Wi-Fi 7 Enterprise Deployment: An Engineer’s Playbook

Yes, if your current plant is Wi-Fi 5 or early Wi-Fi 6, your switch plant supports or can be upgraded to 802.3bt PoE++ and mGig uplinks, and your refresh budget is approved. Deploy selectively if your production plant is a recent Wi-Fi 6E install performing to SLA — use Wi-Fi 7 in high-value cells like conference rooms, clinical bays, or gaming pits rather than full-site rip-and-replace.

The MLO resilience story is the strongest near-term justification; raw aggregate-throughput gains depend on client silicon that has not reached mainstream endpoints yet.

Not always, but often on the edges. Cat 6 supports 2.5 and 5 GbE at 100 meters, which covers most Wi-Fi 7 APs in LPI mode. Cat 6A is preferred for 10 GbE uplinks in high-density cells. Existing Cat 5e plant may need spot replacement on longer runs or where 10 GbE is targeted. We validate cabling room by room during predictive design and produce a remediation BOM before APs are ordered, not after.

Cisco (Catalyst 9176/9178 family), Aruba (AP-730 series on ArubaOS 10 / Aruba Central), Juniper Mist (AP47 and AP64), Meraki (MR/CW series Wi-Fi 7), Extreme Networks (AP5010/AP5020 universal hardware), and Ruckus (R770). Feature parity across platforms — particularly MLO mode support and AFC integration — is still converging. We evaluate vendor selection against the customer’s operations model, compliance posture, and existing controller/cloud footprint rather than defaulting to one ecosystem.

Most enterprise Wi-Fi 7 APs require 802.3bt (PoE++ Type 3 at 60W or Type 4 at 90W) for full-radio operation. Wi-Fi 7 PoE requirements are tighter than Wi-Fi 6E: 802.3at (PoE+ at 30W) forces feature downshifts —

reduced spatial streams, disabled auxiliary radios, lower TX power on the 6 GHz radio, or disabled USB. The access-switch refresh to PoE++ is frequently the hidden line item in a Wi-Fi 7 enterprise deployment budget and sometimes exceeds the AP spend.

Yes. Wi-Fi 7 is backward compatible with Wi-Fi 6E and earlier clients on the same SSID. Mixed deployments are common during phased rollouts — Wi-Fi 7 APs in high-density cells and Wi-Fi 6E APs elsewhere. Channel plan and RF targets have to be unified across both AP generations; we re-run the Ekahau predictive against the mixed BOM rather than trusting that a Wi-Fi 6E plan auto-extends.

Only 3 non-overlapping 320 MHz channels exist across UNII-5 through UNII-8 in the US 6 GHz allocation. Practical availability is further constrained by power class — at LPI (Low Power Indoor, 5 dBm/MHz PSD), wide-channel range is limited; at Standard Power, AFC coordination is mandatory and only UNII-5 and UNII-7 are allowed. For most indoor enterprise deployments, 320 MHz is a close-to-AP feature rather than a building-wide design default.

Only for Standard Power operation in 6 GHz (UNII-5 and UNII-7). LPI (Low Power Indoor) and VLP (Very Low Power) classes do not require AFC. Standard Power allows up to 36 dBm EIRP but depends on AFC — a cloud service that queries the FCC incumbent database, returns allowed channels and power for the AP’s geolocation, and requires periodic re-checks.

AFC is most valuable for outdoor campus and yard coverage and for very large indoor spaces where LPI power is insufficient.

MLO helps raw throughput when the client radio supports STR (Simultaneous Transmit and Receive) across two bands with strong inter-radio isolation. Most shipping enterprise clients — phones, laptops, tablets — implement NSTR or EMLSR instead, where the two links share a time-domain schedule.

In those modes, the near-term benefit is redundancy, faster roaming, and band failover, not aggregate throughput. Expect the throughput-aggregation story to improve as STR-capable silicon moves into mainstream endpoints over the next two to three years.

A single-site refresh at ~100 APs typically runs 6–10 weeks end to end: 1–2 weeks discovery, 1–2 weeks Ekahau predictive design and BOM, 2–4 weeks procurement and cabling/switch remediation, 1–2 weeks AP swap and controller cutover, 1 week post-install validation. Multi-site rollouts scale in parallel based on crew count and logistics. We scope the full timeline as a fixed-fee SOW with milestone checkpoints, not hourly.

