University campus network

A university campus network (5,000-50,000 students) combines extremely high WiFi density, eduroam authentication (global 802.1X), research/admin/student segmentation, BYOD infrastructure, and an HPC cluster for research. 2026 campus architecture guide: budget, sizing, eduroam, and Fed-ID/Renater integration.

Campus requirements

• WiFi 6/6E coverage: lecture halls, library, cafeterias, residences, and outdoor areas
• Density: 400-800 devices per 300-seat lecture hall
• BYOD: each student has 2-3 devices (laptop, smartphone, tablet)
• eduroam: inter-university roaming (802.1X + federated RADIUS)
• Fed-ID / Renater: national authentication for CNRS/universities
• Research: HPC cluster with InfiniBand/RoCEv2 100G
• Availability: 99.9% except during exams (99.99% during online exams)

eduroam: roaming authentication

Global federation for inter-university WiFi access:

• A Paris-Saclay student can use their credentials to connect at Oxford, Heidelberg, or MIT
• Backend: RADIUS hierarchy (campus RADIUS → national TLR → global eduroam)
• France: GEANT + Renater TLR
• AP configuration: SSID 'eduroam' + WPA2-Enterprise/WPA3-Enterprise + PEAP or EAP-TLS
• Certificates: chain of trust to GEANT
• Essential: no eduroam means no international appeal

Standard architecture

• Core: 2× Cisco Catalyst 9600 or Aruba CX 10000 in StackWise/VSX
• Distribution per building: 2× Catalyst 9500 or Aruba CX 8325
• Access: Catalyst 9300/9300L or Aruba CX 6300
• WiFi: Cisco 9166/9172 WiFi 6E or Aruba AP-635/655
• Research DC: Nexus 9300 + HPC servers + InfiniBand 400G

Segmentation

• VLAN 10-19: ADMIN (staff, student services, finance)
• VLAN 20-29: TEACHING (faculty, classrooms)
• VLAN 30-39: RESEARCH (laboratories, HPC)
• VLAN 40-49: STUDENTS wired (library, computer rooms)
• VLAN 50: WiFi-Eduroam (students + staff + eduroam visitors)
• VLAN 60: WiFi-Guests (conference guests)
• VLAN 70: RESIDENCES (resident students)
• VLAN 80: IoT (energy sensors, building automation)
• VLAN 99: MGMT

Authentication

• 802.1X EAP-TLS: staff + certificates managed by an internal PKI
• PEAP-MSCHAPv2: students using Fed-ID credentials
• Renater Fed-ID: national SSO for applications (Moodle, HAL, etc.)
• RADIUS: FreeRADIUS or Microsoft NPS, integrated with eduroam
• NAC: Cisco ISE or Aruba ClearPass

High-density lecture halls

• 300-500 students in a lecture hall: 800+ simultaneous WiFi devices
• Design: minimum 1 AP / 30 seats = 10-15 APs per lecture hall
• AP: Cisco 9166 or Aruba AP-655 (4×4 MU-MIMO, OFDMA)
• 2.5G mGig uplinks are mandatory
• BSS Coloring + 5/6 GHz band steering

Student residences

• 1 AP / 2-4 rooms depending on the building
• Outbound bandwidth: minimum 1 Gbps per 100 students
• Netflix/Twitch streaming: 80% of evening/night traffic
• P2P isolation (no sharing between rooms)
• Fair-use bandwidth: cap of 50 Mbps/user at peak times

HPC + research

• Cluster: 100-1000 GPU/CPU nodes (NVIDIA DGX, Dell PowerEdge)
• Interconnect: InfiniBand HDR 200G (Mellanox/NVIDIA) or Ethernet 400G RoCEv2
• Storage: Lustre, BeeGFS, IBM GPFS
• Research segmentation: dedicated VRF
• Access: 100G Renater peering

Budget for a campus with 20,000 students

• WiFi: 1500 WiFi 6E APs + licenses: ~1,500,000€ HT
• Switches: 200 Catalyst 9300/9500: ~1,200,000€ HT
• Catalyst 9600 core + StackWise: ~400,000€ HT
• Palo Alto PA-5400 HA firewall: ~250,000€ HT
• ISE NAC: ~150,000€ HT
• HPC cluster (50 nodes): ~2,000,000€ HT
• Total: ~5.5M€ HT over 5 years

Order from OPTINOC

Turnkey university campus network: eduroam, high-density WiFi 6E, and HPC. Cisco/Aruba/Juniper. Fed-ID/Renater expertise. Quote within 1 week.