Skip to content

FTTH Network • Resort fiber

Fiber Network for Resorts: Spread-Out Sites, Coastal Weather and Guest/Back-of-House Separation

By Junun Saleh · Updated · Built on ITU-T, IEEE, PCI and outside-plant sources, each linked below

A hotel is one building. A resort is a village: villas scattered across a hillside, a pool bar 300 metres from the lobby, a beach club on the other side of a road, and a salt wind blowing over all of it. The fiber that serves a resort has three jobs a city-block network never has: reach every corner of a spread-out site, survive the coast, and keep the guest’s phone away from the cash register. This page covers all three.

Quick answer: A resort fiber network works best as a star: a back-of-house core, buried duct trunks to splitter cabinets near each villa cluster, pool and beach area, then short drops to endpoints. Use aerial ADSS only where trenching is not possible. Specify 316L stainless or fiberglass enclosures with an IP66 or better rating for the coast, protect against lightning with all-dielectric cable, bonding and surge protection, and put guest, staff, POS and camera traffic on separate VLANs carried on the same fiber, with a firewall denying routing between them. Distance is rarely the limit: GPON reaches 20 km, while copper stops at 100 m.

In this page, aerial means cable hung on poles. ADSS is all-dielectric self-supporting cable, an aerial fiber cable with no metal in it. Buried covers cable in conduit (duct) and direct-buried armoured cable. A splitter cabinet is an outdoor box that holds passive splitters and fiber joints. A VLAN is a virtual LAN that keeps traffic from different zones apart on the same switches and fiber. POS means point-of-sale: the card terminals and systems in restaurants, bars and shops.

How do you link villas, pools and beach areas across a large resort site?

Build a star from the back-of-house core, with buried duct trunks to splitter cabinets and short drops from there. The passive splitters in each cabinet need no power, so the only powered equipment sits where you can service it: the core and the endpoints. Distance is rarely the constraint. The cable route is. Where you can trench, the same rules as underground FTTH network design apply: leave spare duct for the next expansion and repair.

20 kmupstream reach of GPON under ITU-T G.984, with 32 or 64 splitter outputsITwissen, on ITU-T G.984
100 mthe channel limit for twisted-pair Ethernet, including PoEIEEE 802.3 channel length
~610 mupper span of ADSS before a dead end (about 2,000 ft)ISE Magazine, 2019
3×typical ADSS cable cost compared with standard aerial OSP cableISE Magazine, 2019

How fiber links the parts of a spread-out resortA layout. A back-of-house room with the OLT and core connects by a buried duct trunk to three splitter cabinets. The first cabinet serves a villa cluster, the second the pool and spa, and the third, reached by an aerial ADSS span where trenching is not possible, serves the beach club. Light pulses travel along the trunk and the drops.A resort fiber layout (illustrative)Back-of-houseOLT and corefirewallC1C2C3Villa clusterdrops to each villaPool and spaoutdoor AP, cameraBeach clubPOS, Wi-Fi, camerasBuried duct trunkAerial ADSS, only where trenching is not possibleC = splitter cabinetHow fiber links the parts of a spread-out resortA layout. A back-of-house room with the OLT and core connects by a buried duct trunk to three splitter cabinets. The first cabinet serves a villa cluster, the second the pool and spa, and the third, reached by an aerial ADSS span where trenching is not possible, serves the beach club. Light pulses travel along the trunk and the drops.A resort fiber layout (illustrative)Back-of-houseOLT, core and firewallC1Villa clusterdrops to each villaC2Pool and spaoutdoor AP, cameraC3Beach clubPOS, Wi-Fi, camerasBuried duct trunkAerial ADSS, only where needed

Figure 1: A resort fiber layout (illustrative). A buried duct trunk runs from the back-of-house core to splitter cabinets. One branch uses aerial ADSS where trenching is not possible.

Aerial or buried?

Both can work. The right choice depends on soil, existing poles and how exposed the route is to storms. The table sums up what the outside-plant sources say, with our resort recommendation in the last column. For thinly spread villas, the trade-offs are close to FTTH design for low-density areas.

