Networking, Wi-Fi & Fibre Optics
When staff say "the internet is slow", the connection is often not the problem: it is one router trying to serve forty devices through stone walls. This guide explains how to plan and set up business Wi-Fi with several cabled access points, separate networks and smooth roaming.
What you will learn
Applies to
Tools Required
Before you start
Important
Step-by-Step Guide
1 / 12 steps
Step 1
Assess the building layout
Walk the building with a floor plan. Note wall materials, ceilings, outdoor areas and where the network cabinet will go.
Expected result: A marked-up plan showing walls, rooms and the cabinet position.
For each area, note how many people and devices use it at the busiest time and what they run: calls, payments, streaming.
Expected result: You know which areas need coverage and which need capacity.
| Area | Peak devices | Key use |
|---|---|---|
| Open office | 35 | Cloud apps, calls |
| Meeting room | 20 | Video calls |
| Reception | 8 | Payments, guests |
| Terrace | 25 | Guest internet |
Example figures only.
Place access points on ceilings inside the rooms people use, not in corridors, with some overlap between neighbours.
Expected result: Every busy area has an access point with a clear line to users.
Run a Cat6 or Cat6A cable from the cabinet to each access point, within 100 m. Use fibre between buildings.
Expected result: Every access point has its own tested cable back to the switch.
Patch each access point cable into a PoE+ port. Check the switch's PoE budget covers all access points with headroom.
Expected result: Each access point powers up and appears in the controller.
Create a small number of SSIDs, such as Staff and Guest, with WPA2 or WPA3 security, each mapped to its own VLAN.
Expected result: Staff and guest Wi-Fi names appear on every access point.
| SSID | Security | VLAN | Bands |
|---|---|---|---|
| Office-Staff | WPA2/WPA3 | 10 | 2.4 + 5 GHz |
| Office-Guest | WPA2 (PSK) | 20 | 2.4 + 5 GHz |
Generic sketch. Menu names differ by system.
Turn on client isolation and a per-device speed limit for guests, and block access to staff and CCTV networks.
Expected result: Guests reach the internet only, and cannot see each other.
Example limits only. Set them to suit your connection.
Tag the staff, guest and CCTV VLANs on the switch ports to the access points and router; the firewall controls traffic between them.
Expected result: Guest traffic goes to the internet only; staff and CCTV stay private.
Turn on 802.11k and 802.11v where supported. Test 802.11r with your real devices before leaving it on, as some older devices fail.
Expected result: Devices move between access points with fewer drops.
Turn 802.11r on only after testing your devices.
On the router or firewall, give payments and calls priority and cap guest traffic so one user cannot use the whole connection.
Expected result: Card payments and calls keep working when the network is busy.
| Network | Priority | Limit |
|---|---|---|
| Payments VLAN | High | None |
| Staff VLAN 10 | Normal | None |
| Guest VLAN 20 | Low | Share of total |
Generic sketch. Exact options depend on the firewall.
Check the finished layout: dual internet, firewall, PoE switch on a UPS, access points, wired CCTV and staff devices.
Expected result: A documented network diagram for handover.
Walk every room with a Wi-Fi analyser app. Check signal strength, that neighbours use different channels, and that calls survive moving.
Expected result: Weak spots are found and fixed before handover.
| Access point | Channel | Signal |
|---|---|---|
| AP 1 office | 36 | -58 dBm |
| AP 2 office | 44 | -66 dBm |
| AP 3 meeting | 52 | -74 dBm |
| AP 1 (2.4 GHz) | 1 | -55 dBm |
A weak reading in a busy room means another AP or a move.
Interactive Demonstration
Up to about 15 people on one floor.
Representative equipment
Representative only. Final quantities and positions need an actual site survey.
About 40 to 100 people over one or two floors.
Representative equipment
Representative only. Final quantities and positions need an actual site survey.
Guest rooms, reception, restaurant and outdoor areas, often across several blocks.
Representative equipment
Representative only. Stone walls and building layout vary widely; final quantities need an actual site survey.
