As far as faults go, adding wireless can cause problems on the wired side of your network if not setup right. We have 550 switches on our network; we have over 300 VLANS running. We trunk our wireless AP's and use multi vlans on them. We ran into problems of broadcast traffic being forwarded to all AP ports since they can’t take part in a VTP domain. So the switches the AP's are connected to would have their MAC address tables fill up and stop working correctly. We solved this with manual pruning of the wireless ports to allow only the needed vlans through.
For control we have Ciscoworks and WLSE, they work together to alert us to AP failures, rouge AP's and so on. They also interact with the switches to tell us when there are high errors on wireless port, or duplex mismatches and so on.
Allocation of wireless is hard on our campus, we have a big budget but an even bigger amount of buildings to cover. Over 50 on our main campus alone. We try and cover one building at a time with full wireless coverage on all floors. We also have a wireless webpage where users can request coverage. If a teacher in a building needs wireless for their class, we will install an AP for that use, then come back later and cover the whole building. We have run into some issues where we have run out of ports in a closet to attach wireless to. In some cases we have added switches to expand ports ports. In others we have removed a 24 port switch and added a 48 port in its place.
Performance of the wired network is not hampered much in our case. We have gigabit fiber running to all buildings and wire closets so it can handle the extra wireless traffic with no problems. Most of the switches we hook our wireless to are 3550’s that we use as a master switch in our wire closets. They can handle many ap’s with no trouble.
Security is the biggie in any wireless network. If you have a switch in a building that is setup for a secure network, and someone connects and AP with no security and it forwards DHCP and wireless clients can connect, you have opened that secure network to the world ( or the radius of your wireless signal ) Like I said before we trunk our AP’s and use 3 vlans for the clients. This separates the wireless network from where it is connected to the wired side. Other concerns for wireless is authentication. You can use MAC based auth with WEP/WPA and so on. Right now we use a product called Bluesocket that works with our active directory to authenticate users. You cant logon to the wireless unless you have an account with us. This runs on two vlans, one that has no security aside from the required login, and one that has WPA and the bluesocket login.
I hope this info helps you, feel free to ask for more detail if you want.
