The right Wireless Architecture for you

© 2011 Cisco and/or its affiliates. All rights reserved. Cisco Connect 11© 2012 Cisco and/or its affiliates. All rights reserved.
Toronto, Canada
May 30th, 2013
The Right Wireless
Architecture for You
Francis Girard
Consulting Systems Engineer – Enterprise Mobility
fgirard@cisco.com

Cisco Unified Access: Flexibility
Autonomous AP Centralised FlexConnect
Converged
Access
Cloud Managed
• Intended for static installations
• Aironet Access Points
• Catalyst Switches
• Identity Services Engine
• Prime Infrastructure
• Premise-based Controller
• Controller at every location
• Optimized for campus
deployment
• Centralized Controllers
• Mobility Services Engine
• Data Center hosted Controller
• No Controller at remote sites
• Optimized for small branch
deployment
• Centralized Controllers
• Common LAN & WLAN OS
• LAN & WLAN feature
consistency
• Optimized for high performance
• Optimized for campus & branch
• Catalyst 3850 Switch
• Common LAN & WLAN OS
• LAN & WLAN feature
consistency
• No Controllers
• Optimized for distributed
enterprise
• MR Access Points
• MS Switches
• MX Security
• Dashboard
WAN
Dashboard
WAN Internet

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Connect 4
Autonomous
Access Points

How It Works
Autonomous Access Points
• Since the beginning of times (1997)
• Each AP is individually managed
From AP CLI
From AP GUI
From Cisco Prime Infrastructure (WLSE)
• AP connected to 802.1q trunk switch port
• SSID = VLAN
• End-user is dropped in local VLAN
• End-user data traffic is locally switchedAccess Points
End-User Data Traffic
ISE Prime
Internal
Resources
Campus
Network
Management
Tools

Indoor Autonomous Access Point Portfolio
1600 2600 3600
• 3X3 MIMO-2 Spatial Streams
• CleanAir Express
• ClientLink 2.0
• CleanAir
• ClientLink 2.0
• 4X4 MIMO–3 Spatial Streams
• 802.11ac module (planned)
• CleanAir
• ClientLink 2.0

Outdoor Autonomous Access Point Portfolio
1552I
1552E
1552EU
1552C
1552CU
• Integrated Antennas
• Low Power Consumption
• CleanAir
• ClientLink
• External Antennas
• High Power Gain
• Fiber SPF Option
• PoE Out
• CleanAir
• ClientLink
• Integrated DOCSIS 3.0 Cable
Modem
• Cable Plant Powered
• High Power Gain
• CleanAir
• ClientLink
1552H
1552S
• ATEX Certified Class1 / Div2/
Zone2
• Integrated Honeywell Sensor
Gateway (S)
• PoE Out
• CleanAir
• ClientLink

Benefits
• Affordable entry level solution
No controllers and licensing
• Supports latest Wi-Fi standards:
802.11 a/b/g/n for connectivity
WPA2 for robust security
• Industry best range and throughput
Best of bread RF
• Investment protection
Can be upgraded to a controller-based architectureAccess Points
ISE Prime
Internal
Resources
Campus
Network
Management
Tools

Limitations
• Each AP is managed individually
Prone to configuration inconsistencies
Individual software upgrades
Each AP must be configured in RADIUS server
• Base level Wi-Fi functionality
No dynamic radio resource management
No Advanced security
Rogue detection and mitigation
WIPS
No guest access,
• Voice over WLAN (roaming)
Requires campus wide VLAN’s
Access Points
ISE Prime
Internal
Resources
Campus
Network
Management
Tools

Where / When To Use
• Hotspot deployments with nomadic roaming
• Static environments
• Customers without requirement for advanced
services
Guest access, location, rogue detection, WIPS, etc.
• Small business or small distributed branch
offices
• Small warehouses and plants
Access Points
ISE Prime
Internal
Resources
Campus
Network
Management
Tools

