplink
You must correctly design the switching infrastructure to take full advantage of the increased throughput
capacity of 802.11ac APs. To make sure that there are no network bottlenecks, you must correctly size the
network from the access and distribution switches to the core switch.

Here is a summary of the recommended uplink capacities for 802.11ac wireless networks:n

1 Gbps for Wave 1 APs to the access/edge switchnConsider 2 x 1 Gbps for Wave 2 APs to the access/edge switchn

10 Gbps from the access switch to the distribution switchnConsider dual-homed/redundant 10 Gbps uplink between the access and distribution switchesnMulti-homed/redundant 10 Gbps between core switches

Wi-Fi Cloud AP Deployment Guide

51

Deployment Best Practices

VLAN Design
With WatchGuard Wi-Fi Cloud, it is not necessary to tunnel traffic through VLANs to a wireless controller
located in the core of the network. This enables you to configure VLANs at the access switch layer of the
network.
In this example, each building has a unique VLAN configured for SSID-1. You can restrict a VLAN to asingle building to reduce the amount of broadcast and multicast traffic in the VLAN, and enable seamlessroaming in the building.

Jumbo FramesWith the enhanced frame aggregation capabilities in the 802.11ac standard, the switching network must
support jumbo frames to benefit from frame aggregation. If Jumbo Frame support is not enabled end-to-end
in your network, fragmentation can occur in the network path, which can adversely affect performance.

52

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Summary of Wired Network Recommendations
This table provides a summary of the recommendations for your wired network.
FeatureMinimum

Recommended

Notes

AP Power

PoE

PoE+

AP322 andAP420 devices
require PoE+

AP Uplink
Capacity

1 GbpsConsider 2 x 1 Gbps for linkaggregation

Use AP420 for
link aggregation

Ethernet
Cabling

Cat5e

Cat6a

AccessNetwork
UplinkCapacity

10 Gbps2 x 10 Gbps

VLAN
DesignWireless network VLANs on
access switches

Route at the distribution layer

Jumbo
Frames

A-MPDU and A-MSDU frame
aggregation enabled on APs

Enable support for Jumbo
Frames throughout the entire
switching infrastructure

QoS

Make sure all switches, fromaccess switches to coreswitches, honor QoS tags

Deploy switches and routers that
support Application Visibility andControl (AVC)

Wi-Fi Cloud AP Deployment Guide

Multi-homed /Fault Tolerant53

Deployment Best Practices

Network Services Best Practices
This table provides recommendations for network service configuration to support a WatchGuard Wi-Fi
Cloud deployment in an enterprise environment.
Service

Recommended

DHCP

Use the current network
DHCP servers.

DNS

Use the current network
DNS services.

Proxy

Configure proxy bypass
rules to allow AP to cloud
management traffic.

Notes

All management traffic from the access points to Wi-Fi Cloudmust be configured to bypass proxies while preventing
unfiltered user access to the Internet.
You can use a WatchGuard Firebox to configure policies for
Wi-Fi Cloud traffic and bypass proxies. Predefined policies
are available for this purpose.

Firewall54

You must allow this traffic
on your firewall:nPort 3851 (UDP)
outboundnPort 80 (TCP)
outbound / stateful
inboundnPort 443 (TCP)
outbound / stateful
inbound

NAT

Use the current network
NAT solution.

Traffic
Shapingand QoS

Apply traffic shaping and
QoS to traffic inbound fromInternet.

Content
Filtering

Use the current network
content filter solution.

RADIUS

Use the current network
RADIUS solution.

These are the required ports for WatchGuard APs tocommunicate with WatchGuard Wi-Fi Cloud.

Consider enabling NAT on the AP for small remote sites.

Consider content filtering on the AP for small remote sites.

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

AP Placement and Channel Plan Best Practices
With the information in the capacity planning section of this guide, you can determine how many APs are
required for specific deployment use cases. In this section, you determine where to put the APs and thewireless channels to use.

