Wi-Fi for schools and educational institutions: design, installation and maintenance

What the Wi-Fi project includes

The project starts with a free initial assessment: floor plans of the school, wall materials, the number of classrooms and of devices per classroom, usage by time slot, and the condition of the cabling, the racks and the internet line. With that information we produce a predictive coverage design, check it during a site visit and deliver a proposal with the location of each access point, the network hardware and cabling required, the planned segmentation and an installation schedule that fits the school calendar.

Sizing is based on classroom density, not floor area: in schools with one device per student, the baseline is an access point inside every classroom, with its own channel and power plan, plus dedicated equipment for the assembly hall, dining hall, library, playgrounds and sports courts. We cover on our blog why school Wi-Fi is one of the hardest environments to cover. After the roll-out, coverage is validated on site, classroom by classroom and outdoors, channels and power levels are fine-tuned with the school up and running, and the installation documentation is handed over.

• Network audit and predictive Wi-Fi survey based on the floor plans, with an on-site check.
• Structured cabling, racks and network hardware with PoE+ or PoE++ and multi-gigabit links.
• Indoor access points and outdoor-rated equipment for playgrounds, sports courts and outdoor areas.
• Configuration of VLANs, SSIDs, authentication and policies for each user group.
• Handover documentation: location plan, labelling of data points and ports, IP addressing, VLANs and configuration.
• Installation planned for school holidays, public holidays or outside school hours; the work can be delivered in phases.

Segmentation: students, teachers, administration and guests

Each user group goes on its own VLAN, with its own addressing and rules: students, teachers, administration, guests and classroom devices such as interactive panels, printers, cameras or access control. Authentication is 802.1X against a RADIUS server that validates credentials from the school's directory, integrated with Google Workspace, Microsoft 365 or LDAP and Active Directory, so each person signs in with their own account and lands in the right segment, with no shared passwords.

Explicit rules apply between segments: administration and the school office have access to servers, shared drives and the academic management platform; the student network does not. On top of that come content filtering and endpoint protection: PenwinSafe, our security layer for schools and colleges, starts at €3.50 per device per year.

• Separate VLANs for students, teachers, administration, guests and classroom devices.
• 802.1X with RADIUS and integration with Google Workspace, Microsoft 365 or LDAP/Active Directory.
• Guest network with an access portal, client isolation and direct internet access.
• Rules between segments reviewed so that the student network cannot reach management servers.
• Content filtering and device protection with PenwinSafe, from €3.50 per device per year.

Maintenance that protects the investment

Once the installation is finished, the service that keeps the school year running begins: 24/7 monitoring with automatic alerts that flag an access point that has gone down, a saturated link or a switch that is having problems before the school calls, technical support with a response within four working hours, firmware and configuration management, and regular performance reviews. The network is run from a cloud controller included in the service, so the school does not buy a management appliance, does not maintain it and does not depend on it staying switched on in the comms cabinet.

We work with Aruba, Meraki, Ubiquiti, Cisco and TP-Link, choosing the platform according to the size of the school, the management model and the equipment already installed. Today we manage more than 300,000 daily connections, 600 TB of internet traffic and more than 1,200 switches and firewalls.

• Cloud controller included: the school neither buys nor maintains a management appliance.
• 24/7 monitoring SaaS with automatic alerts and regular performance reviews.
• Firmware updates and configuration management for all the network hardware.
• Technical support with a response within four working hours.
• Aruba, Meraki, Ubiquiti, Cisco and TP-Link, depending on the size of the school and its management model.

Lifetime warranty: each device covered until the manufacturer declares end of life

The manufacturer's warranty on an access point or a switch is usually one year: it runs out before the equipment starts its second school year in service. From then on, every fault is a cost nobody had budgeted for, and in a school that hurts more than in an office, because the budget is set for each school year. An access point that breaks in February has no budget line to fit into, and the answer ends up being to leave a classroom without coverage until September.

That is why we offer a lifetime warranty on the network infrastructure: access points, switches and firewalls. Until the manufacturer declares end of life for that device, it remains covered, and if it fails it is replaced, with the spare unit, labour and configuration included in the service. There is no need to ask for a quote or get it approved to have Wi-Fi back in the classroom.

Cover is counted device by device, not by a common project date: each model is covered for as long as its manufacturer keeps it alive. When that point comes, it is time to plan the replacement of that generation, in good time and within the multi-year plan, rather than finding out on the day something breaks. In a school that already has network hardware installed, cover for the existing equipment is assessed according to its age; the exact scope is set out in writing in the contract.

• The manufacturer's warranty usually covers one year; this one lasts until the manufacturer declares the model end of life.
• Access points, switches and firewalls: the spare unit, labour and configuration are included.
• No common expiry date: each device is covered according to its own model.
• A network hardware fault stops being an unplanned expense halfway through the school year.
• In a school with equipment already installed, cover is assessed according to its age.

A provider that specialises in education

We have been managing the infrastructure of schools and colleges for more than twelve years, and a school does not behave like an office: maintenance windows with fixed dates, a budget cycle that runs from one school year to the next and an owning body – a religious congregation, foundation, co-operative or board of trustees – that decides on an investment competing with every other budget line for the year. That is why the roll-out is organised by phase of education and by building, critical periods such as exams or admissions are avoided, and the proposal can be delivered in phases. We cover on our blog how network installation work is planned without interrupting lessons.

• Specialising in education across Spain: from concertado and private schools to universities, business schools and vocational training.
• Liaison with school leadership, the IT coordinator, administration and the owning body.
• Over a decade managing the technology infrastructure of schools and colleges across Spain.
• Free, no-obligation assessment and proposal.

Network, Wi-Fi and phone systems in one project, including multi-site institutions

On the same infrastructure we deploy the school's cloud-based virtual phone system: SIP extensions in the school office, reception, departments and offices, softphones, internal dialling between sites with no call charges, and recording and archiving of calls when the school needs it. In institutions with several schools or campuses, a single consistent IP addressing scheme, the same security policies at every site, a common numbering plan and a single monitoring console. We operate from Sant Cugat del Vallès, at Benet Cortada 14, and from our offices in Madrid, at Av. de los Poblados 151, and Jaén, at Almagro 14.

• Multi-site virtual phone system with SIP extensions and softphones.
• Internal dialling between sites, call recording and archiving.
• Voice prioritisation on the same Wi-Fi and wired network the school already uses.
• A single provider for network, Wi-Fi, voice and support, with a single monitoring console.

Frequently asked questions