At the AP itself, the Wi-Fi 7 premium over Wi-Fi 6E varies by vendor and model — typically modest on a per-AP basis. The real cost delta shows up in the infrastructure around the APs: 802.3bt PoE++ switching, mGig uplinks (2.5/5/10 GbE), potential cabling upgrades for 10 GbE runs, and controller/cloud platform versions that may require license tier changes.

For a building that already has PoE+ switching and Cat 5e cabling, the infrastructure delta often equals or exceeds the AP delta.

Budget accordingly, and build the number into the SOW at discovery rather than at install.

Yes. Wi-Fi 7 mandates WPA3 (or OWE) with Protected Management Frames as a mandatory mode for 802.11be rates and MLO. On Cisco Catalyst 9800 IOS-XE 17.15.3 and later, a Wi-Fi 7 SSID must use WPA3 with SAE-EXT-KEY (or SAE/SAE-EXT-KEY combination); transition mode mixing WPA2 and WPA3 is not supported in the 6 GHz band.

If a legacy WPA2-only client associates, 802.11be rates are disabled for the entire BSS — the AP falls back to 802.11ax behavior for every client on that SSID.

Segregate WPA2 clients onto a separate SSID and keep the Wi-Fi 7 SSID strictly WPA3 so MLO, 4K-QAM, and 320 MHz stay reachable.

Send the authentication inventory and we’ll scope the SSID split in a fixed-fee SOW — contact us.

Two, in current firmware: MLMR-STR (Multi-Link Multi-Radio, Simultaneous Transmit/Receive) and EMLSR (Enhanced Multi-Link Single Radio). Per Cisco Meraki’s 802.11be technical guide, MLMR-nSTR and EMLMR have significant implementation complexity and are not adopted in Wi-Fi 7 today.

Per IEEE 802.11be certification, EMLSR support is mandatory for AP MLDs but optional for non-AP MLDs, so most phones and tablets will land on EMLSR for power and cost reasons while most enterprise APs implement STR.

Practical implication: aggregate-throughput demos using STR clients are not representative of the installed fleet; design MLO for roam resilience and redundancy first, and re-benchmark throughput once STR silicon becomes mainstream on laptops and phones.

Our Ekahau-based site survey characterizes MLO behavior at the client, not just the AP.

Standard Power (SP) under AFC control reaches 36 dBm EIRP on the AP with a 23 dBm/MHz PSD cap in UNII-5 and UNII-7; the associated SP client device is capped at 30 dBm EIRP and 17 dBm/MHz PSD. Low Power Indoor (LPI) caps at 5 dBm/MHz PSD (roughly 30 dBm EIRP on a 320 MHz channel), integrated antennas only, no battery-powered APs.

Very Low Power (VLP) runs at -5 dBm/MHz PSD, no AFC, and is allowed indoor or outdoor.

Outdoor 6 GHz is SP-only under FCC rules; indoor APs can run either SP or LPI. LPI APs are prohibited from removable external antennas, so weatherized and external-antenna SKUs are SP-mode only — plan AFC integration explicitly in those deployments.

Seven. On February 23, 2024, the FCC Office of Engineering and Technology approved seven AFC systems for commercial operations: Qualcomm, Federated Wireless, Sony Group Corporation, Comsearch (CommScope), the Wi-Fi Alliance Services Corporation, the Wireless Broadband Alliance,

and Broadcom. These systems manage incumbent-protected spectrum access in UNII-5 (5.925-6.425 GHz) and UNII-7 (6.525-6.875 GHz). The FCC rule: an SP AP must contact its AFC system at least once every 24 hours or cease SP-mode transmission.

Vendor AP firmware typically chains to one or two AFC providers natively; check the vendor/AFC pairing before committing a BOM for outdoor or external-antenna AP SKUs.

Our design deliverables include the AFC provider selection as part of the 6 GHz RF profile spec.

IOS-XE 17.15.x, with 17.15.4d the current Cisco TAC Recommended release for CW9800 + CW9176 / CW9178 for full Wi-Fi 7 feature enablement on Catalyst 9800. CW9178 MLO support was introduced in IOS-XE 17.15.2. Per-WLAN 802.11be enable/disable also arrived in 17.18.1 via wireless profile dot11be mlo-group {24ghz | 5ghz | 5ghz-sec | 6ghz}. WPA3/SAE-EXT enforcement on Wi-Fi 7 SSIDs is optional in 17.15.2 and enforced in 17.15.3.

