Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ask Slashdot: How Do You Deploy Small Office Wi-Fi SSIDs?

Posted by timothy on from the call-them-all-linksys-done dept.

First time accepted submitter junkfish writes "I am not able to install a controller based Wi-Fi solution in my office due to cost, but I like presenting my users with a single SSID rather than an array of four or five differently named SSIDs from different access points. What is your experience deploying multiple wireless access points with the same SSID and password? I have been doing this with Cisco 1040 series Access Points this year, and have had good success. It seems like the client is able to determine which AP is best to connect to, and is able to roam around the office without too much of an interruption when it connects to a different AP. Is this sloppy practice? Or does the general state of the 802.11 provide for this sort of resiliency? I am really interested in your opinion because I have not seem too much documented on this subject."

172 comments

  1. I've seen it work by Nefarious+Wheel · · Score: 4, Informative

    I've seen it work with multiple AP's in an office that all had the same SSID. Just cloned the boxes (some cheap Cisco thing, can't remember the part number) and never had any issues with conflicts.

    --
    Do not mock my vision of impractical footwear
    1. Re:I've seen it work by redfox2012 · · Score: 2

      Indeed, you should be fine! A single SSID across all access points is the way to go but, as the Cisco 1040 series seem to be 802.11n your choice of channels is limited.

      Make sure you only use channel 1, 6 or 11 as the others overlap which can confuse clients; you are better off having two of your five arrays on identical channels than overlapping them. Just try to keep the access points with identical channels a reasonable distance apart, so that there is an obvious difference in signal strength.

    2. Re:I've seen it work by wgoodman · · Score: 1

      Why not get a couple routers, set up DD-WRT and use WDS. That's what it's there for and it's simple to configure.

    3. Re:I've seen it work by edrawr · · Score: 1

      Indeed, you should be fine! A single SSID across all access points is the way to go but, as the Cisco 1040 series seem to be 802.11n your choice of channels is limited.

      Make sure you only use channel 1, 6 or 11 as the others overlap which can confuse clients; you are better off having two of your five arrays on identical channels than overlapping them. Just try to keep the access points with identical channels a reasonable distance apart, so that there is an obvious difference in signal strength.

      I couldn't agree more on this. In the past I worked for a small college, and we were having terrible performance issues with a brand new Colubris (now HP) setup. After turning the broadcast power down on each of the APs, we still had clients jumping from AP to AP. After a lot of head scratching and bringing in a professional WLAN analysis contractor, we found that all of the APs were on channel 6. Adjusting them to a pattern to break this up cleaned up all of the issues for us.

      --
      Sauer
    4. Re:I've seen it work by neokushan · · Score: 1

      You adjusted the power before changing the channels? That's like...wireless 101! (However I may be biased, having worked for an ISP).

      --
      +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
    5. Re:I've seen it work by edrawr · · Score: 1

      The controller was supposed to "optimize" the channels automatically... By that it meant "default to 6" and we had to manually assign a channel to each AP.

      --
      Sauer
    6. Re:I've seen it work by neokushan · · Score: 1

      Ahhhhh yes, that does actually make more sense. "Auto" apparently means "6" in most routers.

      --
      +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
    7. Re:I've seen it work by DarwinSurvivor · · Score: 1

      Didn't anyone launch one of the thousands of free wifi analyzers out there (my phone has one ffs) and notice the huge list of 6's? In fact, some Operating Systems show you the channel right in the selection menu.

    8. Re:I've seen it work by Anonymous Coward · · Score: 0

      Why not get a couple routers, set up DD-WRT and use WDS. That's what it's there for and it's simple to configure.

      WDS allows you to use wifi to link to other routers, but bridging over a wire and using identical credentials and SSID is much better for latency, because WDS has to wait for the radio receiving the packet before it can transmit.
      Turn off WDS and run point to point ethernet between routers to replace each MAC you had in WDS, and your wireless clients will work a lot better.
      Source: I tried it and it sucked, but would work in leiu of running a wire.

      TL;DR: wifi mesh protocols solve a different problem: wifi clients on a trunk to another wifi uplink, and wifi via a wifi repeater sucks.

    9. Re:I've seen it work by edrawr · · Score: 1

      This was a few years back, we had a few applications that could give us some insight on our PCs, but there were a lot of APs (about 60 IIRC) in a relatively small building. It was hard to get a good handle on which one was where, as the applications we had were not designed to analyze the amount of spectrum we had in the building.

      --
      Sauer
    10. Re:I've seen it work by Anonymous Coward · · Score: 0

      Because WDS chews up 50% of your wireless bandwidth back-hauling what a cable can do for "free" (in terms of spectrum usage).

    11. Re:I've seen it work by Anonymous Coward · · Score: 0

      Much less work to deploy a Ubiquiti solution, as you can do all your admin and configuration for the whole network within a single interface, as opposed to having to set up each DD-WRT box individually...

  2. I thought it was standard by pclminion · · Score: 3, Interesting

    I thought that was the standard way of doing it anyway. Is it not?

    1. Re:I thought it was standard by Dishwasha · · Score: 5, Informative

      Yes, that is the biggest mistake no-name wireless installers and IT consultants (i.e. the guy installed a wireless AP in his house and now he's an expert) do with small businesses is they use different SSIDs and WEP keys for each access point. It is extremely annoying. Use the same SSID and the same WEP/WAP key for each access point. In the 802.11X standard, it is the responsibility of the wireless client to automatically determine which AP is best and automatically switch and potentially hop channels. You will want slight overlap of the wireless zones, but don't place them too far away or to close to each other. Be aware of any areas where a "firewall" is installed (not an electronic firewall, but a wall with extra insulation that protects different areas from spreading fire) and plan APs accordingly. One you place the APs with approximate locations, do a slow walk-around with your laptop and use airsnort to get signal strengths and tweak AP location before physically installing them in the ceiling or walls or wherever. A popular thing for businesses with the removable ceiling tiles is to cut a small hole in the tile and let the APs antenna(e) point downwards in to the actual normal airspace. Of course, this typically requires running power in to the crawlspace somehow.

    2. Re:I thought it was standard by DigiShaman · · Score: 2

      It will work headless using a bunch of random APs with the same SSID, but reliability is iffy at best. The point of a wired controller managing APs is so it can intelligently manage WiFi channel allocation and load based on all sorts of factors including SNR levels and channel usage overlap.

      --
      Life is not for the lazy.
    3. Re:I thought it was standard by Anonymous Coward · · Score: 0

      I do it this way with two cheap Linksys access points. Same SSID, same pass-phrase, different channels. MAC filtering enabled.

      Having to occasionally update the MAC filter list twice isn't much of a labor. Thou depending on how many access points you have and how often you have to make changes would depend on how boring that might get.

    4. Re:I thought it was standard by hawguy · · Score: 3, Interesting

      I do it this way with two cheap Linksys access points. Same SSID, same pass-phrase, different channels. MAC filtering enabled.

      Having to occasionally update the MAC filter list twice isn't much of a labor. Thou depending on how many access points you have and how often you have to make changes would depend on how boring that might get.

      Why use MAC filtering?

      It does nothing to stop someone that's interested in joining your network - if they can hack your WPA key (or steal it from someone's desk), the MAC is not an impediment at all -- it's broadcast in plain text.

      All MAC filtering does is keep honest users off your network, but if they are that honest, they probably aren't going to get on your network in the first place.

      If you're looking for security, setup a RADIUS server and use 802.1x authentication instead of PSK.

    5. Re:I thought it was standard by Anonymous Coward · · Score: 1

      I've actually had reasonable luck with AP's above the drop ceiling without putting the antennas through.

      But otherwise this is exactly how I do it. AP's are spread throughout the building, all the same SSID & WAP cred. I do use different channels in different areas, and it doesn't seem to confuse the wireless clients.

    6. Re:I thought it was standard by Anonymous Coward · · Score: 0

      bump 'er up....

    7. Re:I thought it was standard by Anonymous Coward · · Score: 1

      I use gear than can run on POE when I set up something above the ceiling tile

    8. Re:I thought it was standard by GlobalEcho · · Score: 4, Insightful

      Be aware of any areas where a "firewall" is installed (not an electronic firewall, but a wall with extra insulation that protects different areas from spreading fire) and plan APs accordingly.

