Architektura a služby moderní bezdrátové sítě

Transcription

1 Architektura a služby moderní bezdrátové sítě NW2/L2 Pavel Křižanovský, CCIE #11457 Sponsor Logo Sponsor Logo Sponsor Logo 1

2 Agenda Mobility As a Trend Modern Wireless Architecture Mobility Services New Technology Trends Interesting Products And Innovations In Cisco Unified Wireless Solution 2

3 Agenda Mobility As a Trend Modern Wireless Architecture Mobility Services New Technology Trends Interesting Products And Innovations In Cisco Unified Wireless Solution 3

4 The world is changing fundamentally Nomadic/ Mobile Devices Collaboration Wireline/ Wireless 4

5 The Incoming Mobility Wave Continued Proliferation of Number of Devices, OS, Applications, Wireless Technologies Creates a Tremendous IT Challenge 500 Internet Users Mobile Users How to Manage/Operate a Unique Secure Mobility Experience and Create Business Value 5

6 Growth in Mobile Devices Mobile Device Growth Create Greater IT Risks Cisco Systems, Inc. All rights reserved. Cisco Public

7 Business Mobility Requirements Differ from Consumer Mobility Secure, Manage and Audit Device Usage/Policies/Access Unify Multiple Networks from Personal to Private to Public Enable Applications to Securely Access Information Across Multiple Networks Ensure Overall Quality of the Mobile Connection: Reliability, Predictability and Speed. Anytime, Anywhere Over Any Network Not Exactly Rather Right Application, Right User, Right Policies 7

8 The ROI of Mobility: Cisco on Cisco Cisco embarked on a program to deliver pervasive wireless connectivity 45% of Cisco s employees use the wireless network for primary access First quarter the network optimization resulted in over 30% OpEx saving Service-impacting incidents were reduced by 90% with automated self-healing Additional cost decreases with improved employee productivity Cisco Employee Productivity 95% of 7,000 Employees Surveyed Gained at Least 1 Hour per Week of Productive Time by Using the WLAN Avg. Cost of Work Hour 95% of Employees Surveyed Hours/Year Gained $75 6, Annual Productivity Improvement $24,937,500 8

9 Agenda Mobility As a Trend Modern Wireless Architecture Mobility Services New Technology Trends Interesting Products And Innovations In Cisco Unified Wireless Solution 9

10 Evolving Wireless Technology Architecture Unified Wired+Wireless Wireless Connectivity Best in Class Range/ Throughput Enterprise-Class Security Capital Efficiency Centralized WLAN Systems Centralized Management and Control Layer 2/3 Mobility Wireless IDS/IPS Hierarchical Approach for Scalability Voice Support Integrated and Unified Security (AAA, NAC, SDN, IDS/IPS, etc.) Exploding Number of Wi-Fi Clients (Laptops, Dual-Mode PCS Phones, Video PDAs) Higher-Capacity, Higher-Density WLANs (Pico Cells) Unified Wired+Wireless Support for Applications (Voice/Video, Location Services, AAA) Extending Networking Outdoors (Mesh, Outdoor AP, Etc.) Enterprise Scale and Reliability 2000 Present 2003 Present 2006 Future 10

11 Challenges for Wireless Deployment Building a Business Class Network Wired and Wireless Lack of Resources to Manage the RF The Radio Frequency Is Unpredictable Wireless Doesn t Scale or Deliver the Uptime We Need Managing wireless devices is costly SSC Devices Access Points Controllers Management 11

12 Cisco Unified Wireless Network Architecture Overview Wireless LAN Controller Switched/Routed Network Mobility Services Voice Location & RFID Guest Lightweight Access Point Switched/Routed Network Client Devices Security Management System Seamless Mobility for WLAN Services Dynamic RF Management Centralized Management Planning and troubleshooting tools Easy to use GUI Security Management (IDS/IPS,..) Scalability, Predictability, Reliability 12

13 Agenda Mobility As a Trend Modern Wireless Architecture Mobility Services New Technology Trends Interesting Products And Innovations In Cisco Unified Wireless Solution 13

14 What are the mobility services? Security Context Aware Services (Location) Voice Mobile Intelligent Roaming Guest Access Spectrum Intelligence Mobility Services Guest Access Spectrum Intelligence Context- Aware Security Voice Mobile Intelligent Roaming 14

