Wireless Wifi Mobility Specialist

Wireless (Wi-Fi) Mobility Specialist

When NOT to Use

• Cellular RAN, 5G core, or private LTE/CBRS-only design → defer unless Wi-Fi coexistence or dual-connectivity is the question
• Carrier BGP/MPLS backbone, IX peering, or internet routing design → network-backbone-architect
• SD-WAN overlay topology, path selection, and SASE insertion as primary deliverable → sd-wan-engineer
• Cloud landing zone, VPC design, and managed cloud service selection → cloud-architect
• Cloud network security guardrails, CSPM, and cloud IAM as primary deliverable → cloud-security-engineer
• Terraform modules, physical DC build, and K8s platform delivery without WLAN design → infrastructure-engineer
• Corporate security program, IdP, and endpoint controls without wireless architecture → information-security-engineer
• SLO programs, on-call, and production incident process as main task → site-reliability-engineer
• OT/ICS segmentation, Purdue model, and plant industrial wireless (ISA) → scada-ics-cyber-security-specialist

Related skills

Core Workflows

1. Scope, constraints, and mobility requirements

Clarify venue types, device classes, density, roaming domains, and compliance.

See `references/wireless_wifi_mobility_scope.md`.

2. RF survey and AP placement

Plan predictive/active surveys, coverage vs capacity, and mounting constraints.

See `references/rf_survey_and_ap_planning.md`.

3. Standards, channels, and capacity

Select Wi-Fi generations, band plan, channel width, power, and DFS/regulatory constraints.

See `references/standards_channels_and_capacity.md`.

4. Security, 802.1X, and segmentation

Design SSIDs, VLANs/VRFs, WPA-Enterprise, guest/captive portal, and RADIUS/NAC handoffs.

See `references/security_8021x_and_segmentation.md`.

5. Roaming, density, and performance

Optimize 802.11k/r/v, band steering, high-density RF, and sticky-client mitigation.

See `references/roaming_density_and_performance.md`.

6. Operations, troubleshooting, and integration

Integrate with LAN/SD-WAN edge, monitor KPIs, and troubleshoot SNR, retries, and interference.

See `references/operations_troubleshooting_integration.md`.

Outputs

• WLAN context — sites/venues, device mix, density tiers, and roaming expectations
• RF and AP plan — survey method, AP map, antenna/orientation notes, and capacity model
• Radio design — band/channel plan, power limits, DFS strategy, and interference mitigations
• SSID and segmentation matrix — auth method, VLAN/ACL, firewall/NAC attachment
• Roaming and density brief — 11k/r/v, band steering, min RSSI, and venue-specific tuning
• Operations baseline — controller/cloud model, monitoring KPIs, and escalation runbooks
• Integration notes — uplink to distribution, PoE budget, DHCP/DNS, and SD-WAN/local breakout hooks

Principles

• Design for mobility first — roaming domains and sticky clients drive AP density more than coverage alone
• Measure RF, do not guess — validate with survey tools and post-deploy verification walks
• Separate roles by SSID — corporate, guest, IoT, and voice each get explicit policy and VLAN paths
• Prefer 5 GHz/6 GHz for capacity — use 2.4 GHz deliberately for reach or legacy, not default overlap
• Align security with NAC — 802.1X and RADIUS are architecture decisions, not AP checkbox settings
• Document vendor-agnostic intent — capture requirements before locking controller-specific features

Operations, troubleshooting, and integration

Table of contents

1. WLAN operations model 2. Integration with wired LAN 3. SD-WAN and edge integration 4. Monitoring and telemetry 5. Troubleshooting methodology 6. Common failure patterns 7. Change management and lifecycle 8. Runbook templates

WLAN operations model

Define roles: RF engineering, network operations, security (NAC), and field services for AP hardware.

Golden templates — SSID, RF, and security policies pushed from templates; avoid one-off AP configs.

Integration with wired LAN

Access layer checklist:

FlexConnect / local mode — document which VLANs terminate locally vs at controller DC.

Handoff to infrastructure-engineer for rack, power, and cabling; to network-backbone-architect for routing and core QoS.

SD-WAN and edge integration

Branch wireless often shares internet breakout with SD-WAN:

Coordinate with sd-wan-engineer for:

• Application routes for SaaS used heavily over Wi-Fi
• SLA classes for real-time traffic from wireless VLANs
• Failover when broadband fails—guest may stay up while corp tunnels down

Do not redesign overlay path selection in this skill—document requirements and interfaces.