      You know a website (viz Slashdot) is geeky when quotation marks have to go around the original meaning of the word firewall.

    9. Re:I thought it was standard by jfanning · · Score: 2

      Something that doesn't seem to have been mentioned explicitly is that DHCP has to be turned off on all access points/wireless routers. There must be only one central DHCP server for the entire network.

      But as mentioned, this is part of the spec. I only realised the same thing last year though, so it was nice to be able to remove my 4 different SSIDs from my home network and just use one.

      The only down side is that it isn't obvious which AP is in use by any particular device (g or n) or if any AP has died. But unless it causes noticeable problems I don't really care.

    10. Re:I thought it was standard by Anonymous Coward · · Score: 1

      Unless your company is a large international one then targeted WPA hacking is for any other purpose than free internet is probably not a concern. What you should worry about is former employees borderline psychopaths that you somehow have shown up. (You'd be surprised how often psychopaths show up in a corporate environment.)
      The kind of people that will try to actually hurt your company will probably try to get hold of the key by non-technical means, for example by stealing a binder or going through the company trash for papers or even just by contacting some new employee and trying to trick the information out of him by impersonating the IT department or whatever.
      You will generally not have to worry that much about technically competent intruders since the kind of people you want to protect the network from doesn't have the mindset to acquire the skill needed.
      MAC filtering can very will be useful to protect the network in those cases but should never be the only method.

      And yes, I work for a company that once had to deal with a psychopath in management position. Luckily this was before I joined.

      Another thing that is pretty useful is to make sure that the offsite backup is at more than one place so that no single person have the possibility to destroy it.

    11. Re:I thought it was standard by Anonymous Coward · · Score: 0

      If he's using the Cisco 1040 he can just use Power over Ethernet.

    12. Re:I thought it was standard by Anonymous Coward · · Score: 0

      I honestly thought that the controller also managed authentication (certificates and checking with a RADIUS server)?

    13. Re:I thought it was standard by anechoic · · Score: 1

      "You'd be surprised how often psychopaths show up in a corporate environment."

      funny, I thought that was where all psychopaths wind up

    14. Re:I thought it was standard by Teun · · Score: 1

      (You'd be surprised how often psychopaths show up in a corporate environment.)

      You could do some extra filtering at the door of the top floor.

      --
      "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    15. Re:I thought it was standard by Anonymous Coward · · Score: 0

      " Of course, this typically requires running power in to the crawlspace somehow."

      No. No. No. Very much a fire hazard unless materials and equipment rated for this use.

      Violates NEC (NFPA70 and 70E).

    16. Re:I thought it was standard by Thalagyrt · · Score: 1

      So, rather than useless MAC filtering, how about doing what's sane and secure: run WPA2-Enterprise and require users to use 802.1x to get on your wireless network. You're either authing user/pass against a RADIUS server (which can hit corporate AD or LDAP) or authing the client cert against an internal CA revocation list, or both. Someone leaves? Invalidate their cert and disable their account. Problem solved.

      --
      Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo!
    17. Re:I thought it was standard by hawguy · · Score: 1

      Unless your company is a large international one then targeted WPA hacking is for any other purpose than free internet is probably not a concern. What you should worry about is former employees borderline psychopaths that you somehow have shown up. (You'd be surprised how often psychopaths show up in a corporate environment.) ...
      MAC filtering can very will be useful to protect the network in those cases but should never be the only method.

      If you're worried about psychopath employees, why would you use something as ineffectual as MAC filtering when there is a much more secure method that will actually work (802.1x) to keep him out of your network?

      Would you tape a sheet over the front doorway to keep out a psychopathic employee, or would you install a security door? The sheet may keep someone out, but the security door is much more likely to do so.

    18. Re:I thought it was standard by RobertLTux · · Score: 1

      oh and btw "The Other Tower" DOES NOT COUNT for a soho biz use different zip codes (far ends of both) as you get bigger then you land up with London New York and Beijing as your backup sites.

      --
      Any person using FTFY or editing my postings agrees to a US$50.00 charge
    19. Re:I thought it was standard by jmilne · · Score: 1

      If you're looking for security, setup a RADIUS server and use 802.1x authentication instead of PSK.

      Not to get nitpicky, but it's Slashdot and we're supposed to know better. The standard is 802.1X, not 802.1x. Capital letters for stand-alone standards, lowercase for addendums to a standard. Case matters, people.

    20. Re:I thought it was standard by hawguy · · Score: 1

      If you're looking for security, setup a RADIUS server and use 802.1x authentication instead of PSK.

      Not to get nitpicky, but it's Slashdot and we're supposed to know better. The standard is 802.1X, not 802.1x. Capital letters for stand-alone standards, lowercase for addendums to a standard.

      Case matters, people.

      Welll, it doesn't really matter, except to pedants. There should never be a case (no pun intended) where two different projects differ only in the case of the letters, so no one will be confused when they look up 802.1x instead of 802.1X.

    21. Re:I thought it was standard by Anonymous Coward · · Score: 0

      The business world tends to attract more sociopaths and narcissists than psychopaths. MAC filtering as a means of stopping malicious, technically savvy former employees is a joke - if they wrote down their old MAC, and you didn't retire the machine and remove it from the wireless config, they already have a valid MAC to spoof. Of course, if you've actually secured your network properly, they shouldn't be able to access any file shares as an unauthenticated user. Heck, the wireless ideally shouldn't be on the corporate network - any enterprise environment I've been in has run it separately, right up to whatever device is connected to the ISP's equipment. The bigwigs might want their iPads to work in the office, but corporate wifi doesn't typically need to provide anything but internet access.

    22. Re:I thought it was standard by Anonymous Coward · · Score: 0

      be wary of modular furniture. quite a bit apparently has aluminum coatings to reduce the spread of fire from cubible to cubicle. obviously this is bad for wifi but good for things like bluetooth (keeps your devices from leaking into your neighbors office).

      some access points do power over ethernet which means installation really really easy. just cable tie the ap to the ceiling tile and run some plenum cat5 above the drop ceiling.

  3. Apple by Anonymous Coward · · Score: 1

    The Airport Extreme's seem to handle this fine. I setup several using the same SSID to extend the signal.

    1. Re:Apple by Anonymous Coward · · Score: 0, Troll

      Other than the painful nonstandard setup, there's nothing particularly unique or interesting about Apple's wireless hardware or its performance.

    2. Re:Apple by Anonymous Coward · · Score: 1

      Compared to most of the cheap crap you find out there, they're remarkably stable and do have high performance. I've had various Buffaloes and Linksyses, and even with various forms of WRT, they tend to die and need a reboot eventually.

    3. Re:Apple by Anonymous Coward · · Score: 1

      (Same as grandparent AC, too lazy to login)

      Your qualitative observation has no more value than mine, and my experience is that there's an Airport Extreme in my office that I have to reboot at least once a week. I've had very similar experiences with high end consumer and SOHO products almost uniformly and regardless of brand.

      Apple needing its own goofy management app with no provision for configuration by HTTP is particularly annoying though.

    4. Re:Apple by Anonymous Coward · · Score: 0

      ... and here's a mod who has clearly never had the hilarious joy of trying to configure an Apple AP when the only available devices for connecting to it are running some version of Android.

  4. Ubiquiti Wireless by Anonymous Coward · · Score: 3, Interesting

    I would highly encourage you to look at the Ubiquiti UniFi system. Software based centralized computer and basic APs are only $66. We're switching to them from Cisco and have been very happy.

    http://www.ubnt.com/unifi

    1. Re:Ubiquiti Wireless by jaseuk · · Score: 2

      They are pretty good, but really work just the same way as the OP described.

      Unifi offers a pretty convenient way to monitor and configure a larger number of access points without anywhere near the cost or infrastructure required with a controller.

    2. Re:Ubiquiti Wireless by gbkersey · · Score: 1

      Thanks for pointing Ubiquiti's UniFi system out. I use their equipment for bridging locations together and it has been really good...

    3. Re:Ubiquiti Wireless by gbkersey · · Score: 1

      Argh! Their routers / bridges run Linux. Why is this software not available for Linux?

    4. Re:Ubiquiti Wireless by Anonymous Coward · · Score: 0

      I second unifi. FWIW, I'm 'esseph' on the forum there. PM me if you need a hand.

