Documentation · Critical network isolation
Guest Wi‑Fi never gets near your checkout.
The biggest worry of anyone running a venue is guest Wi‑Fi getting in the way of sales. That's why Tagnect manages only the guest network: checkout, receipt and fiscal printers, card terminals and internal systems stay on a separate network with a fixed key, which Tagnect neither changes nor depends on.
Recommended topology
Separate networks, separate roles
Operations network (yours)
Checkout, receipt and fiscal printers, card terminals, cameras and internal systems. Fixed, strong, undisclosed key. Tagnect neither manages nor changes this network.
Guest network (Tagnect)
For transient guests only: rotating password, NFC tags and OTP. Isolated from the operations network, with internet‑only egress.
Device network (optional)
TVs, general‑purpose printers and other headless devices, with their own fixed key. Also separate from the operations network.
Scenarios
What happens to your operations in each situation
| Situation | Operations network | Guest network |
|---|---|---|
| Normal operation | Works as usual; Tagnect is not involved | Rotating per‑group password, sign‑in by tag or OTP |
| Automatic guest password rotation | Unaffected (fixed key, outside rotation) | The new password goes live before the old one is removed, with a configurable grace period |
| Tagnect cloud unavailable | Unaffected | Guests already connected keep browsing; new tag sign‑ins wait for the service to return |
| Compromised guest device | Out of reach: guests cannot access the operations network | Client isolation keeps guests from seeing each other |
| Venue internet link down | Depends on the internet provider, with or without Tagnect | Depends on the internet provider, with or without Tagnect |
By platform
How isolation is done on your equipment
On every platform, the guest network has its own SSID and cannot reach the operations network. The details vary by vendor.
- Ubiquiti UniFi and TP‑Link OmadaGuest SSID on its own VLAN, with client isolation and controller rules that block access to the operations LAN.
- Cisco MerakiSeparate guest SSID, with a group policy and LAN access blocking set in the Meraki cloud.
- MikroTik RouterOSThe Tagnect installer creates a dedicated bridge, subnet and DHCP for guests, plus firewall rules that allow internet egress only. The venue's existing network is not changed.
- OpenWrtDedicated interface and firewall zone for guests, with no forwarding to the operations LAN.
Checklist
For your technician to verify at installation
- Card terminals and checkout off the guest networkOn the operations network, by cable, or on the terminal's own 4G SIM.
- Operations SSID with a strong, undisclosed keyWPA2 or WPA3, a fixed key known only to staff.
- Separate subnet or VLAN for guestsWith client isolation turned on.
- No firewall route from guests to operationsGuests go out to the internet only.
- Final testWith a phone on the guest network, confirm you cannot reach the receipt printer or the checkout computer.
Want to validate your network topology?
Send us your equipment's vendor and model and how the checkout and card terminals are connected. We'll recommend the configuration before installation.