Business WiFi network: installation and deployment step by step (site survey, access points, VLANs, security)

The short answer: a business WiFi network installation succeeds when you run it like a construction project, in seven phases, each with its own deliverable. You start from usage (who connects, where, with what), carry out a site survey, prepare cabling and PoE power, mount the access points in the right places, configure separate and properly authenticated networks, then measure the result before handover. The problems we see most often come from a skipped phase, rarely from the hardware.

At ALLSAFE SOLUTIONS, we design and install professional WiFi networks in Casablanca and across Morocco, with managed access points from our partners Fortinet and WatchGuard, or other brands depending on the project. We supply hardware and licences, with or without installation. This guide describes our deployment process; to understand why an undersized WiFi keeps dropping, read enterprise WiFi: why yours drops and how to size it first.

The seven phases of a business WiFi deployment

Phase	What is done	Deliverable
1. Requirements	Usage, number and type of devices, critical areas, building constraints	Approved requirements document
2. Site survey	Floor-plan simulation, then on-site measurement	Access point layout and channel plan
3. Cabling and PoE	Network outlets at access point locations, PoE switches, rack	Cabling plan and PoE power budget
4. Access point mounting	Mounting, orientation, connection, labelling	Access points installed and marked on the plan
5. Configuration	SSIDs, VLANs, authentication, guest portal, firewall rules	Configuration file
6. Acceptance	Coverage and throughput measurement, roaming and voice tests	Acceptance report with survey data
7. Operations	Documentation, monitoring, updates	Documentation handed over and monitoring live

These phases apply equally to a single-floor office, a warehouse, a school or a hotel. Only the depth of each phase changes.

Phase 1: the requirements document

Before talking about access points, answer a few simple questions, area by area:

• Who connects: staff, guests, contractors, devices (printers, cameras, warehouse scanners, meeting room displays).
• With what: recent laptops, smartphones, older scanners that only support the 2.4 GHz band.
• For what: office work, video calls, IP telephony on smartphones, business applications, video.
• Where density is: meeting rooms, training room, reception, open space.
• What cannot stop: a warehouse scanning all day or a reception desk taking calls over WiFi does not have the same needs as an administrative office.
• Building constraints: up-to-date floor plans, materials, ceiling height, suspended ceilings, access to cable risers, landlord approvals.

The result is a requirements document approved by the client. It then serves as the reference for acceptance testing.

Phase 2: the site survey, predictive then on site

The site survey is the phase that makes the difference. Cisco describes it as the first and most important step of a wireless deployment. It happens in two stages:

Survey type	How	When it is enough
Predictive	Floor-plan simulation with materials and heights entered	New build, uniform floor, as a first pass
On site	A temporary access point placed at the planned locations, measuring signal, noise and interference	Thick walls, metal, glass, multiple floors, warehouses, older buildings
Validation	Measurement of the installed network	Always, at the end of the project (phase 6)

The survey sets the location of each access point, the band and channel it uses, and its transmit power. It also identifies interference sources: neighbours’ WiFi networks, industrial equipment, the cafeteria microwave. In Morocco, we often find thick load-bearing walls and glass partitions that behave very differently from what an unmeasured floor plan predicts.

Phase 3: preparing cabling and PoE power

Every professional access point connects over Ethernet and is powered through that same cable (PoE). A wireless bridge between access points is a stopgap, not an architecture. This phase means running a certified network outlet to each location from the survey, see our business network cabling guide, and checking that the switches can power every access point.

PoE standard (IEEE)	Maximum power per port at the switch	Typical use
802.3af (PoE)	15.4 W	IP phones, older access points
802.3at (PoE+)	30 W	Common WiFi 5 and WiFi 6 access points
802.3bt type 3	60 W	High-end WiFi 6E and WiFi 7 access points, PTZ cameras
802.3bt type 4	90 W	More power-hungry equipment

Two things to check on the access point’s datasheet: its PoE class and how it behaves when it receives less. Some access points boot, then disable a radio or a band. You also need to add up the consumption of every access point, phone and camera on the same switch and compare it with the switch’s total PoE budget. We cover this choice in patch rack and PoE switch: how to choose.

Phase 4: choosing and mounting the access points

The choice of range depends mostly on how you want to manage it. If your firewall is a FortiGate, FortiAP access points are managed directly from it and WiFi shares the same security policy, see FortiSwitch and FortiAP in the Security Fabric. To compare with a standalone solution, read Ubiquiti UniFi or Fortinet FortiAP.

