azcomputerguru/claudetools
1
0
Fork 0
Code Issues 72 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
be2ae8b07e4f2c0b11d12fe5fe4d590a36a975b1
claudetools/clients/cascades-tucson/docs/network/csc-ent-device-island-plan.md
Howard Enos 5c77b88654 sync: auto-sync from HOWARD-HOME at 2026-06-24 11:50:01 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-24 11:50:01
2026-06-24 11:50:29 -07:00

8.2 KiB
Raw Blame History

Cascades — CSC ENT Device-Island Consolidation (Phones + Helpany on 5 GHz)

Decision (2026-06-24, Howard + Mike): Repurpose the existing CSC ENT SSID as the permanent WPA2 / 5 GHz-only device island and consolidate BOTH the Poly voice handsets and the Helpany "Paul" sensors onto it, separated at the VLAN layer via Private PSK (PPSK). This gets both device classes off congested 2.4 GHz, keeps the WPA2-only gear on its own network, and clears the path to eventually move CSCNet to WPA3 / WiFi 7 / 6 GHz.

Companion to network-optimization-master-plan.md, voice-vlan-cutover.md, 2026-06-19-vertical-5ghz-lock-request.md, and docs/REMAINING-WORK-PLAN.md (Workstream 6).

Why (background)

Two separate vendor threads converged on the same fix — a dedicated 5 GHz SSID:

  • Poly voice handsets (Vertical / Richard Turner): several Polys sit on saturated 2.4 GHz despite excellent 5 GHz signal; UniFi band steering (no2ghz_oui, already ON) does not hold the Poly OUI (48:25:67) on 5 GHz. Richard (2026-06-24): phones can't be statically pinned to a band; Poly recommends a separate 5 GHz SSID for the phones (or disabling band steering on a shared SSID so the phone targets 5 GHz itself). See 2026-06-19-vertical-5ghz-lock-request.md.
  • Helpany "Paul" sensors (Sandro Cilurzo / Eugenie Nicoud): the room devices are radar fall/motion sensors (Sedimentum backend — no camera, no microphone), currently programmed onto CSC ENT (WPA2, key Ftfd85710#) and landing on 2.4 GHz. Per Sandro (email 2026-06-19): "Do you have a dedicated 5 GHz network with a separate SSID? If so we can remotely transition the Paul devices to that network... we'd need the SSID and password... if 5 GHz is not available or the signal is not strong enough, the devices default to 2.4 GHz." Helpany's engineering performs the band transition remotely once we provide the network.

CSC ENT was deliberately kept as a WPA2 WiFi5 island by Mike back in March 2026 precisely so the WPA2-only Helpany gear had a home while CSCNet moves to newer standards ("CSCNet is slated to be converted to WiFi7 and will not be compatible with their devices — CSC ENT will remain WiFi5 and is the correct network for them to use."). This plan formalizes and extends that role.

Hard constraints (vendor-stated)

  • Helpany is WPA2-only — explicitly NOT WPA3 or hybrid WPA2/WPA3 ("we don't support hybrid, only WPA2"). The device SSID must stay WPA2-PSK.
  • 5 GHz has shorter range than 2.4 GHz. Both vendors warn: a device with weak 5 GHz signal will fall back to 2.4 GHz or be orphaned. Per-room 5 GHz coverage must be verified before transitioning (Cascades is 6 floors with steel hallway walls). Leave any weak-signal device on 2.4 rather than force it.
  • Reprogramming is painful on Helpany's side — they can't reach offline devices, and key rotations need 72 h notice + the new key. The SSID/password must be right and stable.
  • Helpany bandwidth is negligible: < 0.04 Mbps per Paul device; whole fleet ~0.38 Mbps low / 0.75 avg / 1.35 Mbps peak (peaks ~11:00 AM & 7:00 PM). No capacity threat to voice.

Target design

Repurpose CSC ENT; no new SSID (Pauls keep their current SSID + key, so they are NOT reprogrammed — only band-moved by Helpany).

Network Band / Security Mechanism Clients VLAN
CSC ENT (repurposed) 5 GHz-only, WPA2-PSK PPSK Poly voice handsets VLAN 30 (existing voice, keep)
Helpany Paul sensors VLAN 40 (new, sensors)
CSCNet 2.4 + 5 GHz, WPA2 (today) PPSK (per-room) residents + staff IoT/TVs per-room VLANs (unchanged)
Guest 2.4 + 5 GHz, WPA2 — guests VLAN 50 (unchanged)

PPSK key map on CSC ENT:

  • Existing key Ftfd85710# -> VLAN 40 (Helpany). Pauls keep SSID + password unchanged.
  • New voice key -> VLAN 30 (phones). Howard/Richard re-point the Polys to this key.

