How to Plan Cabling for the Next Refresh Cycle: WiFi 7 and PoE++

A wireless refresh is often treated as a radio project: replace the access points, tune the channels and call it done. That approach can leave you with new WiFi 7 hardware connected through old cabling, undersized switches and undocumented patch panels. The result is expensive equipment running below its potential—and a network that is harder to troubleshoot and secure.

Plan the physical layer as part of the refresh, not as “just plumbing”. Cabling, pathways, patching and switching determine what the network can carry, how it can be segmented, and what your teams can see when something goes wrong. After 12 years working across office fit-outs, OT and corporate networks, and incident response, I’ve seen a surprising number of security and availability problems begin with a cable or switch nobody had properly accounted for.

This guide covers how to plan for WiFi 7, PoE++ and CAT6A headroom while improving the foundations that security controls depend on.

Before ordering cable or scheduling installers, map what the refresh must support over its expected life. WiFi 7 introduces higher potential capacity and new operating options, but actual performance depends on client devices, radio design, uplinks, switching and the wider network. A fast access point connected to a congested or low-speed port is still a bottleneck.

Build an inventory of existing and planned endpoints: wireless access points, cameras, phones, building systems, sensors and any OT equipment. Record where they will be installed, their expected power draw, required data rates, environmental conditions and security zone. Include future capacity rather than designing only for the devices already on the asset register.

Ask the uncomfortable question early: what happens at 2am when this fails? A design that cannot identify the affected cable, switch port or power source will make an ordinary fault feel like an incident.

WiFi 7 can offer higher throughput, lower latency and improved use of spectrum, including the 6 GHz band where permitted and supported. But those benefits do not arrive automatically with the access point. Consider the whole path: radio, Ethernet port, access switch, aggregation layer, firewall policies, WAN and application services.

Some WiFi 7 access points have multi-gigabit Ethernet interfaces, and certain models may have more than one wired interface or specific power requirements. Check the manufacturer’s data sheet for the exact model, including the maximum supported link speed, required PoE class, power under different operating modes and any restrictions on features when using a lower-power supply. Do not assume every WiFi 7 AP needs the same port speed or power budget.

For new horizontal runs, CAT6A is a strong default to consider. It supports 10GBASE-T up to 100 metres under the relevant installation conditions and gives useful capacity for multi-gigabit access points and future endpoint changes. That is what I mean by CAT6A headroom: not a promise that every device will run at 10Gbps, but a sensible way to avoid making a new cabling investment obsolete too soon.

Validate the complete channel, including patch leads and termination quality. A cable category printed on a box does not guarantee the installed link meets that category. Require certification results, retain them with the network documentation and make sure each test result maps to a physical outlet and patch-panel port.

PoE++ is commonly used to describe IEEE 802.3bt power over Ethernet, which has Type 3 and Type 4 power levels. The power available to the powered device is lower than the switch’s stated output because some power is lost along the cable. Check the actual device requirement and the switch’s supported PoE type rather than sizing from a label alone.

Calculate power at the switch level as well as at each port. A switch can support PoE++ on individual ports yet lack enough total power budget to run all connected devices simultaneously. Include startup behaviour, operating modes, planned growth and the consequences of losing a power supply. Where access points are business-critical, consider the resilience of the switch power design and upstream UPS capacity too.

Higher power over copper also makes installation quality and thermal conditions important. Cable bundles, pathway fill, ambient temperature, cable type and installation practice can affect heat dissipation. Use a qualified cabling designer and installer, follow applicable standards and local requirements, and ask for the design assumptions to be documented. Avoid treating a high-density bundle of powered links as an afterthought.

Physical infrastructure is part of cybersecurity, not a separate facilities concern. If an unmanaged switch appears beneath a desk, it can create an undocumented path around access controls. If a patch panel is unlabelled, responders may disconnect the wrong device or miss a rogue connection. If a faulty link causes monitoring traffic to drop, security teams can lose visibility precisely when they need it.

Physical-layer faults create both outages and security blind spots. Intermittent links, damaged connectors, poor terminations and overloaded switches can produce packet loss, link flaps and incomplete telemetry. That can disrupt users and make it harder to distinguish a benign fault from malicious activity. In incident response, a mystery cable is not merely untidy; it is an unanswered question about where traffic goes.

