A multifamily owner rolls out per-unit resident Wi-Fi with private keys, unit VLANs, client isolation and a separate management network
A multifamily owner and operator with about 1,100 apartment units across 6 communities in the Southeast, a leader in its segment.
- Scale
- About 1,100 units, 6 communities, 1 private key and 1 VLAN per unit, 3 networks per community (residents, building systems, management), 0 shared resident passwords
- Engagement
- Six weeks of design and a pilot community, then about five months to bring the remaining communities over
The challenge
The owner wanted to offer managed Wi-Fi as an amenity, but its pilot used one network name and one password for a whole building, printed on a flyer. Residents could see each other's printers, smart TVs and cameras, the password had spread to people who no longer lived there, and the leasing office had no way to tell a resident's device from a stranger's. Building systems such as access control and the leasing office computers shared switches with that network, and the owner's insurer had begun asking how resident traffic was kept away from them.
Resident Wi-Fi is an amenity that behaves like a small internet provider. One shared password for a building is easy to launch and hard to live with: it spreads, it never expires, and every device in the building shares a network with every other. The owner's goal was to keep the simplicity of one passphrase per household while giving each household a private network.
The technology that makes this practical is a per-unit private pre-shared key. Every apartment has its own passphrase on the same network name, and the controller uses the passphrase a device presents to decide which VLAN that device belongs to. Residents join their devices the way they always have. Behind the scenes, a printer in 4B and a printer in 5B are on different networks and cannot see each other.
The less visible half of the design is everything the residents never see. Access control, cameras and building controls sit on their own network, and the equipment that manages the Wi-Fi sits on a third one reachable only from a jump host. That separation answered the insurer's question, and it means a compromised resident device has nowhere to go but the internet.
The design also has limits that the owner should know about. Some older smart-home gadgets do not join private-key networks reliably, a household can still share its own passphrase, and isolation between units does not make any device inside a unit safe. In this illustrative case, those limits were written into the move-in guide and the support runbook so that the leasing office could answer them without escalating.
What our team delivered
- A design for each community with three separate networks: resident Wi-Fi, building systems such as access control, cameras and HVAC controls, and a management network for the access points, switches and controllers. The management network is reachable only from a small administrative jump host, and no resident or building-system device can connect to it
- A private key for each unit, sometimes called a private pre-shared key or PPSK. Every unit gets its own passphrase, and the controller places any device that joins with it on that unit's own VLAN. A resident connects phones, laptops, TVs and speakers with one passphrase, and a neighbor's passphrase puts a device in the neighbor's network, not theirs
- Client isolation between units, so a device in one apartment has no path to a device in another. Inside a unit, devices can still reach each other, and a limited multicast DNS (mDNS) service lets a phone find the unit's own TV, printer or speaker without opening anything across the building
- A firewall rule set that gives every unit VLAN internet access only, with default deny toward the building-system and management networks, plus per-unit rate limits so that one household's downloads cannot crowd out the others
- A leasing workflow tied to the lease system: a new key is issued at move-in, the old one is revoked at move-out the same day, and a resident can reset the key from a portal after confirming their identity. No key is printed on a flyer or kept in a shared document
- Access point placement from a measured site survey, 5 GHz and 6 GHz where the radios support them, and a wired jack in each unit's utility closet for the owner's own devices, with thermostats and door locks on the building-systems network, not on the resident one
- Logging of joins, key resets and the rare rogue access point to a central system, and a test after each community went live from inside a unit and from the leasing office, confirming that no path existed to another unit, to building systems or to the management network
Result
The pilot community went live over a weekend, and the other five followed at about one a month once the design was proven. After cutover, tests from a unit reached no other unit, no building-system device and no management interface in any of the 6 communities, and support calls about neighbors seeing each other's devices stopped. Move-out revocation took minutes instead of never happening. That is one illustrative outcome, not a promise: some older smart-home devices handle private-key networks poorly, a resident can still share their own key, and client isolation protects neighbors from each other without making any device safe. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 3 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Roaming without dropping the call
Time from leaving one access point to the first data frame on the next, split by phase. A full WPA2/WPA3‑Enterprise re-authentication repeats the 802.1X exchange; 802.11r (Fast BSS Transition) reuses cached keys, 802.11k (neighbour reports) removes the blind scan, and 802.11v (BSS transition management) lets the network steer the client. Illustrative figures.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.