Start your EVOTECH request in under a minute.
Digital Sign Network Provisioning in Katy, TX 77491
Much of the signage work carried on Katy mailing addresses sits in multi-tenant retail — an endcap restaurant, a suite in a strip centre, a franchise on a pad site where the internet arrives through whatever the landlord put in the electrical closet. Hanging the screen takes an afternoon. Getting the player onto that building’s network without parking it beside the card readers is the part that decides whether the sign still works in February.
The half of a digital sign that has no bracket
Almost every signage quote describes a display, a mount and a media player. The half that decides whether the screen is still showing the right promotion six months from now is the network path behind it, and on most jobs that half is assumed rather than designed.
For one screen in a Katy retail suite it means:
- A port the player can genuinely use — one landing on a switch you may configure.
- An address that comes back the same after a power cut, so Monday’s firewall rule still matches Friday’s device.
- A route out to the content management system and nothing else.
- A correct clock. More scheduled content fails from clock drift than from bad artwork.
- A heartbeat, so a failure reaches you as an alert rather than as a complaint.
- A written record of the port, MAC, reservation and the account that owns the CMS.
None of it is visible on the wall, which is why it is the first thing dropped from a cheap quote and the first thing that fails.
Where the line is between a manager and a contractor
Plenty of single-screen jobs are within reach of a competent office manager: one display, a spare wired jack on a router you control, no tills on the same network, and content changed from a browser. Call somebody when any of these is true — the internet belongs to a landlord, card payments share the building, the screen is more than one room from the network gear, there is more than one display, or the sign must keep running when nobody is on site. Those are the cases where an improvised setup quietly works for a month.
What you are actually plugging into in a leased suite
In a multi-tenant centre the handoff is rarely clean. Opening that closet we tend to find, in order of frequency: a consumer router serving six suites off one flat subnet; a carrier-managed gateway the tenant may not change; a small-business firewall with an expired support contract and nobody who remembers the password; and occasionally a proper demarcation with a labelled feed.
Where the landlord gear cannot be touched — the usual case — we do not fight it. A small managed firewall of your own goes behind the handoff, giving your equipment its own address range, DHCP scope, rules and logs. Signage traffic is outbound-only, so the extra layer of translation costs you nothing operationally.
Two things get settled in writing first: what the lease permits you to install in a shared closet, and whether the circuit feeding it is on your panel. Centre-wide gear on a landlord circuit means your sign goes down for reasons that have nothing to do with your store.
Why a menu board should never share a network with the card readers
Strip a signage player down and you have an always-on, internet-facing computer, patched on a vendor’s schedule rather than yours, mounted in a public area, with a USB port staff will eventually use. On a flat network — one subnet, everything sees everything — it sits one hop from the payment terminals. The remedy is ordinary engineering: its own VLAN, and an access list permitting a few outbound destinations while denying everything sideways.
| Segment | Permitted to reach |
|---|---|
| Signage | CMS host, time source, DNS resolver, vendor update host — outbound only |
| Payments | Payment processor only; nothing initiates a session inward |
| Staff | Internet, plus deliberate exceptions |
| Guest | Internet only, client isolation enabled |
Be careful about the claim being made here. EVOTECH is a licensed and insured low-voltage contractor, not a payment-card assessor. We build and document the segmentation; scope determinations belong to your payment provider or assessor. Anyone who says a screen install makes you compliant is selling something.
Three ways to address a player, and only one holds up
The most common reason a sign that worked at handover stops a month later.
- Plain dynamic DHCP. Any firewall rule or monitoring entry written against that address breaks the first time the lease turns over.
- A static address typed into the device. Looks tidy, and it is why a technician two years from now hands the same address to a printer — the router has no idea it is spoken for.
- A DHCP reservation keyed to the MAC address. The device stays on automatic addressing and the network hands it the same address every time, with the record in the router where the next person will find it.
Reservation is the right answer, with two traps.
MAC randomisation
Newer Android-based players and several smart displays randomise their hardware address per network by default, exactly like a phone, so a reservation written from the sticker on the box matches nothing. Either randomisation is disabled or the reservation follows the address actually presented — documented either way, because it is invisible otherwise.
The morning after an outage
When a Katy centre comes back from a wider outage, every device requests an address in the same thirty seconds. On a small pool shared by the whole complex a headless player that retries quietly can simply lose. A reservation removes it from that race.