Dining room, kitchen, bar and terrace with card terminals and guest Wi-Fi.
Representative equipment
Representative only. Final quantities and positions need an actual site survey.
Classrooms, staff room, library and hall with many devices at once.
Representative equipment
Representative only. Final quantities and positions need an actual site survey. See IT infrastructure for schools.
Several floors or tenants sharing one building backbone.
Representative equipment
Representative only. Final quantities and positions need an actual site survey.
Troubleshooting
Likely cause Too many devices on one access point, neighbouring APs on the same channel, or a slow internet link.
Solution Check channel use and client counts in the controller, add capacity where users gather, and test the internet speed at the firewall.
Likely cause Gaps in coverage, APs at full power, or devices that hold on to a weak AP.
Solution Lower AP power so cells overlap evenly, enable 802.11k/v, and add an AP where the walk test shows a gap.
Likely cause Older devices, printers or payment terminals that do not support fast roaming.
Solution Turn 802.11r off or use mixed mode on that SSID, or move those devices to an SSID without it.
Likely cause The guest SSID is on the staff VLAN, or client isolation and firewall rules are missing.
Solution Map the guest SSID to its own VLAN, enable client isolation and block guest traffic to private networks.
Likely cause Not enough PoE power, a wrong PoE type, or a faulty cable.
Solution Check PoE use on the switch, confirm the AP's PoE requirement, and test or replace the cable.
Likely cause The switch, firewall or ONT is not on a UPS.
Solution Put the ONT, firewall and PoE switches on a UPS sized for the expected outage time.
Likely cause Those APs are not adopted, are offline, or the SSID is limited to certain APs or bands.
Solution Check each AP's status in the controller, and the SSID's AP group and band settings.
In Depth
When staff say "the internet is slow", the connection is often not the problem: it is one router trying to serve forty devices through stone walls. This guide explains how to plan and set up business Wi-Fi with several cabled access points, separate networks and smooth roaming.
For sites with several buildings, read it together with Network planning for large properties.
Before choosing equipment, list:
This tells you how many access points you need, how much switch capacity and PoE power, and which traffic must be protected when the network is busy. Capacity matters as much as coverage: a conference room with sixty laptops may need more than one access point even if one covers it with a strong signal.
Wi-Fi is the last few metres of a network. Behind every reliable access point is a cable. Plan a structured cabling system: Cat6 or Cat6A cable from a network cabinet to each access point, desk, camera and printer, terminated on a patch panel, labelled at both ends and tested. A copper Ethernet channel is limited to 100 metres from switch to device; beyond that, or between buildings, use fibre (see Fibre optic internet vs traditional Ethernet). The 100 metres is the whole channel: up to 90 metres of fixed cable plus patch cords at each end. Newer Wi-Fi 6E and Wi-Fi 7 access points may have 2.5 Gbps or faster ports; Cat6A is the safe choice for new installations. Note that 6 GHz Wi-Fi is not yet clearly permitted in Tanzania (see why is my Wi-Fi slow), so plan coverage on 2.4 GHz and 5 GHz.
Leave spare data points in meeting rooms and offices. Adding a cable later, after painting and ceilings, costs much more than adding it during fit-out.
A single powerful router in the corner cannot cover a building with thick walls. Business networks use several access points, each connected by cable and managed centrally from a controller, cloud dashboard or the access points themselves, so settings are consistent everywhere.
Mesh kits that connect wirelessly can help where cable is impossible, but each wireless hop costs speed. We compare the two in Mesh Wi-Fi vs managed access points.
Use VLANs (virtual networks, IEEE 802.1Q) and separate Wi-Fi names (SSIDs) to keep traffic apart:
Keep the number of SSIDs small, ideally three or four. Every SSID adds beacon traffic on every channel and slows the network for everyone. A guest's infected laptop should never be able to reach your CCTV recorder or accounts PC; the firewall rules between VLANs enforce that. What is a network switch explains tagged and untagged ports.