Monitoring and telemetry

Sources:

• Controller/cloud — client events, roam, auth failures, RF metrics
• SNMP — AP radio stats where supported
• Syslog — auth, rogue, config change
• NetFlow/IPFIX — per-VLAN traffic (wired side)
• Synthetic tests — dedicated test client or sensor (optional)

Dashboards (examples):

• AP up/down, channel utilization, retry %
• Top noisy APs/clients
• 802.1X failure rate and RADIUS latency
• DFS event count by site
• Ticket correlation — WLAN issues vs WAN outage

Alert hygiene:

• Alert on sustained thresholds, not single spikes
• Separate RF alerts from auth alerts from WAN alerts

Handoff to site-reliability-engineer when defining SLOs and error budgets for digital workplace services.

Troubleshooting methodology

Structured flow:

1. Scope — one user, one floor, one site, or global? 2. Correlate time — change window, firmware, RADIUS cert, DFS event 3. Layer — physical (PoE), association, auth, IP, app, path 4. Client vs infrastructure — reproduce with second device; check driver 5. RF vs wired — compare on Wi-Fi vs wired same VLAN

Data to collect:

• Client MAC, AP name, BSSID, channel, RSSI/SNR
• Connection phase — assoc, 4-way, 802.1X, DHCP
• Retry rate, data rate, roam history
• Switch port errors, PoE status

Common failure patterns

SNR vs RSSI:

• RSSI — received power
• SNR — RSSI minus noise floor; low SNR → low MCS and high retries

DFS: clients drop when AP moves channel—check radar detection logs; adjust channel plan.

Co-channel / adjacent-channel: retries rise without obvious low RSSI—review channel overlap map.

Change management and lifecycle

Document maintenance windows for channel changes (brief disconnect) and controller failover tests.

Runbook templates

Single client cannot connect (corp SSID)

1. Verify SSID visible; compare with known-good client 2. Check 802.1X cert and EAP type; review RADIUS accept/reject 3. Confirm VLAN and DHCP scope 4. If isolated to one AP, check RF and AP logs for disassoc reason

Floor-wide slow Wi-Fi

1. Check AP up count vs expected 2. Review channel utilization and retry heatmap 3. Identify new interference or neighbor AP 4. Verify uplink congestion on access switches 5. Check WAN/SD-WAN if apps are cloud-hosted

AP flapping / offline

1. PoE budget and port errors 2. Cable/link (negotiation 1G vs 100M) 3. CAPWAP/tunnel to controller; firewall UDP/TCP paths 4. Replace hardware if physical layer failed

Post-DFS event

1. Identify affected channel and APs 2. Confirm clients reassociated 3. If recurring, exclude problematic DFS channel in plan

Export runbooks to NOC wiki with vendor-specific click paths as appendix—not in architecture docs.

RF survey and AP planning

Table of contents

1. Survey types and when to use them 2. Pre-survey discovery 3. Predictive modeling 4. Active survey and validation 5. AP placement heuristics 6. Antennas and mounting 7. Capacity planning 8. Documentation and acceptance

Survey types and when to use them

Use predictive + active validation for most enterprise rollouts. APoS for high density or first deployment in complex RF environments.

Pre-survey discovery

Collect before modeling:

• Floor plans with scale and ceiling height
• Wall materials (drywall, concrete, glass, metal studs, elevator shafts)
• Existing APs and neighbor networks (co-channel risk in multitenant buildings)
• Metal inventory — racks, conveyors, foil-backed insulation, LED lighting drivers
• Outdoor coverage requirements and cable paths
• Restricted areas — no ceiling mount, aesthetic limits, hazloc rules

Define survey objectives per zone:

• Coverage — minimum RSSI (e.g., -67 dBm for data, -65 dBm for voice)
• Capacity — Mbps per user or per m² at busy hour
• Interference — max co-channel overlap, noise floor targets

Predictive modeling

Modeling workflow:

1. Import floor plan; set scale and per-wall attenuation (calibrate with spot measurements if possible). 2. Place AP models matching intended hardware (antenna gain, MIMO, band support). 3. Set transmit power within regulatory and design caps; avoid “max power everywhere.” 4. Review heatmaps per band: 2.4 GHz, 5 GHz, 6 GHz (if applicable). 5. Iterate AP count and positions until coverage and capacity targets met.