Wireless Signal Strength and Noise Levels
To make sure that all users in your environment receive a strong wireless signal, consider these guidelines
when you install your WatchGuard APs.

Signal Strength
The signal strength is the wireless signal power level received by the wireless client.
nStrong signal strength results in more reliable connections and higher speeds.

nSignal strength is represented in -dBm format (0 to -100). This is the power ratio in decibels (dB) of themeasured power referenced to one milliwatt.

n

The closer the value is to 0, the stronger the signal. For example, -41 dBm is a stronger signal than -61
dBm.

Noise Level
The noise level indicates the amount of background noise in your environment.
n

If the noise level is too high, it can degrade the strength and performance of your wireless signal.

nNoise level is measured in -dBm format (0 to -100). This is the power ratio in decibels (dB) of themeasured power referenced to one milliwatt.

n

The closer the value to 0, the greater the noise level.

n

Negative values indicate less background noise. For example, -96 dBm is a lower noise level than -20
dBm.

Signal to Noise Ratio
The signal-to-noise ratio (SNR) is the ratio between the signal strength and the noise level.
nThis value is represented as a +dBm value.

n

In general, your signal-to-noise ratio should be +25 dBm or higher. Values lower than +25 dBm result inpoor performance and speeds.

For example:n

If you have a -41 dBm signal strength, and a -50 dBm noise level, this results in a poor signal-to-noise
ratio of +9 dBm.

n

If you have a -41 dBm signal strength, and a -96 dBm noise level, this results in an excellent signal-tonoise ratio of +55 dBm.

Wi-Fi Cloud AP Deployment Guide

55

Deployment Best Practices

Predictive Site Survey
Use a predictive site survey software application to develop an AP placement plan estimate coverage andcapacity. You can use a predictive site survey planning application to generate a recommended AP
placement and channel plan, including coverage, SNR, and interference information to help with yourdeployment.
You must provide input on these factors for correct capacity planning:n

Client types and quantity (currently in use and anticipated growth)nApplications (currently in use and anticipated growth) and streaming media requirementsnDesign for capacitynHigh-quality floor mapsnPrecise scale for the floor plannConsideration of possible RF leaks between floors

Indoor Attenuation Reference
To make sure you have an accurate predictive site survey, measure the actual attenuation values for
obstructions within the deployment site. You can use these attenuation values in your site survey. To
measure attenuation values, you must use an AP and a smartphone with an application such as WiFi
Analyzer.
To perform the measurement, check the signal level detected by the client when the client and AP are 5
meters apart with a clear line of sight (LoS). Then, check the signal level again at the same distance with theobstruction between the AP and the smart phone.
The difference between the LoS (line of sight) reading and the second reading is the measure of attenuationlevel for the obstruction. The attenuation values you obtain can improve the accuracy of your predictive site
survey.

Example:56nMeasurement 1: 5 Meters LoS = - 57 dBmnMeasurement 2: 5 Meters behind obstruction = - 53 dBmn

Obstruction Attenuation = 4 dB

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Indoor Attenuation ReferenceThis table shows the estimated values of attenuation for common materials found in typical deployments.
Note the variability in attenuation for a specific type of material (for example, concrete and brick wall +/- 10dB). Precise attenuation values produce a more accurate predictive site survey.
Attenuation Estimations
RF Attenuators

Estimated Attenuation in 2.4 GHz

Estimated Attenuation in 5 GHz

Steel door

16 dB (+/- 3 dB)

28 dB (+/- 3 dB)

Concrete or brick wall

12 dB (+/- 6 dB)

20 dB (+/- 10 dB)

Coated or double-pane

12 dB (+/- 1 dB)

20 dB (+/- 1 dB)

Cubicle wall

4 dB (+/- 1 dB)

6 dB (+/- 2 dB)

Wood door

4 dB (+/- 1 dB)

6 dB (+/- 1 dB)

Glass or window (not tinted)

3 dB (+/- 1 dB)

