Skip to main content

Bandwidth Management and Quality of Service (QoS) in Co-Working Spaces

An authoritative technical reference guide for IT managers, network architects, and venue operations directors on implementing robust Bandwidth Management and Quality of Service (QoS) frameworks in co-working environments. This guide details network segmentation, traffic prioritisation, vendor-neutral configurations, and real-world ROI metrics to deliver enterprise-grade connectivity. It covers IEEE 802.11e/WMM standards, VLAN design, per-user rate limiting, and troubleshooting strategies with measurable business outcomes.

📖 8 min read📝 1,823 words🔧 3 worked examples3 practice questions📚 8 key definitions

Listen to this guide

View podcast transcript
[Theme Music: Upbeat, modern corporate electronic music fades in, plays for 5 seconds, then fades under the speaker's voice.] Hello, and welcome to this Purple Technical Briefing. I'm your host, a Senior Solutions Architect here at Purple, and today we are diving deep into a topic that is absolutely critical for anyone operating a modern shared workspace: Bandwidth Management and Quality of Service, or QoS, in Co-Working Spaces. If you're a venue operations director, an IT manager, or a CTO at a co-working brand, you already know this: in 2026, the single most important amenity you provide isn't the artisanal coffee or the ergonomic chairs. It is the Wi-Fi. But here's the catch: co-working spaces present one of the most volatile and high-density RF environments in existence. You have hundreds of users, all with different devices, running completely unpredictable workloads — from high-stakes video conferences to background database syncs, and yes, even personal cloud backups or streaming. Without a robust, multi-layered QoS and bandwidth management strategy, your network will suffer from bufferbloat, your tenants will experience dropped video calls, and ultimately, they will walk out the door and terminate their leases. Today, we're going to give you the exact technical blueprint to prevent that from happening. [Transition] Let's start with a technical deep-dive. Why does a standard network setup fail in a co-working space? It comes down to a phenomenon called bufferbloat. When a user on your network starts a large file upload or download, standard network switches and routers try to buffer as many packets as possible to maximise throughput. But in doing so, they create a massive queue. If another user on that same network tries to make a Zoom call, their highly latency-sensitive voice and video packets get stuck behind those massive file transfer packets. The result? Jitter, high latency, and a dropped call. To solve this, we must implement Quality of Service, or QoS, across both the wired and wireless layers of your network. At the wireless layer, QoS is governed by the IEEE 802.11e standard, commonly known as Wi-Fi Multimedia, or WMM. WMM replaces the standard first-come, first-served wireless access with Enhanced Distributed Channel Access, or EDCA. This system prioritises wireless frames into four distinct Access Categories: Voice, Video, Best Effort, and Background. To make this work, you must enable WMM globally on all your access points. But that's only half the battle. As those prioritised wireless packets hit your access point and enter the wired network, their WMM tags must be mapped to Layer 3 Differentiated Services Code Point, or DSCP markings. Voice packets are tagged as Expedited Forwarding, while video is tagged as Assured Forwarding, or AF41. This ensures that your switches and your WAN gateway router continue to prioritise this traffic all the way to the internet. Now, how do we structure this logically? The answer is strict network segmentation. You should never, ever run a flat network in a co-working space. We recommend a three-VLAN architecture. VLAN 10 is your Private Office network. This is for your high-value, dedicated tenants. It gets WPA3-Enterprise security and a Platinum QoS profile with prioritised voice and video. VLAN 20 is your Hot-Desk network for flexible members. This gets a Gold QoS profile with balanced, dynamic bandwidth limits. VLAN 30 is your Guest network, managed via a captive portal. This gets a Silver profile with strict, static rate limits and full client isolation. By isolating these networks, you ensure that a guest downloading a large file in your café can never starve a paying corporate tenant in a private office. [Transition] Now, let's talk about implementation. How do you actually deploy this? First, you must establish what we call The 10% Overhead Rule. If you