Centralised
Architecture

How It Works
Centralized Architecture
• Zero touch AP deployment
Auto discovery
AP joins WLC
AP established CAPWAP tunnel with WLC
Auto firmware update
Auto configuration
• Single centralized management point
From WLC GUI
From Cisco Prime Infrastructure
• End-user is dropped in a VLAN behind WLC
VLAN can be dynamically assigned
• End-user date traffic is centrally switchedAccess Points
AP-Controller CAPWAP tunnel (Control and Data Planes)
ISE Prime
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

Indoor Lightweight Access Point Portfolio
600 1600 2600 3600
• Local Ethernet Ports
• ClientLink 2.0
• CleanAir
• ClientLink 2.0
• 802.11ac module
• Security and SI module
• CleanAir
• ClientLink 2.0

Outdoor Lightweight Access Point Portfolio
1552I
1552E
1552EU
1552C
1552CU
• Integrated Antennas
• Low Power Consumption
• CleanAir
• ClientLink
• External Antennas
• High Power Gain
• PoE Out
• CleanAir
• ClientLink
• Integrated DOCSIS 3.0 Cable
Modem
• Cable Plant Powered
• High Power Gain
• CleanAir
• ClientLink
1552H
1552S
• ATEX Certified Class1 / Div2/
Zone2
• Integrated Honeywell Sensor
Gateway (S)
• PoE Out
• CleanAir
• ClientLink

5500
500 APs
7,000 Clients
WiSM2
1,000 APs
15,000 Clients
8500
6,000 APs
64,000 Clients
2500
75 APs
1,000 Clients
5760
1,000 APs
12,000 Clients
Wireless LAN Controller Portfolio

Cisco Unified Access Pillars
Identity
Services Engine (ISE)
Prime
Management
Wired and Wireless Network
• Self-provisioning portal – My Devices
• Secure Group Access (SGA) -
simplified role-based access control
and enforcement based on context,
avoids manual ACL/VLAN configs
• Comprehensive Guest Management
• Consistent functionality across wired and
wireless
• Application Visibility and Control (AVC)
• Sub-second Stateful Switchover (SSO)
• Hierarchical QoS - Port, Access Point, Radio,
SSID, User, & application
• Advanced Analytics and Business Intelligence
• One application wired and wireless -
Cisco Prime Infrastructure 1.4
• Application visibility and assurance –
deterministic end user application
experience across wired and wireless
• Third Party device management

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17
Cisco Identity Services Engine
Identity-based access control policy platform across wired, wireless or VPN.
Automated, role-based and consistent access control
enforcement across wired and wireless
Based on context: user, device, and location.
Self-registration personal device onboarding
Users self-management of their registered devices –
Moves, Adds, Changes & Blacklist (Lost)
One Policy

One Management
Cisco Prime
Infrastructure 1.2
Unified Visibility
Prime 360
Integrated Workflows Aligned
with Lifecycle Processes
Support the way network
operators do their job
Prime Assurance Manager
Enhanced Application Visibility
and Control (AVC)
Offering Wired and Wireless
Application Insight and Control
ISR G2 Routers NAM
ASR WLAN Controller

Benefits
• Centralized management and troubleshooting
for lowest TCO
• Easy to deploy and manage
• Consistent configuration across all AP’s
• Radio Resource Management (RRM)
• Advanced security
WIPS
Identity Networking / RADIUS CoA / ISE
• Guest accessAccess Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

Benefits
• High availability (client SSO)
• AVC - Application Visibility and Control
• Location services
• CleanAir
• Videostream / multicast delivery optimisation
• CMX - Connected Mobile Experience / Analytics
• Apple Bonjour gateway
• Mesh (indoor and outdoor)
• Highly customizable and advanced feature setAccess Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