Only structural change to CSC ENT itself: flip wlan_bands from [2g,5g] to [5g] and enable PPSK. The band flip is the step requiring vendor coordination + the coverage check.

New VLAN 40 (Helpany sensors) — egress-only, isolated like VLAN 30

Mirror the Voice VLAN 30 isolation model: internet/cloud egress only; firewalled off PHI, main LAN, voice, and resident VLANs (HIPAA). Required outbound destinations (Helpany / Sedimentum, Ubuntu/snap based):

Port Proto Destinations
5671 AMQPS (SSL) *.sedimentum.com
8883 MQTT *.sedimentum.com
8030 HTTP *.sedimentum.com
443 HTTPS *.sedimentum.com, snapcraft.io, api.snapcraft.io, public.apps.ubuntu.com, fastly.cdn.snapcraft.io

(VLAN 40 = proposed; confirm it is free on pfSense/UniFi before use. Existing VLANs: 1, 20, 30, 50, 999, room VLANs 101-631; "CSC Internal Network" VLAN 10 is a suspected orphan to verify.)

Why this shape

  • One SSID via PPSK = minimal beacon airtime on a dense 77-AP site (vs. two separate SSIDs).
  • Pauls not reprogrammed — same SSID + key, only a remote band move.
  • VLAN separation keeps voice QoS (DSCP EF) and HIPAA isolation intact; sensor data never mixes with voice.
  • CSC ENT stays the WPA2 island, so a future CSCNet WPA3 migration doesn't touch this gear.

Execution sequence

  1. Build VLAN 40 on pfSense (igc1.40, DHCP scope, DNS) + firewall egress rules above; mirror VLAN 30 isolation.
  2. Enable PPSK on CSC ENT; add keys: Ftfd85710# -> VLAN 40, new voice key -> VLAN 30.
  3. [ONSITE GATE] Verify 5 GHz coverage in the rooms where Pauls + phones live (per-floor, account for steel walls). Use unifi-wifi skill (live-stats.sh --clients, watch-ap.sh).
  4. Flip CSC ENT to 5 GHz-only (apply-wlan.sh <site> bands 5g --wlan <CSC ENT>), coordinated with both vendors during a change window.
  5. Vendors transition their devices:
    • Helpany remotely moves the Pauls to 5 GHz (we hand them: SSID CSC ENT, key Ftfd85710# — unchanged; they confirm strong 2.4 signal per-device first).
    • Poly/Vertical (Richard) — phones re-pointed to CSC ENT + the new voice key. Howard can do the phone-side SSID change directly.
  6. Pilot first: move 2-3 phones + bring up a few Pauls on 5 GHz; verify association + stability before the full fleet.
  7. Full rollout of remaining phones + Pauls.
  8. (Optional cleanup) investigate the stray element-5b32... SSID on the controller and the orphan "CSC Internal Network" VLAN 10; remove if unused (more airtime/clarity back).

We do NOT delete CSC ENT — it becomes the permanent device island. (Supersedes the earlier "delete CSC ENT" idea, which would have orphaned the Pauls.)

Future (separate project) — CSCNet -> WPA3 / WiFi 7 / 6 GHz

  • WiFi 7 on 2.4/5 GHz already works on WPA2 (U7-Pro APs). The thing WPA3 unlocks is the 6 GHz band (6 GHz mandates WPA3 + PMF) — the largest untapped clean capacity at the site.
  • Moving phones + Pauls onto CSC ENT is a prerequisite, but the real blocker for CSCNet -> WPA3 is the ~230 resident PPSK clients (TVs / legacy IoT, many 2.4-only / WPA2-only). That migration needs its own resident-device impact survey and is not gated by the voice/sensor gear.

Vendor contacts

Credentials

  • CSC ENT / CSCNet WPA2 key: Ftfd85710# (vault: clients/cascades-tucson/wifi-cscnet; confirm a CSC-ENT-specific entry exists or add clients/cascades-tucson/wifi-csc-ent).
  • New voice PPSK key (VLAN 30): to be generated + vaulted at clients/cascades-tucson/wifi-voice-ppsk when created.

Open items / decisions

  1. Confirm VLAN 40 is free (and whether VLAN 10 "CSC Internal Network" is an orphan to reclaim).
  2. PPSK-on-one-SSID (recommended) vs. two separate 5 GHz SSIDs — confirm approach.
  3. Schedule the coordinated change window with Poly/Vertical + Helpany.
  4. Per-room 5 GHz coverage verification (onsite) — the gating task.
Reference in New Issue View Git Blame Copy Permalink