have a symmetric 1 Gigabit fibre connection from your ISP, do not configure your traffic shapers to 1 Gigabit. Shape your WAN gateway to 900 Megabits per second — that's 90% of your actual speed. Why? Because this forces your enterprise gateway router to handle all the packet queueing, rather than the ISP's unmanaged modem. This single configuration step virtually eliminates bufferbloat. Next, configure Class-Based Weighted Fair Queueing, or CBWFQ, on your gateway. Allocate your bandwidth into guaranteed pools. Tier 1, which is Critical traffic, gets 40% of your bandwidth for voice and video. Tier 2, which is Business traffic, gets 35% for core cloud applications and web browsing. Tier 3, which is General and Guest traffic, gets 25%. For your hot-deskers, use Dynamic Bandwidth Allocation. Instead of capping users at a low speed, let them burst to high speeds — say, 50 Megabits — when the network is quiet. But during peak hours, dynamically scale them down to a guaranteed baseline of 10 Megabits. For guests, enforce a hard, static cap of 10 Megabits download and 5 Megabits upload. At the physical layer, disable all legacy data rates below 24 Megabits on the 5 Gigahertz band, and turn off the 2.4 Gigahertz band entirely on most of your APs. This forces client devices to roam cleanly to the nearest AP and reduces wireless overhead. Also, always enable Airtime Fairness. This ensures that older, slower devices don't hog the wireless medium, protecting the performance of modern Wi-Fi 6 and Wi-Fi 7 clients. [Transition] Let's address some common pitfalls and troubleshooting scenarios. One of the most frequent complaints we hear from co-working operators is: "Our router's CPU is spiking to 95%, and the internet is slow, but our bandwidth utilisation is low." If you see this, you are likely experiencing a broadcast storm. In high-density environments, devices constantly broadcast discovery packets like mDNS or ARP. When you have hundreds of devices doing this, it saturates the wireless medium and overloads your router's CPU. The immediate fix? Enable Client Isolation on your Guest and Hot-Desk SSIDs. This blocks devices from talking directly to each other, instantly cutting out that broadcast noise and freeing up massive amounts of airtime and CPU. Another issue is sticky clients — devices that cling to a distant AP even when standing right under a new one. To solve this, implement 802.11k, r, and v roaming standards, and adjust your AP transmit power down to 12 to 15 dBm. This prevents APs from shouting over each other and encourages clean roaming. [Transition] Let's do a quick rapid-fire Q&A based on questions we frequently get from IT directors. Question: Can I use my existing consumer-grade or prosumer APs for this? Answer: Absolutely not. Multi-tenant QoS requires enterprise-grade hardware — like Cisco, Aruba, or Ruckus — that can handle high client density, enforce deep packet inspection, and map WMM to DSCP seamlessly. Question: Is 2.4 Gigahertz still useful in a co-working space? Answer: Only for IoT devices like smart thermostats or printers. For your users, 2.4 Gigahertz is too congested and slow. Move all user traffic to 5 Gigahertz and the new 6 Gigahertz bands. Question: How does this impact my bottom line? Answer: Poor Wi-Fi is the leading cause of member churn. By guaranteeing network reliability, you can reduce tenant churn from an average of 20% down to under 8%. Furthermore, you can package these QoS capabilities into premium upsell tiers — offering dedicated SSIDs, private VLANs, and guaranteed bandwidth for an extra monthly fee. It turns your IT infrastructure from a cost centre into a high-margin revenue generator. [Transition] To wrap up, let's summarise the key takeaways. First: Segment your network into at least three isolated VLANs. Second: Enable WMM globally and map it to wired DSCP. Third: Enforce the 10% WAN Overhead Rule to eliminate bufferbloat. Fourth: Enable Airtime Fairness and set a 24 Megabit minimum basic rate to optimise your RF environment. Fifth: Use client isolation to eliminate broadcast noise. By implementing these steps, you will deliver the enterprise-grade connectivity that modern professionals demand, protecting your revenue and scaling your business. If you want to learn more about how Purple can help you manage guest access and deliver deep network analytics, visit us at purple dot ai. Thank you for listening to this Purple Technical Briefing. Until next time, keep your networks fast and your tenants happy. [Theme Music: Upbeat, modern corporate electronic music swells, plays for 5 seconds, then fades out completely.]

