# Cascades — CSC ENT Device-Island Consolidation (Phones + Helpany on 5 GHz)

> **Decision (2026-06-24, Howard + Mike):** Repurpose the existing **CSC ENT** SSID as the
> permanent **WPA2 / 5 GHz-only device island** and consolidate BOTH the Poly voice handsets
> and the Helpany "Paul" sensors onto it, separated at the VLAN layer via Private PSK (PPSK).
> This gets both device classes off congested 2.4 GHz, keeps the WPA2-only gear on its own
> network, and clears the path to eventually move **CSCNet** to WPA3 / WiFi 7 / 6 GHz.
>
> Companion to `network-optimization-master-plan.md`, `voice-vlan-cutover.md`,
> `2026-06-19-vertical-5ghz-lock-request.md`, and `docs/REMAINING-WORK-PLAN.md` (Workstream 6).

---

## Why (background)

Two separate vendor threads converged on the **same** fix — a dedicated 5 GHz SSID:

- **Poly voice handsets (Vertical / Richard Turner):** several Polys sit on saturated 2.4 GHz
  despite excellent 5 GHz signal; UniFi band steering (`no2ghz_oui`, already ON) does **not**
  hold the Poly OUI (`48:25:67`) on 5 GHz. Richard (2026-06-24): phones can't be statically
  pinned to a band; Poly recommends a **separate 5 GHz SSID** for the phones (or disabling band
  steering on a shared SSID so the phone targets 5 GHz itself). See
  `2026-06-19-vertical-5ghz-lock-request.md`.
- **Helpany "Paul" sensors (Sandro Cilurzo / Eugenie Nicoud):** the room devices are **radar
  fall/motion sensors** (Sedimentum backend — *no camera, no microphone*), currently programmed
  onto **CSC ENT** (WPA2, key `Ftfd85710#`) and landing on 2.4 GHz. Per Sandro (email
  2026-06-19): *"Do you have a dedicated 5 GHz network with a separate SSID? If so we can
  remotely transition the Paul devices to that network... we'd need the SSID and password... if
  5 GHz is not available or the signal is not strong enough, the devices default to 2.4 GHz."*
  Helpany's engineering performs the band transition **remotely** once we provide the network.

CSC ENT was **deliberately kept as a WPA2 WiFi5 island** by Mike back in March 2026 precisely so
the WPA2-only Helpany gear had a home while CSCNet moves to newer standards (*"CSCNet is slated
to be converted to WiFi7 and will not be compatible with their devices — CSC ENT will remain
WiFi5 and is the correct network for them to use."*). This plan formalizes and extends that role.

---

## Hard constraints (vendor-stated)

- **Helpany is WPA2-only** — explicitly **NOT** WPA3 or hybrid WPA2/WPA3 (*"we don't support
  hybrid, only WPA2"*). The device SSID must stay WPA2-PSK.
- **Neither vendor can pin a device to 5 GHz from their side** (confirmed: Poly/Vertical AND
  Helpany support, 2026-06-24). The handsets/Pauls choose the band themselves, and band steering
  doesn't hold them. **Therefore a 5 GHz-only SSID (2.4 disabled) is the ONLY mechanism** — you
  remove 2.4 as an option so the device has nowhere else to associate. This is the whole basis of
  the plan.
- **Consequence — 5 GHz coverage is now a HARD GATE, with no safety net.** On a 5 GHz-only SSID
  there is **no 2.4 fallback**: a Paul/phone in a weak-5 GHz spot will simply **fail to connect**
  (not drop to 2.4). 5 GHz has shorter range and Cascades has steel walls. So per-room 5 GHz
  coverage must be **verified and remediated** (AP placement/power/channel) BEFORE cutover — you
  cannot "leave a weak device on 2.4," because 2.4 won't exist on this SSID. The 42 Pauls already
  holding 5 GHz prove coverage in those spots; the **26 Pauls currently on 2.4** (+ any 2.4 phones)
  are the risk set to survey first.
- **Reprogramming is painful on Helpany's side** — they can't reach offline devices, and key
  rotations need **72 h notice + the new key**. The SSID/password must be right and stable.
- **Helpany bandwidth is negligible:** < 0.04 Mbps per Paul device; whole fleet ~0.38 Mbps low /
  0.75 avg / **1.35 Mbps peak** (peaks ~11:00 AM & 7:00 PM). No capacity threat to voice.

