Changing multi tenant building from individual copper to centrally managed fibre

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Changing multi tenant building from individual copper to centrally managed fibre

wratterus

1687 posts

Uber Geek

#252933 17-Jul-2019 17:35

Got an interesting potential project, just wanted to bounce this off the Geekzone community as I've not done something quite like this before and may be either over thinking it, or missing out something vital. 😀

Looking at an assisted living location, approx 12 rooms. Currently each room has Cat5 (not cat5e) run from a central location, patched through with an old school copper frame setup, and each resident pays for their own copper phone & internet connection.

They are wanting to change to Fibre - as this is one building, Chorus do not seem at all keen on installing an ONT in each room, which I think is fair enough.

They're wanting each room to have it's own segregated LAN/wireless, so people can have wireless printers, chromecast etc, and also provision for IP phones (so a physical connection is sort of required for that to be reliable).

What I was thinking of proposing was the following:

Firstly do a test with an 802.3af injector & a UniFi AC in wall AP, with something connected using PoE passthrough on the longest cable run to confirm that the cat5 will actually work OK. Does anyone have experience with how far you can push cat5 in this situation? As long as it does, thinking of the following, not in this specific order obviously.

Install a network cabinet where all the cat5 is currently connected to that frame, and terminate this to a patch panel.

Get Chorus to install fibre to this location. (Looking at a Spark Business 200/200 plan)

Install a USG and a 16 Port UniFi PoE switch in the cabinet, and a UniFi AC in-wall AP in each room, replacing the phone jacks that are there currently. Obviously we'd carefully manage AP power levels and channels on the wifi side. No matter what we do there it can't possibly be worse than a standard modem in every room probably broadcasting flat out with 40MHz channels on 2.4GHz which I bet is what's happening now. 🤮

The in wall APs can pass through 802.3af, so they could power an IP phone too if that is desired - would keep the cabling super nice and tidy.

That part (assuming the cat5 is OK) I'm very happy with - the segregation is a bit more complex. I've got very minimal experience with VLANs, but what I hope to be able to do with the UniFi gear is as follows:

Each AP will be assigned it's own VLAN - hoping to be able to tie both ethernet ports and the wireless on each AP to the same VLAN. This would mean each room would essentially have it's own segregated LAN, but with normal communication so chromecast, wireless printing, file sharing etc etc would all work normally and nobody is printing to someone elses printer for example.

That's something I need to do more research on to see if it's possible - I'm sure it should be but am not familiar enough with VLANs & also using the UniFi gear for this purpose.

Any comments or suggestions very welcome.

Thanks!

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2278523 17-Jul-2019 17:46

Hi, just dealing with the top level issue first, cat5 is good for GigE up to 100m, sometimes, depending on the exact cable and installation quality, however if we are talking runs < 60m then no worries should be good for GigE, and it will do 100Mb/s to full 100m without issues.

Cyril

chevrolux

4962 posts

Uber Geek
Inactive user

#2278532 17-Jul-2019 17:57

So firstly, I wouldn't use a USG or Unifi switch for something like this - they are just far too basic. Hardware wise, no issues, but the Unifi software just simplifies things waaaay too much when you actually need a bit finer control on things.

Your plan of a separate VLAN per room is a good, although slightly admin intensive (for just 12 rooms though, probably a non-issue). Doing a different SSID on AP is also fairly admin intensive in the Unifi software, but again, probably not too bad for 12 rooms. The issue arises though when someone moves out of that room. They will still know the wireless password and therefore still have access to that LAN. So is the plan change that password every time someone moves out of the room? While it is a nice thought to make stuff like Chromecast and all that work, it may be a better idea to have a properly controlled hotspot network with a RADIUS server for user management.

If it was me, I would go Mikrotik router (RB4011 is a good pick these days) with User Manager, and a Mikrotik CRS 24-port PoE switch.

Last thing to bear in mind, with those Unifi in-wall AP's, last time I used them the switch ports were unmanaged. So whatever the default VLAN on the wire connecting it is what appeared on the switch ports - fine if you want the AP and wire to be on the same network, but very useless if you want to connect an IP phone on a separate VLAN.

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2278538 17-Jul-2019 18:11

Hi sorry got called away hence stopped at the cabling bit, but I agree with Sam, an RB4011 ia great device, deployed a few of them. 12 individual networks firewalled from each other will do just fine.

Cyril

wratterus

1687 posts

Uber Geek

#2278579 17-Jul-2019 19:46

Thanks guys. Management of SSIDs and passwords not really an issue in this case, and 12 (or so) is not a lot to keep on top of.

Thanks for the suggestion of the Mikrotik gear. My knowledge of RouterOS is certainly not the best but that could well be a better option than the UniFi equipment.

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2278580 17-Jul-2019 19:51

Hi, the UniFi inwall APs are appealing and can be easily intergated with a RouterOS core, but maybe also consider the far far cheaper Mikrotik inwall device

https://mikrotik.com/product/wsap_ac_lite

Not used one myself, but with a level4 licence you could look at doing distributed routing on these for each room.

Cyril

chevrolux

4962 posts

Uber Geek
Inactive user

#2278604 17-Jul-2019 21:09

I didn't even know about that product. Looks great! And being routerOS you will have control of the switch ports which is great for deploying a voice VLAN for IP phones.

I guess you can also use mikrotik's CAPsMAN for deploying them - never used it myself but it's designed for central management of AP's.

BarTender

3607 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2278621 17-Jul-2019 21:50

My personal view is supportability. Do you want to support this solution for the long term? I personally think going down the Unifi path "should" be fine, as really you want to keep it simple.

12 VLANs, SSID per VLAN only terminated on one AP, no routing between VLANs only outbound to the internet. The Cloudkey is pretty easy to setup and leave instructions on how to change things including controller / device patching and remote management.