header_image.png

執行摘要

共享辦公空間呈現出獨特且多變的 RF(無線電頻率)與網路環境。與使用者行為可預測的傳統企業辦公室,或對頻寬要求較低的公共熱點不同,共享辦公空間必須支援高密度、多租戶的部署,且使用者要求企業級的吞吐量、低延遲和極高的可靠性。單一租戶進行大量資料傳輸或執行未限制的備份同步,就可能降低整個場域的無線體驗,進而導致租戶流失和直接的營收損失。

本指南為網路架構師和 IT 總監提供了一個具體可行、且不綁定特定廠商的頻寬管理與服務品質 (QoS) 政策實施框架。透過利用 Guest WiFi 和安全 VLAN 進行進階網路分段、整合 WiFi Analytics 以監控即時使用率,並強制執行嚴格的 IEEE 802.11e/WMM 標準,營運商可以確保高價值租戶的服務層級協定 (SLA),同時為一般訪客維持流暢的基本體驗。


技術深度解析

多租戶網路的兩難困境

在多租戶的共享辦公環境中,主要的挑戰在於流量的不可預測性。在任何給定的一天,網路必須同時支援對延遲敏感的統一通訊即服務 (UCaaS)(如 Zoom 或 Microsoft Teams)、高突發性的雲端資料庫同步、高吞吐量的檔案傳輸以及娛樂性的影片串流。在沒有主動管理的情況下,標準網路交換器和存取點的「先進先出」(FIFO) 排程將不可避免地導致緩衝區膨脹 (Bufferbloat) — 這是一種高頻寬、非即時封包飽和緩衝佇列的現象,會引入抖動和延遲,從而破壞即時應用程式的可用性。

為了緩解這種情況,網路管理員必須從簡單的速率限制轉變為多層次的服務品質 (QoS) 和流量整形架構。這始於適當的實體和邏輯網路設計,利用企業級硬體來對流量進行分段和優先順序排序。

網路分段與 VLAN 設計

如果沒有對租戶群組進行嚴格的邏輯隔離,就無法進行有效的頻寬管理。我們建議部署至少三個不同的虛擬區域網路 (VLAN),並使用企業級 Cisco Wireless APs 或類似硬體將其對應到不同的 SSID:

VLAN ID SSID 名稱 目標受眾 驗證機制 QoS 設定檔
VLAN 10 CoWork_Private 專屬辦公室租戶 WPA3-Enterprise (802.1X / Cloud RADIUS) Platinum (語音/影片優先)
VLAN 20 CoWork_HotDesk 流動辦公桌 / 彈性會員 WPA3-Enterprise 或 WPA3-SAE 搭配 Portal 黃金 (商業應用程式)
VLAN 30 CoWork_Guest 日常訪客 / 賓客 透過 Guest WiFiCaptive Portal 青銅 (盡力而為 / 限制頻寬)

透過對網路進行分段,管理員可以在 VLAN 邊界套用量身定制的 QoS 設定檔,確保 VLAN 30 上的訪客流量永遠不會排擠 VLAN 10 和 20 上的關鍵業務流量。實施這些安全策略需要與強大的 網路存取控制 (NAC) 解決方案 整合,以便根據使用者憑證動態分配 VLAN。如需詳細指引,請參閱我們的完整指南: 如何使用 Cloud RADIUS 實施 802.1X 驗證

coworking_network_architecture.png

IEEE 802.11e 與 Wi-Fi 多媒體 (WMM)

在無線層,QoS 由 IEEE 802.11e 標準規範,該標準在商業上被稱為 Wi-Fi 多媒體 (WMM)。WMM 取代了傳統的分散式協調功能 (DCF),改用增強型分散式通道存取 (EDCA)。EDCA 引入了四個存取類別 (AC),對應媒介上不同的優先等級:

語音 (WMM-AC_VO) 具有最高優先級,專為 VoIP 和即時互動式音訊設計。它使用最短的退避定時器以將延遲降至最低。視訊 (WMM-AC_VI) 具有高優先級,並針對視訊會議和串流媒體進行了最佳化,在低延遲與高吞吐量之間取得平衡。盡力而為 (WMM-AC_BE) 是標準網頁流量、電子郵件和一般應用程式的預設類別。背景 (WMM-AC_BK) 具有最低優先級,保留給非時間敏感的資料傳輸、系統更新和背景備份。

為了在高度密集環境中保持語音和視訊的清晰度,必須在所有存取點上全域啟用 WMM。此外,必須設定 DSCP (區分服務代碼點) 對應,以便在無線 WMM 類別穿過交換器和路由器時,將其轉換為有線 IP 封包。


實施指南

流量整形與 QoS 部署逐步指南

在共同工作空間中實施頻寬管理需要系統化的方法。請遵循以下與廠商無關的部署步驟,以建立企業級的流量整形策略。

步驟 1:建立 WAN 頻寬預算。 在設定內部限制之前,請先確定您的總 WAN 吞吐量。對於一個典型的 200 人共同工作空間,建議使用對稱的 1 Gbps / 1 Gbps 光纖連線。在 WAN 閘道保留硬性的 10% 開銷緩衝,以防止介面飽和與緩衝區膨脹 (bufferbloat)。這將留下 900 Mbps 的可分配頻寬。