Common modeling mistakes:

• Ignoring elevators and shafts as RF blockers and reflection sources
• Using default wall loss for warehouse (underestimate open space, overestimate metal aisles)
• Placing APs only in hallways for room coverage (adjacent-room penetration varies)
• Forgetting vertical bleed between floors in multi-story buildings

Active survey and validation

Post-deployment or APoS validation:

Walk all critical paths: entrances, conference rooms, stairwells, loading docks, nurse stations, etc.

AP placement heuristics

General placement rules:

• Prefer ceiling mount at center of coverage cell for omnidirectional patterns.
• In corridors, stagger APs on alternating sides to reduce down-corridor co-channel coupling.
• For open offices, grid APs for capacity; overlap at -67 to -72 dBm for roam, not -55 dBm everywhere.
• Avoid physical obstructions within 1 m of antenna (HVAC, metal beams, large AP clusters).
• Elevator lobbies often need dedicated AP; shafts attenuate but doors open frequently.
• Restrooms and small rooms may get adequate penetration; do not over-densify without need.

Cell overlap: enough for roam without excessive CCI. Voice often needs more overlap than best-effort data.

Antennas and mounting

Mounting:

• Document height, orientation, and down-tilt for directional installs.
• Use appropriate hardware for ceiling type (grid, hard lid, exposed deck).
• Plan cable length for external antennas; avoid excessive loss on long coax (prefer fiber + indoor AP).

Capacity planning

Estimate AP count from capacity, not coverage alone:

Required Mbps per area ≈ users × Mbps_per_user × busy_hour_factor
AP airtime capacity ≈ effective_goodput_per_radio × radios_used

Factors:

• Wi-Fi 6/7 improves efficiency (OFDMA, MU-MIMO) but does not remove physics in dense venues.
• 2.4 GHz — limit use; often 3 non-overlapping channels; high CCI in dense sites.
• 5 GHz — more channels; DFS adds channels but radar events cause moves.
• 6 GHz (6E) — large clean spectrum where clients exist; plan 6 GHz-capable APs and clients.

High-density tactics:

• More APs at lower power vs few APs at high power
• Disable 2.4 on selected AP radios where legacy not required
• Band steering toward 5/6 GHz
• Multicast mitigation for large lecture/stadium spaces

Documentation and acceptance

Survey deliverables:

• Annotated floor plans with AP IDs, channels (post-survey), and mounting notes
• Heatmaps (RSSI/SNR/SNR) per band with legend and survey date
• Interference report — rogue/neighbor APs, noise sources, recommended mitigations
• AP table — model, name, MAC, IP, group, channel, power, VLAN uplink
• Exceptions list — areas below threshold with remediation plan

Acceptance sign-off should tie to requirements doc thresholds, not subjective “looks fine.”

Roaming, density, and performance

Table of contents

1. Roaming fundamentals 2. 802.11k, 11r, and 11v 3. Band steering and client steering 4. Sticky clients and mitigation 5. High-density venue design 6. Voice and real-time traffic 7. Mesh and outdoor mobility 8. Performance testing and KPIs

Roaming fundamentals

Roaming occurs when a client reassociates to a new AP while keeping L3 continuity (same subnet) or tolerating brief disruption.

Design for L2 roaming domains per SSID/VLAN within a site unless centralized L3 mobility (e.g., L3 roam anchors) is explicitly architected.

Key metrics:

• Roam time — association + auth (802.1X full reauth is slower than 11r key cache)
• Packet loss during roam — voice tolerates <150 ms gap (environment-specific)
• Sticky duration — time client holds weak AP before roam

802.11k, 11r, and 11v

802.11r (FT):

• Reduces roam time for 802.1X by pre-authenticating keys
• Requires same mobility domain on controller; SSID must enable FT
• Test all client types—some IoT and older phones break with FT enabled

802.11k:

• AP provides neighbor list; client makes better roam decisions
• Enable with 11v on dense campuses

802.11v:

• Network-assisted BSS transition; helps move clients off overloaded AP
• Use with load balancing and band steering carefully to avoid roam storms

Band steering and client steering

Band steering — encourage dual-band clients to use 5 GHz or 6 GHz:

• Probe suppression or preference on 2.4 GHz
• Client capability checks before steer
• Monitor steer failures (client stays on 2.4)

Client steering / load balancing — move clients between APs on same band:

• Thresholds: client count, utilization, SNR
• Avoid aggressive steering causing ping-pong roams

Best practices:

• Pilot steering on one floor; watch retry rates and helpdesk tickets
• For voice SSID, conservative steering—stability over utilization
• Document exceptions for known-bad clients (allowlist 2.4 only)

Sticky clients and mitigation

Sticky clients stay on a distant AP despite better neighbors—causes low throughput and CCI for others.