Network Based Application Recognition - NBAR2
Deep Packet Inspection et App ID
NBAR2 LIBRARY
Deep Packet inspection
Traffic
POLICY
Packet Mark and
Drop
Wireless LAN Controller
Netflix = 50%
YouTube = 15%
WebEx = 10%
Citrix = 9%
Exchange= 8%
Netflow v9 export
• Classify 1000+ applications with sub-classification within applications: e.g. Lync – desktop share, video/voice, file transfer
• Apply Granular policies - Per SSID, Device, Campus, Building, Floor
• Real-time troubleshooting on the Wireless LAN Controller
• Wired-wireless consistent export to standard netflow collectors
Application Visibility and Control (AVC)

Limitations
• All end-user traffic is forwarded to the WLC
• Poor use of LAN/WAN infrastructure when
internal resources are distributed
• WLC may become a bottleneck
• WLC can be a single point of failure
Access Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

Where / When To Use
• Flexible architecture for campus, large branch,
home, and outdoor
Enterprise campus
Large manufacturing plants
Hospitals
Education campus / universities
• Significant customization needs
• For VoWLAN deployments / real time
applications with roaming
• Need / prefer on-premise management
Access Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

FlexConnect
Architecture

How It Works
FlexConnect Architecture
• First available in 2005
• Originally named Hybrid Remote Edge Access
Point (Hybrid-REAP / H-REAP)
• Extension to the Centralised architecture
• End-user is can either be dropped in a VLAN
behind WLC, or in a VLAN in the switch to
which the AP is connected
Per SSID, user/group and/or per location
• End-user data traffic can be locally switchedAccess Points
AP-Controller CAPWAP tunnel (Control Plane)
ISE Prime
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

How It Works
• First available in 2005
• Originally named Hybrid Remote Edge Access
Point (Hybrid-REAP / H-REAP)
• Extension to the Centralised architecture
• End-user is can either be dropped in a VLAN
behind WLC, or in a VLAN in the switch to
which the AP is connected
Per SSID, user/group and/or per location
• End-user data traffic can be locally switchedAccess Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
WAN
Management
Tools
Branch

Indoor Lightweight Access Point Portfolio
1600 2600 3600
• ClientLink 2.0
• CleanAir
• ClientLink 2.0
• 802.11ac module (planned)
• CleanAir
• ClientLink 2.0

5500
500 APs
7,000 Clients
WiSM2
1,000 APs
15,000 Clients
8500
6,000 APs
64,000 Clients
2500
75 APs
1,000 Clients
Virtual Controller
200 APs
3,000 Clients
Flex7500
6,000 Aps
64,000 Clients
FlexConnect
FlexConnect Wireless LAN Controller Portfolio
Centralized and/or
FlexConnect

FlexConnect – Advanced Services
• High Availability – WAN Survivability
FlexConnect AP provides wireless access and services to clients when the
connection to the primary WLC fails
• Fast Secure Roaming in remote branches – for VoWLAN
• Dynamic VLAN and ACL assignment – per user
• Scalability
• Number of FlexConnect groups: 500 (7500s) and 100 (5500s)
• APs per Group: 50 (7500s) and 25 (5500s)

FlexConnect – WLC Authenticator
Branch OfficeData Center
WLC
ISR 3925 ISR 3925
VPN
AP
ISR 3925 ISR 3925
Dot1X Auth Req
Dot1x Auth Success
New Client1
2
AAA RADIUS
• All the client authentication requests travels through Central Controller
• If Controller is not reachable, then no clients can authenticate

FlexConnect – AP Authenticator
WLC
ISR 3925 ISR 3925
VPN
AP
ISR 3925 ISR 3925
Dot1X Auth Req
Dot1x Auth Success
New Client
• All the client authentication requests travels straight from AP to RADIUS Server.
• If Controller is not reachable, clients can still continue to authenticate and access network services.
1
2
AAA RADIUS

FlexConnect – AP Authenticator
WLC
ISR 3925 ISR 3925
AP
ISR 3925 ISR 3925
Dot1X Auth Req
Dot1x Auth
Success
New Client
• All the client authentication requests travels straight from AP to Local Branch RADIUS Server.
• If WAN link is down, clients can still continue to authenticate and access network services.
1
2
AAA RADIUS