    5. Re:Ubiquiti Wireless by TooMuchToDo · · Score: 1

      Not everything that runs on Linux is open source.

    6. Re:Ubiquiti Wireless by lebean · · Score: 5, Informative

      It's available for linux, go to the forums at their site, the UniFi section and look at any version announcement. They even have a Debian/Ubuntu repo, if you're on RHEL/CentOS you just grab a tarball and install the mongodb bits yourself.

    7. Re:Ubiquiti Wireless by gbkersey · · Score: 1

      Cool....

    8. Re:Ubiquiti Wireless by gbkersey · · Score: 1

      And your point is? My point is that I don't want to rely on Windoze for infrastructure tasks....

    9. Re:Ubiquiti Wireless by wolrahnaes · · Score: 1

      Adding another vote for UniFi. I took a shot on them because they were cheap, basically a last chance for Ubiquiti as I had been burned by a lack of support on the RouterStation Pro a few years back. So far it's turned out to be a good choice. I have two customers running six APs each who are very happy with them, another rolling out nine (they're offered in a discounted three-pack, so multiples of three are a matter of convenience).

      The "controller" package is only really used for configuration, firmware updates, and running the captive portal as opposed to a traditional wireless controller, but this means it's light on resources even though it's Java-based. It is a properly done Java app at least, and not only runs on all major OSes but even runs well on non-x86 CPUs. Pretty much any server with a bit of spare CPU power can run it, or if there isn't a server around people have run the controller on Raspberry Pi units.

      --
      I used to get high on life, but I developed a tolerance. Now I need something stronger.
    10. Re:Ubiquiti Wireless by hjf · · Score: 1

      I wouldn't hire anyone using the word "Windoze".

      You know, professionalism, yadda yadda.

    11. Re:Ubiquiti Wireless by hjf · · Score: 1

      I use their cameras. The cameras are OK (not awesome), but the management software just plain SUCKS. You can't schedule it to auto-delete old recordings! So you can't have a "set it and forget it" thing.

      But, their linux support is fantastic. I can't believe "apt-get install airvision airvision-nvr" JUST WORKED. Impressive.

      Oh, and their 900Mhz APs.. man, that is awesome. I have two locations 1 km apart with a couple 8-10 stories tall buildings right in the path, and I get a steady signal. At only 6mbit, it sucks, but that's impossible to do in other bands. And for less than $100 each!

    12. Re:Ubiquiti Wireless by epyT-R · · Score: 1, Insightful

      well, I wouldnt hire anyone citing 'professionalism' as justification for anything. Fallacious ' reasoning' is the cornerstone of passive- aggressive office politics.

    13. Re:Ubiquiti Wireless by mea_culpa · · Score: 1

      This.
      Just last month I picked up a 3-pack from newegg for like $130. Install took minutes and the system automatically configured and updated firmware as I deployed the APs.
      I was considering Cisco mainly because I wanted something reliable, but couldn't get myself to buy their software and certainly didn't want to battle IOS just for a few WAPs.

      If a portion of your building needs better coverage, add another. The Unifi software will automatically detect it and with one click 'adopt' it into your existing WAP pool.
      It really doesn't get better than this.

    14. Re:Ubiquiti Wireless by Anonymous Coward · · Score: 0

      Ubiquiti's UniFi controlller also runs on Mac if thats any consolation.

    15. Re:Ubiquiti Wireless by alucardX · · Score: 1

      I have one of their cameras in use as well. I didn't even try their program I just used ZoneMinder directly. That works pretty well actually. I couldn't do a direct video stream to the system and ended up running it through ffmpeg but it is still working well. My biggest complaint with the camera is the cheap plastic mount. If you use the camera outdoors then the wind blows the camera and causes a motion event. Other than that it's great for the price.

    16. Re:Ubiquiti Wireless by hjf · · Score: 1

      their software is actually zoneminder with a pretty skin

    17. Re:Ubiquiti Wireless by alucardX · · Score: 1

      I knew that much about it. I didn't know just how much of their software wasn't free software and actually didn't care that much to dig in and find out at the time. I might look into it some more though. I try to avoid non-free software.

  5. If I were your client... by Anonymous Coward · · Score: 0

    I would be fine with the multiple APs and single SSID but I would prefer you not deploy them with a PSK. 802.1x with a Radius implement of some sort would be a good starting point.

  6. Simple to do by Anonymous Coward · · Score: 0

    It's rather simple to do - we have 3 access points in our home. All you have to do is give them all the same SSID, and put each individual one on separate channels. Also, give each router a static IP address and remember to turn off DHCP.

    Alternatively, you can use wifi extenders.

    1. Re:Simple to do by alostpacket · · Score: 1

      Do any of your APs act as repeaters? I tried this but was having some trouble with devices on the network being able to see each other among other bizarre errors.

      --
      PocketPermissions Android Permission Guide
    2. Re:Simple to do by TerraRasa · · Score: 1

      You need to ensure that the routers are on the same subnet. Ideally you would have the routers connected to a single server/master router that runs the DHCP server and connects to either the outside world or wider internal infrastructure that's using separate subnets.

    3. Re:Simple to do by SensiMillia · · Score: 1

      Wifi repeaters were only defined for 802.11b. Many non-standard solutions exist for 802.11g and 802.11n, some of them work, some give problems.
      Anyway, one of the likely root causes is the Hidden Node problem. Make sure any access points configured to the same channel are well out of reach of each other and only use channel 1, 6 and 11.

      http://en.wikipedia.org/wiki/Hidden_node_problem
      http://en.wikipedia.org/wiki/List_of_WLAN_channels

    4. Re:Simple to do by DarwinSurvivor · · Score: 1

      Also check which channels your neighbours are using!

  7. It sorta hands off, but not by design. by Anonymous Coward · · Score: 1

    What you are talking about will work fine in smaller offices. As far as I can tell, though, there is no handover when a signal is poor, only when it is lost. The laptop will stay connected to whatever the original access point is until it can not contact it anymore. If the distance increases after initial connection and the signal becomes crappy, it won't automatically connect to a closer AP until the original connection drops completely.

    That said, Cisco does make some equipment that handles that, I believe. In my environment, I only need 2 APs to cover my building, so I decided I didn't need that more expensive solution.

    1. Re:It sorta hands off, but not by design. by Anonymous Coward · · Score: 0

      This is exactly something I've been looking for a solution to for a while. How to make a client re-associate when there is a stronger signal strength AP closer, without actually having to drop the connection to the initial access point first....

  8. Apple hardware does this by Anonymous Coward · · Score: 0

    The airport express/airport extreme will do this as well. I have a two story house and I have a airport express and two extremes all on the same SSID and password. I don't know if apple makes a windows version of the airport utility however.

    1. Re:Apple hardware does this by Anonymous Coward · · Score: 0

      They do:

      http://support.apple.com/kb/index?page=answerlink&url=http%3A%2F%2Fsupport.apple.com%2Fkb%2FDL456&answerid=16777216&src=support_site.kbase.search.searchresults

  9. Set up by Jagjr · · Score: 1

    I've set a few up and it's relatively simple. Make sure they have the same SSID - Passphrase and Security type (WPA2-PSK is what i use). Just make sure you have one doing DHCP or atleast a box on your network doing it and just kick the rest into bridge mode.

    1. Re:Set up by Anonymous Coward · · Score: 0

      My experience is that using pre-shared keys in an office with more than a couple employees is bad news. Be careful.

  10. Is there any other way? by hawguy · · Score: 3, Informative

    Is there another way to do it? I've always set office (and my home) Wifi networks up like this -- as long as the AP's are all on the same subnet, roaming among them should be fairly transparent.

    Try to use non-overlapping channels as much as possible. (i.e. channel 1 at the east end of the office, channel 6 in the middle and channel 11 at the west end). If you can't use non-overlapping channels, some tuning of power levels to prevent interference between nodes can help -- i.e. if you have a long office with 4 nodes on 3 channels: [1, 6, 11, 1] you may see better performance if you turn down the transmit levels on the two channel 1 nodes so they don't interfere with each other as much. And dual-band 802.11n can help even more both because there's more channels on 5Ghz, and because the 5Ghz signals will be attenuated more.