Aerial, direct-buried and duct routes compared
Method Strengths Limits Resort use
Buried duct (conduit) Spare innerducts let you add cable later; high pulling tension; splices kept in pedestals or vaults Needs trenching or boring; bend radius and pulling limits apply Default for trunks and anything you may expand
Direct-buried armoured No conduit cost; armour resists rodents and crushing Best in soil with few rocks; metallic armour must be grounded and bonded; no spare capacity Short, open-ground drops to villas where you will not add cable
Aerial ADSS No metal, so no bonding or grounding; fast on existing poles; spans to about 610 m Costs about 3× standard aerial cable; wind and ice beyond the design load can cause an outage Hard crossings only: roads, ravines, water edges
Lashed to a messenger Higher fiber counts; messenger shields the cable; cheapest where strand already exists Messenger and armour need bonding and grounding; not built for large wind and ice loads Only on existing, sound strand

The ADSS facts come from ISE Magazine’s guide to aerial cable types (2019), which also notes that if a weather event exceeds the design wind and ice loadings, “this can cause a service outage.” An earlier ISE comparison (first published 2013) adds that loose-tube cable lashed to a strand is not designed for large wind and ice tensile loads, while ADSS can carry loads up to thousands of pounds depending on the design. The buried-cable facts come from the Fiber Optic Association’s outside-plant guide. One resort-specific rule of our own: never hang cable from trees or building roofs. They move, rot and get cut.

Distance limits that matter

Fiber’s reach is generous. ITwissen’s GPON summary gives 20 km for the upstream rates of ITU-T G.984 and a splitter of 32 or 64 outputs. A resort site is almost always well inside that, so reach is not the limit. Copper is. A twisted-pair Ethernet channel, including PoE, stops at 100 m, which is why a pool bar, a beach club or a far villa cluster needs fiber to its door, with an ONT or switch placed near the endpoint. Fiber’s real limit is the optical budget: every splice, connector and splitter takes loss, so count them across the whole route before you fix the split ratio.

Distance limits for copper, aerial spans and GPONA log-scale ruler from 10 meters to 100 kilometers. A copper Ethernet or PoE channel reaches 100 meters, one ADSS span can reach about 610 meters, and GPON reaches 20 kilometers. The bars grow in order.Distance limits on a log scale10 m100 m1 km10 km100 kmCopper Ethernet and PoE channel100 mOne ADSS span, upper figureabout 610 mGPON reach, ITU-T G.98420 kmReach also depends on split ratio and optical budget. Measure your own routes.Distance limits for copper, aerial spans and GPONA log-scale ruler from 10 meters to 100 kilometers. A copper Ethernet or PoE channel reaches 100 meters, one ADSS span can reach about 610 meters, and GPON reaches 20 kilometers. The bars grow in order.Distance limits, log scale10 m100 m1 km10 km100 kmCopper Ethernet and PoE channel100 mOne ADSS span, upper figureabout 610 mGPON reach, ITU-T G.98420 kmReach also depends on split ratioand optical budget. Measure your routes.

Figure 2: Distance limits on a log scale (illustrative). Copper stops at 100 m, one ADSS span reaches about 610 m and GPON reaches 20 km.

Outdoor-rated gear

Any equipment outside needs an ingress rating under IEC 60529. As Zenitel’s explainer puts it, IP66 means dust-tight and protected against high-pressure water jets from any direction. IP67 is equally dust-tight but covers temporary immersion between 15 cm and 1 m instead. For splitter cabinets and outdoor ONTs, IP66 is the practical minimum; choose IP67 where water can pool, such as a ground-level handhole.

Choose this if

Choose buried duct if…

  • The route is long, exposed to storms or likely to grow.
  • You can trench or bore the ground, and soil is workable.
  • You want spare capacity for future villas and services.
  • You want to avoid wind and ice loading on the cable.