7 dB (+/- 1 dB)

Drywall (interior)

3 dB (+/- 1 dB)

4 dB (+/- 1 dB)

Ceiling tiles, curtains, blinds

1 dB (+/- .5 dB)

2 dB (+/- 1 dB)

One-for-One AP Replacement
Before you choose a one-for-one AP replacement approach, make sure these conditions are true:n

The current wireless network provides correct coverage everywhere (for example, -62 dBm).

n

All clients can detect two to three APs in all locations.

n

The current network is designed for capacity.

n

All applications perform correctly.

n

The environment has remained the same (for example, no building renovations) since the existing AP
placement plan was created.

n

The current network is designed for 5 GHz.

n

All clients can roam successfully.

Avoid Self Induced CCI in 2.4 GHz
Even if DFS channels are not used, 5 GHz channels outnumber 2.4 GHz channels by a wide margin. Thismeans that if both 5 Ghz and 2.4 GHz radios are active on all APs in a network designed for capacity, there
is a high probability that the APs could create harmful co-channel interference (CCI) in the 2.4 GHz band.
Another factor is that 2.4 GHz frequencies provide greater coverage range than 5 GHz frequencies. To
minimize the amount of self-induced CCI in the 2.4 GHz band, we recommend you disable 2.4 GHz radios
on some of the deployed APs .

Wi-Fi Cloud AP Deployment Guide

57

Deployment Best Practices

40 MHz Channel Plan
The diagram below is an example of a 40 MHz channel plan that does not use DFS channels. In the US, aswell as in several other regions, there are only four non-overlapping 40 MHz channels available if DFS
channels are not used. The example plan minimizes CCI because adjacent APs do not use the same
frequencies.

80 MHz Channel Plan
This is an example of an 80 MHz channel plan that uses DFS channels. In the US, as well as in several
other regions, there are six non-overlapping 80 MHz channels available if DFS channels are used. As withthe 40 MHz plan, the example plan minimizes CCI because adjacent APs do not use the same frequencies.

58

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

AP Mounting Recommendations
WatchGuard APs for indoor use are usually mounted on walls or ceilings. Outdoor APs are usually mounted
on walls and poles.
More information about mounting options are provided in the WatchGuard AP Hardware Guides.
Information about WatchGuard AP antenna radiation patterns (internal and external) can be found incorresponding device data sheets located on the WatchGuard website.

Wall Mount
While not as common as ceiling mounts, wall-mounted APs are also appropriate for most rooms. Wallmounted APs can also be found in large rooms, such as auditoriums, where ceiling mounts are not practicalbecause of ceiling height or accessibility. If you mount APs with a wall mount, consider the antennaradiation patterns, including back lobe patterns, of the AP model you deploy.

Ceiling Mount
Most wireless network deployments use ceiling mounts. When you mount APs to a ceiling, it is preferable
to mount APs below the ceiling. Do not hide APs above a dropped ceiling for aesthetic or physical security
purposes. The ceiling space can include metallic structures such as pipes or AC ducts that can attenuate
RF transmissions.

Wi-Fi Cloud AP Deployment Guide

59

Deployment Best Practices

Structural Proximity and Electrical Interference
These factors can affect the reliability and performance of the wireless network:nPhysical obstacles that can impede radio transmissionsnRadio frequency interference (RFI) from electronic devices and other radio sourcesnElectromagnetic interference (EMI) from fluorescent bulbs, motors, and appliancesnIncorrect AP antenna placementn

Improper antenna selectionnDistances between access points and clients

60

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

AP Placement
For full wireless coverage and to make sure that all clients on your environment receive a strong wirelesssignal, consider these guidelines for the location and placement of your WatchGuard APs:nInstall your APs in a central location away from any corners, walls, or other physical obstructions toprovide maximum signal coverage.

nInstall your APs in a high location to provide the overall best signal strength reception and performancefor your wireless network. In general, one AP can cover up to approximately 2000 square feet, withvariation based on the physical environment and wireless interference.

n

Make sure you do not install an AP near any electronic devices that can interfere with the signal, suchas televisions, microwave ovens, cordless phones, air conditioners, fans, or any other type ofequipment that can cause signal interference.

n

When you install more than one AP, make sure to leave enough space between them to provide
maximum coverage for your wireless network area of availability.

n

For wireless coverage over many floors, you can stagger the placement of APs to cover both verticaland horizontal space.