    In my current office, I have about 120 Wifi nodes (through a Cisco WLAN controller), all are broadcasting the same SSID.

    1. Re:Is there any other way? by Anonymous Coward · · Score: 1

      ubiquity. makes acess points that will mesh without a controller, they are cheap too (about $90 each).

    2. Re:Is there any other way? by postbigbang · · Score: 2

      You can stagger on the low bands to avoid overlapping channels, or if the machines are modern, and support N-high, then use the non-adjacent N channels for even wider, non-overlapping support. Using N-high as your propose is a great idea, and forcing users to N if their hardware uniformly supports it, will speed the hell out of the network; make sure you have sufficient backhaul for the traffic, which could get huge. Also make sure you stagger DHCP IP address ranges to help preserve sessions.

      Sadly, some RPCs will destroy sessions when you change APs, as will certain IPSec VPN-based connections during AP roaming. Session roaming often can work seamlessly, but some apps will balk, including printing/scanner/shared-network-peripheral apps and others. Have users stand still if they're using them if their sessions are getting hosed. Finish printing, then walk out of the conference room, etc.

      --
      ---- Teach Peace. It's Cheaper Than War.
  11. WDS by Raven42rac · · Score: 0

    This problem has been solved already, it's called WDS. http://en.wikipedia.org/wiki/Wireless_distribution_system

    --
    I hate sigs.
    1. Re:WDS by Anonymous Coward · · Score: 1

      This is for when the access points don't have a wired ethernet backhaul, so you can use WDS to interconnect them with wireless. From OP post it seems that he already has the APs interconnected, therefore WDS is not needed at all.

    2. Re:WDS by pjr.cc · · Score: 5, Informative

      WRONG!

      This is *NOT* what WDS was designed to do. There seems to be quite a lot of people under the impression that if you want multiple access points co-operating with one another such that clients can roam between them seemlessly, you need WDS. Not sure where that came from but its got nothing to do with that.

      WDS is about peer-to-peer AP connections such the data is travelling wirelessly between access points, and while WDS can be the "backbone" of a seemlessly-roaming SSID-consistent WiFi network, its an inherently flawed system. This is typically used for places where you need to bridge networks wirelessly when you cant put down a cable (for eg, you might have two offices across the road from one another).

      WDS will also chew up a considerable amount of wifi bandwidth doing this (and the problem gets exponentially worse as you add more AP's/clients).

      The point being though that WDS wasnt designed for the purposes of providing distributed access to a wifi network with a single SSID, but to allow AP's to also be clients to each other while still being AP's.

      Ultimately the way the guy describes his setup is the correct method of deployment, multiple AP's with the same SSID and encryption parameters, thats all there is to it.

    3. Re:WDS by parallel_prankster · · Score: 1

      Please mod parent up. The GP has no idea of what WDS is! WDS is like having 2 APs with an wireless "ethernet" connection between them in addition to regular clients. But because it uses the same radios for WDS connection and client connections you lose bandwidth.

    4. Re:WDS by Anonymous Coward · · Score: 0

      Is it a good practice to not broadcast the SSID's? Would the clients be able to switch from one AP to the next as the signal strength increases with proximity?

    5. Re:WDS by TechyImmigrant · · Score: 1

      At the time of writing the original 802.11 specification, the WDS frames were barely 'designed'. They were just a frame format with an additional address, so you could have the source, destination, transmitter and receiver addresses. There was a vague idea that you could use this for AP to AP communication in some way, but the details were far from worked out. There was no explicitly specified, interoperable description of how to use WDS frames.

      It took several years of arguing and rather daft proposals for higher level uses of WDS to get specified so they could be ignored by everyone.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  12. Already Answered by Anonymous Coward · · Score: 1

    Answered already but it is build into the protocol.

    http://superuser.com/questions/122441/multiple-access-points-for-the-same-ssid

  13. cost vs controller by Anonymous Coward · · Score: 0

    check out cloudtrax.com, the open-mesh gear might be a good candidate for you, it's cheap and pretty easy to deploy. it's also one time licensing (included in hardware cost)

  14. Old PC + pfSense by iMouse · · Score: 1, Interesting

    Why not install pfSense on an old PC (Pentium 4-class is more than enough) with a couple of NICs and the FreeRADIUS 2 module? Put the APs in bridged mode and set up 802.1x authentication.

    If you didn't want to use self-signed certs and a private CA, your only cost would be for certificate purchases/renewals. The cost is negligible if you count your staff IT hours as costing you nothing.

    1. Re:Old PC + pfSense by ProfessionalCookie · · Score: 4, Informative

      Because the power to run a Pentium 4 for 2 years would cost more than getting a modern little embedded box.

    2. Re:Old PC + pfSense by Anonymous Coward · · Score: 1

      I'm an admin with several 5508 controllers. They do a whole lot more than 802.1x authentication (hands-off coverage management, rogue detection, fast roaming w/o client reauth, etc). But on a budget, FreeRADIUS is a great solution and your 1040's will support it. It's a very bad idea to use anything except WPA2-Enterprise (essentially 802.1x with CCMP) in an office environment since TKIP is broken and using pre-shared keys is a management nightmare. 802.1x gives you the ability to grant and revoke network access based on computer or user rights. A policy as simple as allowing any LDAP (or Active Directory) computer or user account wireless access as long as their account is enabled will save you countless hours the first time you need to terminate an employee who would otherwise have knowledge (or a laptop with knowledge) of your pre-shared key. We've also had luck in our test labs using 1200 series AP's as RADIUS servers and hosting a small number of 802.1x-enabled AP's using just Windows domain controllers.

      Good luck!

    3. Re:Old PC + pfSense by pnutjam · · Score: 1

      Then get a small embedded box, there are several x86 embedded boxes that are appropriate, alix, soekris, or something beefier with VIA or Atom. I like netgate for my embedded devices, but pfsense has some other hardware resellers listed.

      --
      Cheap storage VM.
  15. even google has nothing about this by Anonymous Coward · · Score: 0

    just tried "wireless network multiple access points" on google and no information at all :(

    ... I'm kidding ! :)
    http://superuser.com/questions/122441/multiple-access-points-for-the-same-ssid
    http://www.dummies.com/how-to/content/wireless-network-routing-with-multiple-access-poin.html

  16. One SSID Different Channels by Anonymous Coward · · Score: 1

    afaik you need to choose one SSID and one password for all the access point, but you should configure them to different channels so they dont interfere with each other. With this setup the client should choose automatically the best access point and roam to the next when he moves to another room.

  17. Clients are a pain by Anonymous Coward · · Score: 0

    Part of the wireless standard is the clients chooses what ap they connect to, this maybe improve with updating the wireless drivers. High capacity wireless can have problems also make sure your Cisco AP are channel stage as in one is channel 1 the next one is channel 6 the next its channel 11 it's will help with SNR the only company I know that can fix a lot of these problems is Meru where the whole system can run single channel and makes decisions on the clients behalf but it needs s controller to do this.

  18. If you're already spending big money on Cisco... by Anonymous Coward · · Score: 0

    ...Cisco stand-alone 1040 AP's then set one as the master and configure the others as wireless repeaters. I did that to the first floor of our office building and now roaming between APs is working much smoother than when they were all wired up as individual APs bearing the same SSID. It's almost as good as having Cisco LWAP AP's with a wireless controller.

  19. Options by Anonymous Coward · · Score: 0

    Maybe Apple AirPort(s) managed via MacOS X Server?

    If even that is out of budget, maybe look at OpenMesh? http://www.open-mesh.com

  20. WDS is a security risk by Anonymous Coward · · Score: 0

    from the wiki:

    Dynamically assigned and rotated encryption keys are usually not supported in a WDS connection. This means that dynamic Wi-Fi Protected Access (WPA) and other dynamic key assignment technology in most cases cannot be used, though WPA using pre-shared keys is possible.

    This is due to the lack of standardization in this field, which may be resolved with the upcoming 802.11s standard. As a result only static WEP or WPA keys may be used in a WDS connection, including any STAs that associate to a WDS repeating AP.

    WPA and WEP are thoroughly broken and are not even an option if you care at all about security, the state of WiFi security in this decade is a fricken joke.

    1. Re:WDS is a security risk by Raven42rac · · Score: 1

      Well that's a whole other discussion, 120 similarly configured access points is worse, IMHO.