MLO is automatically enabled once 802.11be is enabled on the WLAN — there’s no separate MLO toggle.

Before a refresh, confirm the controller cluster is at 17.15.x (Cisco TAC Recommended) and redundancy peers match; a mismatched controller pair will silently fall back to 802.11ax behavior on the Wi-Fi 7 AP until both peers are in sync.

802.3bt Class 6 (up to 60W) for full operation on both CW9176I and CW9178I. On 802.3at (PoE+), radios run in a degraded/reduced-stream mode; on 802.3af, all radios are operationally down. Actual power consumption runs 30W to 52W depending on load.

Both include mGig ports at 100M/1G/2.5G/5G/10G BASE-T over Cat 6/6A cabling — Cat 5e will not carry 10 GbE at distance, and that is the number one overlooked line item in a Wi-Fi 7 upgrade budget.

Switch-side, verify the edge switch supplies Class 6 on every AP port, not just a shared port budget.

Send us the switch inventory and cable plant and we’ll return a PoE/cabling gap report inside a fixed-fee SOW from WiFi Hotshots wireless services.

Yes. CW9176I ships a single mGig 100M/1G/2.5G/5G/10G BASE-T uplink; CW9178I ships dual mGig 10G uplinks that can be link-aggregated to 20 Gbps effective. HPE Aruba AP-730 carries dual 5 Gbps ports for redundant data and power. Juniper Mist AP47 provides two 10 Gbps Ethernet ports with failover for data and power.

A 1 GbE uplink caps a single AP well below 1 Gbps after protocol overhead — far below what a Wi-Fi 7 radio can deliver on a 160 or 320 MHz channel.

Edge switches need 2.5G/5G/10G mGig ports at every Wi-Fi 7 AP drop to avoid the wired port being the new bottleneck.

This is usually the quiet driver behind a campus LAN refresh riding alongside the AP refresh.

Wi-Fi 7 MLO at the OS level requires Windows 11 24H2 or later. Per Intel support, on Windows 11 prior to 24H2 the Intel BE200 adapter operates at Wi-Fi 6E capabilities regardless of AP capability. Samsung Galaxy S24 Ultra (Snapdragon 8 Gen 3 with FastConnect 7800) supports full Wi-Fi 7 including 320 MHz and 4K-QAM; US and Exynos-variant S24 and S24+ models ship Wi-Fi 6E only.

Through 2026, MLO-capable clients remain a small minority of the installed enterprise fleet.

Plan for Wi-Fi 6 and 6E clients to dominate usage for the first 12-24 months of any Wi-Fi 7 refresh — design cell sizing, capacity, and channel plan against the actual client mix, not the AP PHY ceiling. Our predictive survey inventories the client endpoint mix before modeling.

No. 320 MHz channels exist exclusively in the 6 GHz band. IEEE 802.11be supports 20, 40, 80, 160, and 320 MHz widths, but only 6 GHz has enough contiguous spectrum for 320 MHz.

The US 6 GHz band offers roughly 1200 MHz of usable spectrum — three non-overlapping 320 MHz channels in LPI mode, typically one usable 320 MHz channel under Standard Power with AFC because of incumbent protection. 2.4 GHz caps at 20 MHz by best practice to preserve channel reuse; 5 GHz caps at 160 MHz.

Marketing decks that show 320 MHz gains at 5 GHz are wrong.

If 320 MHz operation is critical to the use case, the AP class has to be 6 GHz capable and the RF profile has to be designed around that band’s rules.

Roughly 42 dB SNR. Per Cisco Meraki’s 802.11be technical guide, 4K-QAM needs SNR close to 42 dB compared to the 25 dB SNR floor acceptable for 256-QAM in prior generations. Wi-Fi Alliance quantifies 4K-QAM at about 20% higher transmission rates than Wi-Fi 6’s 1024-QAM —

the gain is real but conditional. Practical implication: 4K-QAM is only reachable close to the AP in low-interference environments, typically within a few meters and line-of-sight.

Most clients in a typical enterprise deployment negotiate lower MCS under production conditions.