Wi-Fi Cloud AP Deployment Guide

61

Deployment Best Practices

62

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Post-Deployment Validation Survey
There are many post-deployment site survey tools available. The Ekahau Site Survey (ESS) is one of themost popular tools for this purpose. Like most site survey tools, ESS supports both passive and active site
surveys. An active survey measures sent packets and received packets. This mode is used to determine
metrics such as packet loss and packet delay. A passive survey listens to probes and beacons passively
and is useful for creation of coverage and SNR (Signal to Noise Ratio) maps. ESS also supports a hybrid
survey mode that simultaneously performs a passive and active survey. We recommend you use the hybrid
mode.

These are guidelines for a post-deployment validation survey:n

If you use Ekahau, use Hybrid survey mode. Use Passive or Active mode if you use another tooln

Survey both the 2.4 GHz and 5 GHz bandsnDisable Auto Channel (ACS/DCS)n

Remove all SSIDs from the client excluding the SSID you will surveynGather a sufficient number of data points (for example, 1 data point for every 10 to 20 feet)n

Perform the survey with doors closed

Wi-Fi Cloud AP Deployment Guide

63

Deployment Best Practices

Summary of Recommendations for an AP Placement and Channel Plan
This table provides a summary of the recommendations for an AP placement and channel plan.
Recommendations

Notes

Use a predictive site survey
application.

The predictive site survey can automate the AP placement andchannel capacity planning process.

Consider 1-for-1 AP
replacement.

Only implement 1-for-1 replacement if conditions are true as outlinedin the One-for-One AP Replacement section of this guide.

SNR should be 25 dB or greater
throughout the coverage area.

Minimum RSSI should be -62
dBm throughout the coveragearea.

If designing for 256 QAM rates everywhere the minimum RSSI
should be -52 dBm (w/ 80MHz channels).

Clients should see two to threeAPs (on different channels) at
RSSI of -70 dBm or greater.
Consider deploying one full-time
WIPS sensor for every two to
five APs.

Depends on security requirements.

Distance between two APsshould be approximately 30 to
70 feet.
Reduce AP transmit power.

Classroom:
5 GHz: 8 to 16 dBm
2.4 GHz: 4 to 10 dBm

Auditorium or Lecture Hall:
5 GHz: 5 to 12 dBm
2.4 GHz: 3 to 10 dBm
APs may be ceiling or wallmounted.

64Consider back lobe radiation of antenna when you use a wall mount.

Wi-Fi Cloud AP Deployment GuideDeployment Best Practices

Recommendations

Notes

Disable 2.4 GHz radios on apercentage of APs.

Percentage of APs with disabled 2.4 GHz radios depends on how
many unique 5 GHz channels are in use. The more 5 GHz channels
in use the greater the % of APs that should have there 2.4Ghz radios
disabled.

AP placement and channel planshould use channels to minimize
CCI and ACI.
Stagger APs across floors.
Consider directional antennas
for very high client density
deployments.
For high ceilings (higher than 30
feet / 9.14 meters), high gain (69 dB) patch antennas arerecommended.
Adjust AP output power in
relation to antenna gain.
Know the antenna radiation
patterns and focus gain towards
clients.
Do not place APs near lighting
fixtures or conductive material.
Do not place APs above ceilingtiles.
Perform a thorough post deployment site survey.

Wi-Fi Cloud AP Deployment Guide

65

Deployment Use Cases
This section provides solutions for three common use cases in an educational campus environment. Eachuse case includes simplified AP placement and channel plans.

