azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
dbe355a2d5dcf8263b0fbe08bb93e5c838f4e69c
claudetools/clients/cascades-tucson/docs/network/csc-ent-device-island-plan.md
Howard Enos 2a1a275511 sync: auto-sync from HOWARD-HOME at 2026-06-24 17:37:00 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-24 17:37:00
2026-06-24 17:37:35 -07:00

11 KiB
Raw Blame History

Cascades — CSC ENT Device-Island Consolidation (Phones + Helpany on 5 GHz)

Decision (2026-06-24, Howard + Mike): Repurpose the existing CSC ENT SSID as the permanent WPA2 / 5 GHz-only device island and consolidate BOTH the Poly voice handsets and the Helpany "Paul" sensors onto it, separated at the VLAN layer via Private PSK (PPSK). This gets both device classes off congested 2.4 GHz, keeps the WPA2-only gear on its own network, and clears the path to eventually move CSCNet to WPA3 / WiFi 7 / 6 GHz.

Companion to network-optimization-master-plan.md, voice-vlan-cutover.md, 2026-06-19-vertical-5ghz-lock-request.md, and docs/REMAINING-WORK-PLAN.md (Workstream 6).

Why (background)

Two separate vendor threads converged on the same fix — a dedicated 5 GHz SSID:

  • Poly voice handsets (Vertical / Richard Turner): several Polys sit on saturated 2.4 GHz despite excellent 5 GHz signal; UniFi band steering (no2ghz_oui, already ON) does not hold the Poly OUI (48:25:67) on 5 GHz. Richard (2026-06-24): phones can't be statically pinned to a band; Poly recommends a separate 5 GHz SSID for the phones (or disabling band steering on a shared SSID so the phone targets 5 GHz itself). See 2026-06-19-vertical-5ghz-lock-request.md.
  • Helpany "Paul" sensors (Sandro Cilurzo / Eugenie Nicoud): the room devices are radar fall/motion sensors (Sedimentum backend — no camera, no microphone), currently programmed onto CSC ENT (WPA2, key Ftfd85710#) and landing on 2.4 GHz. Per Sandro (email 2026-06-19): "Do you have a dedicated 5 GHz network with a separate SSID? If so we can remotely transition the Paul devices to that network... we'd need the SSID and password... if 5 GHz is not available or the signal is not strong enough, the devices default to 2.4 GHz." Helpany's engineering performs the band transition remotely once we provide the network.

CSC ENT was deliberately kept as a WPA2 WiFi5 island by Mike back in March 2026 precisely so the WPA2-only Helpany gear had a home while CSCNet moves to newer standards ("CSCNet is slated to be converted to WiFi7 and will not be compatible with their devices — CSC ENT will remain WiFi5 and is the correct network for them to use."). This plan formalizes and extends that role.

Hard constraints (vendor-stated)

  • Helpany is WPA2-only — explicitly NOT WPA3 or hybrid WPA2/WPA3 ("we don't support hybrid, only WPA2"). The device SSID must stay WPA2-PSK.
  • Neither vendor can pin a device to 5 GHz from their side (confirmed: Poly/Vertical AND Helpany support, 2026-06-24). The handsets/Pauls choose the band themselves, and band steering doesn't hold them. Therefore a 5 GHz-only SSID (2.4 disabled) is the ONLY mechanism — you remove 2.4 as an option so the device has nowhere else to associate. This is the whole basis of the plan.
  • Consequence — 5 GHz coverage is now a HARD GATE, with no safety net. On a 5 GHz-only SSID there is no 2.4 fallback: a Paul/phone in a weak-5 GHz spot will simply fail to connect (not drop to 2.4). 5 GHz has shorter range and Cascades has steel walls. So per-room 5 GHz coverage must be verified and remediated (AP placement/power/channel) BEFORE cutover — you cannot "leave a weak device on 2.4," because 2.4 won't exist on this SSID. The 42 Pauls already holding 5 GHz prove coverage in those spots; the 26 Pauls currently on 2.4 (+ any 2.4 phones) are the risk set to survey first.
  • Reprogramming is painful on Helpany's side — they can't reach offline devices, and key rotations need 72 h notice + the new key. The SSID/password must be right and stable.
  • Helpany bandwidth is negligible: < 0.04 Mbps per Paul device; whole fleet ~0.38 Mbps low / 0.75 avg / 1.35 Mbps peak (peaks ~11:00 AM & 7:00 PM). No capacity threat to voice.

