A large multinational financial institution has hired you to design a new full-stack wired and wireless network for its new six-story regional office building. The bottom two floors will provide retail space for a large banking branch. The upper floors will be carpeted corporate office space, with each floor approximately 100,000 sq ft (9290 sq m). All data centers are offsite and outside this project’s scope. The customer is underserved by its existing L2-based network infrastructure and wants to use modern best practices in the new design. The network must be fully resilient and fault-tolerant, with dynamic segmentation at the edge.

The retail space will offer public guest Wi-Fi. Retail associates will use corporate tablets for customer service, and the retail floors will contain a mix of wired and wireless devices. Corporate users will primarily connect wirelessly, although several wired clients, printers, and hard VoIP phones will also be used.

The customer also plans to renovate the corporate office space to take advantage of 'smart office' technology. These enhancements will enable blue-dot wayfinding, presence analytics, and other location-based services.

The client wants redundant RADIUS resources in each of its three geographical regions (AMER, EMEA, and APAC). A large office location in each region has sufficient VMware resources available.

Each region has 5,000 clients, all of whom must perform either 802.1x wired or wireless authentication, as well as 802.1x authentication for one personal Wi-Fi device.

All non-personal devices must also validate health with a local agent.

An average of 500 guests are expected to be connected, with a maximum of 700 simultaneous connections using Guest Portal for Internet access.

TACACS authentication will also be configured for a total of 1,200 evenly distributed NADs.

To support virtual IPs and server redundancy in every region, how many Virtual Policy Manager Licenses are required?