Use Case 1 — Classroom
A classroom environment can be a challenging use case because of the combination of moderate to highclient density, a relatively high per-client throughput requirement, and the close proximity of multiple
classrooms. Video-based learning has become more prevalent, and this solution is optimized for aclassroom video use case.

Requirementsn

30 client devices active concurrently in each classroomn

Tablets 802.11ac 1x1

n

4 Mbps throughput

Environmentn

All DFS channels are availablenInterior walls have moderate attenuation

Channel Capacity Planning
For this use case, there are 30 tablets that are 802.11ac 1x1 active concurrently in each classroom. To
support HD video, the throughput requirement for each client is 4 Mbps. In this example, DFS channels areavailable so we use an 80 MHz channel plan.
This channel capacity estimation is for a single classroom. The proposed solution can be scaled upwards toaccommodate the total number of classrooms.

Wi-Fi Cloud AP Deployment Guide66

Deployment Use Cases

Step 1
Before you begin your calculations, you must know the estimated channel capacity per radio. You can findthis information in Channel Capacity Estimates. When you reference the estimated channel capacity
tables, an estimated clients per radio density is required. Because the classroom must support 30
concurrently active clients, this use case falls into the moderate density category,

Use Case
Classroom

DeviceType
Tablets11ac
1x1

Number of
Active Devices /Density
30 / Moderate

Application and Client
required Bitrate

ChannelCapacity

HD Video (720p) /4 Mbps139Mbps/80
MHz

Per Device
Airtime /ChannelCapacity
2.88%

The moderate density table in Channel Capacity Estimates shows that for 802.11ac 1x1 clients (1 Spatial
Stream) with an 80 MHz channel, the estimated throughput capacity is 139 Mbps. To determine thepercentage of airtime or channel utilization an individual client requires to meet a per-client throughput
requirement, divide the throughput requirement by estimated channel capacity and multiply by 100.
n(App Bitrate or throughput / Channel Capacity) X 100 = Per Device Airtimen(4 Mbps / 139 Mbps) x 100 = 2.88%

n

Per Device Airtime = 2.88%

Step 2
You must now determine the total channels/radios required to deliver the throughput requirement to allclients simultaneously.

Use Case
Classroom

DeviceType

Number of Active
Devices / Density

Per
DeviceAirtime

Total
AirtimeEstimated Channels /Radios Required

Tablets
11ac 1x1

30 / Moderate

2.88 %

86 %1

To estimate the total channels/radios required, multiply the per-client airtime required by the total number ofclients active concurrently:nNumber of Active Devices x per Device Airtime = Channels/Radios Requiredn

30 Active Devices x 2.88% per Device Airtime = 86.3%

nChannels/Radios Required = 1 (Rounding up)

67

Wi-Fi Cloud AP Deployment GuideDeployment Use Cases

Solution
This image shows the floor plan for a wing of the school building.

5 GHz Plan
This image shows the AP placement and 5 GHz channel plan for a wing of a school building. We
recommend you use the AP420 for this use case. There are 12 ceiling-mounted AP420 devices for this wingof the building, each with an active 802.11ac radio (80 MHz).

Wi-Fi Cloud AP Deployment Guide

68

Deployment Use Cases

2.4 GHz Plan
This image shows the AP placement and 2.4 GHz channel plan for a wing of school building. While there are
twelve AP420 devices used for this wing of the building, only seven of them have their 2.4 GHz radios
enabled. Five of the 2.4 GHz radios are disabled to reduce the level of CCI in the 2.4 GHz band.

69

Wi-Fi Cloud AP Deployment GuideDeployment Use Cases

Use Case 2 — Lecture Hall
It can be a challenge to support a very high number of devices in a relatively confined space. These use
cases are common in education environments. For this sample use case, at peak times there can be as
many as 200 devices connected to the wireless network simultaneously.
For this use case, the device population is made up of an even mix of 802.11ac 1x1, 2x2 or 3x3 clients. The
exact ratio of clients varies from day to day but for planning purposes, we recommend that you plan for 2x2
clients to simplify the process. If there were a larger proportion of 1x1 clients compared to 2x2 and 3x3, you
would plan for 1x1 clients. Client fingerprinting capabilities in the current wireless network is the best way todetermine a client mix for your use case.