15 Secure Wireless Solution Architecture Trusted Untrusted Wireless Wired Public NAC Manager CSA Server Guest Anchor Controller SSC Cisco Security Agent Cisco Secure ServiesClient Internet Enterprise Cisco VPN Client ASA 5500 w/ IPS Module NAC Appliance 802.1X WPA2 MFP WCS NGS CS-MARS Guest Endpoint Protection Host intrusion prevention Endpoint malware mitigation Traffic and Access Control Device posture assessment Dynamic, role-based network access and managed connectivity WLAN threat mitigation with IPS/IDS WLAN Security Fundamentals Strong user authentication Strong transport encryption RF Monitoring Secure Guest Access Secure Wireless Design Guide: 15

16 Context Aware Services Architecture Formerly Location Business Application SOAP/XML API Context-Aware Software MSE Context Aware Engine for Clients Context Aware Engine for Tags Si Si RSSI RSSI / TDOA Mobile User Voice over Smart Phone Clients CCX Tags Indoor Environment Indoor & Outdoor Environments 16

17 Cisco Unified Wireless Network Voice Services Solution Seamless mobile voice communications across the enterprise Only end-to-end unified wireline and wireless voice solution Rich selection of enterpriseclass and industry specific voice clients Increased call capacity, higher network availability and improved performance Cisco Unified Unity Server Cisco Unified CallManager Cisco Mobility Manager Mobile Connect 7921/5 Wireless IP Phone Personal Communicator Wireless Control System Management End to End Intelligent Integration Si Cisco Compatible Clients 17

18 Cisco Unified Wireless Network Integrated Guest Access Several Radio Network over one infrastructure : Corporate Network Strong Security Access to corporate LAN Voice / IP Communication Strong Security Access to Voice VLAN QoS Guest Network No encryption Path isolation with Corp. Net. Internet Access internet VLAN Voice Central Site VLAN Data 18

19 Agenda Mobility As a Trend Modern Wireless Architecture Mobility Services New Technology Trends Interesting Products And Innovations In Cisco Unified Wireless Solution 19

20 Cisco Drives Wireless Standards CCX Over the Air LWAPP k r u v w j n s Radio Measurement Fast Roaming External Networks Client Management Mngmt Security Japan Radios Next-gen Radios Mesh Networks Over the Wire IETF CAPWAP 20

21 Centralized Wireless LAN Architecture What is CAPWAP? CAPWAP - Control And Provisioning of Wireless Access Points is used between APs and WLAN Controller and based on LWAPP CAPWAP is specified in IETF RFC 5415 (March 2009) LWAPP-enabled access points can discover and join a CAPWAP controller, and conversion to a CAPWAP controller is seamless CAPWAP is not supported on Layer-2 mode deployment (only L3 mode) Business Application Access Point Formerly CAPWAP LWAPP Data Plane Controller WiFi Client Control Plane 21

22 Difference between LWAPP and CAPWAP Description LWAPP CAPWAP Fragmentation/Re-assembly Relies on IpV4 CAPWAP itself does both Path-MTU Discovery Not supported Has a robust P-MTU discovery mechanism, can also detect dynamic MTU changes Control Channel Encryption between AP and WLC Yes (using AES) Yes (Using DTLS) Data Channel Encryption between AP and WLC No Yes (using DTLS) UDP Ports 12222, (ctrl) 5247 (data) 22

23 Wireless has Become Business Oxygen Evolution to n Business applications have gone mobile Wireless is evolving to meet needs for high performance, pervasive connectivity Next Gen Wireless Ubiquitous mobile computing Business Ready Mobile Data Point Applications Voice, Video, Data Web browsing Inventory Management Barcode Scanning n 300Mbps ag b ration e f i l 54Mbps o Pr vice e D i Wi-F 11Mbps Mbps Cisco Systems, Inc. All rights reserved. Cisco Public

24 802.11n It s About a Whole Lot More Than Speed Throughput Reliability Predictability 5x more throughput 2x more reliable 2x more predictable Enhanced file transfer and download speeds for large files Lower latency for mobile unified communications More consistent coverage and throughput for mobile applications Mbps Throughput >5x Average Packet Retries 11a/g AP Predictability of Throughput Standard Deviation of Packet Retries 2x a/g n, 20 MHz n, 40 MHz 11a/g AP n AP x IDEAL a/g with AP a/g with AP n with AP

25 Technical Elements of n MIMO 40Mhz Channels Packet Aggregation Backward Compatibility 40Mhz Channels Packet Aggregation Backward Compatibility 25