Target design

Repurpose CSC ENT; no new SSID (Pauls keep their current SSID + key, so they are NOT reprogrammed — only band-moved by Helpany).

Network Band / Security Mechanism Clients VLAN
CSC ENT (repurposed) 5 GHz-only, WPA2-PSK PPSK Poly voice handsets VLAN 30 (existing voice, keep)
Helpany Paul sensors VLAN 40 (new, sensors)
CSCNet 2.4 + 5 GHz, WPA2 (today) PPSK (per-room) residents + staff IoT/TVs per-room VLANs (unchanged)
Guest 2.4 + 5 GHz, WPA2 — guests VLAN 50 (unchanged)

PPSK key map on CSC ENT:

  • Existing key Ftfd85710# -> VLAN 40 (Helpany). Pauls keep SSID + password unchanged.
  • New voice key -> VLAN 30 (phones). Howard/Richard re-point the Polys to this key.

Only structural change to CSC ENT itself: flip wlan_bands from [2g,5g] to [5g] and enable PPSK. The band flip is the step requiring vendor coordination + the coverage check.

New VLAN 40 (Helpany sensors) — egress-only, isolated like VLAN 30

Mirror the Voice VLAN 30 isolation model: internet/cloud egress only; firewalled off PHI, main LAN, voice, and resident VLANs (HIPAA). Required outbound destinations (Helpany / Sedimentum, Ubuntu/snap based):

Port Proto Destinations
5671 AMQPS (SSL) *.sedimentum.com
8883 MQTT *.sedimentum.com
8030 HTTP *.sedimentum.com
443 HTTPS *.sedimentum.com, snapcraft.io, api.snapcraft.io, public.apps.ubuntu.com, fastly.cdn.snapcraft.io

(VLAN 40 = proposed; confirm it is free on pfSense/UniFi before use. Existing VLANs: 1, 20, 30, 50, 999, room VLANs 101-631; "CSC Internal Network" VLAN 10 is a suspected orphan to verify.)

Why this shape

  • One SSID via PPSK = minimal beacon airtime on a dense 77-AP site (vs. two separate SSIDs).
  • Pauls not reprogrammed — same SSID + key, only a remote band move.
  • VLAN separation keeps voice QoS (DSCP EF) and HIPAA isolation intact; sensor data never mixes with voice.
  • CSC ENT stays the WPA2 island, so a future CSCNet WPA3 migration doesn't touch this gear.

CSC ENT is NOT empty — evacuation prerequisite (live 2026-06-24)

A live pull found 149 clients on CSC ENT, not a near-empty legacy SSID. Only 68 are Helpany Pauls (the anchor that stays). The other ~79 must be moved off first — 14 staff PCs (already in the domain-migration plan), 11 printers, 11 DIRECTV resident TVs, 11 resident IoT/TVs (Ring/ Echo/LG/Samsung), 15 personal phones/tablets, 17 unknown/randomized. About 51 clients are on 2.4 GHz today and would be dropped immediately by a 5 GHz-only flip (25 of them non-Helpany). Full per-device inventory + the resident "help-reconnect" list: csc-ent-client-inventory-2026-06-24.md. The resident devices (DIRECTV/Ring/Echo/TVs/phones) are the visible-impact set — they need a relocation/reconnection plan before the flip.

