One guest network, one payment network: shrinking PCI scope across 38 hotels
A hotel group with 38 properties across the United States and the Caribbean, a leader in its segment.
- Scale
- 38 hotels, ~6,400 rooms, ~3,000 Wi-Fi 6 APs, 1 Gb/s dual internet per property, 2 regional hubs
- Engagement
- Design, pilot at two hotels and phased rollout over 10 months
The challenge
Every hotel ran one flat network. Guests, the property management system (PMS), card terminals, door-lock gateways, cameras and the back office shared the same addresses, so every property was in scope for the card-data environment and a single infected guest laptop could reach the front desk. Guests also complained that streaming from a phone to the room TV never worked, because casting does not cross wireless client isolation.
A hotel is a public network with a cash register in the middle of it. At this group every property ran one flat network: guests, the front-desk PMS, card terminals, door-lock gateways, cameras and the back office all shared it. That made every hotel part of the card-data environment and gave a stranger in room 412 a route to the people checking him in. Guests had a different complaint: casting from a phone to the room TV never worked.
We separated the network by function. Each property now has its own guest, in-room, staff, PMS and POS, building and camera zones, each in a VRF with a default-deny firewall between them. Guest Wi-Fi uses WPA3 with client isolation and a captive portal for visitors, plus Passpoint (IEEE 802.11u) for loyalty members, whose phones join on arrival with no login page.
Casting was solved with per-room private pre-shared keys issued through RADIUS. Each room becomes its own small network: the guest's phone, laptop and TV see each other, with mDNS proxied inside the room, and nothing else. The result is the experience guests expected without opening the guest network to itself.
The payment side is where the audit work changed. Point-to-point encrypted terminals sit on one dedicated payment VLAN that can reach only the processor over TLS. Under PCI DSS 4.0.1, scope follows the systems that store, process or transmit card data and the systems that can touch them, so a payment VLAN with no route from guests or staff is a much smaller assessment than 38 whole networks. We run the annual segmentation test to prove the claim and keep the results ready for the assessor.
The PMS and door-lock gateways reach the two regional hubs over IPsec (IKEv2, AES-GCM), with BGP across both so a failed internet circuit moves traffic in about a second. We piloted at two hotels, rehearsed the cutover in a lab replica of one property, and rolled out by property during low season. Staff devices use 802.1X, anything unknown lands in a quarantine VLAN, and logs from all 38 hotels go to one place.
What our team delivered
- A separate VRF and firewall zone per function at every property: guest, in-room devices, staff, PMS and POS, building systems, cameras and management, with default-deny between them and nothing but named flows allowed
- Guest Wi-Fi on WPA3 with client isolation, a captive portal for visitors, and Passpoint (Hotspot 2.0, IEEE 802.11u) with WPA2/WPA3-Enterprise for loyalty members, who now join automatically on arrival
- Per-room private pre-shared keys through RADIUS, so each room is its own VLAN, a guest's devices and the room TV can see each other for casting (mDNS proxied inside the room), and no one else can
- Point-to-point encrypted (P2PE) card terminals on a dedicated payment VLAN that can reach only the processor over TLS, which keeps the cardholder-data environment to a few ports on one VLAN instead of the whole property
- PMS and door-lock gateways in their own zone, reachable only from the front-desk staff VLAN and from the two regional hubs over IPsec (IKEv2, AES-GCM), with BGP across both hubs for failover
- 802.1X with certificates on staff devices, MAC authentication bypass with profiling for printers and cameras, and a quarantine VLAN for anything unknown
- Centralized logging, quarterly access reviews, and a segmentation penetration test each year that proves guest and staff networks cannot reach the payment VLAN, with results kept for the assessor
Result
The card-data environment shrank from 38 whole property networks to one payment VLAN per hotel, so the annual assessment covers far less and a compromised guest device has nowhere to go. Streaming to the room TV works, loyalty members connect without a login page, and a failed internet circuit moves the PMS to the second path in about a second.
Roaming without dropping the call
Time from leaving one access point to the first data frame on the next, split by phase. A full WPA2/WPA3‑Enterprise re-authentication repeats the 802.1X exchange; 802.11r (Fast BSS Transition) reuses cached keys, 802.11k (neighbour reports) removes the blind scan, and 802.11v (BSS transition management) lets the network steer the client. Illustrative figures.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Defense in depth, on a loop
Every device on your network sits behind a monitored firewall with two internet circuits, so attacks are stopped at the door and a provider outage does not stop the business.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.