Mitigations:

Set min RSSI per SSID/AP group—not globally maximum without validation.

High-density venue design

Venues: stadium, arena, lecture hall, conference center, warehouse peak shifts.

Tactics:

• High AP count, low power, narrow cells
• Directional antennas for seating bowls; sectorization
• Split bands — dedicated 5 GHz and 6 GHz plans; limit 2.4 to legacy pockets
• Disable low rates (basic rate sets) where safe—reduces airtime waste
• Multicast-to-unicast for broadcast-heavy apps
• DHCP and DNS scale—short lease times; anycast DNS
• Controller clustering and AP limits per RF group

Capacity checklist:

• Model peak concurrent clients per AP/seat section
• Plan uplink (2.5G/5G/10G) per AP; avoid oversubscribed access switches
• Airtime utilization alarms per AP (typically investigate sustained >60–70%)

Healthcare and warehouse variants:

• Healthcare — roaming for carts and voice; minimize channel changes during DFS
• Warehouse — metal racks; plan for aisle coverage; scanner roam testing at rack ends

Voice and real-time traffic

Wi-Fi voice (VoWLAN) requirements:

• Dedicated voice SSID with QoS (WMM UP queues)
• 802.11r where supported by handsets
• Consistent codec and CAC on wired side
• QoS trust end-to-end—DSCP honored on switches if wired QoS used

VDI and video conferencing:

• Prefer 5/6 GHz; adequate SNR; avoid hidden node in open offices
• Wired QoS or SD-WAN classes for egress—coordinate with sd-wan-engineer

Mesh and outdoor mobility

Mesh (where offered):

• Half-duplex mesh backhaul reduces capacity—prefer wired backhaul when possible
• Hop count limits (typically ≤2–3 for production)
• Outdoor mesh — power, lightning, pole rights, and line of sight

Outdoor bridging:

• Point-to-point 5 GHz links; align antennas; monitor fade from weather
• Regulatory EIRP and licensing for long links

Mobility across outdoor campus APs:

• Overlap at building entrances for seamless handoff indoor/outdoor
• Tune min RSSI at perimeter to encourage indoor AP when inside

Performance testing and KPIs

Test scenarios:

Operational KPIs (monitor continuously):

• Retry rate (%), channel utilization, noise floor
• Client count per AP, sticky client reports
• DFS events, radar detected channel moves
• Auth failures (802.1X), RADIUS latency
• AP uptime, capwap/tunnel status

Escalation thresholds should be baseline-relative (compare to same hour prior week).

Security, 802.1X, and segmentation

Table of contents

1. SSID design patterns 2. Authentication methods 3. 802.1X and EAP architecture 4. RADIUS and NAC integration 5. WPA2-Enterprise vs WPA3-Enterprise 6. Guest and captive portal 7. Segmentation and policy enforcement 8. Operational security practices

SSID design patterns

Minimize SSID sprawl—each SSID consumes airtime (beacons, probes). Typical enterprise set:

Use hidden SSID sparingly—does not provide security; complicates operations.

Authentication methods

OWE (Enhanced Open) — encrypted open for guest in some designs; verify client support.

802.1X and EAP architecture

Logical components:

Supplicant (client) ↔ Authenticator (AP) ↔ Authentication server (RADIUS)
                              ↕
                         AS (AD/LDAP via RADIUS)

Key concepts:

• Authenticator terminates 802.1X on AP; passes EAP to RADIUS.
• Supplicant must be configured (GPO, MDM, or manual) with correct EAP type and trust anchors.
• Certificate trust — deploy enterprise root or use public CA for EAP-TLS; document rotation.
• Machine vs user auth — Windows often machine auth before user; affects VLAN assignment timing.

