Energy SOE Unified Wireless Access and AI Network Assurance

Challenge

Each province had built its own wireless with different SSIDs, authentication and security policies, so staff could not roam across provinces and HQ could not audit device access. Remote-site network faults waited for a provincial engineer to travel, averaging over two days to fix.

GSS scope of responsibility

GSS owned design of the unified wireless and authentication architecture, survey / deployment / cutover at 310 sites, the central wireless management platform and nationwide field response. Access policy and endpoint compliance requirements were set by the customer information-security department.

Solution

GSS unified the wireless architecture and access control (single national SSID + zero-trust onboarding), surveyed, deployed and cut over 310 sites in four waves, and built a central wireless management and AI network assurance platform at HQ, backed by GSS's nationwide field-engineering network.

Background

The enterprise runs 310 city offices and production sites under 26 provincial companies, with 85,000 employees. Over more than a decade each province had built its own wireless, with different vendors, SSID conventions, authentication methods and security policies. HQ staff travelling to a province had to request new accounts, and HQ security had no view of who was connecting where.

The sharper problem was at remote production sites: when the network failed, a provincial engineer had to travel out, and repairs averaged more than two days while production management systems ran offline.

Solution

Unified wireless and access control (traditional network business)

• Unified architecture: one national controller design (HQ active-active with provincial local forwarding) and one SSID convention, so staff roam seamlessly at any site with the same identity.
• Zero-trust onboarding integrated with the group identity platform: staff devices on 802.1X + certificates, guests on SMS, production devices on MAC + behavioural allow-lists; VLAN and access policy assigned by role after onboarding.
• Phased delivery: GSS completed RF surveys, installation, cut-over and legacy decommissioning at 310 sites in four waves over 18 months, drawing on 60+ field engineers nationwide, with each site cut over within a single non-working day.
• Equipment: ~9,800 APs and 1,200 access switches, all registered in the group asset system.

AI network assurance (AI business)

• National wireless health profile: the central platform collects radio, client and application metrics from 9,800 APs every five minutes and scores each site; HQ drills down by province, city and site.
• Fault prediction and self-healing: models trained on historical alarms and metrics spot AP radio degradation, uplink congestion and slowing authentication servers early; common faults (AP offline, channel conflict, DHCP exhaustion) are resolved by automated runbooks with no human involvement.
• Intelligent dispatch: faults that cannot self-heal generate a ticket with root-cause analysis and required spares, dispatched directly to the nearest GSS field engineer — provincial staff no longer travel to sites.
• Security analytics: access-behaviour modelling flags anomalous devices (bulk night-time joins, lateral scanning, spoofed MACs), quarantines them to an isolation VLAN and notifies group security.

Results

Metric	Before	After
Sites	26 separate provincial builds	310 sites, one architecture
Connected devices	Not countable	120,000+ (centrally visible)
Cross-province roaming	Not supported	Seamless with one identity
Site fault repair	> 2 days average	~6 hours including travel
Self-healed alarms	0	~45% need no human action
Unauthorised devices	Undetected	Isolated in real time, 200+ / month

Completed in August 2024; GSS continues nationwide field engineering and remote managed operations, and the architecture has been adopted as the group standard for new sites.