Plan the physical design to support the logical security design. That means documenting which switch ports serve which areas and device types, controlling access to cabinets, securing spare ports, and ensuring the switching platform can enforce the intended policies. Segmentation depends on capable switching and correct design—not simply on creating VLAN numbers in a spreadsheet.

Map the security zones and traffic flows before implementation. Corporate users, guest WiFi, building management, cameras and OT devices should not be casually placed in one broadcast domain. Use appropriate VLANs and access controls, but also define how traffic is permitted between them, where it is inspected, and how exceptions are approved.

Ensure access switches support the required features, such as VLAN assignment, access control lists or equivalent policy enforcement, management-plane protection and suitable monitoring. Confirm that trunks, native VLAN handling, spanning-tree settings and uplink capacity are consistent across the path. A security policy that stops at the access switch is not useful if downstream design reconnects zones without control.

Firewalls can enforce boundaries between zones and inspect permitted flows. Endpoint detection platforms can provide visibility into activity on managed hosts. Neither replaces sound switching, reliable cabling or a clear network map. Similarly, network visibility tools and packet capture can help investigate traffic, but they need a stable, documented path to the relevant links. Garland, for example, offers network visibility and packet-broker solutions that may be useful in architectures where traffic needs to be aggregated for monitoring.

Office standards do not always suit plant rooms, warehouses or outdoor locations. OT networks may include equipment with long service lives, fixed configurations and strict uptime requirements. Environmental conditions, electromagnetic interference, distance, temperature and vibration can all affect the choice of cable, enclosure and switching hardware.

In these areas, confirm the requirements with operations and the equipment vendor before changing topology or addressing. Industrial networking suppliers such as MOXA offer products designed for industrial environments, but the model and deployment still need to match the site’s temperature range, mounting, power and security requirements. Avoid introducing a device simply because it has an industrial-looking case; include it in the asset inventory, configuration baseline and support plan.

For long runs or noisy environments, fibre may be the better choice for uplinks or inter-building connections. Plan the fibre type, connector standard, spare strands and termination locations. Keep power delivery separate from data where copper PoE distances or environmental constraints make it unsuitable.

A cabling refresh is a rare chance to remove accumulated uncertainty. Require installers to label both ends of every run using a consistent scheme, update rack elevations and port maps, and provide cable test results in a usable format. Mark abandoned cables for removal or clearly identify why they remain. If you cannot tell whether a cable is live, spare or forgotten, you have inherited risk.

Keep network management out of the user and guest networks. Change default credentials, use secure management protocols, restrict administrative access and record switch configurations in a controlled repository. Ensure monitoring covers switch health, port status, PoE consumption, errors and uplink utilisation. A link that is technically up but accumulating errors deserves attention.

Vendors such as Cisco may form part of a switching and wireless refresh, but procurement should follow requirements rather than brand preference. Validate interoperability, licensing, support lifecycle, feature cyberdaily.au sets and operational skills. The right design is one your team can secure and support—not just one that looks impressive in a bill of materials.

ACSC guidance on secure network design and cyber security practices assumes that organisations have dependable foundations to build on. Segmentation, secure administration, monitoring and incident response all rely on knowing what is connected, where traffic flows and whether the infrastructure is behaving as intended. Guidance cannot compensate for undocumented switching, unmanaged devices or failed physical links.

Use the refresh to review relevant ACSC guidance alongside your organisation’s risk assessment and operational requirements. Translate broad principles into practical controls: approved switch configurations, controlled change management, tested backups, restricted management access, documented network zones and a process for investigating unknown devices. Make sure the design is reviewed by both security and operations teams.

WiFi 7 and PoE++ can deliver valuable capability, but only when the cabling, switching and power design are ready for them. CAT6A headroom, verified power budgets, capable switching and accurate documentation help keep performance predictable and security controls enforceable.

Most importantly, treat the physical layer as part of the security architecture. Label it, test it, monitor it and include it in incident response planning. The label maker in my laptop bag gets a workout on refresh projects for a reason: when something fails at 2am, clear labels and a known-good design can save hours—and prevent a small fault becoming a security blind spot.