Capacity plans should sit on 1024-QAM or below at the -67 dBm data-coverage contour; 4K-QAM is a bonus rate, not a design foundation. Our post-install validation surfaces the achievable SNR gradient across the floor plan, not just RSSI coverage.

Standard Power is required for outdoor 6 GHz operation — not restricted to indoor. Per Cisco’s AFC FAQ, the FCC requires outdoor access points to operate in SP mode in the 6 GHz band;

indoor APs can operate in either SP or LPI mode. LPI is indoor-only with integrated antennas and no external antenna option. For weatherized or external-antenna APs — outdoor campus coverage, yard Wi-Fi, stadium bowl coverage — SP under AFC is the only legal path.

Weatherized SP SKUs include Cisco CW9179F, Juniper AP47E-US, and HPE Aruba AP-755.

Plan AFC provider selection, precise geolocation, and height parameters as part of the outdoor design; these are not runtime configuration details that can be patched in after install. The wireless engineering team handles AFC scoping as part of the SP outdoor RF profile.

Wi-Fi 6 / 802.11ax OFDMA allocates exactly one resource unit (RU) per station per transmission. Wi-Fi 7 / 802.11be introduces Multi-RU — multiple RUs allocated to a single STA in the same transmission.

Per Wi-Fi Alliance, this improves flexibility for spectrum resource scheduling and enhances spectrum efficiency; per Juniper Mist’s 802.11be deployment reference, Multi-RU is a core 802.11be airtime feature.

The operational benefit: the AP can skip over narrowband interference or puncture around busy sub-channels and still serve the same client inside one TXOP, rather than waiting for the full channel to clear.

Multi-RU pairs directly with preamble puncturing — both exist to keep wide channels useful when part of the spectrum is occupied.

In dense small-packet environments (conference rooms, classrooms, guest Wi-Fi) the efficiency gain is measurable even before MLO.

Preamble puncturing lets the AP carve out a 20 MHz slice of a wide channel that has interference and keep using the rest of the spectrum instead of abandoning the full channel. Per Cisco Meraki’s 802.11be guide, puncturing is allowed only on channel widths greater than 80 MHz — it is not supported on 40 MHz.

Granularity is 20 MHz per puncture.

Static preamble puncturing is mandatory for Wi-Fi 7 client certification; in Wi-Fi 6 it was optional and therefore rarely implemented. The real payoff lives on 160 MHz and 320 MHz operation, where a single 20 MHz interferer would otherwise force the AP back to 80 MHz or lower.

Ruckus’s vendor blog frames it plainly: puncturing keeps wide channels operational under realistic incumbent and adjacent-channel conditions — exactly where Wi-Fi 7 marketing numbers live or die in a production building.

The controller handles AFC as a proxy. Per Cisco’s Catalyst 9800 AFC configuration guide, individual SP APs are exempt from interfacing with the AFC system directly when the necessary registration data is communicated by a proxy device such as the wireless controller.

The 9800 submits AP geolocation and returns the allowed channel and power list from the AFC provider. APs still need precise geolocation — Cisco CW9176I ships with built-in GPS for AFC, and Juniper AP47 carries a GPS/GNSS receiver for the same reason.

Standard Power must be enabled per 6 GHz RF profile on the controller, and AP height parameters must be configured.

Skipping height configuration or submitting imprecise geolocation will cause AFC to return an empty or overly restrictive channel list — then the AP silently falls back to LPI rules.

Cisco Meraki Wi-Fi 7 APs (CW9171I, CW9172I, CW9172H, CW9176D1, CW9176I, CW9178I) use the unified LIC-CW licensing SKU with two tiers. Essentials covers centralized management, zero-touch firmware updates, open APIs, 24×7 enterprise support, and Cisco Spaces Essentials. Advantage adds Adaptive Policy and Cisco Spaces Advantage. Licensing is unified across Meraki Dashboard and Catalyst 9800 controller management — one license covers the AP regardless of deployment mode, including dual-managed.

Co-Term (legacy term-based) licenses are cloud-only for Wi-Fi 7; subscription licensing is required for on-prem or mixed deployment.

That shift alone is often the first budget conversation on a CW9176/CW9178 refresh, before the AP BOM even gets priced.