步驟 2:定義流量類別與優先權佇列。 在您的核心閘道器/防火牆上設定類別加權公平佇列 (CBWFQ) 或低延遲佇列 (LLQ)。根據來源 VLAN 和應用程式特徵定義三個主要類別。第一層(關鍵)分配 40% 的保證頻寬給 VoIP 和 UCaaS 流量,並對應至 DSCP EF。第二層(商務)分配 35% 給雲端應用程式和網頁流量,並對應至 DSCP AF41。第三層(一般/訪客)分配 25% 並設有嚴格的總量上限,並對應至 DSCP CS1。

qos_priority_tiers_infographic.png

步驟 3:設定單一使用者限速(動態頻寬分配)。 為了防止「頻寬怪獸」降低網路品質,請盡可能實施動態單一使用者限速,而非靜態上限。動態限速允許使用者在網路閒置時衝刺到更高的速度,但在尖峰時段會將其縮減至保證的基準線。針對行動辦公/彈性 SSID,設定每個用戶端 50 Mbps 下載 / 20 Mbps 上傳的動態限制,並在尖峰使用期間提供至少 10 Mbps 對稱的保證頻寬。針對訪客 SSID,強制執行每個用戶端 10 Mbps 下載 / 5 Mbps 上傳的嚴格靜態上限。

步驟 4:實施應用程式層(第 7 層)過濾。 現代防火牆和 AP 利用深層封包檢測 (DPI) 來識別應用程式,不論其使用何種連接埠。設定第 7 層規則,將點對點 (P2P) 檔案分享、BT 下載和個人雲端備份限制在每位使用者最高 2 Mbps。確保已知的 UCaaS 網域(例如 *.zoom.us*.microsoft.com)會自動標記為 DSCP EF 或 AF41。


最佳實踐

嚴格的射頻規劃與頻道重複使用

當多個存取點在相同頻道上運作時,高密度共同工作空間會遭受同頻道干擾 (CCI)。在現代工作空間中,請將舊型裝置遷移至 5 GHz 和 6 GHz 頻段。如果物聯網 (IoT) 必須啟用 2.4 GHz,請將其限制在少數特定 AP 上,並使用互不重疊的頻道(1、6、11)及最低發射功率。部署 Wi-Fi 6E 或 Wi-Fi 7 以利用新開放的 6 GHz 頻譜,該頻譜提供多達 14 個額外的 80 MHz 頻道,可完全消除 CCI。在 5 GHz 頻段中請堅持使用 40 MHz 頻道寬度,以在吞吐量與頻道可用性之間取得平衡。

空中時間公平性

在所有企業級 AP 上啟用空中時間公平性 (ATF)。ATF 為所有用戶端分配相同的頻道存取時間,而非相同的封包數量。這可防止使用舊標準(運作於 802.11n 或更舊標準)的慢速舊型用戶端獨佔無線介質,進而拖慢現代高速 Wi-Fi 6/7 用戶端的運作速度。

持續分析與監控

利用企業級的 WiFi Analytics 深入掌握租戶行為、裝置密度和應用程式使用情況。透過分析歷史流量趨勢,IT 經理可以在發生實體瓶頸之前,主動調整頻寬分配。這同樣適用於 Hospitality 環境、 Retail 部署和 Transport 樞紐,在這些環境中,多租戶無線網路密度是一個持續存在的營運挑戰。


疑難排解與風險緩解

即使有強健的 QoS 設定,共享工作空間網路仍會遇到效能異常。下表提供了針對最常見頻寬相關故障的診斷矩陣。

症狀 根本原因 診斷步驟 緩解行動
尖峰時段 Zoom/Teams 通話斷斷續續 WAN 閘道器處發生 Bufferbloat 或 DSCP 對應錯誤 從用戶端裝置執行 Bufferbloat 測試;檢查交換器連接埠統計資料以確認是否有丟棄的傳出封包 在路由器上針對 UCaaS 流量啟用 LLQ;將 WAN 額外開銷預留比例從 10% 調整至 15%
5 GHz 頻段高延遲與封包遺失 因 AP 發射功率過大或通道過寬導致的同通道干擾 (CCI) 進行 RF 場地勘測,或檢查控制器的通道圖與干擾指標 將通道寬度從 80 MHz 縮減至 40 MHz;啟用動態通道分配 (DCA)
特定租戶回報在獨立辦公室內網速緩慢 實體阻礙或用戶端裝置卡在遠處的 AP (黏性用戶端) 在無線控制器儀表板中檢查用戶端的 RSSI 和連線頻段 啟用 802.11k/r/v 快速漫遊;將最小基本速率調整為 12 Mbps 或 24 Mbps
訪客網路使用量暴增,排擠企業租戶 繞過訪客速率限制,或 Captive Portal 工作階段逾時時間設定過長 在防火牆儀表板中驗證訪客 VLAN 的總頻寬消耗 在訪客 SSID 上實施嚴格的單一使用者速率限制 (10/5 Mbps);將工作階段逾時時間縮短至 4 小時