---

## Target design

Repurpose CSC ENT; **no new SSID** (Pauls keep their current SSID + key, so they are NOT
reprogrammed — only band-moved by Helpany).

| Network | Band / Security | Mechanism | Clients | VLAN |
|---|---|---|---|---|
| **CSC ENT** (repurposed) | **5 GHz-only, WPA2-PSK** | **PPSK** | Poly voice handsets | **VLAN 30** (existing voice, keep) |
| | | | Helpany Paul sensors | **VLAN 40** (new, sensors) |
| | | | Proxess door locks | **VLAN 60** (new, access control) |
| **CSCNet** | 2.4 + 5 GHz, WPA2 (today) | PPSK (per-room) | residents + staff IoT/TVs | per-room VLANs (unchanged) |
| **Guest** | 2.4 + 5 GHz, WPA2 | — | guests | VLAN 50 (unchanged) |

**PPSK key map on CSC ENT:**
- Existing key `Ftfd85710#` -> **VLAN 40** (Helpany). Pauls keep SSID + password unchanged.
- New voice key -> **VLAN 30** (phones). Howard/Richard re-point the Polys to this key.
- New door-lock key -> **VLAN 60** (Proxess). UnWired programs the locks onto this key during the install.

> **Door locks confirmed WiFi + 5 GHz-capable (Howard, 2026-07-15).** So the Proxess locks live on
> CSC ENT via their own PPSK -> VLAN 60, exactly like Helpany. Because they do 5 GHz, they work on
> CSC ENT **both before and after** the 5 GHz-only flip — the lock rollout is NOT gated by the
> resident/staff evacuation. Enabling PPSK on CSC ENT is the only near-term prerequisite.

**Only structural change to CSC ENT itself:** flip `wlan_bands` from `[2g,5g]` to `[5g]` and
enable PPSK. The band flip is the step requiring vendor coordination + the coverage check.

### New VLAN 40 (Helpany sensors) — egress-only, isolated like VLAN 30
Mirror the Voice VLAN 30 isolation model: internet/cloud egress only; firewalled off PHI, main
LAN, voice, and resident VLANs (HIPAA). Required outbound destinations (Helpany / Sedimentum,
Ubuntu/snap based):

| Port | Proto | Destinations |
|---|---|---|
| 5671 | AMQPS (SSL) | `*.sedimentum.com` |
| 8883 | MQTT | `*.sedimentum.com` |
| 8030 | HTTP | `*.sedimentum.com` |
| 443 | HTTPS | `*.sedimentum.com`, `snapcraft.io`, `api.snapcraft.io`, `public.apps.ubuntu.com`, `fastly.cdn.snapcraft.io` |

(VLAN 40 = proposed; confirm it is free on pfSense/UniFi before use. Existing VLANs: 1, 20, 30,
50, 999, room VLANs 101-631; "CSC Internal Network" VLAN 10 is a suspected orphan to verify.)

### Why this shape
- **One SSID via PPSK** = minimal beacon airtime on a dense 77-AP site (vs. two separate SSIDs).
- **Pauls not reprogrammed** — same SSID + key, only a remote band move.
- **VLAN separation** keeps voice QoS (DSCP EF) and HIPAA isolation intact; sensor data never
  mixes with voice.
- CSC ENT stays the **WPA2 island**, so a future CSCNet WPA3 migration doesn't touch this gear.

---

## CSC ENT is NOT empty — evacuation prerequisite (live 2026-06-24)

A live pull found **149 clients on CSC ENT**, not a near-empty legacy SSID. Only **68 are Helpany
Pauls** (the anchor that stays). The other **~79 must be moved off first** — 14 staff PCs (already
in the domain-migration plan), 11 printers, **11 DIRECTV resident TVs, 11 resident IoT/TVs (Ring/
Echo/LG/Samsung), 15 personal phones/tablets, 17 unknown/randomized**. About **51 clients are on
2.4 GHz** today and would be **dropped immediately by a 5 GHz-only flip** (25 of them non-Helpany).
Full per-device inventory + the resident "help-reconnect" list:
`csc-ent-client-inventory-2026-06-24.md`. **The resident devices (DIRECTV/Ring/Echo/TVs/phones)
are the visible-impact set — they need a relocation/reconnection plan before the flip.**

