Office guest WiFi in Dubai is more nuanced than just creating a second SSID with a separate password. Done well, it isolates guest traffic from internal systems, caps bandwidth so guests don't saturate your business circuit, brands the experience, captures email or contact info for marketing, and meets TDRA (Telecommunications and Digital Government Regulatory Authority) compliance if you're a hotel or public-facing venue. Here's the full setup guide Azizi Technologies runs on every Dubai office guest WiFi job.
What does a complete office guest WiFi setup include?
A complete Dubai office guest WiFi setup has six layers: a guest VLAN isolated from internal networks, a captive portal for branding and terms acceptance, per-guest bandwidth caps, session timeouts, WPA2 or WPA3 encryption, and default-deny firewall rules. Most offices already own hardware that supports all six - the work is configuration, not new kit.
- Guest VLAN (typically VLAN 20) with its own DHCP scope, firewalled from staff, servers and IoT
- Captive portal splash page with logo, terms of use and optional email capture
- Per-client rate limit of 5-25 Mbps depending on venue type
- Session timeout of 1-24 hours so DHCP leases recycle and terms get re-accepted
- WPA2-Personal or WPA3 on the guest SSID - never an open network
- Default-deny firewall rule between the guest VLAN and every internal subnet
Separate VLAN for guests - isolation is the point
Guest WiFi must be on a separate VLAN (typically VLAN 20) firewalled from internal VLANs (staff on VLAN 10, IoT on 30, servers on 40). A compromised guest device must never be able to reach your file server, ERP system, or VoIP phones. Configure inter-VLAN deny rules at the firewall (FortiGate, Meraki MX, UDM Pro) - guest VLAN can reach the internet only, not 10.0.0.0/8 or other internal ranges.
Size the guest DHCP scope generously. A 30-staff office hosting a training day can see 60-80 guest devices, so a /24 scope (254 addresses) with a 4-hour lease is the practical minimum - busy showrooms and clinics get a /23. An exhausted scope looks identical to 'broken WiFi' to the guest standing in reception.
Enable client isolation on the guest SSID
Beyond the VLAN firewall rule, switch on layer-2 client isolation on the guest SSID itself - one checkbox in UniFi, Meraki and Omada. Guests keep full internet access but cannot see each other's devices, which matters the day a visitor's laptop arrives already infected.
Captive portal for branding and capture
A captive portal is the splash page guests see when they connect - typically with your logo, WiFi name, terms of use, and either a 'Connect' button or an email-collect form. Vendors: Ubiquiti UniFi built-in captive portal (free), Cisco Meraki Splash Page (built into Meraki licence), Aruba ClearPass, Aircove, Tanaza, Cloud4Wi, EasyWiFi. Marketing-focused captive portals integrate with Mailchimp, HubSpot or Salesforce to add visitors to email lists.
For a typical 10-50 person Dubai office, the built-in UniFi or Omada portal is enough: logo, terms checkbox, connect button - live in under an hour. Paid platforms earn their Request a quote monthly fee only when you need verified guest identity (TDRA venues), multi-site dashboards or CRM sync.
What hardware does office guest WiFi actually need?
Usually nothing new - every business-grade access point sold since 2018 broadcasts 4-8 SSIDs simultaneously, so guest WiFi rides on the APs you already own. Starting from consumer routers? The typical shopping list for a 10-40 person Dubai office:
- Access points: Ubiquiti U6+ (around Request a quote) or U6 Pro (around Request a quote), or TP-Link Omada EAP670 at Request a quote - plan one AP per 100-150 m2
- Gateway/firewall: UniFi UDM Pro (around Request a quote) or FortiGate 40F/60F (Request a quote) to enforce the VLAN rules
- PoE switch: 8-16 port PoE+ (Request a quote) powering APs over the same Cat6 runs that carry data
- Already on Meraki? An MR36 (Request a quote plus annual licence) slots into the existing dashboard
TDRA compliance for public-facing guest WiFi
Hotels, hospitality venues, retail outlets and cafes serving the public in Dubai must comply with TDRA regulations for guest WiFi: log every guest connection with verified identity (passport, Emirates ID, or OTP-verified mobile number), retain logs for at least 12 months, block prohibited content (VPN, gambling, certain political content). Standard office WiFi for visitors and clients is NOT subject to TDRA compliance - only public guest WiFi is. If your office only has occasional client visitors, you don't need TDRA-level captive portal.
