Design and Deployment of Mobility Services

Transcription

1

2 Design and Deployment of Mobility Services Tjie Seng, Njauw Consulting Systems Engineer #clmel

3 Agenda Introduction to MSE/CMX Indoor Location Positioning MSE Installation New MSE UI CMX Analytics CMX Visitor Connect FastLocate (Packet-Based RSSI Calculation) CMX SDK FastLocate Key Takeaways 3

4 Abstract WLAN location based services is opening a whole new ecosystem of applications applicable to numerous verticals such as retail, healthcare, hospitality, education and others. New capabilities in device silicon have improved the accuracy of the blue dot including the user experience and the networks ability to provide relevant services. This session will explain the fundamentals of WLAN location based services, architecture, design and best practices. RF triangulation and architecture will be explained in light of the AP, Controller and MSE. Several models will be covered, including: location mapping, analytics, and location based browser integration.

5 Cisco Connected Mobile Experience (CMX) DETECT CONNECT ENGAGE GUEST PRESENCE Mobile device detected GUEST ACCESS Seamless, secure Wi-Fi on-boarding Cisco Connected Mobile Experience GUEST EXPERIENCE Local services

6 CMX Services DETECT CONNECT ENGAGE CMX Analytics CMX Tools: API, SDK Guest Presence CMX Facebook CMX Connect CMX Analytics CMX Tools: API, SDK Guest Access CMX Engage CMX Analytics CMX Tools: API, SDK Guest Experience Cisco Connected Mobile Experience

7 ANALYTICS DATA How CMX Works Access Points Controller MSE Depending on Application Layer DEVICE-BASED DISCOVERY Browser Engage Device Engage LOCATION DATA APPLICATION DATA Mobile Application Server (3 rd Party ISV) Analytics UI

8 Indoor Positioning

9 Cisco Location Services Topology Cisco Prime Infrastructure Management Station (Client Browser) SNMP SOAP/XML Location API via SOAP/XML over HTTPS Wireless Clients

10 Location Based Services Architecture Wi-Fi AP measures and reports RSSI (Receive Signal Strength Indicator) to WLC (ie seconds depending on endpoint) WLC (unified/flexconnect) aggregates and periodically reports them to MSE via NMSP (ie 2 seconds, configurable) MSE applies advanced positioning algorithms (ie API real time, Analytics every 15 mins) Determine location (RF algorithm/modelling) Location notifications (to outside app. Server) Statistical processing for CMX Analytics Displaying all devices on a map in Cisco Prime (SOAP/XML/REST) SOAP/ Cisco Prime XML/REST Infrastructure Intra/ Internet LAN or WAN NMSP Cloud-based application Mobility Services Engine (MSE) w/ Location Analytics Wireless LAN Controller unified or FlexConnect Wi-Fi Access Point (AP) Wi-Fi Client Wi-Fi Client Wi-Fi Access Point (AP)

11 General Architecture Considerations Co-located (AP, WLC & MSE in the same LAN) Partly Distributed (AP on LAN, WLC & MSE remote) Fully Distributed (AP & WLC in the same LAN & MSE remote) Location application In-house E.g. corporate HQ Server Cloud based app. server Cloud based app. server MSE MSE+WLC per site E.g. campus MSE+WLC per DC E.g. retail HQ MSE per DC E.g. Regional HQ WLC MSE+WLC per site E.g. unified WLC MSE+WLC per DC E.g. Flexconnect WLC Unified WLC per site E.g. property/venue Bandw idth considerations Insignificant (links >=100Mbps vs. LBS traffic <1Mbps) Significant (MSE & app server link ~ T-1 vs. 5Mbps for 100K client for northbound API) More Significant (MSE & App server link + WLC & MSE link ~T-1 vs. 1.5Mbps for 10K client for NMSP traffic) TPS considerations Over 1000 TPS for 100K client per campus/venue Over 1000 TPS for 100K client per venue Over 1000 TPS for 100K client per venue Flexible MSE deployment options Intranet (e.g. OC-1) In-house/IT location application (e.g. corporate HQ) MSE+WLC per site (e.g. Campus) GigE LAN GigE LAN e.g. Unified WLC Internet (e.g. T-1) WAN/LAN Cloud-based location application MSE+WLC per data centre (e.g. Retail HQ) GigE LAN e.g. FlexConnect WLC Internet (e.g. T-1) WAN/ Intranet (e.g. T-1) Cloud-based location application MSE per data centre (e.g. Regional HQ) GigE LAN Unified WLC per site (e.g. property/event)