The HPE Aruba AP-730 delivers 9.3 Gbps maximum tri-band aggregate data rate across 2.4, 5, and 6 GHz, and up to 14.4 Gbps aggregate using optional dual 5 GHz and dual 6 GHz radio modes. The 730 Series supports EHT20/40/80/160/320 channel widths with data rates from 1 Mbps up to 5.8 Gbps on a single 802.11be EHT320 channel. Minimum software is AOS 10.7 for AP-730, AP-734, and AP-735.

Aruba’s Ultra Tri-Band (UTB) filtering lets 5 GHz and 6 GHz radios operate simultaneously without cross-band restrictions, which is what makes the dual-band-radio mode practical rather than marketing.

Dual 5 GHz and dual 6 GHz modes are where the 14.4 Gbps number lives; tri-band mode sits at 9.3 Gbps.

All five vendors ship 802.11be APs supporting MLMR-STR at minimum; EMLSR and MLMR-nSTR adoption varies. Cisco CW9178I runs quad-radio tri-band (2.4/5/6) with dual mGig 10G uplinks and MLO in low-power mode supported in IOS-XE 17.18.1.

HPE Aruba AP-730 uses UTB filtering for simultaneous 5 GHz and 6 GHz operation at 9.3 Gbps tri-band (14.4 Gbps in dual-radio mode). Juniper AP47 carries four radios — three 4×4 serving plus a dedicated Marvis/ML radio — dual 10 Gbps uplinks, and integrated GPS for AFC.

Ruckus R770 runs 2×2 (2.4) + 4×4 (5) + 2×2 (6) at 12.22 Gbps combined with a 10 Gbps uplink.

Extreme AP5020 ships three 4×4:4 radios up to 20 Gbps aggregate with SDR radios capable of dual 5 GHz and dual 6 GHz modes. MLMR-nSTR and EMLMR are not adopted in any current vendor firmware.

A Wi-Fi 7 SSID in 6 GHz requires stricter crypto than a legacy WPA3 WLAN. Per Cisco’s WPA3 deployment guide and Catalyst 9800 IOS-XE 17.15/17.18 release notes: Personal mode uses WPA3-SAE-EXT-KEY or FT-SAE-EXT-KEY (not plain WPA3-SAE), cipher is GCMP256 (not CCMP128), and PMF is mandatory.

For guest or unauthenticated 6 GHz SSIDs, a pure OWE WLAN is recommended — OWE transition is not supported. Enterprise 802.1X runs WPA3-Enterprise 192-bit for maximum crypto strength, or standard WPA3-Enterprise with GCMP256 otherwise.

Transition modes that mix WPA2 and WPA3 on the same SSID are not supported on Wi-Fi 7 6 GHz WLANs — period.

Plan the SSID authentication policy against this cipher matrix before cutting over, especially where certificate supplicants or legacy printers are in scope. Our network security architecture scope covers the 802.1X and certificate pieces.

IEEE 802.11be-2024 was formally published on 22 July 2025, standardizing 320 MHz channels, MLO, 4K-QAM, Multi-RU, and static preamble puncturing. Wi-Fi CERTIFIED 7 launched earlier — 8 January 2024 — with the Wi-Fi Alliance certification program running against draft amendments ahead of final IEEE publication. Vendor APs shipped as Wi-Fi 7 before mid-2025 rely on Wi-Fi Alliance certification against the draft standard, not the final published amendment.

For procurement documentation and internal security reviews, the dates matter: the Wi-Fi Alliance certification ensures interoperability across certified devices in the certification window, and IEEE publication ratifies the underlying amendment for regulatory and standards reference.

APs certified under the draft and shipping against the final 802.11be-2024 standard are interoperable; the distinction is primarily documentation and compliance tracking.

Per FCC 6 GHz unlicensed rules, the US band provides roughly 1200 MHz across UNII-5 (5.925-6.425 GHz), UNII-6 (6.425-6.525 GHz), UNII-7 (6.525-6.875 GHz), and UNII-8 (6.875-7.125 GHz).

The full band carries 59 non-overlapping 20 MHz channels, 29 × 40 MHz, 14 × 80 MHz, 7 × 160 MHz, and 3 non-overlapping 320 MHz channels in LPI mode.

Under Standard Power with AFC, typically only 1 × 320 MHz channel is usable in the US (Canada allows 2) because SP is restricted to UNII-5 and UNII-7 and AFC trims further based on incumbent protection.

UNII-6 and UNII-8 are LPI and VLP only — not available for SP.

Channel planning has to start from the power class, not the headline channel count.