Don't guess your TDRA status
The line between 'office with visitors' and 'public venue' matters: a ground-floor showroom or clinic waiting room advertising free WiFi is closer to a public venue than a 4th-floor accountancy practice. If unsure, get the portal vendor's TDRA position in writing - retrofitting identity logging after launch costs far more than building it in.
Bandwidth caps per guest
Don't let guests saturate your office line. Standard bandwidth caps: 5 Mbps per guest in low-traffic offices, 10 Mbps in retail / hospitality with high WiFi expectation, 25 Mbps in coworking spaces or hotels marketing as 'business-grade WiFi'. Configure per-client rate limiting at the AP or controller level - UniFi Network, Meraki Dashboard, and Aruba Central all support this natively.
Sanity-check caps against your circuit. Twenty simultaneous guests capped at 5 Mbps is a 100 Mbps worst case - trivial on a 500 Mbps Etisalat Business or du fibre line, painful on an older 100 Mbps plan. On slower circuits, cap the whole guest VLAN at 20-30 percent of the line and let QoS keep staff VoIP and Teams in front.
Session timeout and re-authentication
Guest sessions should expire to free up DHCP leases and re-validate identity. Standard timeouts: 4 hours for office visitor WiFi, 24 hours for hotel guests, 1 hour for cafe/retail walk-ins. After timeout, guests see the captive portal again and re-accept terms. Reduces unauthorised long-term use by neighbouring offices or street-level squatters.
WPA2 or WPA3 for the guest SSID
Use WPA2-Personal (shared password) for guest SSID - it's fine for the threat model. WPA3 is optional and adds slight authentication delay during captive portal redirects. Open (no password) guest SSIDs are not recommended - they expose guest device traffic to wireless eavesdropping. The captive portal can show the WiFi password on the splash screen for ease of guest connection.
| Office Type | Captive Portal | Setup Cost | Monthly AED |
|---|---|---|---|
| SMB office (5-25 staff) | UniFi built-in | Request a quote | Request a quote |
| Mid-office (25-75 staff) | Meraki / Aruba built-in | Request a quote | Request a quote |
| Hotel boutique (TDRA) | Aircove or Tanaza | Request a quote | Request a quote |
| Retail / cafe (TDRA) | EasyWiFi or Cloud4Wi | Request a quote | Request a quote |
| Marketing-focused (CRM) | Tanaza + HubSpot integration | Request a quote | Request a quote |
Guest WiFi setup cost by Dubai office size
Will the Etisalat or du router handle guest WiFi on its own?
No - the Huawei and Sercomm units bundled with Etisalat Business and du office plans have a basic 'guest network' toggle, but no VLAN isolation you can audit, no captive portal, no per-client caps and no usable logs. The standard fix on every office install: put the ISP unit into bridge mode so it works as a modem only, and let your own gateway (UDM Pro, FortiGate, Meraki MX) run routing, VLANs and the guest network. Etisalat and du support enable bridge mode on request.
Double NAT breaks captive portals
If the ISP router keeps routing while your firewall also routes (double NAT), captive portal redirects fail intermittently - guests connect but the splash page never loads, usually on iPhones first. Bridge mode on the ISP unit removes the entire fault class.
Default deny on inter-VLAN routing
On the firewall, configure 'default deny' between guest VLAN and any internal VLAN, with explicit allow rules only for specifically needed services (e.g. internal printer for client print jobs, if needed - but usually not even that). Most Dubai office guest VLANs only have internet egress, no internal access at all. This single firewall rule prevents 90 percent of guest-WiFi-based attacks.
- Deny guest VLAN to all internal ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Deny guest VLAN to the firewall management interface and the WiFi controller IP
- Allow internet on ports 80/443 plus DNS - block outbound SMTP port 25 to stop spam relays
- Review denied guest-to-internal attempts monthly - repeated hits are an early compromise signal
Branding the captive portal experience
Upload your office or hotel logo, set brand colours, write a welcome message in English plus Arabic where appropriate. Include 'Terms of Service' and 'Privacy Policy' links - mandatory for TDRA compliance, recommended for everyone else. Add social-login (LinkedIn for professional offices, Facebook for retail) to increase capture rates. Test the experience on iPhone Safari, Android Chrome, and laptop browser before launching.
How do you set up office guest WiFi step by step?
