Key takeaways

  • Run at least three wireless networks: staff, guest and devices (IoT). Each sits on its own VLAN with firewall rules between them. Guests and devices get internet access only.
  • WPA3 is the strongest Wi-Fi encryption in common use. CISA advises equipment that supports WPA3 because older protocols can leave a network open to exploitation.
  • Transition mode lets WPA2 and WPA3 devices share one network. It is convenient, but the network still accepts the older method, so use it only while old devices need it and plan to retire it.
  • Client isolation stops devices on the same wireless network from talking to each other. Turn it on for guest networks. It is not a substitute for network separation.
  • Put the access points, switches and controller on a management network that no wireless client can reach, with strong admin passwords and no administration from the internet.
  • Separate names and passwords are not segmentation. The separation has to be enforced where the traffic is routed, by VLANs and firewall rules.

Why one network is a problem

On a flat network, a visitor's phone, a conference-room display, the label printer and the accounting laptop can all see each other. Anything infected, or anything with a weak default password, is a stepping stone to everything else. Small offices usually reach this state by accident, one device at a time.

Segmentation limits that. The same idea appears in NIST's guidance on securing wireless local area networks, SP 800-153, which treats the design of the wireless network and its connection to the wired one as part of security, not an afterthought.

The three networks most offices need

  • Staff. Managed laptops and phones that use company data. Strongest encryption, individual sign-in where you can (WPA3-Enterprise or 802.1X), access to file shares and internal systems.
  • Guest. Visitors and personal phones. Internet only, no route to the office network, client isolation on, optional bandwidth limits and a simple terms page. CISA's home-network advice makes the same point: a guest network on a separate channel with its own password protects your main credentials.
  • Devices (IoT). Printers, cameras, TVs, badge readers, smart plugs, building controls. They cannot run security software and often run old firmware. Put them on their own network, allow only the traffic they need, and block them from reaching staff devices.

A fourth network is worth adding when it applies: a payment-device or point-of-sale network for card terminals, kept apart from everything else.

Where the separation really happens

Each wireless network name, or SSID, maps to a VLAN, a separate virtual network on the switch. The firewall or router connects those VLANs and decides what may cross. A good baseline rule set: staff can reach devices they need to manage, devices can reach only the few services they require, guests can reach only the internet, and nothing from guest or devices can start a connection to staff. Test it from a guest phone: you should not be able to see or open a staff printer, share or admin page.

A consumer router's guest network feature is better than nothing. Check that it truly blocks access to the main network, since cheaper models differ. For anything beyond a very small office, use access points and a firewall that support VLANs properly.

WPA3, WPA2 and transition mode

The Wi-Fi Alliance says WPA3 networks use the latest security protocols, disallow outdated legacy protocols and require Protected Management Frames, which protect management messages from forging and eavesdropping. WPA3‑Personal also gives better protection against password guessing. CISA says WPA3 is currently the strongest encryption and advises using equipment that supports it, because WPA and WPA2 can leave a network open to exploitation.

Not every device supports WPA3. Access points offer a transition mode, sometimes labeled WPA2/WPA3, so both kinds of client can join one network. The trade-off is that the network keeps accepting the older method, so an attacker or a downgraded client can still use it. A sensible approach:

  • Staff network: WPA3 only where all staff devices support it; otherwise transition mode while you replace the old ones.
  • Guest network: transition mode is usually fine, because the network is already isolated.
  • IoT network: many devices are WPA2-only. Give them their own WPA2 network on the isolated VLAN so they do not force the staff network to stay in transition mode. Use a long, unique passphrase.
  • Keep a list of devices that need the older method and a date to retire or replace them.

Client isolation

Client isolation, sometimes called AP isolation or peer-to-peer blocking, stops devices on the same wireless network from communicating directly. On a guest network it prevents one visitor from probing another. Turn it on there. Be careful on the staff and IoT networks, where it can break wireless printing, casting to displays and local discovery. If you turn it on there, test the workflows that depend on devices talking to each other, and create specific allow rules instead of turning isolation off.

Isolation is a feature of the wireless network. It does not replace VLANs and firewall rules, because wired devices and devices on other networks are outside its reach.

The management network

Access points, switches, controllers and the firewall all have administration pages. If those are reachable from the guest network or from the internet, they are a target. Create a management VLAN that only a small admin group can reach. Give each device a unique administrator password stored in the company password manager, turn off administration from the internet, keep firmware current and turn off default features you do not use, such as UPnP on the router. Our small-office router audit article covers that side in more detail.

Rollout in an afternoon

  • List every wireless device and decide which network it belongs on.
  • Create the VLANs and SSIDs, and write the firewall rules before moving anyone.
  • Move the IoT devices first, then guests, then staff, testing as you go.
  • Test the rules from a guest phone and from an IoT device.
  • Record the design: SSIDs, VLAN numbers, addresses, rules and who owns each.
  • Repeat the check after new equipment arrives and at least twice a year.

We design and test small-office networks with separated staff, guest and device segments and leave you a one-page diagram that your team can maintain.

Sources

This article is general information, not legal or technical advice for your environment. Product menus, license names and provider rules change; check the vendor's current documentation before you act. Last reviewed .

Next article

Related reading

Need help with this?

We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.

Managed IT Services