On the WiFi generation, one regulatory point: ANRT authorised WiFi 6E, which adds the 6 GHz band, through decision ANRT/DG/N°07/2021 of May 2021. This band is useful in dense areas, provided the company’s laptops and smartphones support it: a quick inventory of your devices avoids buying access points nobody will benefit from.

For mounting, the rules we apply:

1. On the ceiling, at the centre of the areas to serve, rather than in corridors or above doors.
2. Never above a metal suspended ceiling, nor shut inside a cupboard or trunking.
3. Orientation as per the datasheet: a ceiling-designed access point radiates poorly when wall-mounted.
4. Out of the public’s reach, with a lockable bracket in accessible areas (reception, lobby, training room).
5. Labelling of every access point and every switch port, recorded on the plan.

Phase 5: configuring networks and security

The rule: few network names (SSIDs), each tied to its own VLAN, and authentication suited to each group of users. Multiplying SSIDs consumes airtime and lowers throughput for everyone.

Network	Authentication	VLAN and filtering
Staff	WPA3 or WPA2-Enterprise, 802.1X against the directory (Entra ID, Active Directory)	Internal VLAN, application access by profile
Guests	Captive portal, Wi-Fi Enhanced Open (OWE) where devices support it	Isolated VLAN, internet only, rate-limited
Devices	WPA3-Personal or WPA2-Personal with a key specific to that network	Dedicated VLAN, traffic limited to what is strictly needed

A useful technical point: in the 6 GHz band, the Wi-Fi Alliance mandates WPA3 and forbids open networks, so older devices stay on the 2.4 and 5 GHz bands. On the firewall, traffic between VLANs is filtered, access point administration is reachable only from the management network, and the default password is changed at commissioning. If your teams use IP telephony over WiFi, quality of service (QoS) and fast roaming (802.11r) are tuned at this stage.

Phase 6: acceptance, measure before handover

Acceptance compares the result with the requirements document, with measurements to back it up. We check:

• Coverage and signal level in every area, recorded on the plan.
• Real throughput in dense areas, during working hours and not in an empty building.
• Roaming: a call or video meeting while walking from one area to another must not drop.
• Network isolation: from guest WiFi, no access to the internal network.
• Authentication: an account disabled in the directory does lose its WiFi access.

Gaps are fixed (power, channel, access point moved or added) and measured again. The acceptance report is handed to the client with the survey data.

Phase 7: documentation and operations

A WiFi network delivered without documentation quickly becomes unmanageable. We hand over the access point layout, the list of access points and ports, the SSIDs and VLANs, the firewall rules and the admin credentials, kept in a password vault rather than a spreadsheet. After that, 24/7 monitoring detects an access point that is down, a saturated area or a switch running short of power, and firmware updates are scheduled. This is what our managed IT services cover.

Deployment mistakes we fix

1. Access points bought before the site survey, mounted wherever there was an outlet, then supplemented at random.
2. Consumer repeaters or access points mixed with professional ones, with no roaming and no central console.
3. An undersized PoE switch: access points reboot or disable a radio when load increases.
4. One network for everyone, guests included, with a shared password that has never changed.
5. Transmit power at maximum on every access point, so they interfere with each other and keep devices stuck on a distant one.
6. No measurement after installation, so no way to prove the network does what was asked.

Checklist before launching your WiFi deployment

• Up-to-date site plans and a list of critical areas.
• Device inventory, including the oldest ones and those limited to 2.4 GHz.
• Priority uses: voice, video calls, business applications, warehouse scanners.
• Predictive site survey, completed by an on-site measurement if the building is complex.
• Certified network outlets at access point locations and PoE budget checked.
• A single management console, consistent with your firewall.
• Approved plan of SSIDs, VLANs and authentication methods.
• Measured acceptance written into the contract, with a report handed over.
• Monitoring and updates planned after commissioning.

For venues open to the public, our specific advice is in WiFi for hotels and riads in Morocco.

How we do it

We start with a free audit of your site and usage: site visit, floor plans, device inventory and the state of existing cabling. We then carry out the site survey, propose the layout and hardware, supply access points, switches and licences, and handle mounting, configuration and measured acceptance, with full documentation. We work on site from Casablanca. After commissioning, the network is monitored 24/7 and a critical incident is handled in under 15 minutes.

See our business network and WiFi services in Morocco, then request your free initial audit: we reply within 24 business hours.