Hardening a busy clinical Wi-Fi network without breaking 100+ devices

The challenge

What needed fixing

The main staff Wi-Fi was running older security settings, guest Wi-Fi was being used by staff for streaming, and the 2.4 GHz band was congested (high airtime use and retry rates).

My approach

What I did, in order

1. Modern security without dropping legacy devices

   Moved the staff network to WPA2/WPA3 transition mode with Protected Management Frames (PMF) set to optional, so newer devices get WPA3 and older ones keep working.

2. Tested Fast Roaming, then rolled it back

   Enabled 802.11r Fast Roaming. About 50 legacy clients dropped, so I rolled it back right away and ~105 clients recovered. I kept it off and documented why.

3. Locked down guest Wi-Fi

   Applied a 10/10 Mbps speed limit, a business-hours-only schedule, and traffic rules blocking streaming.

4. Fixed 2.4 GHz congestion

   Set a minimum data rate and lowered transmit power so the band stops carrying slow, far-away clients.

5. Investigated with DPI, planned the next step

   Used deep packet inspection to see what traffic was really on the network, and planned a dedicated IoT network next.

Architecture

Sanitized diagram

What I learned

Takeaway

Test changes on a live clinical network with a rollback ready. Security settings have to work with the oldest device on the network, not just the newest.