Office guest WiFi in Dubai is more nuanced than just creating a second SSID with a separate password. Done well, it isolates guest traffic from internal systems, caps bandwidth so guests don't saturate your business circuit, brands the experience, captures email or contact info for marketing, and meets TDRA (Telecommunications and Digital Government Regulatory Authority) compliance if you're a hotel or public-facing venue. Here's the full setup playbook Azizi Technologies runs on every Dubai office guest WiFi job.
1. Separate VLAN for guests - isolation is the point
Guest WiFi must be on a separate VLAN (typically VLAN 20) firewalled from internal VLANs (staff on VLAN 10, IoT on 30, servers on 40). A compromised guest device must never be able to reach your file server, ERP system, or VoIP phones. Configure inter-VLAN deny rules at the firewall (FortiGate, Meraki MX, UDM Pro) - guest VLAN can reach the internet only, not 10.0.0.0/8 or other internal ranges.
2. Captive portal for branding and capture
A captive portal is the splash page guests see when they connect - typically with your logo, WiFi name, terms of use, and either a 'Connect' button or an email-collect form. Vendors: Ubiquiti UniFi built-in captive portal (free), Cisco Meraki Splash Page (built into Meraki licence), Aruba ClearPass, Aircove, Tanaza, Cloud4Wi, EasyWiFi. Marketing-focused captive portals integrate with Mailchimp, HubSpot or Salesforce to add visitors to email lists.
3. TDRA compliance for public-facing guest WiFi
Hotels, hospitality venues, retail outlets and cafes serving the public in Dubai must comply with TDRA regulations for guest WiFi: log every guest connection with verified identity (passport, Emirates ID, or OTP-verified mobile number), retain logs for at least 12 months, block prohibited content (VPN, gambling, certain political content). Standard office WiFi for visitors and clients is NOT subject to TDRA compliance - only public guest WiFi is. If your office only has occasional client visitors, you don't need TDRA-level captive portal.
4. Bandwidth caps per guest
Don't let guests saturate your office line. Standard bandwidth caps: 5 Mbps per guest in low-traffic offices, 10 Mbps in retail / hospitality with high WiFi expectation, 25 Mbps in coworking spaces or hotels marketing as 'business-grade WiFi'. Configure per-client rate limiting at the AP or controller level - UniFi Network, Meraki Dashboard, and Aruba Central all support this natively.
5. Session timeout and re-authentication
Guest sessions should expire to free up DHCP leases and re-validate identity. Standard timeouts: 4 hours for office visitor WiFi, 24 hours for hotel guests, 1 hour for cafe/retail walk-ins. After timeout, guests see the captive portal again and re-accept terms. Reduces unauthorised long-term use by neighbouring offices or street-level squatters.
6. WPA2 or WPA3 for the guest SSID
Use WPA2-Personal (shared password) for guest SSID - it's fine for the threat model. WPA3 is optional and adds slight authentication delay during captive portal redirects. Open (no password) guest SSIDs are not recommended - they expose guest device traffic to wireless eavesdropping. The captive portal can show the WiFi password on the splash screen for ease of guest connection.
| Office Type | Captive Portal | Setup Cost AED | Monthly AED |
|---|---|---|---|
| SMB office (5-25 staff) | UniFi built-in | AED 0 (included in WiFi install) | AED 0 |
| Mid-office (25-75 staff) | Meraki / Aruba built-in | AED 0 (included with hardware) | AED 0 |
| Hotel boutique (TDRA) | Aircove or Tanaza | AED 3,500-6,500 | AED 200-500 |
| Retail / cafe (TDRA) | EasyWiFi or Cloud4Wi | AED 2,500-5,000 | AED 150-400 |
| Marketing-focused (CRM) | Tanaza + HubSpot integration | AED 5,500-12,000 | AED 400-800 |
Guest WiFi setup cost by Dubai office size
7. Default deny on inter-VLAN routing
On the firewall, configure 'default deny' between guest VLAN and any internal VLAN, with explicit allow rules only for specifically needed services (e.g. internal printer for client print jobs, if needed - but usually not even that). Most Dubai office guest VLANs only have internet egress, no internal access at all. This single firewall rule prevents 90 percent of guest-WiFi-based attacks.
8. Branding the captive portal experience
Upload your office or hotel logo, set brand colours, write a welcome message in English plus Arabic where appropriate. Include 'Terms of Service' and 'Privacy Policy' links - mandatory for TDRA compliance, recommended for everyone else. Add social-login (LinkedIn for professional offices, Facebook for retail) to increase capture rates. Test the experience on iPhone Safari, Android Chrome, and laptop browser before launching.
Free Dubai office guest WiFi setup quote
Send your office or hotel address, rough staff/guest count, and any TDRA compliance needs - we'll quote a guest WiFi setup including captive portal, VLAN isolation, branding, and any compliance work needed. Free site survey before quote.
Frequently asked questions
Do I need TDRA approval for office guest WiFi in Dubai?
Only for public-facing venues (hotels, cafes, retail, hospitality). A regular office where occasional clients visit doesn't need TDRA captive portal compliance. Hotels with 20+ rooms or any business marketing WiFi to walk-in customers does need it.
Can guest WiFi use the same APs as staff WiFi?
Yes - all enterprise APs (UniFi, Meraki, Aruba, Omada) broadcast multiple SSIDs simultaneously, each mapped to a separate VLAN. One physical AP, multiple isolated networks. Standard part of every office WiFi install.
How do I prevent guests from using too much bandwidth?
Per-client rate limiting at the AP/controller. Standard caps: 5 Mbps per guest for offices, 10-25 Mbps for hospitality. Plus QoS rules that prioritise staff traffic so even if guests max their cap, staff still gets bandwidth.
Should I require email registration on guest WiFi?
If you want to build a marketing list, yes - integrate captive portal with Mailchimp / HubSpot / Salesforce so each guest connection creates a CRM lead. If you just need WiFi to 'work' for clients, a simple 'Accept Terms' click is fine.
What's the legal liability if a guest does something illegal on my office WiFi?
Best practice: have a written Acceptable Use Policy that guests accept via captive portal click-through. This shifts liability to the guest. TDRA-regulated venues must additionally log identity and connection times. Talk to a Dubai-licensed lawyer for specific liability advice.
Do you offer guest WiFi as part of office WiFi installation in Dubai?
Yes - guest WiFi setup with captive portal, VLAN isolation, bandwidth caps, and basic branding is included in every Azizi Technologies office WiFi installation at no extra cost. Advanced CRM integration or TDRA compliance for hospitality is quoted separately.
Azizi Technologies Team
· Editorial TeamPractical IT and digital marketing guidance from the Azizi Technologies team - an in-house team of certified engineers, SEO specialists, and digital marketers serving Dubai businesses since 2007.
Ready to get the same results we wrote about?
Free 24-hour SEO audit. Transparent AED pricing. Real Dubai client case studies. No sales call required.