12 WiFi Based Location Calculation Basics A WIFI device seen by one AP could be located on anywhere in this circle When a device is seen by two AP then location must be in this line When a device is seen by four AP then location must be at this point. Accuracy highest when a device is seen by at least 4 Access points

13 Location Readiness ~20m ~20m A point on floor map is locationready if: min. of 4 AP s are deployed ~20m min. of 3 AP s are within ~20m (-75 dbm) At least 1 AP placed in each of at least 3 surrounding quadrants 13

14 AP Placement Examples Poor AP placement and coverage for location linear AP placement Proper AP placement and coverage for location staggered AP placement with perimeter coverage 14

15 RF Planning for Location Based Services Use case Event Action Presence user enters building/store send welcome message form Mobile Concierge Proximity Asset-tracking Mobility/path tracking user is close to a department in store devices/tags has moved outside area Subject movements send advertisement alert loss prevention CMX Analytics updates Zoned (Geo Fenced) Un-zoned Network location supports these applications based on expected accuracy and how often location is available.

16 Average Expected Accuracy Examples 5 7 meter Prerequisite Optimal RF deployment Height & Position of AP s AP Alignment & Orientation AP density Choice of external Antenna Interference Line-of-Site (obstacles) Type of Clients Band of operation Cisco Unified Wireless Networking with an average of m²

17 Total Location Error TIP: Use a fully powered, unassociated Samsung device for best results. Movement error (currency) Estimation error (accuracy) RF Uncertainty Client speed Uncertainty uncertainty in exact RF propagation loss between the client and the AP Initial position estimation error + Movement error uncertainty on speed of the user since the client device reports position periodically TOTAL LOCATION ERROR

18 Location Accuracy/currency Examples Accuracy: function of AP density & AP height Currency: function of AP density and client type (client probes network at different rate) Application Venue type AP density Avg. Accuracy Currency Presence Mall, airport 10+K Sq ft 30ft N/A Proximity Retail <2.5K Sq ft 15ft ~30s Asset-tracking Enterprise, mall 5K Sq ft 20ft >> 1min Mobility-tracking Mall, airport <2.5K Sq ft 15ft ~30s

19 AP Placement Proper placement and density of access points is critical in achieving the quoted location tracking performance Original design may have been based on coverage model Evolving needs may require a different AP-deployment model Access Point Density recommendations Use smaller, overlapping cells (lower data rates disabled) For wireless data only deployments: 10% AP cell overlap For wireless data + voice deployments: 20% cell overlap AP density [Cell radius/area] 28ft/2500sqft 40ft/5000sqft Antennas should be oriented horizontally (vs. vertically) Antenna diversity should be enabled (ClientLink not relevant for location)

20 Large Scale Deployment 1. Good Hardware: No overprovisioned CPUs, SSD drives, use large scale VM (16vCPU/24Gig Memory) 2. Break out Analytics from CAS and break out Connect / Engage from CAS if used. 3. Break solution down in smaller WLC. Each WLC should see on average less then 1,500 moves per second (between 10,000 50,000 clients). At overload, MSE will disconnect from PI (7.6 CCO release) or drop excess NSMP packets (new fix in 7.6MR2 and 8.0) and have gaps in Analytics / API, but will stay connected to PI. MSE at 31,000 clients on one 8vCPU machine