FlexConnect – Local Authentication
WLC
ISR 3925 ISR 3925
AP
ISR 3925 ISR 3925 Dot1X Auth Req
Dot1x Auth
Success
• All the client authenticated directly by the AP.
• If WAN link & Local Backup RADIUS Server is down clients can still continue to authenticate and access
network services.
1
2
AAA RADIUS

By The Way…
• SSID’s
on “Local Mode” AP’s
• Centrally Switched SSID’s
on FlexConnect AP’s
• End-user traffic is always
switched at the controller• “Local Mode” 


Benefits
• Same benefits as for the Centralised
Architecture (most of them) + …
• Flexible deployment and configuration options
• Simple wireless operations with DC hosted
controller (no need to distribute controllers)
• Efficient use of WAN resources for branches
Only desired traffic is tunneled to the controller
• Highly available and scalable for large number
of remote branchesAccess Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
WAN
Management
Tools
Branch

Limitations
• Some WAN limitations may apply
RTT must be below 300 ms data (100 ms voice)
Minimum 500 bytes WAN MTU (with maximum four
fragmented packets)
• Requires site wide VLAN for roaming
(VoWLAN)
• Some features are not available in standalone
mode or in local switching mode
AVC and VideoStream
See full list in « H-REAP Feature Matrix » at www.cisco.com
Access Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
WAN
Management
Tools
Branch

Where / When To Use
• Flexible architecture for small to medium size
branches (up to 50 AP’s per site)
Retail stores
Food / restaurant chains
Small warehouses
Branch offices
• Excellent migration option for autonomous AP’sAccess Points
ISE Prime
Wireless LAN
Controller
Internal
Resources
WAN
Management
Tools
Branch

Converged Access

How it works
Converged Access
• Similar to Centralised Architecture
• Mobility Agent (MA) is responsible for:
– AP CAPWAP termination
– Maintaining client database
– Policy enforcement
• Mobility Controller (MC) is responsible for:
– Client Mobility
– Radio Resource Management (RRM)
– WiPS, Spectrum Management
Access Points
ISE Prime
MC
MA
Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools

How it works
Converged Access
– Client Mobility
Access Points
ISE Prime
MC Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools
MA
M
A
M
A
M
A
M
A
Catalyst 3850

Wireless Control
System
Access Control
Server
LAN Mgmt
Solution
Identity
Mgmt
NAC
Profiler
Guest
Server
Cisco Wireless
LAN Controller
Internal
Resources
Cisco FirewallCisco
Access Point
Catalyst
Switch
Corporate
Network Internet
One Management
Prime
One Policy
ISE
Delivering Converged Access
IOS Based WLAN Controller
• Consistent IOS and ASIC as Catalyst
3850
• Required to scale beyond 250 AP or 16K
client domains
Converged Access Mode
• Integrated wireless controller
• Distributed wired/wireless data plane
(CAPWAP termination on switch)
New 5760
One Network
Catalyst 3850

• 802.11n
• Clean Air
• Video Stream
• Radio Resource
Management (RRM)
• Wireless Intrusion
Prevention System
(WiPS)
• 802.11ac Ready
Features:
• Stacking, Stackpower
• Trustsec/Identity
• AVC/Medianet
• Flexible Netflow
• Granular QoS
• Smart Operations
• EnergyWise
• Virtualization
Features:
B e n e f i t s
• Built on Doppler – Cisco’s Innovative
Flexparser ASIC technology
• Eliminates operational complexity
• Single Operating System for wired and
wireless
Single Platform for Wired and Wireless
• 20+ Years of IOS Richness – Now on Wireless
WIRELESS WIRED
Note: All features may not be available on
new platforms at introduction but are
expected to be added within 12-18 months