What the player must reach, and what it must never be allowed to reach
A signage player should carry one of the narrowest rule sets in the building.
| Allow, outbound | Why it exists |
|---|---|
| HTTPS to the CMS host | Playlist checks, content download, proof-of-play reporting — the whole job. |
| Time synchronisation | Dayparted content fires at the wrong hour on a drifted clock, and certificate validation fails outright if the device thinks it is the wrong year. |
| DNS to the local resolver | So name lookups stay visible and filterable. |
| Vendor firmware host | Blocked, the player slowly becomes the oldest device on the network. |
The deny side matters more. No inbound port forwarding to a player, ever — remote control comes from the CMS’s own outbound session or a VPN. Nothing sideways to payments or cameras. Hard-coded public DNS is the quiet one: some players ignore the resolver handed to them, so pin them to yours or write a deliberate exception.
Worth recognising: a group of older players all stop connecting on the same day with no network change. That is almost always a trust-store problem — a root certificate the device shipped with has expired, so it refuses a connection that is in fact fine. The fix is firmware, not a firewall rule.
Captive portals, band steering and 2.4 GHz in a busy centre
Sometimes the drop genuinely cannot be pulled — a hard ceiling, a landlord who forbids penetrations, a screen on a demising wall.
The guest network is not an option. A captive portal expects a browser, a human and a tick box; a headless player has none, and portal sessions expire on a timer, so even a manually authorised device drops off overnight. Guest networks also commonly isolate clients, blocking the local app used to configure the player.
Band matters. Plenty of budget players are 2.4 GHz only. In a retail centre that band already carries every neighbouring tenant’s network, backup radios on payment terminals and a stack of IoT devices across three usable channels. Put a restaurant microwave — transmitting around 2.45 GHz — twenty feet away and you get an outage that arrives at lunchtime and clears by three, exactly the pattern blamed on the sign vendor. One Cat6 run, terminated and tested, outperforms every workaround here and costs less than the second service call.
What EVOTECH does on a 77491 provisioning call, in order
- Find the demarcation. Where the circuit enters, whose equipment it is, what the lease permits, which panel feeds it.
- Inventory what exists — switch make and whether it is managed, current addressing, existing VLANs, what the last installer left behind.
- Agree the plan on paper and get it approved before anything changes.
- Get a real path to the screen. Pull and test the drop, or certify an existing one rather than trusting it; a cable that passes continuity but fails a performance test resurfaces as intermittent sync weeks later.
- Configure and join. VLAN, outbound rules, reservation, DNS and time source; then force a content change and watch it land.
- Let it run overnight and verify the early sync window next day — a sign that works at 3pm and fails at 6am is a clock or scheduled-reboot problem.
- Hand over documentation and confirm the CMS account is in your company’s name, not ours.
What changes the number on a Katy provisioning quote
The estimate is free and on site, the quote is itemised, and we will not price this over the phone because the closet decides the job.
- Pathway to the screen. A plenum above a grid ceiling is straightforward; a hard-lid ceiling, a demising wall needing firestopping, or a run through a finished dining room after hours is not.
- Whether the existing switch is managed. If nothing can carry a VLAN, segmentation means adding a device that can.
- What the landlord permits. A tenant-owned firewall behind the handoff is a small addition; changing centre-wide equipment is not.
- Screen count, now and later. One display and the first of six are the same visit but not the same design.
- Monitoring and remote recovery — optional, and the options that pay for themselves in an operating restaurant.
- Trading hours. Work between close and open is scheduled differently to a Tuesday morning.
Six provisioning mistakes that generate a second visit
- The sign went on guest Wi-Fi because it was the fastest way to finish that day. It works until the portal session expires.
- No address reservation. Correct for three weeks, then a power cut reshuffles the building and the monitoring goes blind.
- A port forwarded to the player so somebody could reach it from home — an internet-exposed computer inside your building.
- Nothing written down, so the next fault begins with an hour of discovery the customer pays for.
- The display shares a circuit with the lighting contactor. It dies at close every night, the player’s storage takes the abuse, and eventually it stops coming back cleanly.
Related services
Frequently asked questions
Our landlord provides the internet. Do we still need our own equipment?
Can the sign just use the customer Wi-Fi?
How much internet does one menu board actually use?
Does segmenting the network make us PCI compliant?
The sign works for a week or two, then goes black. What is it usually?
Can we see whether the sign is working without driving to the store?
Get the network side of your sign designed, not assumed
Tell us what the suite looks like and who owns the internet. We survey it, put the segmentation and addressing in writing, and quote it itemised — no pressure, no guesswork.
Book a Free Consultation
Ready for EVOTECH to help?
Before you leave, send the quick version. We will review the page you came from and reply with the clean next step.