Offices
Office towers and business centres
One box, a separate portal for each tenant. Every tenant's visitors stay on their own network; the records stay with building management.
- One SSID per tenant
- One box, many portals
- Coupons from reception
- Visitors kept apart
One building, dozens of employers, one internet line
In an office tower the internet is often provided by building management or the common-area operator, while tenant companies host visitors in the lobby, in meeting rooms and on their own floors. Everyone wants to offer visitors Wi-Fi, but nobody can answer 'whose network is it, and whose records?'
Tenants do not trust each other, and rightly so. Company A's visitor should never see Company B's printer. In practice, though, a single 'Plaza-Guest' password hangs at the door, unchanged for years, with no idea who has connected.
Reception, meanwhile, fields the same question all day: 'What's the Wi-Fi password?' Spelling it out for a five-person delegation, then doing something else for the courier, all takes time.
Law 5651 and building management
The party that offers visitors internet access is what Law 5651 calls a collective-use provider, expected to keep internal IP assignment records, protect them with a timestamp and retain them for 2 years. In an office tower, whether that party is building management, the tenant using the line, or both depends on the contracts; take legal advice. Either way the box records each tenant's traffic through its own portal and VLAN, so the records can be presented separately to whichever party they belong to.
This page is not legal advice; confirm your obligations with your legal adviser.
Installing in the building
- 1
The box sits on the building backbone, between the internet uplink and the floor switches. The existing AP infrastructure stays, with no extra AP licences.
- 2
Each tenant gets its own VLAN and SSID; the box serves each VLAN a separate portal carrying that tenant's logo. Tenants' visitors cannot see each other's devices.
- 3
A shared 'Plaza-Guest' SSID is defined for the lobby and meeting rooms; client isolation is enabled on the APs in common areas.
- 4
Building management's own cameras, lift and automation systems stay entirely outside the guest VLANs, on the management network.
- 5
Reception gets a panel role limited to issuing coupons; the right to view records and phone numbers stays with the authorised role in building management.
Sign-in method
Sign-in method
- SMS code
- Coupon
- Registered user
For the lobby and meeting rooms, reception prints coupons sized to the length of the meeting when a delegation arrives; when the meeting ends, so does the coupon. Day visitors use an SMS code. Consultants and suppliers who visit tenants regularly are set up as registered users and are not asked for a code each time. Recommended plan: the staff template, 20/10 Mbps, 10-hour session, 30-minute idle timeout, 3 devices, no quota, 30-day device remembering.
Ready-made plan templates
Speed, session and device count are set per plan on the box, independent of the access point brand. The values below are our own lab recommendations and can be changed in the panel.
- Recommended for this sector
Staff-guest
Offices, factories, office towers, logistics, tutoring centres
- Speed (down / up)
- 20 / 10 Mbps
- Session
- 10 hours
- Idle timeout
- 30 min
- Devices
- 3
- Daily quota
- None
- Remembered device
- 30 days
Registered users or coupon groups; separate groups for suppliers and subcontractors.
Standard
Cafés, restaurants, shops, bakeries, salons, gyms
- Speed (down / up)
- 10 / 5 Mbps
- Session
- 2 hours
- Idle timeout
- 15 min
- Devices
- 2
- Daily quota
- 1 GB
- Remembered device
- Off
Keeps tables turning; a guest who wants more gets a coupon from the till.
Conference
Events, fairs, waiting lounges, cinemas, bank branches
- Speed (down / up)
- 5 / 2 Mbps
- Session
- 4 hours
- Idle timeout
- 10 min
- Devices
- 1
- Daily quota
- 500 MB
- Remembered device
- Off
Low speed and one device for many simultaneous users; capacity 250 concurrent devices.
Extended stay
Hotels, serviced apartments, dormitories, hospitals, residential complexes
- Speed (down / up)
- 15 / 5 Mbps
- Session
- 24 hours
- Idle timeout
- 30 min
- Devices
- 3
- Daily quota
- 5 GB
- Remembered device
- 7 days
No new code every day; in dormitories the remembered window can span the whole term.
What is recorded
- Which tenant's portal the sign-in came through (VLAN/SSID)
- Phone number (encrypted, masked), coupon code or registered user name
- MAC address and the assigned internal IP
- Session start and end
- The daily hash chain and timestamp
What is not recorded
- Websites visited and e-mail content
- Files shared in meetings
- Which floor the visitor went to, or any indoor location
- Tenant companies' own internal network traffic
Example scenario
Example scenario: a 14-storey business centre
- Problem
- The building had used the same single guest password for years. Two tenants had set up their own guest networks and building management did not know which network belonged to whom. None kept signed records.
- Solution
- One box was placed on the backbone. Each tenant received an SSID with its own branded portal; the lobby and meeting floors were grouped on a shared SSID. Reception was given a coupon-printing role and the tenants' regular consultants were made registered users.
- Outcome
- Reception no longer reads out passwords; it prints coupons matched to the meeting length. Each tenant's visitors see only their own portal. Building management monitors every floor from one panel and can export the archive tenant by tenant.
An illustrative example; no real business is named.
Frequently asked
Do we need one box per tenant?
No. A single box serves a separate portal to each VLAN; you just define an SSID and portal per tenant. The limit is the total number of visitors across all tenants: the Box + Software licence covers up to 250 concurrent devices. In busier buildings a second box or a Virtual Appliance can serve separate sections.
Can a tenant see its own visitor records?
With role-based permissions you can give a tenant's contact an account that sees reports for their SSID only. Phone numbers appear masked; the full number is visible only to the authorised role building management designates. Every view is written to the audit trail.
How does reception hand out coupons?
Reception opens its panel, generates a coupon group sized to the meeting length and headcount, and prints them or shows them on screen. Validity period and device count are set on the group. When the meeting ends the coupon expires; the network may stay up overnight, but nobody gets in without a valid coupon.
Does tenants' internal traffic pass through the box?
It does not, and it should not. The box manages only the guest VLANs; each tenant's corporate network stays behind its own firewall. The box is a pfSense firewall, but it does not replace an enterprise UTM.
Do SMS codes reach foreign visitors' numbers?
Yes. Codes are sent to foreign numbers, and you can route international numbers through a separate SMS provider to manage the cost. For foreign delegations a reception coupon is often the more practical option.
A 20-minute demo for your own venue
Let's work out your device count and sign-in method together.
Request a demo