Requirementsn

200 devices active concurrently in the lecture halln

Mix of 802.11ac devices (1x1, 2x2, and 3x3)n

3 Mbps throughput requirement

Environmentn

All DFS channels excluding 100 are availablen

All APs in the lecture hall are within line of sight of each other

Channel Capacity Planning
For this use case, there a mix of 200 802.11ac laptops, tablets, and smartphones that are active
concurrently. The per client throughput requirement is 3 Mbps. All DFS channels are available, excluding
100 as the currently installed wireless network has detected radar activity on channel 100. We recommend
an 80 MHz channel plan for this use case. If you use auto channel selection, then you must exclude channel
100 from the auto channel candidate list in the radio settings of the Device Template.

Wi-Fi Cloud AP Deployment Guide70Deployment Use Cases

Step 1
The tables in Channel Capacity Estimates help determine the estimated channel capacity. The estimatedper radio density for this use case is likely very high because the requirement is to accommodate 200 active
clients in a confined area. The use of 2x2 clients in this plan simplifies the design process.

Use
Case

DeviceType

LectureHall

Designfor 11ac
2x2

Number of
ActiveDevices /Density
200 / VeryHigh

App orThroughput requirement Bitrate

ChannelCapacity

3 Mbps173Mbps/80
MHz

Per Device
Airtime /ChannelCapacity
1.73%

The very high client density table in Channel Capacity Estimates shows that for 802.11ac 2x2 clients (2Spatial Streams), with an 80 MHz channel, the estimated throughput capacity is 173 Mbps. To determine
the percentage of airtime or channel utilization an individual client requires to meet a per client throughput
requirement, divide the throughput requirement by estimated channel capacity and multiply by 100.
n(App Bitrate or throughput / Channel Capacity) X 100 = Per Device Airtimen(3 Mbps / 173 Mbps) x 100 = 1.73%

n

Per Device Airtime = 1.73%

Step 2
You must determine the total channels/radios required to deliver the throughput requirement to all clientssimultaneously.

Use
Case

DeviceType

Number of Active
Devices / Density

Per
DeviceAirtimeLectureHall

Design for
11ac 2x2

200

1.73%

Total
AirtimeEstimated Channels /Radios Required

347%

4

To estimate the total channels/radios required, multiply the per client airtime required by the total number ofclients active concurrently.

71

nNumber of Active Devices x per Device Airtime = Channels/Radios Requiredn

200 Active Devices x 1.73% per Device Airtime = 347%nChannels/Radios Required = 4 (Rounding up)

Wi-Fi Cloud AP Deployment GuideDeployment Use Cases

Solution
This image shows the lecture hall floor plan.

Auditorium Floor plan

Wi-Fi Cloud AP Deployment Guide72

Deployment Use Cases

5 GHz Plan
This image shows the AP placement and 5 GHz channel plan for the lecture hall. We recommend you use
the AP420 for this use case. A total of four ceiling-mounted AP420 devices are used for the lecture hall,each with an active 802.11ac radio (80 MHz).

73

Wi-Fi Cloud AP Deployment GuideDeployment Use Cases

2.4 GHz Plan
This image shows the AP placement and 2.4 GHz channel plan for the lecture hall. While there are four
AP420 devices used for the lecture hall, only three have their 2.4 GHz radios enabled. One of the 2.4 GHz
radios is disabled to reduce the level of co-channel interference (CCI) in the 2.4 GHz band.