Converged Wired/Wireless Access – Benefits
Scale with
distributed wired
and wireless
data plane
480G stack bandwidth;
40G wireless/switch; 16K
clients without separate
WLC – future proof
Maximum
resiliency with
fast stateful
recovery
Layered network high
availability design with
stateful switchover
Single
platform for
wired and
wireless
Common IOS, same
administration point,
one release
Unified Access - One Policy | One Management | One Network
Network wide
visibility for
faster
troubleshooting
Wired and wireless
traffic visible at
every hop
Consistent
security and
quality of
service control
Hierarchical bandwidth
management and
distributed policy
enforcement

Virtual Controller
200 APs
3,000 Clients
Flex7500
6,000 Aps
64,000 Clients
5500
500 APs
7,000 Clients
WiSM2
1,000 APs
15,000 Clients
8500
6,000 APs
64,000 Clients
2500
75 APs
1,000 Clients
3850
50 APs
2,000 Clients
5760
1,000 APs
12,000 Clients
Converged Access
FlexConnect
Converged Access Portfolio
Centralized and/or
FlexConnect

How it works
Converged Access
– Client Mobility
Access Points
ISE Prime
MC Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools
MA
Catalyst 3850

How it works
Converged Access
– Client Mobility
Access Points
ISE Prime
Internal
Resources
WAN
Management
Tools
M
A
M
A
M
A
M
A
Catalyst 3850
M
C
M
C
M
C
M
C

Benefits
Converged Access
Access Points
ISE Prime
MC Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools
M
A
M
A
M
A
M
A
Catalyst 3850
• Single platform for wired and wireless
• Consistent security and quality of service
control
• Distributed control plane
• Highly scalable
• 802.11ac ready – no bottleneck
• Centralized management and troubleshooting
for lowest TCO
• Radio Resource Management (RRM)

Benefits
Converged Access
Access Points
ISE Prime
MC Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools
M
A
M
A
M
A
M
A
Catalyst 3850
• Highly customizable and advanced feature set
• Advanced security
WIPS
Identity Networking / RADIUS CoA / ISE
• High availability
• Guest access
• Location services
• CleanAir

Limitations
Converged Access
Access Points
ISE Prime
MC Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools
M
A
M
A
M
A
M
A
Catalyst 3850
• More complex to deploy and manage
• No full feature parity with AireOS controllers
AVC - Application Visibility and Control
Bonjour protocol optimisation
Mesh (indoor and outdoor)

Where / When to use
Converged Access
Access Points
ISE Prime
MC Wireless LAN
Controller
Internal
Resources
Campus
Network
Management
Tools
M
A
M
A
M
A
M
A
Catalyst 3850
• Flexible architecture for campus and branches
Enterprise campus
Large manufacturing plants
Hospitals
Education campus / universities

Cloud Manage

How It Works
Cloud Managed
• Cisco acquired Meraki in December 2012
• Leader in cloud managed network solutions
• AP connected to 802.1q trunk switch port
• Local Authentication to RADIUS / AD
• End-user is dropped in local VLAN on AP
VLAN can be dynamically assigned
• End-user data traffic is locally switched
Access Points
Internal
Resources
LAN
Meraki
Dashboard
Internet
AP-Cloud management tunnel (Control Plane – 1 kbps)

100% cloud managed edge networks
Meraki MS
Ethernet Switches
Meraki SM
Mobile Device Management
Meraki MR
Wireless LAN
Meraki MX
Security Appliances

Cisco Unified Access
100% Cloud ManagedUnparalleled Deployment Flexibility
Cisco Enterprise Portfolio Cisco Cloud Managed
Prime ISE
Catalyst 2K/3K/4K/6K
ASA - Firewall
ISR - Routing
MS Switch
MX Series Security
Appliances
Aironet Access Points & Controllers
Dashboard
Cisco Networking Portfolio
MR AP’s
Systems Manager3rd Party MDM Integration

MR wireless access points
55
Feature
highlights
5 models including indoor/outdoor, high performance and value-priced
Enterprise-class silicon including PoE, voice/video optimization
Lifetime warranty on indoor APs
BYOD policies
Application traffic shaping
Guest access
Enterprise security
WIDS / WIPS
Mesh routing

