Hotel Wifi Best Practice

[michaelzanatta]

Hi everyone,

I have some questions about the best practices for configuring a hotel (or campus) Wi-Fi guest connection.

Suppose there are 1500/2000 devices; is it correct to use, for example, a 10.1.x.x/21 network, or is it better to split the network into multiple VLANs/subnets (for example, on each floor)? In the second case, how do you manage when a guest moves, for example, from floor 4 to floor 2, and ensure he remains connected to the network?

Thank you so much.

[marce1000]

  - I can't see the need for multiple subnets with this relatively small amount of clients, which on wireless for instance don't see each other (by default). You will never be able to ensure that they remain on the network when moving because clients are autonomous ; the only parameter 'helping' is 'coverage everywhere'  which is the biggest challenge , depending on the degree of service one is willing to offer to customers (so the quality of the wireless infrastructure becomes a more determining factor for connectedness)

 M.

[michaelzanatta]

Ok, so a /21 or a /20 network doesn't affect so much in WiFi experience for clients? 

[JPavonM]

I would recommend you to enable ARP proxy under Flex profile to stop unwanted broadcast traffic:

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#AddressResolutionProtocolARPproxy

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/flexconnect.html#Cisco_Concept.dita_b7aa7e2e-9efb-4bcb-9d75-27eb91f6662f

[Leo Laohoo]

I would recommending splitting the subnet into /24 (multiple VLANs). 

In both AireOS and IOS-XE, it is possible to create a VLAN Group/Dynamic Interface Group and "bundle" different VLANs together.  

Take down one subnet (maintenance or fat-finger) will not affect the others.  

[Rich R]

I'm with @marce1000 - we don't have any problems using subnets of that sort of size but as @JPavonM says definitely make sure you use ARP proxy and block peer to peer (which you should be doing in a guest environment for security anyway).