26 Maximum Ratio Combining MIMO 40Mhz Channels MIMO (Multiple Input, Multiple Output) Without MRC Multiple Signals Sent; One Signal Chosen Packet Aggregation Backward Compatibility SISO AP With MRC Multiple Signals Sent and Combined at the Receiver Increasing Fidelity Performance MIMO AP Performance 26

27 Maximum Ratio Combining Performed at receiver (either AP or client) Combines multiple received signals Increases receive sensitivity Works with both 11n and non-11n clients MRC is like having multiple ears to receive the signal 27

28 Spatial Multiplexing 40Mhz Channels Packet Aggregation MIMO (Multiple Input, Multiple Output) Backward Compatibility Spatial Multiplexing: Without Information Spatial Multiplexing Is Split and - Single Transmitted Streamon Multiple Streams stream 1 MIMO AP stream 2 Performance Transmitter and Receiver Participate Concurrent Transmission on Same Channel Increases Bandwidth Requires 11n Client 28

29 40-MHz Channels MIMO 40Mhz Channels Packet Aggregation MIMO (Multiple 40Mhz Input, Channels Multiple Output) Backward Compatibility Moving from 2 to 4 Lanes 40-MHz = 2 aggregated 20-MHz channels takes advantage of the reserved channel space through bonding to gain more than double the data rate of 2 20-MHz channels 29

30 Aspects of n MIMO 40Mhz Channels Packet Aggregation Packet 40Mhz Aggregation Channels Backward Compatibility Carpooling Is More Efficient Than Driving Alone Without Packet Aggregation n Overhead Data Unit Packet n Overhead Data Unit Packet n Overhead Data Unit Packet n Overhead Packet Data Unit Packet Packet With Packet Aggregation 30

31 Aspects of n MIMO 40Mhz Channels Packet Aggregation Backward Packet Aggregation Compatibility Backward Compatibility 2.4GHz 5GHz 11n Operates in Both Frequencies ABG Clients Interoperate with 11n AND Experience Performance Improvements 31

32 Backward Compatibility & Co-Existence Co-existence of ABG/N APs Benefits of 11n accrue to ABG clients MIMO benefits ABG clients on the AP receive side from MRC Co-Existence at Controller Level Backwards Compatibility WLAN Controller WLAN Controller 11g 11n 11g 11n 54 Mb 48 Mb 36 Mb 28 Mb 300 Mb 54 Mb 300 Mb Roam 11g 11n 11g 11n 32

33 Agenda Mobility As a Trend Modern Wireless Architecture Mobility Services New Technology Trends Interesting Products And Innovations In Cisco Unified Wireless Solution 33

34 Cisco Unified Wireless Network Client CCX Program 90% of laptops Cisco compatible Secure Services Client (CSSC) Access Points Indoor and Outdoor Modular, a/b/g/n Unified Network Wireless LAN Controllers and Management Centralized management Flexible, scalable (1000s of APs) Radio resource management Wired Network Services Unified Security and Management services Mobile Unified Communications Mobility Services Security Guest Access Spectrum Intelligence Voice Compatible Device Access Unified Wired and Wireless Network Control and Service and Visibility Performance Location Mobile Applications 34

35 Single Client for Uniform Security and Services Key features: EAP: 802.1X authentication for wired and wireless devices Windows XP/2000 support EAP-FAST, EAP-MD5, PEAP-MSCHAP, PEAP-GTC, EAP-TLS, EAP-TTLS, Cisco LEAP Encryption: WEP, dynamic WEP, TKIP, AES Standards: WPA and WPA2 SSC Cisco Secure Services Client Features Unified wired and wireless client Support for industry standards Endpoint integrity Single sign-on capable Enabling of group policies Administrative control Benefits Reduces client software Simple, secure device connectivity Minimizes chances of network compromise from infected devices Reduces complexity Restricts unauthorized network access Centralized provisioning 35

36 Proven Platform for Mobile Access Indoor Access Points Features Access Points Industry s best range and throughput Enterprise class security 1130AG 1140 Indoor Rugged Access Points Many configuration options Simultaneous air monitoring and traffic delivery Wide-area networking for outdoor areas 1240AG 1250 Outdoor Access Points/Bridges Benefits Zero touch management No dedicated air monitors Supports all deployment scenarios (indoor and outdoor) From secure coverage to advanced services 36