Choose aerial ADSS if…

  • You must cross a road, ravine or water edge where trenching is not possible.
  • Sound poles already exist and the span is within the cable’s design.
  • You want a no-metal cable that needs no bonding.
  • The design wind and ice loads match your site, and you can accept the risk beyond them.

What fiber network equipment survives salt air, humidity, storms and lightning?

Glass fiber is the easy part. The enclosures, fasteners, glands and any metal in the path are what fail. A coastal resort needs equipment chosen for chlorides and condensation, a cable route sized for storms, and a lightning plan that keeps metal out of the signal path. If you need to explain the result to owners, our look at how reliable fiber internet really is covers the uptime question in plain terms.

2–5 yrshow long standard industrial enclosures can last on a coast without the right materialsIndustrial Monitor Direct (vendor blog)
316Lthe stainless grade to specify, not 304, which is prone to chloride crackingIndustrial Monitor Direct (vendor blog)
500 mmminimum height to mount junction boxes above gradeIndustrial Monitor Direct (vendor blog)
6 monthsinspection interval to consider on coastal sites; annual at minimumIndustrial Monitor Direct (vendor blog)

The numbers above come from one vendor knowledge-base article on marine junction boxes. It describes itself as general information, so treat it as a guide and confirm against the datasheet of the enclosure you buy. Its points line up with common practice: specify 316L, not 304; use A4-80 stainless fasteners; use stainless or nickel-plated brass glands with EPDM seals, because nylon glands degrade quickly in salt spray; slope enclosure tops at least 15° so water does not pool; and add anti-condensation heating when the temperature swing exceeds 15°C.

Coastal hazards and what survives themFour rows pair a hazard with a defense. Salt air is met by a 316L or fiberglass enclosure with stainless fasteners. Humidity is met by sealed glands and a heater or desiccant. Storm wind and ice are met by ADSS rated for site loads or buried duct. Lightning is met by all-dielectric cable, bonding and surge protection. Each hazard highlights in turn.HazardWhat survivesSalt airchloride corrodes metal and fasteners316L or FRP enclosureA4 stainless fastenersHumiditycondensation inside sealed boxessealed glands, heater or desiccantStorm wind and iceloads past the cable's design ratingADSS rated for site loadsor buried ductLightningsurges ride metal into the buildingall-dielectric cablebonding, surge protectionIllustrative. Confirm every rating on the manufacturer's datasheet.Coastal hazards and what survives themFour rows pair a hazard with a defense. Salt air is met by a 316L or fiberglass enclosure with stainless fasteners. Humidity is met by sealed glands and a heater or desiccant. Storm wind and ice are met by ADSS rated for site loads or buried duct. Lightning is met by all-dielectric cable, bonding and surge protection. Each hazard highlights in turn.Salt airchloride corrodes metal and fasteners316L or FRP enclosureA4 stainless fastenersHumiditycondensation inside sealed boxessealed glands, heater or desiccantStorm wind and iceloads past the cable's design ratingADSS rated for site loadsor buried ductLightningsurges ride metal into the buildingall-dielectric cablebonding, surge protectionIllustrative. Check every datasheet rating.

Figure 3: Coastal hazards and what survives them (illustrative). Each hazard has a matching design choice. Confirm every rating on the datasheet.
Coastal hazards, what they do and what to specify
Hazard What it does What to specify
Salt air Chlorides attack metal enclosures, fasteners and glands 316L stainless or FRP enclosures; A4-80 fasteners; stainless or nickel-plated brass glands with EPDM seals; check salt-mist test data (IEC 60068-2-52)
Humidity Condensation forms inside sealed boxes when temperature swings Sealed glands, a heater where the swing exceeds 15°C, desiccant in rarely opened boxes; water-blocked cable (gel or dry tape)
Storm wind and ice Loads beyond the cable’s design rating can cause an outage Buried duct on exposed routes; ADSS rated for your site loads where aerial is unavoidable; no tree attachments
Lightning Surges travel along any metal path into the building All-dielectric cable; ground and bond any armour or strength members; surge protection where copper or mains enters; short outdoor copper runs

For lightning, start from the cable. ADSS has no metal, so ISE notes it needs no bonding or grounding. Armoured cable has a metallic layer that, per the Fiber Optic Association, must be grounded and bonded. The ITU-T publishes guidance on protecting telecom lines against lightning: K.47 covers protection of telecommunication lines against direct lightning flashes (edition May 2012), and the ITU lists the older K.25 on optical fibre cables as withdrawn, with its requirements incorporated into K.47. Ask your designer which edition and national code they follow. The practical rule is simple: the weak point is usually copper, such as PoE runs to a pool-side camera, not the fiber.

