Network requirements
Everything Harlow puts on a hotel network connects outbound, over encrypted connections, to Harlow's cloud. Nothing listens for inbound traffic, and no port needs opening.
Outbound traffic
- Direction
- Outbound only, from badges and the connector workstation to Harlow
- Protocols
- HTTPS on port 443, and WebSocket over TLS (WSS) on 443 from the connector workstation
- Inbound
- None. No port forwarding, no VPN, no inbound rule of any kind
- Proxies
- Transparent proxies that pass TLS through are fine. Proxies that intercept TLS are not supported on the badge network
- Captive portals
- Not supported. A badge cannot click through a sign-in page, so the staff network must grant access on join
- Bandwidth
- Small. A spoken request is a few hundred kilobytes; a property's badges together are well under what one phone uses
The Wi-Fi the badges join
- Band
- 2.4 GHz. Badges do not use 5 GHz, so the staff network must be available on 2.4 GHz in every area staff work, including back of house
- Security
- WPA2-Personal or WPA3-Personal with a passphrase, or WPA2-Enterprise with certificates (EAP-TLS). Open networks are possible for a pilot but not recommended
- Addressing
- DHCP. Badges keep a fixed hardware address, so an allow-list or a reserved VLAN works
- Time
- Badges set their clock from the network. Offer an NTP server through DHCP, or allow outbound NTP (UDP 123) to public time servers. Without correct time, encrypted connections cannot be verified
- Coverage
- Everywhere a badge is worn. Where coverage drops, requests are held on the badge and sent the moment the network is back, so a dead zone costs time, not requests
- Isolation
- Client isolation on the staff network is fine. Badges do not talk to each other or to phones over Wi-Fi
The connector workstation
The workstation needs outbound HTTPS and WSS to Harlow and, for Opera, whatever the Opera client itself already needs. It does not need to reach the badges or the phones. Full requirements on the connector page.
Phones and desk computers
The app runs in a browser and needs ordinary HTTPS access to Harlow. Phones also need Bluetooth on, to connect a badge. Nothing is installed on hotel computers.
What is never needed
- No inbound ports, no DMZ, no VPN tunnel.
- No agent on hotel servers, no database access, no Active Directory integration.
- No change to the PMS, the phone system or the guest network.