Network Design · Logical Architecture

SSIDs, VLANs, authentication, RF plan, WAN and switch port map for the 530.62 sqm floor — 2 SSIDs (guest optional, default off) over 5 VLANs on 7× U7 Pro XGS, terminated on a USW-Pro-XG-10-PoE and a reused UCG-Fiber. WAN is now decided: RISE Ded-100 + PLDT BB-200 dual-WAN in load-balance (§4). Physical placement and the coverage model live on the 2D Plan page.

2+1 opt

SSIDs broadcast

VLANs (2 no-SSID)

~375 peak

Concurrent clients

5 Gbps

UCG-Fiber IDS/IPS

1 · SSID / VLAN plan

SSID	Authentication	Bands	VLAN	Subnet	Policy
SWC-Corp MLO	WPA3-Enterprise — 802.1X EAP-TLS via Entra ID (PPSK fallback, see §2)	5 + 6 GHz	20	10.20.20.0/23	Managed devices only; /23 because 150 staff × 2–3 devices ≈ 400 addresses — a /24 would exhaust
SWC-Guest optional	WPA2/WPA3 PSK rotated monthly — no portal (see §5)	2.4 + 5 GHz	30	10.20.30.0/24	Optional locked guest — default OFF. If enabled: client isolation, internet-only, 10/10 Mbps cap, schedule-limited
SWC-IoT	WPA2-PSK	2.4 GHz	40	10.20.40.0/24	Printers, meeting-room TVs; allow CORP→IoT (printing), deny IoT→CORP
— (no SSID)	Wired / management only	—	10	10.20.10.0/24	APs, switch, gateway UI. Never broadcast.
— (no SSID)	Reserved	—	50	10.20.50.0/24	Future UniFi Protect CCTV, no internet egress

Why so few SSIDs Day one broadcasts only 2 (SWC-Corp, SWC-IoT) — SWC-Guest is staged but off by default per the client's no-guest decision. Every SSID beacons per band, per AP, at the lowest basic rate — pure airtime tax. UniFi itself hard-caps at 4 SSIDs per band with meshing enabled (meshing is off here — all APs wired), and community consensus is to stay at ≤ 3–4. VLANs do not need their own SSID: RADIUS (802.1X) and PPSK both assign VLANs per user on a single SSID. verified

2 · Authentication

802.1X EAP-TLS tied to Entra ID CONFIRMED — client 2026-07-02

The prerequisite is now verified: all ~150 staff are on company-managed, Intune-enrolled laptops — so per-device certificate auth is a GO. The company runs M365/Entra + Intune + Tactical RMM with no on-prem AD, so password EAP (MSCHAPv2) cannot work against cloud-only Entra. Certificates are the path:

Intune Cloud PKI add-on issues per-device certs — ~$2/user/mo (₱0 if already on Intune Suite — verify licensing) verified
RADIUSaaS (~€1.50/user/mo up to 275 users) speaks RadSec direct to the UCG-Fiber — TLS-encrypted RADIUS to the cloud, no on-prem VM to build or patch verified
Certificates auto-revoke with the Entra account — offboarding kills WiFi access the same hour as e-mail

Indicative opex at 150 users: PKI ≈ ₱17,400/mo + RADIUSaaS ≈ ₱14,550/mo estimate

Fallback: PPSK day-one bridge, migrate after

Still staged for day one even with EAP-TLS confirmed: if subscription procurement slips past the office opening, launch SWC-Corp on per-user PPSK (private pre-shared keys): free, native UniFi, per-key VLAN assignment, works with every client type. Migrate to EAP-TLS once PKI + RADIUS are live.