Marine enclosure service life by materialA bar chart of vendor-reported service life for a small marine enclosure: galvanized steel 1 to 2 years, PVC-coated steel 3 to 5 years, fiberglass 8 to 12 years and 316 stainless steel 15 to 20 plus years.Service life of a small marine enclosure, upper figure in yearsGalvanized steel1–2 yearsPVC-coated steel3–5 yearsFRP (fiberglass)8–12 years316 stainless15–20+ yearsVendor figures for a 200x150x80 mm marine enclosure. Illustrative: use your datasheets.Marine enclosure service life by materialA bar chart of vendor-reported service life for a small marine enclosure: galvanized steel 1 to 2 years, PVC-coated steel 3 to 5 years, fiberglass 8 to 12 years and 316 stainless steel 15 to 20 plus years.Marine enclosure life, upper figureGalvanized steel1–2 yearsPVC-coated steel3–5 yearsFRP (fiberglass)8–12316 stainless15–20+Vendor figures for a small marine enclosure.Illustrative: use your datasheets.

Figure 4: Marine enclosure service life by material (illustrative, vendor figures). The cheapest box is often the most expensive over the life of the network.

Plan the storm message and the inspection checklist now. After a storm, guests and staff want to know what is down and when it returns. TheWriter.id’s free Outage Message Generator drafts copy-ready notices for email, SMS and status pages. For the six-monthly coastal inspection, the Technician Checklist Generator builds a checklist technicians can follow the same way every time.

How do you separate POS, cameras, staff and guest traffic on one fiber backbone?

Give each zone its own VLAN on the shared fiber, then control routing at a firewall that denies traffic between zones by default. One fiber backbone can carry all four lanes. What matters is where the lanes are separated and who can cross them. IEEE 802.1Q is the standard that specifies virtual LANs and VLAN bridges.

31 Mar 2025date all 51 future-dated PCI DSS v4.0.1 requirements became mandatoryPurple (vendor guide)
1.3.1requirement to restrict traffic to and from the card-data environment to what is necessaryPurple (vendor guide)
Quarterlyminimum scan for unauthorised wireless access points (requirement 11.2)Purple (vendor guide)
Sept 2024PCI SSC supplement on scoping and segmentation for modern networksPCI Security Standards Council

Segmentation is not only a security habit. According to Purple’s guide to PCI DSS for hotel Wi-Fi, a vendor source, guest Wi-Fi is treated as in scope until it is shown to be segmented from the cardholder data environment, and segmentation is the practical way to reduce scope. The PCI Security Standards Council’s supplement (September 2024) covers scoping and segmentation in modern network designs, and states that it is supplemental and does not replace any PCI standard. Confirm your design with your assessor.

Four traffic lanes on one fiber backboneFiber from the PON carries all traffic into a switch and firewall. From there four colored lanes run separately: guest Wi-Fi on VLAN 10, staff systems on VLAN 20, POS and payments on VLAN 30, and cameras and NVR on VLAN 40. The firewall blocks routing between guest and POS. Colored pulses travel down each lane.One fiber backbone, four separate lanes (example VLAN IDs)Fiber fromthe PONall trafficSwitch andfirewallVLANs set hereroutes denied bydefaultGuest Wi-FiVLAN 10Staff systemsVLAN 20POSVLAN 30Cameras and NVRVLAN 40The firewall blocks routing between guest and POS. Set your own rules with your assessor.Four traffic lanes on one fiber backboneFiber from the PON carries all traffic into a switch and firewall. From there four colored lanes run separately: guest Wi-Fi on VLAN 10, staff systems on VLAN 20, POS and payments on VLAN 30, and cameras and NVR on VLAN 40. The firewall blocks routing between guest and POS. Colored pulses travel down each lane.One backbone, four separate lanesFiber from the PONall traffic on one pathSwitch and firewallVLANs set here, routes denied by defaultGuestWi-FiVLAN 10StaffsystemsVLAN 20POSVLAN 30CamerasVLAN 40The firewall blocks routing between guest and POS.Set your own rules with your assessor.

