Rolling out wireless in a government setting is not the same as deploying it in a corporate office. The buildings are older, the user population is enormous and varied, the security requirements go well beyond what most enterprise policies cover, and the expectation is that it just works — for ministers, for clerks, for visiting delegates, and for the devices they bring through the door.

I've been responsible for end-to-end wireless services across NICNET for over a decade — which means I've seen what breaks, when it breaks, and why. The architecture we settled on is centralised controller-based, which makes large-scale management possible. Authentication runs on 802.1X with a RADIUS backend. For IoT and legacy devices that can't do 802.1X, we use Identity PSK (iPSK) — each device gets its own unique key without the management overhead of full 802.1X. Rogue AP containment runs continuously because in a shared government building, unauthorised APs get plugged in — and detecting them quickly matters.

I documented the methodology we developed in the TUNE INTO WLC handbook (ISBN 978-93-5419-656-0, Copyright L-97828/2020) so that teams across NIC could build on it rather than rediscovering the same lessons at every new site.

Five phases, every time — no exceptions.