Never launch on a single shared corporate PSK
PPSK offboarding is manual (150 keys, no Entra tie) — acceptable as a bridge, a credential-exposure risk if it becomes permanent
Note: the UCG-Fiber's built-in RADIUS only authenticates local UniFi user entries — it cannot validate against Entra, so it is not a corp-WiFi IdP verified

3 · RF configuration

AP	Location	5 GHz	6 GHz	2.4 GHz
AP1	Open-plan North	36 / 40 MHz	80 MHz PSC	off
AP2	Open-plan Center	149 / 40 MHz	80 MHz PSC	ch 1, low
AP3	Open-plan South	44 / 40 MHz	80 MHz PSC	off
AP4	Conference Room	60 / 40 MHz, low	80 MHz PSC	off
AP5	South Amenity reused	153 / 40 MHz	80 MHz PSC	ch 6, low
AP6	Reception / Entrance	157 / 40 MHz	80 MHz PSC	off
AP7	North Block / Meeting	64 / 40 MHz	80 MHz PSC	ch 11, low
GLOBAL		min-RSSI −75 dBm · band steering prefer 5/6 GHz · MLO on SWC-Corp · min basic rate 12 Mbps (2.4) / 24 Mbps (5) · TX power Medium (open-plan) / Low–Medium (meeting cells) · meshing off (all APs wired)

Regulatory anchors — DFS and PH 6 GHz 5 GHz is anchored on non-DFS channels 36 / 44 / 149 / 157: Mactan-Cebu International Airport sits ~10 km away and DFS radar hits are plausible — a hit forces an AP to vacate its channel mid-day. AP4/AP7 use DFS 60/64 as low-power in-room cells where a rare hit is tolerable; swap to non-DFS if events show up in logs. 6 GHz in the Philippines is the lower 500 MHz only (NTC MC 002-07-2024) — plan 80 MHz PSC-aligned channels, do not expect the full 1200 MHz that US documentation assumes. 2.4 GHz broadcasts from only 3 of 7 APs (ch 1/6/11, low power) to avoid self-interference.

4 · WAN & gateway — decided client 2026-07-02

Two lines, both already in the Johndorf Tower riser

Primary — RISE Dedicated 100 Mbps (₱36,864/mo ≈ €534, VAT-ex) → SFP+ / 10GbE WAN on the UCG-Fiber (per RISE's handoff). Symmetric, SLA-backed DIA.
Secondary — PLDT Broadband 200 Mbps (₱4,500/mo ≈ €65) → 2.5GbE WAN2. Deliberately not dedicated — cheap and contract-light; the PLDT I-Gate lock-in traps that killed a dedicated backup are dissected on Vendors §6.
Total recurring ≈ ₱41,364/mo ≈ €599/mo (VAT-ex).
Open question for the building: do the two feeds share a riser duct? Path diversity is unverified.

Dual-WAN policy: load-balance, not pure failover

UCG-Fiber multi-WAN in load-balance (distributed) mode, both links active
Real-time classes pinned to RISE — Teams/Zoom/Meet, VoIP, VPN ride the dedicated SLA path
Bulk spills to PLDT BB-200 — OS/app updates, cloud sync, streaming, large transfers
Either line down → all traffic converges on the survivor automatically
5G CPE demoted to optional: with two diverse wired lines already in the riser, a 5G CPE (~₱8,000 estimate) is only a nice-to-have day-one bridge if installs slip — no longer a design requirement.

Bandwidth reality check — 100 Mbps dedicated is thin for 150 heads. Our demand model for a video-heavy 150-person office estimates 500–720 Mbps aggregate peak. RISE Ded-100 alone is ≈ 0.67 Mbps per head, and ~40 concurrent Teams calls (≈ 80–100 Mbps) saturate it by themselves. The load-balance split is the mitigation — real-time stays on the clean dedicated path while bulk rides the 200 Mbps broadband — but it is a mitigation, not headroom. Monitor per-WAN utilization through the first month; if RISE sustains >70–80% at peak, take the upgrade path: RISE Dedicated 200 at ₱57,600/mo (+₱20,736/mo) — a plan change on an existing circuit, not a new build.

UCG-Fiber capability check verified

5 Gbps IDS/IPS throughput · zone-based inter-VLAN L7 firewall, 55,000+ signatures · rated 500+ clients / 50+ UniFi devices · 2× 10G SFP+, 1× 10GbE RJ45 WAN, 4× 2.5GbE · native RadSec · multi-WAN load-balance with policy-based routing (how real-time gets pinned to RISE). This site is 9 UniFi devices and ~375 peak clients — full IPS at line rate with ample headroom over the combined 300 Mbps WAN. Do not also route a future second floor through it (client ceiling).