Figure 5: One fiber backbone, four separate lanes (illustrative, example VLAN IDs). The firewall denies routing between zones by default.
Network zones for a resort and their rules
Zone What is on it Rule of thumb
Guest Villa and public Wi-Fi, in-room devices, guest TVs Internet only; client isolation on; no route to any other zone
Staff Back-office PCs, property management, staff Wi-Fi Internet and staff apps; limited, named access to POS and cameras
POS and payments Card terminals and POS servers in restaurants, bars, spa and shops Only the payment processor and POS hosts; nothing from guest or camera zones
Cameras and security CCTV, access control, the recorder Cameras reach the recorder only; no internet; view-only access for authorised staff
Default traffic rules between resort network zonesA grid of source zones against destinations. Guest may reach the internet only. Staff may reach the internet and staff apps, with limited access to POS and view-only access to the camera recorder. POS has limited internet access to its payment processor and reaches only POS systems. Cameras reach only the camera recorder. Each source row highlights in turn.Who may talk to whom, by default (illustrative policy)FromTo: InternetTo: Staff appsTo: POSTo: Camera NVRGuestYesNoNoNoStaffYesYesLimitedView onlyPOSLimitedNoYesNoCamerasNoNoNoYesLimited: only the specific hosts and ports each service needs. Set the policy with your assessor.Default traffic rules between resort network zonesA grid of source zones against destinations. Guest may reach the internet only. Staff may reach the internet and staff apps, with limited access to POS and view-only access to the camera recorder. POS has limited internet access to its payment processor and reaches only POS systems. Cameras reach only the camera recorder. Each source row highlights in turn.Who may talk to whom (illustrative)InternetStaffappsPOSCameraNVRGuestYesNoNoNoStaffYesYesLimitedViewPOSLimitedNoYesNoCamerasNoNoNoYesLimited: only the hosts and ports eachservice needs. Set policy with your assessor.

Figure 6: Default rules between zones (illustrative policy). “Limited” means only the specific hosts and ports each service needs.

Where to separate on a PON

  1. Carry zones as VLANs end to end. Use a PON ONT or switch that supports multiple VLANs, so every zone rides the same fiber to the same outlet without being mixed.
  2. Enforce rules at one firewall. Terminate the VLANs at the back-of-house core, and deny routing between zones by default. Allow only named exceptions.
  3. Give POS its own path where audit demands. A dedicated ONT or port for the payment zone is a simple way to prove separation.
  4. Isolate cameras. Put them on their own VLAN reaching only the recorder, and check that power over copper stays inside the building or in short, surge-protected runs.
  5. Test the separation. From a guest device, try to reach a POS or camera address, and record that it fails. Repeat after every change.

One line in a network brief, written two ways (illustrative)

TypicalSeparate guest and staff networks for security.
SpecificFour VLANs on the shared fiber: guest, staff, POS and cameras. A firewall at the core denies routing between them by default. POS reaches only the payment processor. Cameras reach only the recorder. A guest device cannot reach any POS or camera address, and the test is repeated after every change.

What should you confirm before building a resort fiber network?

Confirm the route, the gear, the weather plan and the zones, in that order. This list turns the sections above into questions for a designer or integrator.

