The guest Wi-Fi password at the front desk can take down your Mexico operation: how to separate guests, CCTV and IoT with VLANs

On September 24, Mexican business outlet Expansión reported something we see every week at ProcessBi: the Wi-Fi password handed to visitors is the first step toward paralyzing a company. If the site runs one single network, whoever joins the front desk Wi-Fi is already sitting next to your servers, printers, cameras and sensors.

If you manage IT from abroad, this one deserves a close look. The Mexico office or plant is usually the site nobody on your team has walked through in a year, and the network there grew the way local vendors left it.

What a flat network looks like

A flat network is what you get by default: a modem, a couple of switches, an access point (the box that broadcasts Wi-Fi) and everything wired together as if it were one cable. It works, so nobody touches it again.

The trouble is that it has no doors. A visitor laptop sees the accounting server, the warehouse camera and the reception printer as if they shared a table. As Imagen Radio put it the same day, people remain the weakest link. So the network has to hold even when someone shares the password.

Signs your Mexico site runs a flat network

In our experience, most sites tick at least two of these:

• One Wi-Fi password that vendors, former employees and half the neighborhood know.
• The password taped to the reception desk or written on the meeting room whiteboard.
• Hikvision cameras plugged into the same switch as the office PCs.
• From any phone on the Wi-Fi you can open the login page of the router or a camera.
• Nobody can say how many devices are connected right now.

Two ticks: keep reading. All of them: write to us today.

What segmentation means (and why it is not expensive)

Segmenting means splitting the network into lanes. The tool is called a VLAN (virtual local area network): same switch, same cabling, but each group of devices lives in its own segment and cannot see the others. No recabling. You need a managed switch, an access point that supports several networks and someone who configures it properly.

Segment	What goes there	What it can reach
Guests	Visitors, vendors, candidates	Internet only
Operations	PCs, laptops, printers	Server and internal services
CCTV	Cameras and NVR recorder	Only the recorder and whoever manages it
IoT	LoRa sensors, time clocks, screens	Only their own platform
Management	Router, switches, access points	IT team only

The guest network is completed by a captive portal: the page where a visitor accepts the terms and gets access that expires. The password stops being a secret inherited forever.

ProcessBi

The 10-point checklist

1. The guest password is different from the operations one and gets rotated.
2. From the guest Wi-Fi no internal address is reachable.
3. Cameras and the NVR live on their own VLAN with no direct internet exposure.
4. IoT sensors and time clocks sit on another VLAN.
5. Router, switches and access points are managed only from the IT network.
6. The captive portal shows terms and issues access that expires.
7. There is an inventory of connected devices, reviewed quarterly.
8. Factory passwords on cameras, switches and router have been changed.
9. A network diagram exists and someone besides the local vendor understands it.
10. A former employee or vendor cannot get back in with the old password.

Where it hurts most

A plant where sensors and cameras share the network with production PCs. A store where the customer Wi-Fi is the one the payment terminal uses. An office in Mexico where nobody local knows how the network is built and the IT team is an eight-hour flight away.

The fix is the same in all three: separate the lanes and document it. It is exactly the kind of job that calls for IT smart hands in Mexico rather than a flight.

Let’s talk

And at your Mexico site?

Here is how we do it: we inventory what is connected, draw the network, configure switches and access points with VLANs, set up the captive portal and put CCTV and LoRa IoT on their own lanes. It is included in our IT support plans and as field service anywhere in Mexico, with reporting in English.

Book a free network assessment — we reply the same business day.