Failure modes to design for:

• RADIUS timeout → local fallback policy (deny vs guest VLAN) — default deny for corp SSID
• Clock skew → breaks cert validation
• Wrong outer identity → privacy and routing of inner EAP

RADIUS and NAC integration

RADIUS responsibilities:

• Accept Access-Request from NAS (AP/controller)
• Return Access-Accept/Reject with VLAN, ACL, or filter-id attributes
• Accounting (optional) for session logging

Common attribute mappings:

NAC / posture (conceptual):

• Redirect to remediation VLAN until patch/AV criteria met
• Integrate with ClearPass, ISE, FortiNAC, etc. as policy engine
• Document MAB (MAC auth bypass) for devices that cannot do 802.1X—tight allow lists only

High availability:

• Multiple RADIUS servers; AP/controller server lists with dead-time
• Geographic RADIUS placement for latency; cloud RADIUS requires resilient path

Handoff to information-security-engineer for identity program; this skill covers WLAN binding to that program.

WPA2-Enterprise vs WPA3-Enterprise

Migration approach:

1. Inventory client capabilities (WPA3 support %). 2. Pilot WPA3-Enterprise SSID or mixed mode on test floor. 3. Monitor connection failures and driver issues. 4. Deprecate WPA2-only when metrics allow.

Guest and captive portal

Guest flows:

• Web redirect — DNS hijack or HTTP redirect to portal; HTTPS requires careful cert handling
• Social/sponsor — sponsor email approval for contractors
• Self-registration — SMS/email verification; logging for compliance

Security controls:

• Guest VLAN without RFC1918 access to corp
• DNS filtering and egress firewall
• Bandwidth limits and session timeout
• WIPS — detect rogue gateways on guest VLAN

Document data retention for guest logs (GDPR, local law).

Segmentation and policy enforcement

Map SSID → VLAN → VRF/firewall zone:

FlexConnect / local switching vs central switching:

• Local switching — VLAN terminates at access switch; lower WAN hairpin
• Central switching — traffic tunnels to controller; easier policy centralization, more WAN load

Coordinate with network-backbone-architect and sd-wan-engineer for path and breakout when guest traffic should exit locally at branch.

Operational security practices

• Disable legacy protocols (WEP, WPA-TKIP) everywhere
• Enforce PMF where possible
• Rotate PSKs and MPSK keys on schedule
• Monitor rogue APs, evil twin, and deauth (where detectable)
• Protect controller management — out-of-band or dedicated mgmt VLAN, MFA for admin
• Backup configs and document golden templates
• Patch controller/AP firmware on supported train with rollback plan

Certificate operations:

• Track EAP-TLS cert expiry; automate renewal via MDM/PKI
• Use separate certs for admin UI vs EAP if vendor supports

Standards, channels, and capacity

Table of contents

1. 802.11 generations at architecture level 2. Frequency bands and channel planning 3. Channel width and airtime tradeoffs 4. Transmit power and cell sizing 5. DFS and regulatory domains 6. Interference types and mitigation 7. Wi-Fi 6/6E/7 feature selection 8. Vendor-agnostic design patterns

802.11 generations at architecture level

Select generation based on client mix, venue density, lifecycle (5–7 year AP refresh), and licensing cost—not headline peak Mbps.

Frequency bands and channel planning

Channel planning principles:

• Use non-overlapping 20 MHz channels as the baseline grid; widen only where benefit proven.
• Assign channels to minimize co-channel overlap between APs on same ESS.
• Group APs into RF profiles / zones (floor, building) for consistent channel plans.
• In multitenant buildings, document external CCI from neighbors; adjust channels or negotiate.

Example 5 GHz 20 MHz non-DFS set (region-dependent): 36, 40, 44, 48, 149, 153, 157, 161.

Channel width and airtime tradeoffs

Wi-Fi 6 does not eliminate channel planning—wider channels reduce planning flexibility.

Preamble puncturing (Wi-Fi 6/7) can help in partial interference scenarios—verify controller/AP support before relying on it in design docs.

Transmit power and cell sizing

• Start from minimum power that meets coverage/capacity targets, not max EIRP.
• Align TX power with cell size; high power increases hidden nodes and sticky clients.
• Use automatic power control cautiously—validate it does not create roaming holes.
• Document min/max power per AP group (office vs atrium vs outdoor).

Hidden node symptoms: retries, asymmetric uplink/downlink, poor TCP performance despite good RSSI on one side.

DFS and regulatory domains

DFS channels (5 GHz): radar detection required; AP may leave channel and clients disconnect briefly.

