Contents

Wired Network Best Practices

This section provides suggestions on how to deploy a wired network infrastructure to support a high performance 802.11ac wireless deployment for enterprise environments.

AP Power Requirements

Not all WatchGuard APs have the same power requirements. Some models, such as the AP125, are fully functional with standard Power over Ethernet (PoE, 802.3af). For most deployments, we recommend you install switches that support PoE+ (802.3at), even if you currently do not have plans to deploy an AP that requires PoE+. The use of PoE+ switches enables you to support Wave 2 APs.

AP325 and AP420 models must use full PoE+ power or be connected to a power adapter for the third WIPS scanning radio to be fully effective. Lower PoE power results in reduced performance and effectiveness of WIPS scanning and intrusion prevention functions.

In addition, make sure that LLDP-capable switches provide appropriate PoE+ power for AP420 devices:

  • You must enable LLDP on the switch
  • Disable static allocation of maximum power of 30W (if previously configured)

AP Power Requirements

Model

Description

Recommended Use

Power

Notes

AP120 (Legacy model)

Dual radio, 11ac Wave 1, 2x2, Indoor

Low density / throughput areas

PoE

Fully functional with PoE

AP320 (Legacy model)

Dual radio, 11ac Wave 1, 3x3, Indoor

Medium to high density / throughput areas

PoE

Fully functional with PoE

AP125

Dual radio, 11ac Wave 2, 2x2, Indoor

Low density / throughput areas

PoE

Fully functional with PoE

AP322

Dual radio, 11ac Wave 1, 3x3, Outdoor

Outdoors

PoE+

Requires PoE+

AP325

Tri-radio, 11ac Wave 2, 2x2, Indoor

Low / medium density / throughput areas

PoE+

Requires PoE+

AP327X

Dual radio, 11ac Wave 2 2x2, Outdoor

Outdoors

PoE+

Requires PoE+

AP420

Tri-radio, 11ac Wave 2, 4x4, Indoor

High density / throughput areas

PoE+

Requires PoE+, LLDP enabled on switches

AP Uplink Capacity

In lab tests, the dual band throughput of 802.11ac Wave 1 APs has exceeded 1 Gbps. The maximum theoretical data rate in the 5 GHz band is 1.3 Gbps (802.11ac 3x3). In the 2.4G Hz band (802.11n 3x3) it is 450 Mbps.

In production, throughput rarely exceeds the 1 Gbps barrier. With Wave 2 APs, such as the AP420 that supports 4 spatial streams with a combined maximum data rate of 2.3 Gbps (1.7 Mbps for 5 GHz and 600 Mbps for 2.4 GHz), it is likely that throughput in a production environment can exceed the 1 Gbps throughput barrier in some use cases.

Link Aggregation

WatchGuard recommends that you enable this feature in a device template so that you can connect two Ethernet cables to each supported AP and a compatible switch with link aggregation enabled. The AP can then load balance upstream traffic across an aggregated 2 Gbps connection. Both links should use CAT6 Ethernet cabling.

AP Cabling

At a minimum, 802.11ac APs require Cat5e cables.

For fully 802.11ac Wave 2 deployments, we recommend that you deploy Cat6a cables because Wave 2 APs have Ethernet ports that support rates greater than 1 Gbps.

Cable Category Reference

Cable Category

Max Data Rate

Bandwidth

Max Distance (Meters)

Max Distance (Feet)

Cat 5

100 Mbps

100 MHz

100 Meters

328 Feet

Cat 5e

1 Gbps

100 MHz

50 Meters

164 Feet

Cat 6

10 Gbps

250 MHz

50 Meters

164 Feet

Cat 6a

10 Gbps

500 MHz

100 Meters

328 Feet

Cat 7

10 Gbps

600 MHz

100 Meters

328 Feet

Access Network Uplink

You must correctly design the switching infrastructure to take full advantage of the increased throughput capacity of 802.11ac APs. To make sure that there are no network bottlenecks, you must correctly size the network from the access and distribution switches to the core switch.

Diagram of network uplinks for core and access switches for wireless deployment

Here is a summary of the recommended uplink capacities for 802.11ac wireless networks:

  • 1 Gbps for Wave 1 APs to the access/edge switch
  • Consider 2 x 1 Gbps for Wave 2 APs to the access/edge switch
  • 10 Gbps from the access switch to the distribution switch
  • Consider dual-homed/redundant 10 Gbps uplink between the access and distribution switches
  • Multi-homed/redundant 10 Gbps between core switches

VLAN Design

With WatchGuard Wi-Fi Cloud, it is not necessary to tunnel traffic through VLANs to a wireless controller located in the core of the network. This enables you to configure VLANs at the access switch layer of the network.

In this example, each building has a unique VLAN configured for SSID-1. You can restrict a VLAN to a single building to reduce the amount of broadcast and multicast traffic in the VLAN, and enable seamless roaming in the building.

Diagram of VLAN deployment for a wireless network

Jumbo Frames

With the enhanced frame aggregation capabilities in the 802.11ac standard, the switching network must support jumbo frames to benefit from frame aggregation. If Jumbo Frame support is not enabled end-to-end in your network, fragmentation can occur in the network path, which can adversely affect performance. 

Summary of Wired Network Recommendations

This table provides a summary of the recommendations for your wired network.

Feature

Minimum

Recommended

Notes

AP Power

PoE

PoE+

AP322, AP325, AP327X, and AP420 devices require PoE+

LLDP enabled on switches for AP420

AP Uplink Capacity

1 Gbps

Consider 2 x 1 Gbps for link aggregation

 

Ethernet Cabling

Cat5e

Cat6a

 

Access Network Uplink Capacity

10 Gbps

2 x 10 Gbps

Multi-homed / Fault Tolerant

VLAN Design

Wireless network VLANs on access switches

Route at the distribution layer

 

Jumbo Frames

A-MPDU and A-MSDU frame aggregation enabled on APs

Enable support for Jumbo Frames throughout the entire switching infrastructure

 

QoS

Make sure all switches, from access switches to core switches, honor QoS tags

Deploy switches and routers that support Application Visibility and Control (AVC)

 

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search