Common Campus Network Mistakes Ugandan Schools Make — and How to Avoid Each

Mistake 1: Treating campus Wi-Fi like a large home network

Many schools start with a handful of consumer routers or small-business access points, adding more as complaints grow. The result is a patchwork of SSIDs, dead zones in lecture halls, and no central visibility. Consumer devices lack band steering, airtime fairness, and the ability to handle hundreds of simultaneous connections in a library or exam hall.

How to avoid it: Begin with a site survey that maps buildings, construction materials, and expected device density per room. Choose enterprise-grade access points that support seamless roaming, multi-SSID with VLAN tagging, and centralised management. Plan for at least one AP per 30–40 users in high-density areas, and ensure each AP has a wired uplink — never mesh wirelessly between APs for backbone traffic.

Mistake 2: Skipping structured cabling and labelling

Cables are often pulled through ceilings without a plan, terminated on mismatched patch panels, and left unlabelled. When a port fails or a new block is added, the IT team spends hours tracing wires. In Ugandan schools where power surges and rodent damage are common, undocumented cabling makes fault isolation nearly impossible.

How to avoid it: Adopt a structured cabling standard (TIA/EIA-568 or ISO/IEC 11801) from day one. Use colour-coded patch cords: blue for data, yellow for voice, red for CCTV, green for access control. Label every cable at both ends with a consistent scheme (block-floor-cabinet-port). Keep an up-to-date as-built diagram in both soft and hard copy at the network cabinet. Require the installer to provide test reports for every link.

Mistake 3: Running student, staff, admin, and guest traffic on one flat network

A single SSID with one pre-shared key is the fastest way to set up, but it lets a student’s compromised laptop scan the bursar’s file server, and it gives guests access to internal printers. Bandwidth-heavy streaming in dormitories chokes the finance office’s connection to the core banking portal.

How to avoid it: Segment with VLANs and enforce them at the switch port and wireless controller. Typical segments:

• VLAN 10: Admin and finance (wired only, 802.1X authentication)
• VLAN 20: Teaching staff (wired + wireless, RADIUS)
• VLAN 30: Students (wireless only, captive portal + RADIUS)
• VLAN 40: Guest (wireless only, time-limited voucher, rate-limited)
• VLAN 50: IoT — CCTV, door access, biometric readers (no internet egress) Apply ACLs on the core switch or firewall so each VLAN talks only to what it needs. Use per-user bandwidth contracts on the student VLAN to prevent one torrent session from starving the whole campus.

Mistake 4: Leaving security to the firewall’s default settings

A firewall is installed, the admin password is changed, and then it is forgotten. No intrusion prevention signatures are updated, no SSL inspection is enabled, and VPN profiles for branch campuses or remote lecturers use split-tunnelling that leaks traffic. Meanwhile, the school’s public IP appears on threat intelligence feeds because an unpatched IoT camera is beaconing to a botnet.

How to avoid it: Treat the firewall as a managed service, not a set-and-forget box. Subscribe to signature updates and schedule them weekly. Enable SSL inspection for outbound traffic (with a trusted CA deployed to managed devices). Configure site-to-site VPNs for each branch campus with full tunnelling and strict firewall policies. Place all IoT devices (CCTV, door controllers) in a dedicated VLAN with no direct internet access; they should reach their management server only through a jump host. Review logs monthly — look for repeated failed VPN logins, unusual outbound connections from the server VLAN, and large DNS queries that may indicate data exfiltration.

Mistake 5: No proactive monitoring or defined support agreement

The network runs until it doesn’t. A core switch fails on a Friday afternoon; the only person who knows the CLI is on leave. The school calls three vendors, gets three different diagnoses, and loses two days of online exams. There is no baseline of normal utilisation, so a gradual degradation in Wi-Fi performance goes unnoticed until students protest.

How to avoid it: Put a managed support agreement in place before the first cable is terminated. The agreement should specify:

• 24/7 monitoring of critical devices (core switches, firewalls, controllers) with alerting on CPU, memory, interface errors, and licence expiry
• Quarterly on-site health checks: firmware audit, config backup verification, cable integrity spot-check
• Defined response times: critical (core down) within 4 hours, major (building offline) within 8 hours, minor (single AP) next business day
• A shared runbook with network diagrams, IP schema, VLAN table, and escalation contacts
• Annual capacity review: compare peak utilisation trends against licence limits and plan upgrades before term starts Ask the provider to demonstrate their monitoring dashboard during the proposal stage. If they cannot show real-time visibility of your specific devices, keep looking.

Mistake 6: Treating CCTV and door access as separate, unmanaged networks

Cameras are plugged into a spare switch in the guard house, powered by cheap PoE injectors, and recorded on an NVR with a default password. Door controllers use a proprietary protocol on the same flat network as the staff laptops. When the NVR fills up, footage is lost; when a door controller crashes, the vendor blames the school’s “dirty” network.

How to avoid it: Run CCTV and access control on the same managed infrastructure but in their own VLAN (e.g., VLAN 50). Use industrial-grade PoE switches with redundant power supplies for camera runs longer than 90 metres. Choose cameras and controllers that support ONVIF and standard protocols so you are not locked into one vendor. Configure the firewall to allow the NVR and access-control server to pull firmware updates from approved mirrors only. Schedule monthly verification: confirm recording retention, test door unlock from the management console, and check switch port statistics for errors on camera links.

Mistake 7: Underestimating density in exam halls, libraries, and dormitories

A single AP in a 200-seat exam hall works fine during a staff meeting but collapses when 180 students launch the online assessment platform simultaneously. In dormitories, concrete walls and interference from microwave ovens and Bluetooth speakers turn a “five-bar” signal into unusable throughput.

How to avoid it: Design for peak concurrent devices, not average coverage. For high-density rooms:

• Use APs with multi-user MIMO (MU-MIMO) and OFDMA (Wi-Fi 6/6E)
• Disable 2.4 GHz radios on every other AP to reduce co-channel interference
• Set minimum data rates to 12 Mbps or higher to prevent sticky clients
• Enable band steering and load balancing at the controller
• Conduct a validation survey with a loaded test — 30+ devices running iPerf or a simulated exam session — before accepting handover For dormitories, consider in-room APs with a wired backhaul to each room, or corridor-mounted APs with directional antennas aimed into rooms. Budget for a post-occupancy survey after the first term; real usage patterns always differ from predictions.

Mistake 8: No documentation handover or knowledge transfer

The installation team leaves behind a box of patch cables and a verbal “it works.” Six months later, the IT officer who managed the project has moved on. The new officer cannot find the firewall’s management IP, does not know the RADIUS shared secret, and has no record of which switch ports are trunked to the wireless controller.

How to avoid it: Make documentation a contractual deliverable with sign-off. Require:

• Layer 1: As-built cabling diagrams with cable IDs, lengths, and test results
• Layer 2: Switch port maps (VLAN assignments, trunk/access, PoE budget per port)
• Layer 3: IP addressing scheme, VLAN interfaces, DHCP scopes, routing table
• Security: Firewall rule base with business justification for each rule, VPN peer configs, certificate store
• Wireless: AP placement map, channel plan, SSID-to-VLAN mapping, RADIUS policies
• Credentials: Stored in a password manager accessible to authorised staff only, with expiry reminders
• Runbooks: Common tasks (add SSID, replace AP, onboard new branch, firmware upgrade) Schedule a two-day knowledge-transfer workshop before final payment. Have the incoming IT officer perform a supervised disaster-recovery drill: restore firewall config from backup, rebuild a switch from spare, re-provision an AP.

Explore Office Networks & Wi-Fi →