21 Software Recommendations New Deployment WLC 8.0, MSE 8.0, PI 2.X Existing Deployments (with an addition of MSE or upgrade and incremental PI Upgrade) WLC 7.4 +, MSE 8.0, PI / today MSE 7.6MR2, PI What are the dependencies? WLC 8.0 supports new NMSP message that allows MSE to tell WLC to disconnect user required for CMX Visitor Connect, WLC 8.0 supports new AP image for FastLocate PI and 2.2 have a setting that allows the Analytics, CMX Visitor Connect to be on different machine then CAS

22 MSE Installation

23 Prepare Prime: Floor Plans AP Positions Coverage Areas Location Regions Rails Calibration Modell

24 Floorplan Import Floorplan and scale appropriate Position APs and select correct antenna pattern Coverage Areas - Zones Zones are representing different areas. e.g. in a shopping mall this could be the food court, event areas etc. Zones will be used in CMX Analytics and in CMX Browser Engage. Location Regions Use this to help the system to improve accuracy Create inclusion region at the outer walls of the building Create exclusion region around areas where no clients are expected Shelves and Racks Maintenance Rooms Create Rails along corridors

25 Map Editor This is where you draw your Areas, Regions, Rails etc.

26 AP MAP Placement

27 MSE Installation Deploy OVA Default Login: Username: root Password: password Default NCS Username: admin Password: admin Configuration Script /opt/mse/setup/setup.sh

28 Setup Script Use the menu options to set: 2) Hostname 3) DNS 5) eth0 IP Address 8) Timezone 12) NTP 19) Password Settings 18) Root password 21) NCS user 22) NCS password 23) Apply Settings Always use valid NTP source for WLC, Prime and MSE

29 After Successful Configuration Start MSE Services automatically on boot chkconfig msed on Handle MSE Service: /etc/init.d/msed [start/stop/status]

30 Prime Infrastructure: Configure MSE

31 Add Mobility Service Engine

32 Synchronise Network Design (Floors)

33 Synchronise Network Design

34 Synchronise Controllers Check NMSP Status

35 Check NMSP Status NMSP Status Echo Request Echo Response Last Active Time is Current

36 Enable Services from Prime MSE with CAS and CMX Analytics Enabled

37 Services Mix Services on the Same MSE Context Aware Services and CMX Analytics can be run on the same MSE. wips should be run on a separate MSE without any additional services. Mobile Concierge Service client device dependencies/mobile App Enablement CMX Browser Engage is comprised of two components --- The CMX Dashboard which resides on an MSE and is used to manage CMX campaigns. The HTTP Proxy component which can reside on either an MSE (for central switched environment) or an ISR router running a UCS-E module (for Flex deployments). The CMX Dashboard component should be run on a separate MSE (if using the 3355, low end, or standard vmse) or on an MSE with other services (if using a high end MSE). For best performance it is recommended to host CMX dashboard on a separate MSE. If using the MSE proxy, the MSE should be either a low end vmse, standard vmse or The High end vmse cannot be used for the MSE proxy.

38 User/Groups at MSE Users for GUI (Analytics, CMX Dashboard) Users for API access

39 Check if Clients Show up in the Maps

40 New Admin UI on MSE 40

41 Access the New UI from Prime Infrastructure 41

42 Example: CMX Analytics Service 42

43 Settings - Dashboard 43

44 Settings General Properties / Services 44

45 Settings Licensing 45

46 Example: Filtering Parameters 46

47 CMX Analytics

48 Cisco Connected Mobile Experiences (CMX) DETECT CONNECT ENGAGE GUEST PRESENCE Mobile device detected GUEST ACCESS Seamless, secure Wi-Fi on-boarding LOCATION ANALYTICS GUEST EXPERIENCE Local services

49 Use Cases Which area did people spend time at? Peak times in the venue? New or repeat customers? Most frequently used paths in the venue WiFi Stats: Associated vs Non-associated devices

50 CMX Analytics Topology Cisco Prime Infrastructure Management Station (Client Browser) SOAP/XML Analytics UI (Client Browser) Analytics Engine Wireless Clients