      --
      I hate sigs.
    2. Re:WDS is a security risk by Anonymous Coward · · Score: 0

      if you care at all about security, the state of WiFi security in this decade is a fricken joke.

      This is my favorite line. My view is that if you cared about security, you wouldn't be broadcasting your network in the first place.

    3. Re:WDS is a security risk by Mabhatter · · Score: 1

      Not broadcasting SSID only saves you from "casual" hacks... Anybody with a wi-fi detector program is going to know you HAVE Wi-Fi signals... They don't need SSID to crack them anymore.

  21. Aruba AP's by Anonymous Coward · · Score: 0

    We have a dozen Aruba AP's deployed w/ a virtual controller which floats between the various AP's. the AP's are a bit pricy $600, however I have no complaints supporting close to a 100 clients in our small environment.

  22. Re:If you're already spending big money on Cisco.. by Anonymous Coward · · Score: 0

    I believe this is the preferred Cisco method, or something similar.

  23. PowerCloud by Anonymous Coward · · Score: 0

    Check out PowerCloud (see, http://powercloudsystems.com). They will do what you want at a very reasonable fraction of the cost of a Cisco or Aruba system. They can even provide replacement firmware for a few APs mentioned in the thread.

  24. look into mesh networking by Anonymous Coward · · Score: 0

    check out meraki gear. they pretty much are using routerboards running busybox (or were, at least) to create a wireless mesh network. if meraki doesn't look proper, i'd generalize a bit and look around for other mesh networking gear. you pretty much hang access points, including a base station, connect your uplink for the wan on the base station, and the other ap's act as extenders for your wan.

  25. Unifi by ProfessionalCookie · · Score: 5, Informative

    If the only think keeping you from a controller based solution is cost try Ubiquiti's Unifi. You can run without a controller and if you need one you can use any old embedded box. http://www.ubnt.com/unifi

    1. Re:Unifi by Anonymous Coward · · Score: 3, Informative

      This guy has it. I think the Unifi setup rivals the cost of their other ap's, too, like the Bullet M2 HP and the PicoStation (best outdoor AP for the $). Even better is that as of AirOS 5.5, multiple VLANs are supported. This gets a bit whacky thanks to their vague user-manual and uninformative GUI but is well worth it given the cost and good customer service. It takes some playing around with to understand how they do the VLAN tagging.

      To properly configure client roaming between the AP's, simply name them all with the same SSID and scale their power output to have about 10% overlap. This will give allow the client's to make the best decisions when roaming from one AP to another but also helps conserve your client's battery life. Be sure to keep adjacent AP's on separate channels.

      Jeremy Cioara does a good job of explaining this in his CCNP Switch series over at CBTNuggets.

    2. Re:Unifi by mokomull · · Score: 2

      This is only marginally different from separate access-points, though. Their "controller" is only for management -- it doesn't do anything for helping users roam between the APs, for instance. You need actual enterprise-class equipment if you want that.

    3. Re:Unifi by Nimloth · · Score: 4, Informative

      +1 for Ubiquiti Unifi. I run the controller on my Macbook, the APs are spread across several locations and some locations have several. Roaming is seemless, quality and features are impressive and they are dirt cheap. 3 packs are 250$, that comes to about 85$ / AP. The controller is included and there is no license to pay or recurring fees.

    4. Re:Unifi by ArhcAngel · · Score: 1

      Came to recommend this. It is dead easy to set up and it works better than I expected it to. I set up multiple SSIDs for different business units and an open hotspot for our guests that is isolated from the rest of the network. The ability to add an office layout is nice if you are adding more than a couple of hotspots and don't remember where HS249 is located. I haven't found anything close at this price point.

      --
      "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    5. Re:Unifi by Anonymous Coward · · Score: 0

      you dont need the controller software to let users roam from one unifi ap to another
      the controller software is just for initial management and for web portals for login. other then that the system handles itself quite nicely if it has to restart due to power or network outage as each AP stores its configuration and waits for changes from the management pc/ip

    6. Re:Unifi by Anonymous Coward · · Score: 0

      +1 Unifi.

      We have ~85 APs across a 10 acre Campus. Separate SSIDs on separate VLANs. Works great, cost effective, free management software.

    7. Re: Unifi by kd4zqe · · Score: 1

      +1 for UniFi! I'm using unifi for a public internet project in my town. Instead of the usual stock UniFi APs I'm using their Picostation M2HP with the available alternative firmware what ports it to UniFi operation. They're cheap and weather proof and offer a bit more range than the basic APs. They continue to operate if the controller goes offline with the only downside occurring that captive portal functions don't work. If you can deal with that you'll have a robust system that can notify you of offline hardware and usage metrics on a per machine basis, giving you plenty of flexibility as an administrator. VLAN support is nice and it can help a lot with ensuring privacy against unauthorized users.

      --
      You're not paranoid if they really ARE out to get you...
    8. Re:Unifi by cthulhu11 · · Score: 1

      I bought a single one for home use based on a couple of recommendations. My wife's Macbook Air, Kindle Fire, and iPhone randomly drop the connection. This didn't happen with our older Airport Express.

    9. Re:Unifi by Anonymous Coward · · Score: 0

      Roaming is NOT seamless for Ubiquiti. The controller is only for management.

    10. Re:Unifi by Anonymous Coward · · Score: 0

      Bullshit. We have a mixture of D-Link and Cisco Wi-Fi routers (not even proper access points) distributed around our offices and configured to behave like dumb access points. They all have the same SSID and password, they're just operating on separate channels. Roaming works fine on all devices we care about.

  26. Check out these OpenWrt forum posts by Anonymous Coward · · Score: 0

    One of my hobbies is messing around with dd-wrt and OpenWrt on various hardware platforms. At home, I have 6 APs in use (3 on 2.4GHz and 3 on 5GHz). I've found that wireless clients will not roam between APs even when all are configured with identical SSID and encryption settings. The clients tend to stay connected until the AP is completely gone, even if you're 10ft from another AP (unless you cycle the radio off/on so it starts looking for the best AP again). So I did some research and found you could build an OpenWrt image that would allow the APs to communicate and deassociate the client when the signal is better elsewhere, but this requires some real messing around. I gather this is where Cisco gained some check marks for Cisco clients roaming between Cisco APs.

    https://forum.openwrt.org/viewtopic.php?id=10353
    https://forum.openwrt.org/viewtopic.php?id=26290

    So you can do this for free but it requires some moderate geekery.

  27. Extended wireless networks do this, no? by Anonymous Coward · · Score: 0

    I thought this was inherent in, for example, extended wireless networks (e.g., Airport Extreme / Time Capsule plus Airport Express(es)).

  28. Without a controller by Kernel+Kurtz · · Score: 2

    the options are limited. You can use the same SSID on the various APs (separating channels as mentioned). So long as the clients are all on the same vlan (usually a DHCP scope), it will work reasonably well. Most of the protocols are fairly forgiving. If you have WDS capability, by all means use it.

    802.1x adds complications, but if you have a RADIUS type server a WLAN controller should be a more realistic consideration.

  29. Aruba makes controller less APs up to 16 units by Anonymous Coward · · Score: 0

    We are replacing our 12 Cisco APs that have a 4400 wireless controller with 16 Aruba IAP 105's.
    they are really cool devices. You can run multiple ssid's if needed and they all pull their info from 1 AP.

  30. Ubiquity Networks by NicholasPoore · · Score: 1

    Ubiquity networks provide a product line that are centrally managed and support up to 4 SSID's per access point / network. The management software is a little messy, however the access points are less that $100 each, and come with PoE injectors and mounting brackets for wall mount, or ceiling mount. A really nice clean product.

    1. Re:Ubiquity Networks by Anonymous Coward · · Score: 0

      I just bought a 3 pack of their UniFi AP's for home for approx $250. Easy to set up and get running quickly and they provide a pretty decent speed boost over the Cisco home crap I'd bought previously.

  31. I've done this very successfully with DDWRT by Anonymous Coward · · Score: 1

    I'm running this configuration in a small office right now with two WRT-54GL routers running DDWRT.