投資報酬率與商業影響

租戶留存與流失率降低

共享工作空間中排名第一的抱怨就是網路連線品質不佳。在一個轉換成本低且彈性空間選擇眾多的產業中,僅僅一週的不穩定連線就可能促使高價值企業租戶終止租約。透過妥善實施的 QoS 架構,營運商一致回報年度租戶流失率從產業平均的 18–22% 降至 8% 以下,這代表保留了顯著的租金收入。

透過進階方案創造新營收

透過利用強大的網路核心,共享工作空間營運商可以將其 WiFi 基礎設施從成本中心轉變為高利潤的營收來源。營運商可以引導租戶從標準方案升級至高級網路套裝方案,以每月溢價提供專用 VLAN、專屬 SSID、保證對稱頻寬以及靜態 IP 位址。

方案等級 功能特色 參考定價
標準 (Standard) 共享熱點 SSID、50/20 Mbps、盡力而為 QoS、Captive Portal 登入 包含在基礎會員資格中
高級 (Premium) 專用 VLAN/SSID、100/100 Mbps、白金級 QoS (VoIP 優先)、WPA3 每月 +£150
企業 (Enterprise) 客製化專屬 SSID、對稱 200 Mbps、雲端 RADIUS 整合、靜態 IP 每月 +£450

營運效率

透過自動化頻寬分配和流量整形,每日與「網路慢」相關的 IT 支援工單量可減少高達 75%。這讓場地的現場社群經理能夠專注於接待和銷售,而不是排除網路故障。相同的原則也適用於 醫療保健 機構和公共部門場地,在這些地方,網路可靠性在營運上至關重要。如需進一步閱讀高密度無線部署策略,請參閱我們的指南: 學校 WiFi:2026 年管理員與 IT 指南


收聽:技術簡報播客


參考文獻

[1] Cisco Systems, "High Density Wi-Fi Deployment Guide," 2025. [2] Internet Engineering Task Force (IETF), "Controlled Delay Active Queue Management (CoDel)," RFC 8289, 2018. [3] IEEE Standards Association, "IEEE 802.11e-2005 — Amendment 8: Medium Access Control (MAC) Quality of Service Enhancements," 2005. [4] Aruba Networks, "Airtime Fairness Technology Whitepaper," 2024.

Key Definitions

Bufferbloat

High latency and jitter caused by excessive buffering of packets in network equipment, particularly at the WAN boundary. When high-bandwidth, non-real-time traffic saturates these buffers, real-time packets (like VoIP and video) are delayed, causing severe performance degradation.

IT teams encounter bufferbloat when users complain of choppy video calls despite having high-speed fibre internet. It is mitigated by reserving a 10% WAN bandwidth overhead and implementing active queue management (AQM) like FQ-CoDel.

Quality of Service (QoS)

A set of technologies and techniques used to manage network resources by prioritising specific traffic types. QoS mechanisms allow administrators to guarantee bandwidth, minimise latency, and control jitter for critical applications.

Essential in multi-tenant co-working spaces to ensure that real-time collaboration tools (Zoom, Teams) take precedence over background file transfers and recreational streaming.

Wi-Fi Multimedia (WMM)

A Wi-Fi Alliance interoperability certification based on the IEEE 802.11e standard. It provides Quality of Service (QoS) features to Wi-Fi networks by prioritising traffic into four Access Categories: Voice, Video, Best Effort, and Background.

Must be enabled globally on co-working access points to ensure that wireless devices can prioritise voice and video packets before they are transmitted over the air.

Differentiated Services Code Point (DSCP)

A 6-bit field in the header of an IP packet used to classify and prioritise network traffic at Layer 3. Standard markings include EF (Expedited Forwarding for voice) and AF (Assured Forwarding for video and business apps).

Used to maintain QoS priority as traffic moves from the wireless AP, across wired switches, and out through the WAN gateway router. DSCP markings must be preserved end-to-end for QoS to function correctly.

Airtime Fairness (ATF)

An enterprise wireless feature that allocates channel transmission time (airtime) equally among connected clients, regardless of their connection speed or wireless standard.

Prevents legacy or distant devices with poor signal strength from consuming excessive wireless medium time, protecting the throughput of modern Wi-Fi 6/7 devices in high-density co-working environments.

Dynamic Bandwidth Allocation

A traffic shaping technique that dynamically adjusts a user's bandwidth limits based on real-time network utilisation, allowing high burst speeds when the network is idle while enforcing strict baselines during peak hours.

Enables co-working operators to offer a responsive, high-speed user experience without risking total network saturation during peak business hours.

Co-Channel Interference (CCI)

Interference that occurs when two or more wireless access points in close proximity operate on the same frequency channel, forcing them to share airtime and drastically reducing overall wireless capacity.