51 Device/Path Database Creation The process of downloading and creating the Devices/Path database is automatic For a fresh install data collection begins immediately o o MSE database data polled every 15 minutes by default Analytics available after first 15 minutes passes For an upgrade to an existing MSE which has been collecting data, then Location Analytics will download the last 3 days of data o o MSE database data polled every 15 minutes by default Analytics are available immediately since data is in the Location Analytics database Analytics processing on the MSE can impact performance in two ways Polling frequency: trials have shown this to be negligible on a polling frequency of every 15 minutes Size of the dataset to be processed: analytics have been optimised to work only on a sample of the data if too large a dataset is requested

52 Analytics Configuration Enable CMX Analytics Service on MSE

53 Analytics Configuration Enable History Logging for Client Stations

54 Analytics UI Login to Username / PW as selected in the initial configuration of MSE (connection user) Or create new user on MSE Preferred browser: Google Chrome Test your browser is suitable at If this is successful, you should see a WebGL rotating cube If the support is not there, it may be possible to update your video driver

55 CMX Analytics Dashboard

56 CMX Analytics Retain the ability to refine Rules selecting items such as building, date/time/zones etc. Improved cluster view by selecting description icon displaying Dwell Time, Distribution over Time, and Visits (2d view). Dwell, Device Count, Crowding, 3D to 2D map toggle, and other frequently used UI selections available on main UI page, no need to drill down to submenu.

57 Analytics: Most Popular Paths 57

58 Reports: Daily Visitors

59 Reports: Detected vs. Connected Devices 59

60 CMX Visitor Connect

61 CMX Visitor Connect Cisco Prime Infrastructure CAS Service (Location) MSE SOAP/XML Rest API Connect & Engage Service MSE Device Specific / Location Specific Login Screen 1 HTTP 8083 redirect at login Wireless Clients

62 Configuring Visitor Connect In MSE 8.0 simplifies Visitor Connect configuration User only needs to configure items to be collected (ie and name) and zones that this template will be used. You can configure that Social Auth users to have higher quota then non Social Auth users.

63 Location-Specific Guest Access CMX Connect CONNECT TERMS AND CONDITIONS; REGISTRATION CUSTOM LANDING PAGE/VIDEO SIMPLIFIED SOCIAL LOGIN

64 CMX for Facebook Wifi Facebook Cisco Prime Infrastructure CAS Service (Location) MSE SOAP/XML Rest API Connect & Engage Service MSE Device Specific / Location Specific Login Screen First redirect, on port 8084 then moved to Facebook 1 2 HTTPS redirect at login Wireless Clients

65 Configuring CMX for Facebook WIFI: Pairing Facebook Page CMX for Facebook WIFI Step 1: MSE 8.0 you pair MSE to FB Account. CMX for Facebook WIFI Step 2: Configure FB Wifi Parameters

66 Configuring CMX for Facebook WIFI: Location Specific FB Page CMX for Facebook WIFI Location Specific Pages Step 1: Navigate to Location Pair with Facebook Step 2: Select Location Step 3: Page location with Facebook Page

67 Capacity Guidelines MSE User DB stores last 50,000 MAC addresses that have logged on for authentications (every user creates entry), purged after 160 days (configurable). Logins per Second: Concurrent Login Rate of 45 logins / sec Visitor Connect (benchmark) 401 page to user if limit is exceeded and they need to retry Concurrent Login Rate of 500 logins / sec Facebook (benchmark) 401 page to user if limit is exceeded and they need to retry Recommend to deploy service into separate box from location calculations (i.e., CAS) when number of users exceeds 10,000

68 Guest Onboarding Methods Guest Method CMX Visitor Connect / Facebook Wifi CMX Visitor Connect (old) WLC Based with / without ISE MSE Image N/A - Uses WLC image only Authentication Oauth with Social Credentials i.e. FB, G+, Linkedin Or Native FB Oauth with Social Credentials i.e. FB, G+, Linkedin Guest Users in ISE or via PI / Cisco Lobby Ambassador or AAA Info to authenticator Disconnect Credentials only (0Auth) or Credentials and Packet Counts New NSMP message for force deauthentication controlled by FB policy or config (on WLC 8.0) Credentials only Session timeout on WLC Credentials Configurable in PI or ISE Requirements Standard MSE Standard MSE Standard WLC + ISE Usage Limiting Policy Time based for Facebook and Usage Quote Limiting for Social vs non Social user. None Yes