    Really great setup, and works seamlessly as I go back and forth between the two offices.
    One of the wireless units acts as the router, the other acts as simply an access point and forward's it's traffic to the router over an ethernet cable.
    Super simple to setup, the only trick is to make sure that the two units are on different channels.
    The cost for both units was less than $100 and the hardest thing was having the building super route the ethernet cable through the ceiling.

    Good luck

  32. You did good. by Anonymous Coward · · Score: 0

    All WiFi base stations on the same subnet (routing disabled except for the one unit that is connected to broadband; often done by turning off DHCP), each unit has the same SSID, each unit has the same encryption (WPA2 preferred), and each unit has the same password.

  33. It'll Just work..... by RedLeg · · Score: 5, Informative
    It's part of the standard, and I know, cause I helped write it.

    Set the SSID the same for each AP. Set them on different channels so that the AP's don't "step on" each other's bandwidth. Roaming is a station-side (client in common usage) decision, so your PCs will automatically pick the AP with the best signal strength.

    As far as authentication goes, this all depends on the AP. All should support PSK (preshared secret keys, aka passwords) and in that scenario, set them all to the same value on each AP. The PSK should be at least 24 characters long, and the SSID for the net unique to keep the security at acceptable levels and reduce the possibility of offline dictionary attacks against the PSK.

    Assuming the APs support it, Enterprise grade authentication with individual per-user passwords is within reach at little to no cost. You can tie into Active Directory or set up a free AS (Authentication Server) using FreeRadius on a linux box. The definitive reference for doing this with an MS server is a book titled "Deploying Secure 802.11 Wireless Networks with Microsoft Windows". Make sure you check for updates to the book online, and there is an appendix which details how to set it all up in a lab environment, which will let you prove principle without screwing with the production network.

    Google around and you will find loads of information on how to do this with Open Source, the key articles being some from Linux Journal from about 6-8 years ago.

    Hope this Helps......

    1. Re:It'll Just work..... by Anonymous Coward · · Score: 0

      It's part of the standard, and I know, cause I helped write it.

      A-HA! There's the culprit!

    2. Re:It'll Just work..... by kriston · · Score: 1

      Perhaps you can help clear up a debate that has been happening on and off for years.

      Is it really necessary to space the channels so far apart? It seems to be a conventional wisdom that flies in the face of the intent of the standard. Sure, the spectrum does overlap somewhat, but isn't the protocol and the air interface designed to handle this situation gracefully?

      It sure does in the city where we have multiple APs coming in five-by-five on each and every channel.

      Thanks in advance!

      --

      Kriston

    3. Re:It'll Just work..... by TechyImmigrant · · Score: 2

      It's part of the standard, and I know, cause I helped write it.

      A-HA! There's the culprit!

      It's not just him. I was there as well. The difference is that over several years roaming IEEE 802, I managed to remove more text from the specs than I added. This is probably my biggest contribution to society.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    4. Re:It'll Just work..... by TechyImmigrant · · Score: 1

      Perhaps you can help clear up a debate that has been happening on and off for years.

      Is it really necessary to space the channels so far apart? It seems to be a conventional wisdom that flies in the face of the intent of the standard. Sure, the spectrum does overlap somewhat, but isn't the protocol and the air interface designed to handle this situation gracefully?

      It sure does in the city where we have multiple APs coming in five-by-five on each and every channel.

      Thanks in advance!

      The collision avoidance protocol works most efficiently when the devices sharing the spectrum are on the same channel. Having to content with partially overlapping interferes is not going to improve the spectrum usage.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    5. Re:It'll Just work..... by hcs_$reboot · · Score: 1

      Just a humble question since you seem to know the standards: if all APs have the same SSID but have each a different MAC address (which of course is the case by default), won't the clients require to enter the (same) password for each AP?
      Or in other words, is the SSID enough to ensure an AP "unicity"? (and having all APs with the same SSID makes clients "believe" they access the same point)

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    6. Re:It'll Just work..... by Anonymous Coward · · Score: 0

      So the original poster here who worked on the protocol says set the APs on different channels and you, who also worked on the protocol, say that you shouldn't do that because the collision detection protocol works best if you don't? I'm confused!

    7. Re:It'll Just work..... by nateb · · Score: 1

      Client sees the same network it was just on on a different channel and tries the same credentials. Bingo, everything works! Problem solved from that perspective..

      --
      -- Nate
    8. Re:It'll Just work..... by Maow · · Score: 1

      Perhaps you can help clear up a debate that has been happening on and off for years.

      Is it really necessary to space the channels so far apart? It seems to be a conventional wisdom that flies in the face of the intent of the standard. Sure, the spectrum does overlap somewhat, but isn't the protocol and the air interface designed to handle this situation gracefully?

      It sure does in the city where we have multiple APs coming in five-by-five on each and every channel.

      Thanks in advance!

      I am not expert, but I do believe that the channels are kept apart by as much as possible because any given channel can use enough bandwidth to overlap a couple channels next to it. Hence having as big a gap allows best utilization of each channel.

      Wikipedia's Wifi Limitations section explains it better:

      A Wi-Fi signal occupies five channels in the 2.4 GHz band. Any two channels numbers that differ by five or more, such as 2 and 7, do not overlap. The oft-repeated adage that channels 1, 6, and 11 are the only non-overlapping channels is, therefore, not accurate. Channels 1, 6, and 11 are the only group of three non-overlapping channels in the U.S.

    9. Re:It'll Just work..... by TechyImmigrant · · Score: 1

      Set the APs on non-overlapping channels or the same channel. That's what the original poster meant by 1, 6 and 11.
      1 - 11 represent frequency slots, but the signal bandwidth is much wider than one slot.

      A transmission centered on channel 4 would overlap with a transmission centered on channel 6 for example.

      1, 6 and 11 correspond to the low, high and middle frequencies of the 2.4GHz unlicensed band.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    10. Re:It'll Just work..... by Anonymous Coward · · Score: 0

      If that is what works best, then why set the standard to have 11 overlapping channels, why not just the group of three non-overlapping ones?

    11. Re:It'll Just work..... by TechyImmigrant · · Score: 1

      The standard has been through many amendments and revisions with numerous different physical layer specifications of varying bandwidth. So a fine grained frequency specifier is appropriate to work with all RF phys (there was one IR phy).

      Really the question should be why present users with the low level frequency channel number as a choice in a user centric UI? Why not just ask 'low, middle or high' and map it to 1, 6 and 11 for 11b or 11n on 2.4GHz unless they switch on 'advanced' mode.

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    12. Re:It'll Just work..... by aled · · Score: 1

      It's part of the standard, and I know, cause I helped write it.

      A-HA! There's the culprit!

      It's not just him. I was there as well. The difference is that over several years roaming IEEE 802, I managed to remove more text from the specs than I added. This is probably my biggest contribution to society.

      I was going to say that RedLeg comment was very cool but yours is awesome ;-)

      --

      "I think this line is mostly filler"
  34. Google. by Anonymous Coward · · Score: 0

    Why anyone would bother to post such an utterly basic question on here and why it would get posted is beyond me.

    If you spend 20 seconds on google you wouldnt need to post stuff that took over a minute to write and then who knows how many minutes to wait for a response that helps you. Basically you took atleast an hour to find something out you could have discovered within just a few minutes on google. Or hell, here is an idea, call cisco. Most companies have support for their products that can be helpful to you.

    So Ill go with the old addage "google it". Or do you always need constant hand holding?

    1. Re:Google. by Anonymous Coward · · Score: 0

      Because Google will tell you if it can be done, and how it can be done, but /. gives you feedback from people that have done it. That can be important when trying to convince the Boss something is a good, or bad, idea.

  35. Aruba by Anonymous Coward · · Score: 0

    its worth looking at the controller-less or virtual controller options from Aruba, they are very cost effective and very easy to deploy.

    1. Re:Aruba by pjr.cc · · Score: 1

      I work with Juniper and Cisco on no-wifi, and for the last 18 months we've been doing wifi with aruba too... couldn't agree more, they're quite fantastic and gained something of a reputation for doing wifi well (well deserved IMHO).

  36. One SSID is best practice. by Above · · Score: 5, Informative

    Controllers came well after AP's were invented, so people had to solve this problem for years without them as an option at all. Multiple AP's sharing the same SSID and key is exactly how the standard was designed, and was the best practice for deployment for many years. The short answer is, it works great, and is how you should be deploying.