Managed switches let you set up VLANs and see which port is causing trouble. PoE switches power access points, cameras and IP phones through the data cable, so they all stay running from one UPS. Most current access points need PoE+ (802.3at, 30 W at the switch port), and some high-end models need 802.3bt. Add up the power each device needs from its data sheet and leave headroom; the PoE budget calculator does the arithmetic.
The Wi-Fi device, not the access point, decides when to move to a new access point. Three IEEE amendments help, where both the access points and the device support them:
Support varies. Some older devices, card machines and printers fail to connect to an SSID with 802.11r turned on, so test it with your real devices, or use your system's mixed or adaptive mode if it has one, and leave it off on the payments SSID if terminals struggle. Overlapping coverage between neighbouring access points, at sensible power levels, does more for roaming than any setting.
A business router or firewall should:
Power cuts are frequent in Zanzibar, and lightning surges travel along cables. Put every network cabinet on a UPS, earth the cabinets properly, fit surge protection on cables that run outdoors, and use fibre rather than copper between buildings.
After installation, walk the building with a phone or laptop running a Wi-Fi survey or analyser app. Check signal strength in every room (Cisco's design guides use about -67 dBm or stronger at the edge of each access point's coverage as the usual target for roaming and calls), check that neighbouring access points use different channels, and run a speed test in the busiest areas. At handover you should receive a network diagram, an IP address plan, a list of passwords held securely by named people, and labelled cables. Monitoring that alerts someone when an access point or link goes down turns many outages into quick fixes.
The designer on this page shows representative layouts for an office, hotel, restaurant, school and commercial building. Final quantities always need a site survey.
If you are fitting out a new building or your current Wi-Fi is unreliable, see our networking, Wi-Fi and cabling service or contact us to arrange a site survey.
This guide is general information. Procedures, product features and firmware change, so check your own equipment's documentation before you start.
FAQs
It depends on wall materials, room layout and the number of users at the busiest time. A walk-through survey, ideally with Wi-Fi measurements, is the reliable way to decide. Thick stone walls need more access points than open-plan offices.
Often, if they are Cat5e or Cat6 in good condition and properly terminated. Cables should be tested before you rely on them, especially for newer access points with faster ports.
Only if the internet connection is actually the bottleneck. If the problem is coverage, interference or an overloaded router, a faster package will not help.
Yes. They should be separate SSIDs on separate VLANs, with the guest password changed regularly. Staff networks are better protected with individual logins (WPA2/WPA3-Enterprise) where your equipment supports it.
The phone decides when to roam, and some hold on to a weak signal. Lowering access point power, enabling 802.11k/v and checking coverage overlap usually helps more than adding access points.
They will all work, but they cannot be managed together or share roaming features. Use one system across the site.
Someone should apply updates, watch for failures and handle changes. That can be your own IT person or a managed IT support plan.
We measure the building, place access points where the signal is needed and wire them properly, so the Wi-Fi works in every room.
Ask for clarification, tell us a problem this did not solve, or suggest a topic. An engineer reads every message, and we use them to improve the Knowledge Center.
Keep learning
Networking, Wi-Fi & Fibre Optics
40 min
A reset wipes a MikroTik router back to its default configuration, or to nothing at all. Done well it takes twenty minutes; done in a hurry it erases...
View Guide
Networking, Wi-Fi & Fibre Optics
12 min
A network switch is the box that connects the wired devices in a building so they can talk to each other and reach the internet. This guide explains h...
View Guide
Networking, Wi-Fi & Fibre Optics
20 min
Troubleshooting fix
Slow Wi-Fi is rarely one fault. It is usually distance, thick walls, a crowded channel or simply the internet plan. One wired test tells you which hal...
View Guide
Networking, Wi-Fi & Fibre Optics
12 min
Comparison
Fibre optic cable carries data as light through glass, while Ethernet cable carries it as electrical signals through copper. This guide compares the t...
View GuideEngineers reply Mon – Fri, 08:00 – 17:00
We'll send a copy of the conversation to our team. Next time, the chat starts fresh.