Having a fully managed setup with User Management etc sounds like overkill as again who is going to support this long term? When things break / fall over.

I would think a document with screenshots showing how to change the SSID Password whenever people move in or out would be sufficient if you wanted to keep it simple and not need to come in every time things need to change and provide tech support.

Another option would be to look at a small DSLAM and run VDSL to each room. That way it is the responsibility of each person to manage their own VDSL router.

The thing I think you're really underestimating in complexity is the phone. There is a metric ....load of complexity there which I don't think you have even thought about especially since you're going to be dealing with sick / older folks.

Are people going to have personal emergency alarms (such as ST Johns or someone else).
Do the residents have "special" phones such as the ones able to talk bluetooth / proprietary protocols to hearing aids that they use on the POTS PSTN line.
Any other life supporting medical equipment that is / could be connected over the PSTN phone which may or may not play nice over VoIP.
And any of the above that could force the resident to fork out significant dollars to move from their current POTS PSTN solution to a Mobile solution.

As you are dealing with people in assisted living situation you would have to expect that. If there is a chance that someone could die if the system you are installing stops working then you better think about layers of redundancy including but not limited to Mobile switch over in the event of fixed broadband loss, SMS alerting, UPS monitoring, periodic messages to an external system indicating the system is fine so if it stops raise an alarm, ability to remotely power cycle all components independently without losing remote management and monitor their state via out of band / Mobile data .... the list goes on.

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

JeremyNzl

359 posts

Ultimate Geek

#2278626 17-Jul-2019 22:17

For 200m runs of POE & Data,

Mikrotik Gper https://www.gowifi.co.nz/cabling/gper.html

I have a Ubiquiti powerbeam on the end of 200m syncing at gig drawing 7w

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2278649 18-Jul-2019 07:59

chevrolux:

Last thing to bear in mind, with those Unifi in-wall AP's, last time I used them the switch ports were unmanaged. So whatever the default VLAN on the wire connecting it is what appeared on the switch ports - fine if you want the AP and wire to be on the same network, but very useless if you want to connect an IP phone on a separate VLAN.

They've supported VLANs on the individual ports for probably at least a good 2 1/2 - 3 years. The feature appeared not long after the original inwall hit the market.

There are limitations though - they can only be an access port with PVID for example and can't be be trunk port to accept tagged VLANs. Without true trunk port and and CDP support it means there are limitations.

wratterus

1687 posts

Uber Geek

#2278806 18-Jul-2019 11:27

Thanks very much everyone for the comments. BarTender brings up some very good points, although we have actually covered most of that, I possibly should have gone into a bit more detail in the original post.

All the cable runs are well under 100m. Think the longest would be around 65m - this is essentially multiple rooms in the one building.

All the St John alarms etc would be changed to mobile based before the copper is disconnected, so there would be no reliance on the internet connection itself for anything vital in that way. The management at the site are organizing all of that and are aware of what needs to happen there.

We wouldn't be officially providing a phone service for each unit- it would more be that the option to use a VoIP phone would be there - or possibly an ATA if someone wants to use one of the fancier phones as you mention.

We can obviously offer to assist people with porting their number over etc when they move in (if they want to keep their same number) but that would be done on a case by case basis and charged directly to the individual, not as part of some ongoing support.

It's definitely something that wants to be as hands off as possible, so the Mikrotik User management thing is probably not so appealing in this case.

I am quite familiar with the UniFi ecosystem, and it does provide a very nice centralized management interface to see whats happening - regardless I would need to do some research & testing with VLANs etc as it's an area I've not got good knowledge in.

Really appreciate all the comments though there's a lot of very helpful information! Thank you.

trig42

5816 posts

Uber Geek

ID Verified

#2278811 18-Jul-2019 11:32

How does Chorus normally do an MDU for fibre?

Can they not install an ONT for every apartment in the comms room, and use the existing copper to get from ONT to a router in those apartments. Then the tenants can choose their own ISP and plan?

This may be not how Chorus do things, hence my first question.

chevrolux

4962 posts

Uber Geek
Inactive user

#2278814 18-Jul-2019 11:35

trig42:

How does Chorus normally do an MDU for fibre?

Can they not install an ONT for every apartment in the comms room, and use the existing copper to get from ONT to a router in those apartments. Then the tenants can choose their own ISP and plan?

This may be not how Chorus do things, hence my first question.

Yep normally they would stick an ONT in every room. But they charge for the privilege.

"Hey Mr Customer, pay me $50k to install my network, that I own and will continue to profit off for many years to come".

wratterus

1687 posts

Uber Geek

#2278816 18-Jul-2019 11:40

chevrolux:

Yep normally they would stick an ONT in every room. But they charge for the privilege.

"Hey Mr Customer, pay me $50k to install my network, that I own and will continue to profit off for many years to come".

I wasn't involved in that part of the conversation but think that's about how it went.

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2278824 18-Jul-2019 11:46

trig42:

How does Chorus normally do an MDU for fibre?

Can they not install an ONT for every apartment in the comms room, and use the existing copper to get from ONT to a router in those apartments. Then the tenants can choose their own ISP and plan?

This may be not how Chorus do things, hence my first question.

Un fortunately that topology is not what is done, instead each apartment has to have fibre to it and an ONT installed.

Cyril

BarTender

3607 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#2279497 19-Jul-2019 10:47

Some further thought about this. Are you really sure that a per room solution where each network is isolated?

You could always keep it super simple and put APs in the hallway so then everyone would have coverage across the whole complex.

Then have a central switch that runs to outlets in each room if people needed Ethernet outlets and run PoE AP or other devices in each room if something special is needed. Then add a specific SSID for that individual.

That way it's kept even simpler.