Intuitive Browser-Based Dashboard
User
fingerprints Client
location
Application
QoS Real-time
control
Instant
search
Wired +
wireless

SaaS feature delivery, quarterly updates
WAN optimization
User/device fingerprinting Application firewall
Mobile application deployment
Content filtering Network access control

Scalable cloud infrastructure
Telmex
Nationwide hotspot and 3G
offload network
Next Retail
550 retail stores across the
UK
Motel 6
70,000 hotel room
deployment
Jeffco School District 80,000
student district with 100+
schools

Systems Manager MDM
Feature
highlights
Device Management controls iOS, Android, Mac, and Windows devices
Cloud-based - no on-site appliances or software, works with any vendor’s network
100% free - available at no cost to any organization, sign up at meraki.com/sm
Centralized app deployment
Device security
Rapid provisioning
Backpack™ file sharing
Asset management

Benefits
Cloud Managed
• It’s too easy!!!
• Simple to buy (2 SKUs)
• Easy to deploy and manage over the web
Add devices or sites in minutes
• Out-of-the-box optimized feature set
• Ongoing upgrades and enhancements
• Reliable
Highly available cloud with multiple datacenters
Network functions even if connection to cloud
is interruptedAccess Points
Internal
Resources
LAN
Meraki
Dashboard
Internet
AP-Cloud management tunnel (Control Plane)

Benefits
Cloud Managed
• Secure
No user traffic passes through cloud
Fully HIPAA / PCI compliant (level 1 certified)
3rd party security audits, daily penetration test
Reliability and security information at meraki.com/trust
• No bottlenecks
• And… did I say it’s easy?
Access Points
Internal
Resources
LAN
Meraki
Dashboard
Internet

Limitations
Cloud Managed
• Customer must embrace cloud services
• Limited customisation capability (compared to
on-premise controller based solutions)
• Single architecture – less flexibility
• No layer 3 roaming
• Requires site wide VLAN for roaming
(VoWLAN)
• Limited integration with 3rd party solutions
Access Points
Internal
Resources
LAN
Meraki
Dashboard
Internet

Where / When to Use
Cloud Managed
• Mid-market businesses / distributed sites
• Remote branches without on-site IT
Retail
Professional services
Lawyers offices
Clinics
Construction
K-12 Education
Hospitality
• Lean IT
• Cloud service users (salesforce, box.net, gmail)Access Points
Internal
Resources
LAN
Meraki
Dashboard
Internet

Summary

Autonomous Centralized FlexConnect
Converged
Access
Cloud
Managed
Best of Breed RF
One Policy—ISE
One Management—Prime
Sub-Second Failover N/A N/A
Advanced Features, Highly Scalable
Application Visibility and Control
TrustSec/SGA
Common Policy Enforcement for LAN and
WLAN
Network Wide Traffic Visibility
One Operating System LAN and WLAN
Unified Access—Wireless Deployment Modes
Highly Differentiated Value Across All Deployment Models

On-Premise and Cloud-Managed Networking Positioning
EnterpriseMid-Market / Commercial
Cisco Enterprise Portfolio
On-Premise Managed
- Deployment Flexibility
Cisco Cloud Networking Portfolio
Cloud Managed
- Lean, Generalist IT
- Distributed small sites
Network Size (Sites, Density)
Features/NetworkServices
Small Business
Cisco Small Business
Solutions

Complete Your Paper
“Session Evaluation”
Give us your feedback and you could win
1 of 2 fabulous prizes in a random draw.
Complete and return your paper
evaluation form to the room attendant
as you leave this session.
Winners will be announced today.
You must be present to win!
..visit them at BOOTH# 100

Thank you.

The right Wireless Architecture for you

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (16)

Similar a The right Wireless Architecture for you

Similar a The right Wireless Architecture for you (20)

Más de Cisco Canada

Más de Cisco Canada (20)

Último

Último (20)

The right Wireless Architecture for you