Wi-Fi Cloud AP Deployment Guide74

Deployment Use Cases

Use Case 3 — Dormitories
Students in dorm rooms depend on solid connectivity and performance to do homework, in addition to
streaming movies and playing video games. Dorm room walls often have very high levels of RF attenuation.
Install APs directly in the dorm rooms for a high signal strength (-62 dBm or greater) throughout the rooms.

Requirementsn

10 devices active concurrently in each dorm roomn

Mix of 11n and 11ac devices (1x1, 2x2 and 3x3)n

5 Mbps throughput requirement

Environmentn

DFS channels are not availablen

Dorm room walls have very high levels of attenuation

Channel Capacity Planning
For this use case there are 10 devices that are a mix of 802.11n and 802.11ac devices (1x1, 2x2 and 3x3),
active concurrently in each dorm room. The requirement is to provide each client with a per client throughput
requirement of 5 Mbps. DFS channels are not available so a 40 MHz channel plan is required.
This is a channel capacity estimation for a single dorm room. The proposed solution scales upwards toaccommodate the total number of dorm rooms.

Step 1For this use case the clients per radio density is low. Check the low client density table in Channel Capacity
Estimates to get an estimated throughput capacity. For a mix of 802.11n and 802.11ac clients, werecommend a design for 802.11ac 1x1 or average clients.

75

Use
Case

Device
Type

Dorm
Room

Designfor 11ac
1x1

Number of
ActiveDevices/Density

App orThroughput requirement Bitrate

ChannelCapacity

10 / Low

5 Mbps70Mbps/40MHz

Per Device
Airtime /ChannelCapacity
7.14%

Wi-Fi Cloud AP Deployment GuideDeployment Use Cases

The low client density table in Channel Capacity Estimates shows for 802.11ac 1x1 clients (1 Spatial
Stream) with a 40 MHz channel, the estimated throughput capacity is 70 Mbps. You must determine thepercentage of airtime or channel utilization an individual client requires to meet a per client throughput
requirement.
n(App Bitrate or Throughput requirement / Channel Capacity) X 100 = Per Device Airtimen(5 Mbps / 70 Mbps) x 100 = 7.14%

n

Per Device Airtime = 7.14%

Step 2
You must determine the total channels/radios required to deliver the throughput requirement to all clientssimultaneously.
Use
Case

DeviceType

Number of
Active Devices

Per Device
Airtime

Total
AirtimeEstimated Channels /Radios Required

Dorm
Room

Design for
11ac 1x1

10

7.14%

71.4%

1

To estimate the total channels/radios required, multiply the per client airtime required by the total number ofclients active concurrently.
nNumber of Active Devices x per Device Airtime = Channels/Radios Requiredn

10 Active Devices x 7.14% per Device Airtime = 71.4%

nChannels/Radios Required = 1 (Rounding up)

Solution
This image shows the floor plan for a wing of the dormitory.

Wi-Fi Cloud AP Deployment Guide76

Deployment Use Cases

For this solution, you must deploy one AP per room because of the very high attenuation properties of thematerial used in the wall construction. For dorms with walls that have less attenuation, one AP per two
rooms is preferable. The proposed solution uses a 40 MHz channel. For a one AP per two room plan, you
could use an 80 MHz plan to support the 5 Mbps per device throughput requirement. The number of devices
per AP would double but so would the approximate throughput capacity of each AP. We recommend you
use the wall mounted AP120 or AP320 for this use case.

5 GHz Plan
This image shows the AP placement and 5 GHz channel plan for the dormitory with one AP per room. A
total of 25 AP120/AP320 devices are used for the dormitory, each with an active 802.11ac radio (80 MHz).

77

Wi-Fi Cloud AP Deployment GuideDeployment Use Cases

2.4 GHz Plan
This image shows the AP placement and 2.4 GHz channel plan for the dormitory. While there are 25
AP120/AP320 devices used for the dormitory, only 16 of them have their 2.4 GHz radios enabled. 2.4 GHz
radios are disabled to reduce the level of co-channel interference (CCI) in the 2.4 GHz band.

