Connect. Secure. Manage.
Guest Wi-Fi Network Design
Design Cisco or Meraki guest wireless with a separate traffic path, clear access limits and capacity that does not undermine staff connectivity.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Guest Wi-Fi network design establishes how visitors connect, where their traffic goes and which systems remain outside their reach. MCI Network Services prepares Cisco and Meraki guest-network designs for offices, campuses and multi-site organisations. The deliverable connects the visitor experience to the addressing, firewall, identity and operational decisions needed to support it, rather than treating a separate SSID and an internet connection as a complete security boundary.
Coverage and capacity
Design Wi-Fi around the spaces, devices and traffic that depend on it.
Secure access
Align authentication, segmentation and guest access with the wider network.
Measured performance
Validate roaming, interference and user experience instead of relying on signal bars.
Define the access requirement and responsible teams
We identify the intended visitors, expected numbers and applications they need to use. Internet-only access is distinguished from contractor or partner access to selected internal services. Those exceptions may need a different policy or onboarding process. The design records the business owner who can approve them, avoiding an informal arrangement in which a network engineer must decide which external users deserve corporate access.
Reception, facilities, security and IT responsibilities are agreed where relevant. A guest service may require sponsorship, support and account expiry, not just technical operation. The design should explain who performs those tasks and what happens outside normal staffing hours. This keeps the proposed visitor journey realistic and prevents the customer from adopting a workflow that depends on an operational role nobody actually fulfils.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Select an appropriate network boundary
We compare the supported forwarding options for the customer’s Cisco or Meraki architecture. Local internet breakout, a separate guest subnet or centralised termination can each have a place, depending on the sites and security model. The choice is documented with its dependencies and consequences, including where routing, address translation and inspection occur.
The design explicitly addresses access to internal networks and management services. Wireless client isolation is not treated as a substitute for those controls. We identify the permitted destinations and the enforcement points that block everything else within the agreed scope. Where shared services are necessary, such as a portal or resolver, their access is defined narrowly rather than broadly opening the guest network to a corporate segment.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Plan addressing, DNS and onboarding together
Client addressing must fit the selected forwarding model and expected demand. We review scope capacity, lease behaviour, gateway placement and the path to the intended resolver. These dependencies are included in the design so visitors do not reach a welcome screen only to lose access when the next stage of the connection requires a missing service.
Onboarding is selected for the actual audience. A simple visitor service and a sponsored contractor process have different requirements. Where a captive portal is used, we consider certificates, browser behaviour and the permitted pre-authentication path. The project does not assume that a portal proves identity or that accepting terms authorises every subsequent use of personal information. The customer’s approved process and privacy wording guide the implementation.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Design useful capacity and controlled coexistence
The guest load is assessed alongside corporate wireless demand. We consider busy meeting areas, events and periods when many devices arrive at once. Radio coverage, airtime and upstream internet capacity are evaluated together. A bandwidth limit cannot compensate for a fundamental coverage gap, and a fast internet circuit does not remove contention among clients sharing a congested channel.
The number of wireless services is kept purposeful. Different visitor groups may justify separate treatment, but every additional SSID should have a clear reason and an owner. We also consider how the guest service coexists with voice, collaboration and operational devices. The design should preserve the priority of business-critical applications without making ordinary visitor use so restrictive that staff routinely bypass the intended process.
Specify acceptance tests before installation
The acceptance plan follows a fresh visitor from discovery through onboarding and normal application use. It includes representative device types and checks expiry or withdrawal where required. We also test the prohibited paths that define the security boundary. A guest reaching the internet is only half the outcome; the design must demonstrate that the access they should not have remains unavailable.
Operational failures are considered explicitly. The customer needs to know what happens when a portal, resolver, sponsor process or internet link is unavailable. Any fallback must be approved and constrained, not an improvised shared password that removes the intended controls. Test results identify what was demonstrated and what could not be exercised safely, giving the operations team a realistic picture of the service’s limitations.
Produce a design that can be maintained
The handover includes the topology, access policy, addressing plan, onboarding process and named responsibilities. It also records the information collected by the workflow and the technical settings needed to support the approved retention and access arrangements. Future changes can then be reviewed against a known design rather than made through isolated dashboard edits with uncertain consequences.
MCI can take the design into implementation or provide an independent review of an existing guest wireless service. Where centralised Cisco controller termination is appropriate, guest anchoring can be assessed within the same project. Share the site layout, visitor groups and access expectations so we can define a service that is welcoming to users and precise about the boundaries it must preserve.
Technical references
- Deny Local LAN wireless firewall settings — Cisco / Cisco Meraki
- Wireless client isolation — Cisco / Cisco Meraki
- Guest and internal wireless network configuration — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.