On an existing UniFi, Omada, Meraki or Aruba network, the full guest WiFi build takes 2-4 hours, in this order:
- 1Confirm the ISP router is in bridge mode and your own gateway handles all routing
- 2Create the guest VLAN (e.g. VLAN 20) with a /24 or larger DHCP scope and 4-hour leases
- 3Add default-deny firewall rules from the guest VLAN to every internal subnet
- 4Create the guest SSID, bind it to VLAN 20, set WPA2 and enable client isolation
- 5Switch on the captive portal, upload logo and terms, test the redirect on iPhone and Android
- 6Apply per-client rate limits (5-25 Mbps) plus a total ceiling for the guest VLAN
- 7Set the session timeout - 4 hours for offices, 24 for hotels - and connect any CRM integration
- 8Test from a real guest device: internet works, internal IPs unreachable, speed matches the cap
What does guest WiFi cost to run month to month?
For most Dubai offices the ongoing cost is zero: UniFi and Omada portals carry no licence fees. Recurring costs appear in three cases - Meraki or Aruba cloud licences (roughly Request a quote per year), hosted captive portal platforms for TDRA venues (Request a quote), and managed support. Azizi Technologies covers guest WiFi under its standard WiFi AMC from Request a quote: monitoring, firmware updates, portal changes and fault response.
Meraki licences are not optional
Cisco Meraki APs stop serving WiFi entirely when the cloud licence lapses. If your guest WiFi runs on Meraki, diarise the renewal date the day it is installed.
"Nine out of ten guest WiFi faults we get called for trace back to one of two things: an exhausted DHCP scope, or a 'temporary' firewall exception someone added for a visitor and never removed."
Which guest WiFi mistakes do Dubai offices make most often?
- Guest SSID on the same subnet as staff - a second password is not segregation
- No bandwidth caps, so one visitor's cloud backup stalls the whole office
- An open, passwordless SSID broadcasting the company name to the entire tower
- Captive portal tested on a laptop but never on iPhone Safari, where most redirect bugs live
- A printer or NAS 'temporarily' allowed from the guest VLAN and forgotten for years
Free Dubai office guest WiFi setup quote
Send your office or hotel address, rough staff/guest count, and any TDRA compliance needs - we'll quote a guest WiFi setup including captive portal, VLAN isolation, branding, and any compliance work needed. Free site survey before quote.
Frequently asked questions
Do I need TDRA approval for office guest WiFi in Dubai?
Only for public-facing venues (hotels, cafes, retail, hospitality). A regular office where occasional clients visit doesn't need TDRA captive portal compliance. Hotels with 20+ rooms or any business marketing WiFi to walk-in customers does need it.
Can guest WiFi use the same APs as staff WiFi?
Yes - all enterprise APs (UniFi, Meraki, Aruba, Omada) broadcast multiple SSIDs simultaneously, each mapped to a separate VLAN. One physical AP, multiple isolated networks. Standard part of every office WiFi install.
How do I prevent guests from using too much bandwidth?
Per-client rate limiting at the AP/controller. Standard caps: 5 Mbps per guest for offices, 10-25 Mbps for hospitality. Plus QoS rules that prioritise staff traffic so even if guests max their cap, staff still gets bandwidth.
Should I require email registration on guest WiFi?
If you want to build a marketing list, yes - integrate captive portal with Mailchimp / HubSpot / Salesforce so each guest connection creates a CRM lead. If you just need WiFi to 'work' for clients, a simple 'Accept Terms' click is fine.
What's the legal liability if a guest does something illegal on my office WiFi?
Best practice: have a written Acceptable Use Policy that guests accept via captive portal click-through. This shifts liability to the guest. TDRA-regulated venues must additionally log identity and connection times. Talk to a Dubai-licensed lawyer for specific liability advice.
Do you offer guest WiFi as part of office WiFi installation in Dubai?
Yes - guest WiFi setup with captive portal, VLAN isolation, bandwidth caps, and basic branding is included in every Azizi Technologies office WiFi installation at no extra cost. Advanced CRM integration or TDRA compliance for hospitality is quoted separately.
Usman K.
· IT Support LeadIT support lead at Azizi Technologies. Manages 24/7 helpdesk, Microsoft 365 migrations, server administration, and managed IT contracts for Dubai SMBs. Microsoft Certified. Mentioned by name in client reviews for fast resolution.
Ready to get the same results we wrote about?
Free 24-hour SEO audit. Transparent AED pricing. Real Dubai client case studies. No sales call required.