    For the long answer, you have to understand what happens when a user needs to switch AP's, and how the controllers improve that process. When a client wants to switch from one AP to another it must dissociate from the first, associate with the second which includes exchanging new session keys, gratuitous ARP to inform the L2 network, and then carry on. This process typically takes between 100-500ms, depending on the client, AP, and random luck. For most users doing most things this is all fine, if you're browsing the web and chatting on IM it's a non-issue.

    However, for some clients like VoIP phones and video chat a 100-500ms pause is a disaster. Enter the controller solution. The WiFi protocol was divided between things that require hardware (transmitting at the right time, rf modulation, etc) and things that were all in software, just on the AP like exchanging key material. The hardware kept doing the hardware things, but the software activities were moved to the controller. The advantage is that the entire session does not need to be torn down, the radio can switch AP affinity (BSSID) while using the same key material since the key material is tunned back to the controller from both AP's. A client can now switch AP's in 10-50ms, which for most VoIP apps and video conferencing means seamless connections.

    Note to the pedantic: yes, there are some other details, controllers enable triangulation features and some other RF analysis, there are a few protocol nits I omitted, and this omits a lot of important design considerations like proper AP placement and channel selection.

    Now, go back to the requirements. If you don't deploy WiFi VOIP phones, and don't have other real time streams, controllers may be a total waste of your money. If the goal is to get users e-mail and web access when sitting in the conference room or courtyard, vendors are selling something not needed when they push controllers.

    Second note to the pedantic: Controllers can make networks scale better, so if you're deploying 25+, or more likely 100+ AP's my previous paragraph doesn't apply, but that's not what most people reading this are doing.

    So to the OP, yes, put them on the same channel. For less than 10 AP's with no real time requirements it is the best practice, and a perfectly valid way to deploy a WiFi network. A controller may be able to get some advanced features (auto-channel management, threat detection, triangulation), but in most small businesses they are features that would rarely if ever be used. There are thousands of WiFi networks deployed without controllers that work quite well. Do read a good document on how to place AP's and select channels, you'll want to use non-overlapping channels in a grid pattern and try and get it to where clients can always see 2-3 AP's, no more, no less.

    If you really want a controller, there are some lower cost options than the big players. Ubiquity has a nice solution in their UniFi line, and Netgear now offers an appliance based controller. Aruba has several mid priced offerings. They don't all have the features of say high end Cisco gear, but offer a lower cost solution.

  37. Today I understand Wonko the Sane by Anonymous Coward · · Score: 0

    This right here is my instructions on a box of toothpicks. The fact that they come in several vendor defined languages only serves to reinforce the painful insanity here.

    There is no way setting up an n APs, with n ESSIDs, and n keys will ever be a better solution performance-wise than n APs, with 1 ESSID, and 1 key.

    This will hold true whenever n is constant across both scenarios, and those APs are otherwise configured the same.

    This isn't to say that this would be a great solution above a particular density (power density, station density, bandwidth density, whichever crosses the line first), but that line isn't necessarily easy to define. Just mind your design, output, power and channel plan.

  38. Why? by Lumpy · · Score: 1

    Why write off a proper wireless network right away?

    http://www.ubnt.com/unifi I can put in a 4 AP managed system with a cheap PC as the controller for less than the cost of ONE stand alone Cisco AP.

    Plus it's better quality that anything you can buy from Dlink, Cisco, etc...

    --
    Do not look at laser with remaining good eye.
  39. DHCP Server? by Anonymous Coward · · Score: 0

    I am not seeing in the oft-repeated scenario here of multiple AP's with the same SSID and pasword/key how DHCP serving is managed.
    Would each AP be a DHCP server for whichever client connects? Should each offer an IP from a unique range within the same subnet? Any other guidelines related to that?

    TIA

    For a nice little channel range checker, consider the "Wifi Analyzer" Android app (maybe it has iOS version, too?). It has a nice graphical display of strength of multiple AP's within range, and the channels they use. On an Android tablet or phone with good wifi hardware it is much more convenient than lugging a notebook PC around.

    HTH
    --
    RO

    1. Re:DHCP Server? by chris234 · · Score: 2

      Generally you'd want to use some other device for DHCP, probably your router in a SOHO setup.

  40. Aruba Intstant by Anonymous Coward · · Score: 0

    We use a product from Aruba Networks called Aruba Intant AP for wireless access at our offices. They call it "controllerless" but really you configure the first AP with SSID and security settings then just plug more APs into the same network and they auto-configure and adjust to minimize interference. If the controller AP goes down the other APs elect a new controller and service continues uninterrupted. It is for small deployments (I think a max of 16 APs) but has worked well for our purposes (WiFi bar code scanners, several laptops and some WiFi printers).

  41. Couple of other points about controllers.. by pjr.cc · · Score: 1

    as everyone's stated, what you've done so far is correct.. IMHO, controllers are well worth the money - though shop around, cause (again, IMHO) juniper and cisco are way too expensive for what they are.

    What a controller will give you is a unified simple way of managing it all. I.e. configure it in one spot rather then every AP. They also often include things like portals, authentication services and firewalls. I.e. a central CA for using certificate based auth, a captive wifi portal for open access points that go to the internet or stuff like that.

    Where that becomes GREAT is trying to debug stuff, when you get past 4 AP's it starts to get a little tedious making sure every AP is configured correctly (i.e. same SSID, same authentication info), and gets really hard to maintain channel separation effectively. Alot of controller based systems will distribute the channels well based on the topology of your AP network, and that is very handy.

    All of this is doable manually, what a controller can do that you cant do anywhere else is force handoff from one AP to another. AP Clients typically head for the closest AP based on signal strength alone and that can get a little annoying because you'll often end up with several AP's that are flooded and others that are barely used, controllers can manage that and push clients off one AP and tell them to use a different one.

    The other bit that is mighty hard to do with out a controller is running multiple SSID's from the same AP's connected to different networks (and often the firewall in the controller plays a part in this too). It can be handy in some situations to have a "visitor" SSID thats open access but only gets internet along side an "internal" SSID that gets on your internal network and maybe authenticated via certificates. Controllers handle that very well.

  42. Mod Parent Up by laing · · Score: 1

    Also be sure to use channels that are spaced far enough apart so as to not interfere at all. (E.g. 1, 6, & 11)

  43. I did it with cheap Linksys APs once... by trparky · · Score: 1

    I did it with cheap Linksys APs once. All I did was to see the SSID to be the same on all three Linksys APs but with different channels broadcast channels. I was then able to seamlessly transition from one AP to the next hoping from one to the other with no issues.

  44. PC Cost vs electricity dependent on country by vgerclover · · Score: 1

    Because the power to run a Pentium 4 for 2 years would cost more than getting a modern little embedded box.

    It is in some countries with heavily subsidized electricity and high import tarifs.

  45. Does it work mixing G and N access points? by Anonymous Coward · · Score: 1

    If an office network mixes brands, models, and 802.11g access points with 802.11n access points, is it still best practice to have them share SSIDs?

  46. It just works by manu0601 · · Score: 1

    Multiple AP with same SSID just works, and moving client switch from an AP to another smoothly. You just have to take care about channels used by your AP: try to have as few overlap as possible.

  47. How do you load balance without a controller? by Anonymous Coward · · Score: 0

    One of the things that worries me is that people walking around in a way that gets them to overload a single AP. Let's say that the normal limit of an AP is 25 to 30 clients. In this case, how do I make sure that a client chooses an AP based on signal, but that existing connections/load of an AP is also taken into consideration.

    1. Re:How do you load balance without a controller? by Mabhatter · · Score: 1

      Narrow halls and small conference rooms? That only hold about 25 people... Hmmm

  48. You are able to install a controller based Wi-Fi.. by PhunkySchtuff · · Score: 1

    I am not able to install a controller based Wi-Fi solution in my office due to cost...

    Yes, you are.

    Check out UniFi by Ubiquity Networks - they're cheaper than you think (in the same ballpark as premium consumer wifi gear) and the controller is a software instance you can run on just about anything. Management is through a web browser and is dead easy.

    The wifi networks have great throughput, the Pro access points have 3x3 MIMO, and they're stable and reliable.