A major issue in high-density co-working spaces. Mitigated by proper channel planning, reducing channel widths to 40 MHz, and utilising the 6 GHz band in Wi-Fi 6E/7 deployments.

Client Isolation

A security and performance feature on wireless access points that prevents connected wireless clients from communicating directly with each other or scanning other devices on the same subnet.

Mandatory for guest networks and hot-desking SSIDs to protect tenant security and eliminate unnecessary wireless broadcast traffic (like ARP and mDNS) from consuming airtime.

Worked Examples

A high-density co-working space spanning 15,000 square feet over two floors accommodates 250 active daily members, including 15 private office tenants. During peak hours (10:00 AM to 3:00 PM), users experience severe jitter and packet loss on Microsoft Teams and Zoom calls. The venue has a symmetric 500 Mbps fibre connection. Design a vendor-neutral QoS and bandwidth allocation strategy to resolve this issue.

To resolve the peak-hour latency and jitter, implement a three-pronged QoS strategy: WAN-level queueing, wireless traffic shaping, and logical segmentation.

WAN-Level Rate Limiting & Queueing: Set a WAN bandwidth limit on the gateway router to 450 Mbps (90% of the 500 Mbps circuit) to prevent bufferbloat. Configure Low Latency Queueing (LLQ) on the WAN interface with a strict priority queue of 50 Mbps for voice and video conferencing traffic (identified via Layer 7 DPI signatures for Zoom, Teams, and Webex), mapped to DSCP EF. Configure CBWFQ for the remaining 400 Mbps: Class-1 (Private Office VLAN 10) receives a 50% bandwidth guarantee (200 Mbps), burstable to 450 Mbps, mapped to DSCP AF41; Class-2 (Hot-Desk VLAN 20) receives a 35% guarantee (140 Mbps), burstable to 300 Mbps, mapped to DSCP AF21; Class-3 (Guest VLAN 30) receives a 15% guarantee (60 Mbps), capped strictly at 100 Mbps aggregate, mapped to DSCP CS1.

Wireless Layer Configuration (WMM & Roaming): Enable Wi-Fi Multimedia (WMM) globally across all APs, mapping wireless voice and video queues directly to the wired DSCP EF and AF41 markings. Enforce Airtime Fairness (ATF) on all APs. Set the Minimum Basic Rate to 24 Mbps on the 5 GHz band and disable 2.4 GHz on 80% of the APs.

Per-User Rate Limiting: Apply dynamic per-user rate limiting on VLAN 20 (Hot-Desks): 30 Mbps download / 10 Mbps upload per client, burstable to 50 Mbps when total network utilisation is below 60%. Apply strict static per-user limits on VLAN 30 (Guests): 10 Mbps download / 3 Mbps upload.

Examiner's Commentary: This solution directly addresses the root cause of choppy video calls, which is bufferbloat and wireless medium starvation. By reserving a 10% overhead buffer at the WAN gateway, we prevent the ISP's modem from queueing packets, transferring queue scheduling control to the enterprise router where LLQ is active. Segmenting the private offices onto VLAN 10 with a guaranteed 50% bandwidth pool protects the venue's primary revenue-generating tenants from the volatile traffic of hot-deskers and guests. Disabling legacy 2.4 GHz rates and enforcing a 24 Mbps minimum basic rate optimises the RF environment, freeing up airtime for latency-sensitive applications.

An enterprise co-working operator wants to upsell a high-value financial services tenant who requires a dedicated, highly secure network for 30 employees within a private office suite. They demand a guaranteed symmetric 100 Mbps throughput, a dedicated SSID, and strict isolation from all other tenants to comply with financial regulations. Detail the step-by-step configuration and deployment model to deliver this service using shared physical infrastructure.

To deliver this premium enterprise service securely and reliably on a shared infrastructure, utilise dynamic VLAN steering, dedicated SSID provisioning, and strict QoS bandwidth reservation.

Logical Network Segmentation & Security: Create a dedicated VLAN (VLAN 105) on the core switch and gateway firewall. Configure a dedicated SSID named CoWork_FinSecure broadcasted only by the access points in the vicinity of the tenant's private office suite. Secure the SSID using WPA3-Enterprise authentication integrated with a Cloud RADIUS server. Each tenant employee is assigned unique 802.1X credentials; upon successful authentication, the RADIUS server returns a Tunnel-Private-Group-ID attribute of 105, dynamically steering the user's device into VLAN 105. Configure strict ACLs on the gateway firewall to block all inter-VLAN traffic between VLAN 105 and any other tenant VLANs.