  • Which routes can be trenched or bored, and which need aerial ADSS?
  • Is the trunk in duct with spare innerducts for future villas?
  • What is the optical budget for the longest route, counting every splice, connector and splitter?
  • Are all outdoor boxes IP66 or better, in 316L stainless or FRP, with stainless fasteners and glands?
  • Are boxes mounted at least 500 mm above grade, sloped to shed water, and heated or desiccated where needed?
  • Is the cable all-dielectric where possible, with armour bonded and surge protection where copper or mains enters?
  • Are outdoor copper and PoE runs short, and is the rest done in fiber?
  • Are guest, staff, POS and camera traffic on separate VLANs, with a firewall denying routing between them?
  • Who inspects coastal equipment, how often, and from which checklist?

Fiber network for resorts: frequently asked questions

What is the best fiber layout for a large resort?

A star of buried duct trunks from a back-of-house core to splitter cabinets near each villa cluster, pool area and beach club, with short drops to each endpoint. Passive splitters need no power in the field. Use aerial ADSS only where trenching is not possible, and size every route against the optical budget.

Should resort fiber be aerial or buried?

Buried duct is the safer default for coastal, storm-exposed sites because it avoids wind and ice loads, and spare innerducts let you add cable later. Aerial ADSS suits point-to-point crossings where trenching is not possible. It is all-dielectric, so it needs no bonding or grounding, but a storm beyond its design wind and ice loading can cause an outage.

How far can fiber run on a resort site?

GPON is specified for up to 20 km in ITU-T G.984, so reach is rarely the limit on a resort site. Copper is: Ethernet and PoE channels are limited to 100 m. That is why long runs to pools and beach areas should be fiber, with the ONT or switch placed near the endpoint.

What outdoor rating should resort network equipment have?

IP66 means dust-tight and protected against high-pressure water jets. IP67 means dust-tight and protected against temporary immersion between 15 cm and 1 m. On a coastal site the enclosure material matters as much as the rating: specify 316L stainless or fiberglass, and check the datasheet for salt-mist testing.

How do you protect resort fiber from lightning?

Use all-dielectric cable where you can, because it carries no metallic path for a surge. Ground and bond any metallic armor or strength members, add surge protection where copper or mains enters a building, and keep outdoor copper runs short. ITU-T K.47 covers protection of telecommunication lines against direct lightning flashes.

How do you separate guest, POS, staff and camera traffic on one fiber?

Put each on its own VLAN (IEEE 802.1Q), carry them all on the same fiber backbone, and enforce rules at a firewall that denies routing between zones by default. Under PCI DSS, guest Wi-Fi counts as in scope until it is shown to be segmented from the payment environment, so segmentation also reduces audit scope. Confirm your design with your assessor.

Sources

  1. ISE Magazine: Don’t Leave It Up in the Air, telecom aerial cable applications and types (August 2019)
  2. ISE Magazine: Aerial deployment comparison, ADSS and loose tube cable (first published 2013, republished December 2016)
  3. Fiber Optic Association: Outside plant cable types
  4. ITwissen: gigabit PON (GPON), line rates, reach and splitter outputs
  5. Zenitel: IP66 explained
  6. Industrial Monitor Direct: Marine-grade junction box selection for coastal installations (vendor knowledge base)
  7. ITU-T: Recommendation K.47, Protection of telecommunication lines against direct lightning flashes (05/2012)
  8. ITU-T: Recommendation K.25, Protection of optical fibre cables (withdrawn 2013, incorporated into K.47)
  9. IEEE 802.1 Working Group: 802.1Q, Virtual LANs and VLAN Bridges
  10. Purple: PCI DSS 4.0.1 for hotel WiFi (vendor guide)
  11. PCI Security Standards Council: Information supplement on PCI DSS scoping and segmentation (September 2024)

Figures 1 to 6, the comparison and rules tables and the checklists are our illustrations and recommendations, not published standards. The ISE articles (2019, 2016) and the vendor sources (Industrial Monitor Direct, Purple) are older or commercial, so confirm figures against manufacturer datasheets and your assessor. The 100 m twisted-pair limit is the IEEE 802.3 channel length. Enclosure life figures are a vendor’s for a small marine box. Example VLAN IDs are illustrative.