Wi-Fi Cloud AP Deployment Guide

78

Channel Capacity Estimates
These capacity estimation tables are for reference only. Actual capacity depends on environmental
conditions, levels of co-channel interference (CCI) and adjacent channel interference (ACI), client behavior,and quality of wireless network design. You can use predictive survey tools to automate capacity planning.
The capacity estimations presented in this section are for a hands-on approach to capacity planning.
These capacity tables only consider 5 GHz capacity. As most wireless LANs also include capacity in the
2.4 GHz band, this results in a built-in capacity buffer provided by the 2.4 GHz band that is typically a small
fraction of the capacity in 5 GHz. The size of the 2.4 GHz capacity buffer depends on how clients are
distributed across bands and the ratio of 5 GHz spectrum to 2.4 GHz spectrum in use.
Estimated Max Throughput Capacity - 60 % Max Data Rate
1 Client Active

20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

52 Mbps

120 Mbps

260 Mbps

520 Mbps

2 Spatial Streams

104 Mbps

240 Mbps

520 Mbps

1.04 Gbps

3 Spatial Streams

173 Mbps

360 Mbps

798 Mbps

1.40 Gbps

4 Spatial Streams

208 Mbps

480 Mbps

1.04 Gbps

2.08 Gbps

This table is for low-density use cases where there is minimal loss (~ 5%) due to contention and the loss
caused by signal strength degradation and rate adaptation are estimated to be 20%.
Estimated Low Density Throughput Capacity - 35 % Max Data Rate
1 - 15 Clients Active

20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

30 Mbps

70 Mbps

151 Mbps

303 Mbps

2 Spatial Streams

61 Mbps

140 Mbps

303 Mbps

607 Mbps

3 Spatial Streams

101 Mbps

210 Mbps

465 Mbps

821 Mbps

4 Spatial Streams

121 Mbps

280 Mbps

607 Mbps

1.21 Gbps

Wi-Fi Cloud AP Deployment Guide

79

Channel Capacity Estimates

This table is for moderate density use cases where there is moderate loss (~ 8%) due to contention and theloss caused by signal strength degradation and rate adaptation are estimated to be 20%.
Estimated Moderate Density Throughput Capacity - 32 % Max Data Rate
16 - 30 Clients Active

20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

28 Mbps

64 Mbps

139 Mbps

277 Mbps

2 Spatial Streams

55 Mbps

128 Mbps

277 Mbps

555 Mbps

3 Spatial Streams

92 Mbps

192 Mbps

426 Mbps

750 Mbps

4 Spatial Streams

111 Mbps

256 Mbps

555 Mbps

1.11 Gbps

This table is for high-density use cases where there is high loss (~ 13%) because of contention and the loss
caused by signal strength degradation and rate adaptation is estimated to be 20%.
Estimated High Density Throughput Capacity - 27 % Max Data Rate
31 - 45 Clients Active

20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

23 Mbps

54 Mbps

117 Mbps

234 Mbps

2 Spatial Streams

47 Mbps

108 Mbps

234 Mbps

468 Mbps

3 Spatial Streams

78 Mbps

162 Mbps

359 Mbps

633 Mbps

4 Spatial Streams

94 Mbps

216 Mbps

468 Mbps

938 Mbps

This table is for very high-density use cases where there is very high loss (~20%) because of contention
and the loss caused by signal strength degradation and rate adaptation is estimated to be 20%.
Estimated Very High Density Throughput Capacity - 20 % Max Data Rate80

46 - 60 Clients Active

20 MHz40 MHz80 MHz160 MHz

1 Spatial Stream

17 Mbps

40 Mbps

87 Mbps

173 Mbps

2 Spatial Streams

35 Mbps

80 Mbps

173 Mbps

347 Mbps

3 Spatial Streams

58 Mbps

120 Mbps

266 Mbps

469 Mbps

4 Spatial Streams

69 Mbps

160 Mbps

347 Mbps

695 Mbps

Wi-Fi Cloud AP Deployment Guide