Bandwidth Reservation & QoS Profiling: On the WAN gateway, create a dedicated traffic class for VLAN 105. Configure a CBWFQ policy that guarantees a symmetric 100 Mbps of WAN throughput exclusively for VLAN 105. Set a hard traffic-shaping limit of 100 Mbps on VLAN 105 to prevent the tenant from exceeding their SLA. Within VLAN 105, enable QoS tagging translation: map incoming client DSCP tags (EF for VoIP, AF41 for video) directly to the corresponding WAN queues.

Client-Level Optimisation: Enable client isolation on the CoWork_FinSecure SSID to prevent devices within the VLAN from scanning or communicating with each other, adding an extra layer of regulatory compliance.

Examiner's Commentary: This scenario demonstrates how to monetise network infrastructure. By leveraging WPA3-Enterprise with dynamic VLAN assignment via Cloud RADIUS, the operator provides bank-grade security without needing physical cabling or dedicated hardware. The core of the SLA is the WAN-level bandwidth reservation (CBWFQ), which guarantees that the tenant always has access to their 100 Mbps, justifying the premium monthly subscription. Strict firewall ACLs ensure compliance with financial regulations regarding multi-tenant data isolation.

During a large-scale tech conference hosted in a co-working space's event hall, 150 attendees connect to the Guest Wi-Fi simultaneously. Within 30 minutes, the entire network grinds to a halt. Hot-desk members in other parts of the building cannot load basic web pages, and the venue's reception desk cannot process credit card payments. Diagnose the network failure and outline the immediate emergency mitigation steps and long-term architectural solution.

This is a classic broadcast storm and wireless medium starvation failure, compounded by a lack of WAN-level bandwidth isolation.

Diagnostic Analysis: 150 active clients on a single guest AP in the event hall saturate the wireless medium. If clients are connected on the 2.4 GHz band or using wide 80 MHz channels, co-channel interference (CCI) spikes, causing massive packet retransmissions. A flood of DHCP requests and broadcast traffic (ARP, mDNS) from the guest network saturates the CPU of the core router. The guest network lacks an aggregate bandwidth cap, allowing conference attendees' devices to consume the entire WAN circuit.

Immediate Emergency Mitigation (15-Minute Resolution): Log into the core firewall and immediately apply an aggregate bandwidth limit on the Guest VLAN (VLAN 30), capping it at 50 Mbps total. Set a strict per-user cap of 3 Mbps download / 1 Mbps upload on the Guest SSID. Enable Client Isolation on the Guest SSID to block peer-to-peer wireless traffic and stop broadcast packets from traversing the airwaves.

Long-Term Architectural Solution: Deploy dedicated high-density Access Points (Wi-Fi 6E/7 APs with directional antennas) specifically for the event hall on a separate, dedicated VLAN (VLAN 40 - Event Space). Configure the core firewall to prioritise VLAN 90 (POS/Operations) with a guaranteed 10 Mbps (DSCP CS5) and VLAN 20 (Hot-Desks) with a guaranteed 200 Mbps. Apply a hard, non-burstable aggregate cap of 150 Mbps on the Event VLAN (VLAN 40).

Examiner's Commentary: This failure highlights the danger of flat network designs and unmanaged guest access. The immediate fix focuses on restoring operations by throttling the guests at the WAN gateway and blocking wireless broadcast traffic via client isolation. The long-term solution structurally protects the business by separating the volatile event space onto its own physical APs and logical VLAN, ensuring that guest events can never disrupt the day-to-day revenue-generating operations of the co-working space.

Practice Questions

Q1. A co-working operator notices that their core gateway router's CPU utilisation spikes to 95% every Tuesday and Thursday afternoon, coinciding with a drop in network speeds for all tenants. No large file transfers are active at the time. What is the most likely cause, and how should the network architect address it?

Hint: Look at the security and protocol settings on the guest and hot-desk networks. Spikes in CPU without high throughput often point to high packet-per-second (PPS) rates from broadcast traffic or device discovery protocols.

View model answer

The most likely cause is a broadcast storm or excessive multicast traffic (such as mDNS, ARP, or Bonjour discovery protocols) originating from the Guest and Hot-Desk SSIDs. In high-density environments with hundreds of devices, background discovery protocols can generate thousands of packets per second. Because broadcast packets must be processed by every device and the core gateway, this saturates the router's CPU without generating significant bandwidth utilisation.

To address this: (1) Enable Client Isolation globally on the Guest and Hot-Desk SSIDs. This immediately blocks peer-to-peer wireless communication and prevents broadcast/multicast packets from being repeated across the wireless medium. (2) Enable IGMP Snooping on all switches to restrict multicast traffic only to the ports that actively request it, reducing switch and router CPU load. (3) Configure the wireless controller to drop ARP and other broadcast frames at the AP level, converting ARP requests to unicast where possible.

