HPE Aruba office Wi-Fi design for meeting rooms and secure employee access

This reference design is a starting point for project discovery, not a completed customer case. Final quantities and settings require site measurements, endpoint compatibility checks and a release-specific implementation design.

1. Requirements analysis

Workload and capacity example

Illustrative workload: 240 people × 2 devices × 60% busy-hour activity gives about 288 active clients. If 60 are in video meetings, measure their application uplink, downlink and bursts separately. Size each meeting room, airtime domain and aggregation link; 288 clients is not an AP quantity or a customer result.

Deliverables at this stage: a measured floor plan, client/application inventory, current topology and dependencies, agreed test objectives and constraints. Keep associated-client counts, active-client counts and concurrent application demand as separate inputs.

2. Solution design

Employee devices → Aruba campus APs → CX PoE access → business network or Internet. Central manages the deployment; ClearPass or enterprise RADIUS provides identity. Tunnel forwarding adds a supported gateway.

Model peak rooms separately

Build separate demand schedules for desks, meeting rooms, training areas and visitors. Estimate active devices from peak occupancy, devices per person and active share, then add scheduled meeting peaks. Use measured application demand to size airtime and uplinks. A client estimate is a workload input, not an automatic AP count.

Choose the forwarding boundary

For a new deployment, evaluate Central-managed AOS 10. For expansion, first inventory software, controllers and licenses. Local bridging and gateway tunneling require different VLAN, DHCP and mobility designs. Document management connectivity separately from client forwarding and test certificate-based employee authentication, guest isolation and meeting-device discovery.

Order the complete configuration

Evaluate AP-615, AP-635 or AP-735 only after checking regional SKUs and client requirements. Include mounting, Central subscriptions and support. Check per-port power class, total switch PoE budget, cable certification and aggregation capacity before ordering a newer AP. Survey candidate positions with representative clients before finalizing quantities.

3. Network topology and forwarding

Choose the employee WLAN forwarding mode first. Bridging needs the employee VLAN on the AP uplink and required access path. Tunneling carries client traffic through the underlay to the selected gateway cluster. Define guest Internet rules separately from employee internal access, and document RADIUS, DNS, DHCP and time-service dependencies.

Dashed paths denote logical management or authentication dependencies, not physical direct cables. Central is the management service, not the client data-plane transit point. If tunneling is chosen, redraw and validate the AP-to-gateway path and the authenticator location for that mode.

SSID, segment and access-policy example

Names and VLAN IDs above are illustrative and must be mapped to the customer address plan. A VLAN is not a complete security boundary: enforce the approved ACL/firewall/role policy at the selected forwarding points and verify both allow and deny behavior. Publish only the minimum necessary SSIDs and verify legacy-client exceptions separately.

4. Implementation plan

1. Requirements and baseline：Deliver floor zones, peak-client schedules and current fault measurements; reserve representative meeting clients for the pilot.
2. Survey and placement：Calibrate desk and meeting-room predictions with temporary AP measurements; document placement, channel reuse and power limits.
3. Infrastructure readiness：Verify switch VLANs, actual PoE modes, DHCP/DNS/NTP, management egress and RADIUS reachability.
4. Configuration and security：Build management groups and identity roles before WLANs; test employee, guest and meeting access, including explicit denial tests.
5. Busy-hour pilot：Measure authentication, retries, call quality and bidirectional load during meeting peaks; change one RF variable at a time.
6. Phased handover：Cut over by floor with old configuration and rollback ports retained; deliver drawings, ownership, policy matrices and monitoring.

Change control and rollback gate

Before each batch, name the change owner, business approver and recovery operator. Preserve the approved pre-change configuration and verify that the hardware/software supports the intended recovery. Stop or roll back if critical transactions fail, identity rules are wrong or agreed recovery limits are exceeded. Capture timestamps and logs before altering the next variable.

5. Configuration and procurement checklist

6. Acceptance and operational handover

1. Repeat conferencing and screen sharing at the scheduled room peak; record client, band, software and timestamps.
2. Walk the desk-to-meeting-room route while recording packet loss, latency and session interruptions.
3. Test guest denial to internal services and employee certificate revocation.
4. Test an agreed uplink or RADIUS-node failure in a maintenance window and record recovery.

Agree numeric coverage, SNR, packet-loss, latency and recovery thresholds with the application owner before the pilot. Record locations, representative clients, load and software so results can be reproduced.

7. Prepare a project request

Send scaled plans, device and application schedules, current software and topology, power and cabling records, destination and rollout constraints. We use these inputs to discuss a project-specific configuration and quotation.

Prepare the network BOM

8. Regional and architecture checks

Product families above are candidates for evaluation. Confirm exact destination SKUs, certifications, permitted channels and software support before ordering. For mainland China, global 6 GHz capability does not establish local permission to enable it. AOS 8, AOS 10 and Central features require version-specific verification.