69 FastLocate (Packet-based RSSI Calculation)

70 Mobile Device Probing Delivers Diminishing Returns OLD WAY Relied Purely on Mobile Devices Probing an Access Point (AP) Sent on most channels - received by neighbour APs on different channels Good for location estimation WHY IT WILL NOT CONTINUE TO WORK Client Probing Frequency is Reducing Updates vary from <1 sec to 5 mins depending on: Client OS Driver Battery Current client activity Other Not enough Data Points to accurately represent realworld movement NEW WAY Supplement Mobile Probing with All Network Packets for Higher Location Resolution Initiated by Network Available More Frequently Provides More Data Points to Accurately Represent End-User Activity Device Agnostic Consistent Across devices and works even when device is sleeping

71 FastLocate Performance Probe RSSI FastLocate (Packet RSSI) Results Time between updates Location Accuracy WHEN MOVING ~ 50 Seconds 8 to 9 Seconds Faster updates when moving 5-30 M 4-10M More consistently accurate locations

72 How FastLocate (Packet RSSI) Works WSM Modules scans EACH of 16 channels every 250ms. Therefore every channel is scanned every 4 seconds. Serving Radio get packets continually. AP Reports RSSI data to WLC two times per second. WLC reports RSSI data to MSE every 2 seconds. With CleanAir a timeslot is used for Cleanair MSE buffers for 5 seconds for calculations independent of WLC. Every 5 seconds location is calculated.

73 Probing vs FastLocate Location Calculations Probe Packets based location calculates on average 2 locations per minute FastLocate based location are calculated on average 9 locations per minute Office A Office A Office A Office A Office A Office A Probe Occurs every 30 Seconds FastLocate location updates about every 6 seconds

74 The Real Impact

75 Restrictions on a Deployment with FastLocate How do I enable this feature? PLR enable needs to be in location template that is pushed from PI to WLC Telnet to WLC and do config location plr enable No Mixed mode support in first version (ALL APs must be same) Security monitoring can be done simultaneously with FastLocate Requires WLC 8.0 / MSE 8.0 / PI 2.1.x Because new AP image is bundled only in WLC for NTP clock sync functionality on AP Requires all APs to be 3600 / 3700 with Wireless Security modules (WSM) (1:1) Because you cannot mix Probe and FastLocate datapoints Scale for FastLocate NMSP messages for ASSOCIATED devices will be 5-7 times more then with typical Probe packets Because of higher number of NMSP packets per minute per device, for associated devices, overall scale of MSE goes down. MSE treats Packet RSSI values the same as Probe Packet RSSI values The overall location calculation algorithm is slightly more complex than previous versions Max scale of MSE is still at 90,000 Location calculations per minute No impact on UNASSOCIATED devices

76 CMX App Engage

77 Mobile Concierge: Native App How it Works iphone App Store / Android Market App Server 1) User Downloads Mobile App 3) App exchanges info with Server 2) User installs app and accepts notification

78 Mobile Concierge: Native App How it Works DB App Server MSE Notifies customer App Server MSE 2) MSE learns the MAC and location of the device 3) Server gets the MAC and Location info from MSE: a. Looks up the database b. Verifies that the user has registered 4) Cust App Server pushes notification via 3G/4G 1) User walks into a store If guest Wi-Fi is available then mobile automatically connects to guest WLAN

79 Mobile Concierge: Native App How it Works DB App Server MSE 6) MSE tracks location & pushes it to the App server 7) Sales Associate armed with customer s purchasing history engages the customer 5) User accepts notification & store app is automatically launched