## Execution sequence

0. **Remove the ~79 non-Helpany clients from CSC ENT onto EXISTING networks — we do NOT build new
   VLANs for them** (scope decision, Howard 2026-06-24): staff PCs -> CSCNet/INTERNAL (domain
   migration); resident TVs/IoT/phones -> CSCNet (resident PPSK / per-room). Only the **phones and
   Helpany** get dedicated VLANs (30 / 40); internal + resident devices are simply relocated, not
   segmented.
   - **2.4-only devices must land on a 2.4-capable SSID (CSCNet), because CSC ENT is losing 2.4.**
     ~10 of the 11 wireless printers are on 2.4 today and several are likely 2.4-only hardware
     (SOHO Brother/Canon) — move those to CSCNet (which keeps 2.4+5). Verify model if unsure;
     default 2.4 printers to CSCNet.
   - Complete the registry with `stat/alluser` first so offline resident TVs aren't missed. **This
     is the gating sub-project** — see the inventory doc.
1. **Build VLAN 40** on pfSense (igc1.40, DHCP scope, DNS) + firewall egress rules above; mirror
   VLAN 30 isolation.
2. **Enable PPSK on CSC ENT**; add keys: `Ftfd85710#` -> VLAN 40, new voice key -> VLAN 30.
3. **[ONSITE GATE] Verify 5 GHz coverage** in the rooms where Pauls + phones live (per-floor,
   account for steel walls). Use `unifi-wifi` skill (`live-stats.sh --clients`, `watch-ap.sh`).
4. **Disable 2.4 GHz on CSC ENT (-> 5 GHz-only)** (`apply-wlan.sh <site> bands 5g --wlan <CSC ENT>`),
   coordinated with both vendors during a change window. **ORDER MATTERS:** 26 of the 68 Pauls (and
   any 2.4 phones) are on 2.4 today; once 2.4 is off CSC ENT there is **no 2.4 fallback** — a Paul
   with weak 5 GHz signal goes OFFLINE. So Helpany must verify 5 GHz coverage + move those 26 to
   5 GHz FIRST; only then disable 2.4. Likewise confirm no 2.4-only device (printer/IoT) is still on
   CSC ENT before flipping.
5. **Vendors transition their devices:**
   - **Helpany** remotely moves the Pauls to 5 GHz (we hand them: SSID `CSC ENT`, key
     `Ftfd85710#` — unchanged; they confirm strong 2.4 signal per-device first).
   - **Poly/Vertical** (Richard) — phones re-pointed to CSC ENT + the new voice key. Howard can
     do the phone-side SSID change directly.
6. **Pilot first:** move 2-3 phones + bring up a few Pauls on 5 GHz; verify association +
   stability before the full fleet.
7. **Full rollout** of remaining phones + Pauls.
8. **(Optional cleanup)** investigate the stray `element-5b32...` SSID on the controller and the
   orphan "CSC Internal Network" VLAN 10; remove if unused (more airtime/clarity back).

**We do NOT delete CSC ENT** — it becomes the permanent device island. (Supersedes the earlier
"delete CSC ENT" idea, which would have orphaned the Pauls.)

---

## Future (separate project) — CSCNet -> WPA3 / WiFi 7 / 6 GHz

- WiFi 7 on 2.4/5 GHz already works on WPA2 (U7-Pro APs). The thing WPA3 unlocks is the **6 GHz
  band** (6 GHz mandates WPA3 + PMF) — the largest untapped clean capacity at the site.
- Moving phones + Pauls onto CSC ENT is a **prerequisite**, but the real blocker for CSCNet -> WPA3
  is the **~230 resident PPSK clients** (TVs / legacy IoT, many 2.4-only / WPA2-only). That
  migration needs its own resident-device impact survey and is **not** gated by the voice/sensor
  gear.

---

## Vendor contacts
- **Poly / Vertical:** Richard Turner <RTurner@vertical.com>
- **Helpany:** Sandro Cilurzo (CEO) <sandro.cilurzo@helpany.com>; Eugenie Nicoud (COO)
  <eugenie.nicoud@helpany.com>
- **Facility liaison:** John Trozzi (Facilities Director) <john.trozzi@cascadestucson.com>

## Credentials
- **CSC ENT / CSCNet WPA2 key:** `Ftfd85710#` (vault: `clients/cascades-tucson/wifi-cscnet`;
  confirm a CSC-ENT-specific entry exists or add `clients/cascades-tucson/wifi-csc-ent`).
- **New voice PPSK key (VLAN 30):** to be generated + vaulted at
  `clients/cascades-tucson/wifi-voice-ppsk` when created.

## Open items / decisions
1. Confirm VLAN 40 is free (and whether VLAN 10 "CSC Internal Network" is an orphan to reclaim).
2. PPSK-on-one-SSID (recommended) vs. two separate 5 GHz SSIDs — confirm approach.
3. Schedule the coordinated change window with Poly/Vertical + Helpany.
4. Per-room 5 GHz coverage verification (onsite) — the gating task.