    You also get some other good features, such as traffic analysis and reporting, a captive portal for guests that can either use tickets (generated in the controller software) or via a PayPal gateway if you want to start charging people for access and plug-and-play for adding new APs to the network.

    Disclaimer - I have deployed a number of Ubiquity networks for my clients, and they're all working successfully.

    --
    Specialist Mac support for creative pros, Melbourne
  49. Name-brand controller alternatives. by Anonymous Coward · · Score: 0

    If you're not up to controller scale, Aruba Networks has a little system called "Instant" which may meet your needs. Several APs essentially talk amongst themselves and one of them is designated as a virtual controller for the others (with some contingency for failover if that one goes down). You still get good enterprise-grade APs that can handle tens of clients each without failling over, and it looks like they've substantially expanded the line of equipment that this is offered for. Worth a look?

    Alternatively, Meraki, if you're willing to buy their whole "cloud-managed" side of things.

  50. Aruba instant by papouxgallant · · Score: 1

    Why not considering using Aruba instant solution? http://www.arubanetworks.com/products/instant/

    1. Re:Aruba instant by johu · · Score: 1

      In my opinion this is only good solution proposed so far. With Instant one gets most benefits of controller based solution without actually purchasing controller.

    2. Re:Aruba instant by Anonymous Coward · · Score: 0

      I agree. I put a comment pretty close to this saying to try the aruba IAP-105's but I can't find it anymore..

      We are switching from our cisco 4400 wireless controller to the IAP AP's. They are awesome! Check them out! Well worth the investment.
      You won't get good quality antenna's with any linksys/home product.

  51. Open-Mesh by Kyn · · Score: 1

    We've started using Open-Mesh https://www.open-mesh.com/ . It's cloud controlled which means the AP require internet access. It's also a mesh so it can be used for areas without a network connection or the mesh can continue working in the event a line does dead. For our budget conscious clients it definitely fits the bill.

  52. If you still looking for a cheap controller by ltjohhed · · Score: 1

    You could have a look at FortiWifi ( http://www.fortinet.com ).

    A FortiWifi that acts both AP and controller and additional Forti AP's to get the coverage needed.

    --
    All generalizations are false
  53. Why can't afford? by AlchemyX · · Score: 1

    You can try ubiquiti solutions. They provide controller which you can install on any PC (Linux or Windows) and run cheap APs. We do it for our hotspots and it works great

  54. Aerohive by Anonymous Coward · · Score: 0

    Nobody has mentioned Aerohive yet so I thought I would throw it in there. Aerohive make the best controller-less access points and they are a great fit for branch offices.

  55. OpenWRT by SkunkPussy · · Score: 1

    Use OpenWRT assuming you have compatible wifi routers, then you can set up seamless single-SSID with ease.

    --
    SURELY NOT!!!!!
  56. Aruba Instants by Anonymous Coward · · Score: 0

    Have a look at these - virtual controller APs - first one installed acts as a master and copies setup to any other APs it finds.

    With POE, adding more APs is a two minute job

    Good luck

  57. Good solution with could management: MERAKI by Anonymous Coward · · Score: 0

    We have upgrade our office wifi to Meraki: trouble free, all centrally managed and professional not overly expensive hardware
    I think they have recently been bought my Cisco

    And no, I do not work for Meraki or Cisco or any other tech company ;-)

  58. Correct answer is... by OneWordReply · · Score: 1

    Post-it.

  59. Re:One SSID is best practice.- make a channel plan by Anonymous Coward · · Score: 1

    I'm with you right up to using the same channel. Hell no! This is suicide. Avoid co-channel interference.

    Lay out your wifi install and figure out your channel plan. Survey for placement. I have several sites where RRM did a horrid job, and I've had to statically assigned channels to get performance up. Cisco design docs are available, google is your friend.

    While WPA2/PSK works, and I use it at home for a 3 AP network, you actually can get faster roaming using 802.1X with key caching between APs.

    Many clients do not fast roam. They drop and reassociate. This can lead to performance issues, but you can't solve it at the AP. it is a clien side issue. I've worked with Dell/Broadcom to fix drivers roaming issues plaguing our fleet deployment, and it is a pain. Finding a USB stick adapter that roams well is very hard.

  60. Zyxel has several options by Anonymous Coward · · Score: 0

    I've installed something like this on some hotels and hospitals with Zyxel NWA-3160, they are very good, and allow for decent VOIP Roaming between AP.
    One Ap is configured as the master controller and replicates settings and logons on all the others,it's also farly quick with roaming computers and VOIP Handsets.

  61. Apple APs. by aMMgYrP · · Score: 1

    I actually did something like this a couple of years ago with Apple Extreme APs and pfSense. Apple Extremes & Expresses both have the built in ability to create a homogenized network. Set them in bridge mode and have pfSense handle the firewall/DHCP/DNS stuff. easy peasy. I did a building with 5 floors and 3-4 APs per floor for about $4000. Plus Apple extremes will happily run in the plenum and can be managed from a central location and single program interface.

  62. Ruckus by Anonymous Coward · · Score: 0

    I'm surprised that nobody has yet mentioned Ruckus wifi systems.

    But since the OP already has the Cisco Aironet AP-1040 access points, the best way is to set one as master and the rest as wireless repeaters, as was mentioned earlier. Make sure you set the channels differently on each (1,6, 11) and don't re-use channels on APs that are too close physically to each other.

    Use a central DHCP server. I use a pfSense box for mine.

  63. Not Really That Difficult by beerdragoon · · Score: 1

    This really isn't that difficult and you can do it on the cheap if wireless isn't critical to your small business. Just buy 1 wired router with a built in DHCP server, and 4 or 5 wireless ones. Unless you need them to be powered by PoE, I wouldn't bother with the Cisco Aironet APs, just buy some cheap Linksys/Cisco wireless routers. Once you have all that, setup your wired router to connect to your network and then configure the wireless routers in the following way:

    1. Disable the WAN/Internet interface on each one, you won't need it.
    2. Give each one a static IP inside your network on the LAN interface (for example: 192.168.1.200 - 192.168.1.205) with a gateway equal to the LAN IP of your wired router (for example: 192.168.1.1).
    3. Set each wireless router to have the same SSID, encryption, password and channel (disable automatic channel selection).
    4. Connect one of the LAN interfaces on each wireless router back to your network.

    Because all your APs have the same SSID and password, the wireless clients should automatically connect to the one with the strongest signal strength. Your connection may temporarily drop if you are downloading a file and start walking across the office but for most people this solution should work. If you require monitoring, use a ping script or network monitoring tool to make sure all the APs are up. PRTG is actually free for less than 10 sensors so I'd recommend that if you don't already have one.

  64. Re:One SSID is best practice.- make a channel plan by Above · · Score: 2

    Oh crap, totally missed that in my proof reading. It should have said "put them on the same SSID", not channel.

    I 100% agree that a proper channel plan is necessary using non-overlapping channels. And you're right that 802.1x caching can help.

    Folks, mod up, not down the AC post I'm replying to, he's right and I made an important typo.

  65. Aerohive by Anonymous Coward · · Score: 0

    Check out Aerohive. They have very affordable branch office products, and you get a wireless IPS, too.

  66. Controllerless solutions by Anonymous Coward · · Score: 0

    Aruba has a controllerless solution which is mainly for remote offices or store wifi (think starbucks). They provide an ability to have multiple access points broadcast the same SSID. Also they communicate together wirelessly to simulate a "controller" which makes office installations lower cost.

  67. I currently do this at home with ddwrt by Anonymous Coward · · Score: 0

    Works great for me. Had shaky coverage in one half of the house, so I put in another (older, g only) router on the same wired network as a bridge, and if I wanted to, I could use WPA2 enterprise and use RADIUS authentication with LDAP or whatnot for extra auditing and even bandwidth quotas per user (eg, admins have first dibs via laptop). This type of infrastructure can be setup on the wired ports if needed as well, so you can have complete auditing in the event someone puts up a rouge AP on your wire, and even succeeds (hey look who's login credentials got that router in!), and prevents the average idiot from even succeeding (but I need pandora, so I needed to put my ipod on a wireless router!).

    TL;DR: YMMV, but it works for me, with 2 consumer routers running ddwrt and bridge mode, and also WPA2 enterprise is pretty cool.