Design practices:

• Include DFS channels in plan where legal to expand capacity; monitor DFS events in operations.
• For latency-sensitive voice, consider avoiding primary operation on DFS-heavy plans if events are frequent in region.
• Set correct country code on controllers/APs—regulatory violation and client connectivity risk.

6 GHz: indoor low-power indoor (LPI) vs standard power with AFC outdoors—follow local rules for 6E deployment.

Interference types and mitigation

SNR matters more than RSSI alone: target SNR thresholds per application class (e.g., 25 dB+ for robust MCS).

Wi-Fi 6/6E/7 feature selection

Features to evaluate at architecture level (vendor naming varies):

Do not enable every feature globally—pilot on one floor or RF profile first.

Vendor-agnostic design patterns

Document design intent independent of vendor UI labels:

• ESS (extended service set) — same SSID across APs; roaming domain
• RF group / zone — shared channel and power policy
• Minimum basic rate — affects coverage footprint and legacy support
• Band steering — policy to move capable clients to 5/6 GHz
• Airtime fairness — reduce one client dominating medium

Conceptual vendor families (not endorsements):

• Cisco — WLC-based or Meraki cloud; CAPWAP, flexconnect/local switching
• Aruba/HPE — Mobility Conductor or Central; role-based policies
• FortiAP — integration with FortiGate security fabric
• Others — Ruckus, Extreme, Juniper Mist—same RF principles, different orchestration

Capture handoff to operations: firmware train, config backup, and license renewal dates in design package.

Wireless Wi-Fi mobility scope

Table of contents

1. Role and boundaries 2. Stakeholders and inputs 3. Mobility and venue model 4. Device and application classes 5. Design constraints 6. Deliverable checklist 7. Handoffs to peer skills

Role and boundaries

The wireless (Wi-Fi) mobility specialist owns enterprise WLAN design, deployment, and optimization for users and devices that move across coverage areas. Scope includes:

• RF and coverage/capacity — surveys, AP placement, antenna selection, and interference planning
• 802.11 architecture — Wi-Fi 5/6/6E/7 feature selection at design level (not chipset driver debugging)
• SSID and segmentation — VLAN mapping, firewall/NAC attachment, guest and IoT isolation
• Enterprise security — WPA2/WPA3-Enterprise, 802.1X/EAP, RADIUS, and captive portal patterns
• Mobility — roaming (802.11k/r/v), band steering, sticky clients, voice/video continuity
• Platform model — controller-based, cloud-managed, or distributed (controllerless) WLAN
• High-density and specialty venues — stadium, warehouse, healthcare, education, hospitality
• Outdoor and mesh — point-to-point bridging, mesh backhaul constraints, and weather-rated gear
• Integration — wired LAN distribution, PoE, DHCP/DNS, DNS filtering, and SD-WAN edge breakout
• Operations — KPI baselines, troubleshooting (SNR, retries, DFS), and change management

Out of scope (defer to peer skills):

Stakeholders and inputs

Gather before locking AP count or SSID matrix:

Minimum discovery artifacts:

• Floor plans with scale (CAD/PDF) and marked user density zones
• Device inventory — laptops, phones, scanners, VoIP handsets, medical/IoT classes
• Existing WLAN — controller model, firmware train, pain points (roaming, drops, density)
• Uplink and PoE — switch models, PoE budget per closet, fiber/copper paths to IDF
• Compliance — PCI, HIPAA, guest logging, lawful intercept (if applicable)

Mobility and venue model

Define mobility domains—areas where a client should roam without re-auth or with fast transition:

Document sticky client risk areas (far corners, legacy devices, printers) and mitigation (min RSSI, disassociation, band steering).

Device and application classes

Build a device × application matrix:

Design constraints

Document non-negotiables early:

• Regulatory domain — country code, max EIRP, DFS radar detection requirements
• Vendor strategy — single-vendor WLAN vs multi-vendor with standardized features
• Controller placement — on-prem HA pair vs cloud-managed (Meraki, Aruba Central, etc.)
• IPv6 — dual-stack SSIDs, RA guard, and DHCPv6 on wireless VLANs
• Multicast — IGMP snooping, multicast-to-unicast conversion for large venues
• Cable plant — Cat6A for 2.5/5 Gb uplinks; fiber to IDF; max PoE per switch
• Change velocity — template-based config vs per-AP customization

Deliverable checklist

Handoffs to peer skills