Execution sequence

  1. Remove the ~79 non-Helpany clients from CSC ENT onto EXISTING networks — we do NOT build new VLANs for them (scope decision, Howard 2026-06-24): staff PCs -> CSCNet/INTERNAL (domain migration); resident TVs/IoT/phones -> CSCNet (resident PPSK / per-room). Only the phones and Helpany get dedicated VLANs (30 / 40); internal + resident devices are simply relocated, not segmented.
    • 2.4-only devices must land on a 2.4-capable SSID (CSCNet), because CSC ENT is losing 2.4. ~10 of the 11 wireless printers are on 2.4 today and several are likely 2.4-only hardware (SOHO Brother/Canon) — move those to CSCNet (which keeps 2.4+5). Verify model if unsure; default 2.4 printers to CSCNet.
    • Complete the registry with stat/alluser first so offline resident TVs aren't missed. This is the gating sub-project — see the inventory doc.
  2. Build VLAN 40 on pfSense (igc1.40, DHCP scope, DNS) + firewall egress rules above; mirror VLAN 30 isolation.
  3. Enable PPSK on CSC ENT; add keys: Ftfd85710# -> VLAN 40, new voice key -> VLAN 30.
  4. [ONSITE GATE] Verify 5 GHz coverage in the rooms where Pauls + phones live (per-floor, account for steel walls). Use unifi-wifi skill (live-stats.sh --clients, watch-ap.sh).
  5. Disable 2.4 GHz on CSC ENT (-> 5 GHz-only) (apply-wlan.sh <site> bands 5g --wlan <CSC ENT>), coordinated with both vendors during a change window. ORDER MATTERS: 26 of the 68 Pauls (and any 2.4 phones) are on 2.4 today; once 2.4 is off CSC ENT there is no 2.4 fallback — a Paul with weak 5 GHz signal goes OFFLINE. So Helpany must verify 5 GHz coverage + move those 26 to 5 GHz FIRST; only then disable 2.4. Likewise confirm no 2.4-only device (printer/IoT) is still on CSC ENT before flipping.
  6. Vendors transition their devices:
    • Helpany remotely moves the Pauls to 5 GHz (we hand them: SSID CSC ENT, key Ftfd85710# — unchanged; they confirm strong 2.4 signal per-device first).
    • Poly/Vertical (Richard) — phones re-pointed to CSC ENT + the new voice key. Howard can do the phone-side SSID change directly.
  7. Pilot first: move 2-3 phones + bring up a few Pauls on 5 GHz; verify association + stability before the full fleet.
  8. Full rollout of remaining phones + Pauls.
  9. (Optional cleanup) investigate the stray element-5b32... SSID on the controller and the orphan "CSC Internal Network" VLAN 10; remove if unused (more airtime/clarity back).

We do NOT delete CSC ENT — it becomes the permanent device island. (Supersedes the earlier "delete CSC ENT" idea, which would have orphaned the Pauls.)

Future (separate project) — CSCNet -> WPA3 / WiFi 7 / 6 GHz

  • WiFi 7 on 2.4/5 GHz already works on WPA2 (U7-Pro APs). The thing WPA3 unlocks is the 6 GHz band (6 GHz mandates WPA3 + PMF) — the largest untapped clean capacity at the site.
  • Moving phones + Pauls onto CSC ENT is a prerequisite, but the real blocker for CSCNet -> WPA3 is the ~230 resident PPSK clients (TVs / legacy IoT, many 2.4-only / WPA2-only). That migration needs its own resident-device impact survey and is not gated by the voice/sensor gear.

Vendor contacts

Credentials

  • CSC ENT / CSCNet WPA2 key: Ftfd85710# (vault: clients/cascades-tucson/wifi-cscnet; confirm a CSC-ENT-specific entry exists or add clients/cascades-tucson/wifi-csc-ent).
  • New voice PPSK key (VLAN 30): to be generated + vaulted at clients/cascades-tucson/wifi-voice-ppsk when created.

Open items / decisions

  1. Confirm VLAN 40 is free (and whether VLAN 10 "CSC Internal Network" is an orphan to reclaim).
  2. PPSK-on-one-SSID (recommended) vs. two separate 5 GHz SSIDs — confirm approach.
  3. Schedule the coordinated change window with Poly/Vertical + Helpany.
  4. Per-room 5 GHz coverage verification (onsite) — the gating task.
Reference in New Issue View Git Blame Copy Permalink