80 Data Privacy Hash MAC Addresses of Northbound Notification

81 Rouges & Wireless Intrusion Prevention (WIPS)

82 Rogue Location On-Demand using Cisco Prime Allows an individual Rogue AP to be located On-demand Keeps no historical record of rogue location Does not locate rogue clients 82

83 Rogue Location In Real-Time with Prime and Mobility Services Engine (MSE) Context-Aware WiFi Interferer Non-WiFi Interferer Track of multiple rogues in real-time (up to MSE limits) Can track and store rogue location historically Microwave Bluetooth Provides location of Rogue Clients, Rouge Ad-Hoc networks & Non-WiFi Interferers 83

84 Zone of Impact with Prime and MSE Context-Aware Rogue Access Point Non-WiFi Interferers 84

85 Cisco s Attack Detection Mechanisms Cisco Prime Core WLC Base IDS Rogue AP and Client Detection 17 Common Attack Signatures Alarm Aggregation, Consolidation and False Positive Reduction Enhanced DoS Attack Behaviour Analysis 115 attack signatures Coordinated Rogue Containment Anomaly Detection Adaptive wips Forensic, Blacklisting, Auto Containment, and Auto Immunity responses 85

86 wips Mobility Services Engine /20/ :09 Spoof MAC 8/22/ :24 DoS Attack 8/24/ :07 DoS Attack wips AP WLC wips MSE Attack Database System-wide Device Database 00:55:9A:6A:34:01 AP 00:1F:3B:1A:A2:01 AP 00:1F:3B:7C:A2:13 Client wips AP Forensics Database Anomaly Detection Engine

87 wips Alarm Flow Attack launched against infrastructure device Detected on AP Communicated via CAPWAP to WLC Passed transparently to MSE via NMSP Logged into wips database on MSE Sent to NCS/CPI via SNMP trap Displayed on NCS/CPI NCS/CPI

88 wips Profile

89 New wips Signatures wips attack mitigation action button is clickable when there is an action applicable to the attack. User can click on the button to launch the action. The result of the action will be displayed in the Annotation message field of this page Alarm Id Signatures 218 Beacon Fuzzed Frame 219 Probe Request Fuzzed Frame 220 Rogue AP Containment 213 Air Drop Session Detected 215 DHCP Starvation Attack 221 Wi-Fi Protected Setup Pin Brute Force

90 Global Forensic Capture A troubleshooting feature to capture and examine the packets received by the AP. Debugging if a valid attack is not being detected Identifying new attacks Start and stop packet capture on access point on demand Capture Options provided: Capture buffer size Packet truncation length Type of frames to be captured (data, control, etc.) Capture time

91 Enhanced Visualisation of Wireless Threat Overlaid display of data AP and rogue AP with coverage and impact Overlaid display of data AP and RF jammer with coverage and impact Rogue s Zone of Impact Interferer s Zone of Impac Wireless attacks display filter Icon per type of threat Attacker Victim Unknow n device

92 Call to Action Visit the Cisco Campus at the World of Solutions to experience the following demos/solutions in action: Speaker to add relevant demos/areas to visit from the campus demos list Get hands-on experience with the following Walk-in Labs Speaker to add the relevant walk in labs from the list Meet the Engineer Discuss your project s challenges at the Technical Solutions Clinics Attend one of the Lunch Time Table Topics, held in the main Catering Hall CL365 -Visit us online after the event for updated PDFs and on-demand session videos. 92

93 Continue Your Education Demos in the Cisco Campus Walk-in Self-Paced Labs Table Topics Meet the Engineer 1:1 meetings 93

94 Q & A

95 Complete Your Online Session Evaluation Give us your feedback and receive a Cisco Live 2015 T-Shirt! Complete your Overall Event Survey and 5 Session Evaluations. Directly from your mobile device on the Cisco Live Mobile App By visiting the Cisco Live Mobile Site Visit any Cisco Live Internet Station located throughout the venue T-Shirts can be collected in the World of Solutions on Friday 20 March 12:00pm - 2:00pm Learn online with Cisco Live! Visit us online after the conference for full access to session videos and presentations.

96

97