Q2. An IT manager wants to implement QoS for a co-working space but discovers their legacy switches do not support DSCP mapping, only basic Layer 2 CoS (Class of Service) 802.1p tagging. How should they adapt their QoS design to maintain traffic prioritisation?

Hint: 802.1p CoS operates at Layer 2 (Ethernet frame), whereas DSCP operates at Layer 3 (IP header). When Layer 3 mapping is unavailable, prioritisation must be maintained within the local broadcast domain using CoS values.

View model answer

When Layer 3 DSCP mapping is unsupported by edge switches, the IT manager must rely on Layer 2 802.1p Class of Service (CoS) tagging. Configure the wireless Access Points to map the wireless WMM Access Categories directly to Layer 2 802.1p CoS tags as traffic enters the wired network. For example: WMM-AC_VO (Voice) maps to CoS 6; WMM-AC_VI (Video) maps to CoS 5; WMM-AC_BE (Best Effort) maps to CoS 0. On the legacy switches, configure egress queuing based on CoS values using Weighted Round Robin (WRR) or Strict Priority queuing on the switch uplink ports, assigning CoS 6 and 5 to the highest-priority queues. At the core gateway router (which supports Layer 3), configure the inbound switchport to read the incoming Layer 2 CoS tags and re-mark them to corresponding Layer 3 DSCP values (e.g., CoS 6 to DSCP EF, CoS 5 to DSCP AF41) before routing the traffic over the WAN interface.

Q3. A co-working space has a 1 Gbps symmetric fibre connection. The operator wants to guarantee that a virtual reality (VR) development company occupying a private suite gets at least 200 Mbps symmetric throughput with less than 5ms latency. However, they also want to ensure that if the VR company is not using their bandwidth, other tenants can utilise it. What specific queuing and traffic shaping configuration should be applied on the WAN gateway?

Hint: Consider class-based queuing mechanisms that support both a guaranteed minimum (committed information rate) and a maximum limit, allowing borrowing of unused bandwidth from a parent pool.

View model answer

Implement Class-Based Weighted Fair Queueing (CBWFQ) with Hierarchical Token Bucket (HTB) on the WAN gateway. Set the parent shaper to 900 Mbps (enforcing the 10% overhead rule). For the VR Tenant Class (VLAN 150), configure a Committed Information Rate (CIR) of 200 Mbps (guaranteed bandwidth) and a Peak Information Rate (PIR) of 500 Mbps (maximum burst limit), assigned to a high-priority queue with low latency characteristics. For the Shared Tenant Class (VLANs 10, 20, 30), configure a CIR of 700 Mbps with a burst limit of 900 Mbps. Enable bandwidth sharing (borrowing) under the HTB scheduler so that when the VR company's utilisation is below 200 Mbps, the unused capacity is automatically distributed among the other tenant classes based on their configured weights. As soon as the VR company initiates a high-throughput transfer, the scheduler immediately reclaims the bandwidth up to the guaranteed 200 Mbps, preempting other traffic classes without dropping active connections.

Continue reading in this series

Designing WiFi Networks for Multi-Tenant Office Buildings

This guide provides IT managers, network architects, and CTOs with a vendor-neutral blueprint for designing scalable, secure, and isolated WiFi networks across multi-tenant office buildings. It covers VLAN segmentation under IEEE 802.1Q, Dynamic VLAN Assignment via 802.1X and RADIUS, RF planning for high-density environments, and compliance considerations under GDPR and PCI DSS. Venue operators and building managers will find actionable architecture guidance, real-world case studies, and configuration pitfalls to avoid before deployment.

Read the guide →

Designing WiFi Networks for Multi-Tenant Office Buildings

This guide provides IT managers, network architects, and CTOs with a vendor-neutral blueprint for designing scalable, secure, and isolated WiFi networks across multi-tenant office buildings. It covers VLAN segmentation under IEEE 802.1Q, Dynamic VLAN Assignment via 802.1X and RADIUS, RF planning for high-density environments, and compliance considerations under GDPR and PCI DSS. Venue operators and building managers will find actionable architecture guidance, real-world case studies, and configuration pitfalls to avoid before deployment.

Read the guide →

Mean time to innocence: how to prove it's not the WiFi

Mean time to innocence (MTTI) is the critical metric defining how long IT teams spend proving a network issue is not their fault. This guide details a five-step observability methodology to eliminate the blame game in multi-tenant environments, replacing finger-pointing with shared evidence to drive down mean time to resolution (MTTR).

Read the guide →