Single point of failure — accepted, mitigated One gateway, one switch, one primary WAN; the UCG class has no HA pairing. Mitigation: (1) keep the old-office gear as cold spares instead of selling — a cloud-restore onto a spare is hours, a PH re-order is days; (2) weekly .unf config backup exported off-box via a TRMM job, on top of (3) Ubiquiti cloud backups tied to the site; (4) MFA enforced on the Ubiquiti account (hardware key for admins). A replacement gateway restores the full network config (same-or-newer UniFi OS).

5 · Switch port map — USW-Pro-XG-10-PoE

Port	Type	Assignment	Notes
1	10GbE PoE++	AP1 — Open-plan North	Trunk: native VLAN 10, tag 20/30/40
2	10GbE PoE++	AP2 — Open-plan Center	Trunk, as port 1
3	10GbE PoE++	AP3 — Open-plan South	Trunk, as port 1
4	10GbE PoE++	AP4 — Conference Room	Trunk, as port 1
5	10GbE PoE++	AP5 — South Amenity (reused unit)	Trunk, as port 1
6	10GbE PoE++	AP6 — Reception / Entrance	Trunk, as port 1
7	10GbE PoE++	AP7 — North Block / Meeting	Trunk, as port 1
8	10GbE PoE++	Spare drop C8 (conference room)	Patched, port disabled until used
9	10GbE PoE++	Spare — wired printer(s)	Access VLAN 40
10	10GbE PoE++	Spare — meeting-room TV	Access VLAN 40
SFP+ 1	10G SFP+	UCG-Fiber uplink	DAC (UACC-DAC-SFP10), trunk all VLANs
SFP+ 2	10G SFP+	Spare	Future second switch / NAS

PoE budget: 7 × 29 W nameplate = 203 W of the switch's 400 W (51%). This is exactly why the original 8-port idea fails — the USW-Pro-XG-8-PoE's 155 W budget locks the design at 5 APs. Full comparison on the Hardware page.

Guest WiFi — decided: none client 2026-07-02

The office ships with no guest SSID — the earlier voucher-portal design is dropped. Recommendation: keep it that way, and only if reception later demands one, enable the pre-staged locked-guest variant:

Own VLAN 30 (10.20.30.0/24) — already reserved in the plan above, SSID default OFF
Client isolation + internet-only firewall (no route to VLANs 10/20/40/50)
Bandwidth cap 10/10 Mbps per client, schedule-limited to office hours
WPA2/WPA3 PSK rotated monthly — no portal, no vouchers, no visitor data collection

Compliance: portal and data collection dropped → NPC/DPO obligations under RA 10173 are not triggered by the WiFi.

6 · Firmware & management policy

Firmware

Official release channel only — never Early Access in production
APs + switch: auto-update window Sunday 02:00 PHT
Gateway: manual update after a 2-week soak on the release

Remote access

UniFi Site Manager (unifi.ui.com) for remote multi-site management — no inbound port-forwards
MFA enforced on the Ubiquiti account; hardware key for admins
Local-only fallback admin kept in the vault

Monitoring hooks

Site Manager alerts webhooked into the existing Teams channel
TRMM job archives the weekly .unf export off-box (existing Tactical RMM stack)
XGS dedicated spectral-analysis radio → per-AP RF interference visibility from day one

Sources & data

UCG-Fiber / U7 Pro XGS / USW-Pro-XG-10-PoE: techspecs.ui.com · SSID & PPSK/RADIUS VLAN behavior: help.ui.com · Cloud PKI pricing: learn.microsoft.com/intune/cloud-pki · RADIUSaaS + RadSec: docs.radiusaas.com · RA 10173 + IRR: privacy.gov.ph · PH 6 GHz: NTC MC 002-07-2024 · WAN decision: client ISP price matrix + answers batch (2026-07-02), PLDT I-Gate proposal docs/pldt-igate-proposal-jun2026.pdf. Full source list, propagation model and vendor quotes: knowledge base. Raw dataset: data-raw/network-architecture.json (2026-07).