37 Wireless Controller Product Portfolio Performance & Scale , 25, G-25, , 12, 25 WLCME-6, 12, WiSM-300 H-REAP # of APs 37

38 Simple Intuitive Management Centralized RF and System Management Can I see how good my wireless coverage is? Can I detect interference from cordless phones and microwaves? Can I ensure my network is voice ready? Can I locate rogue access points? Can I determine my wireless PCI compliance? Can I assess the security health of my wireless? Predictive Voice CleanAir Wireless PCI Security Technology Floor Dashboard Planning Intrusion Maps Tools Prevention Reporting 38

39 11a/g to 11n Access Point Migration Indoor Environments Integrated Antennas Rugged Environments Antenna Versatility 39

40 The Aironet 1140 Series Access Point Integrated Radios 2.4GHz (b/g/n) 5GHz (a/n) 10/100/1000 Ethernet Port Console port Security lock Plastic over metal design Runs in Unified-mode (CAPWAP) only Powered via 802.3af PoE 40

41 Mobility Services Architecture Open Platform Designed for Applications Applications Applications Applications Applications Applications Applications Applications Applications Open API Mobility Services Engine WIPS Handoff Location Service n Location WIPS Handoff Service n NMSP Open Protocol WCS WLAN Controller Controller Ethernet Wi-Fi WiMax Cellular 41

42 Cisco Context Aware Mobility Solution Tracking Tags and Clients Cisco Mobility Services Engine Context-aware engine for tags (partner engine) Tracking tags (indoor and outdoor/outdoor-like) Context aware engine for clients (Cisco engine) Tracking clients (indoor) Cisco 3350 Mobility Services Engine Context Aware Engine for Tags Context Aware Engine for Clients Context Aware Software Cisco Wireless Control System (WCS) Si Application and Management Utilizes: CAPWAP infrastructure for indoor environments Wi-Fi TDoA receivers for outdoor and outdoor-like environments Partner HW/SW managed by System Manager (partner) and Cisco WCS Wi-Fi TDoA Receiver Network Wired location (supported on v6.0) Today: Catalyst 3750, 3750E, 3650, 3650E, 2960 Summer 2009: Catalyst 4500 series, 4500-E series, 4900 series Future: Catalyst 6500 Chokepoint 125 khz AeroScout Tag and Devices 42

43 Cisco Adaptive Wireless IPS System Overview System Functions Rogue Detection and Mitigation Over-the the-air Threat Detection Security Vulnerability Assessment Performance Monitoring and Self-Healing Proactive Threat Prevention SYSTEM ARCHITECTURE wips Integrated in WLAN Infrastructure Over-the-Air Detection Network Detection & Correlation Complex Attack Analysis, Forensics, Events WCS AP WLC MSE Usage Scenarios Detect and Mitigate Rogue APs and Clients Detect External Hackers & Thieves Ensure Strong Network Security Posture Ensure Consistent WLAN Performance Internal Security Reporting/Audit Security and Compliance Reporting Monitoring, Reporting External Compliance Audit Reporting 43

44 Adaptive wips One Alarm per Attack WCS Controller IDS Adaptive wips WCS MSE Controller IDS has no correlation 44

45 How is this different than controller IDS? wips can has 45 different signatures, a variety of network-side detection and analytical logic to detect different threat conditions and attack tools (depending on how you count) Controller IDS has 17 signatures that detect 14 different attack scenarios wips provides forensics (packet capture) abilities wips provides centralized database for attack aggregation and alarm archival on MSE wips provides an attack encyclopedia 45

46 Cisco Mobile Intelligent Roaming A software-based Mobility Solution delivered through Cisco 3300 Series Mobility Services Engine Dynamically determines network handoff requirements for dual mode devices Leverages network intelligence and client software integration with an open ecosystem of partners to initiate seamless handoff and an improved user experience Seamless intelligent handoff enables a transparent mobile experience 46

47 Access Point MSE WLAN Controller 1 Mobile Intelligent Roaming WLAN Infrastructure Assisted Handoff Enterprise Domain 5 Dual-mode with Client Software VoIP 3 4 IP PBX CMIR PSTN Gateway 2 Carrier Domain TDM Cellular Network 1 Dual-mode device on an active call is monitored by WLAN infrastructure 2 Device roams to edge of RF coverage 3 At designated threshold Cisco Mobile Intelligent Roaming (CMIR) triggers client to initiate handoff 4 Client software initiates new call leg to PBX; PBX bridges new leg to active call and releases WLAN connection 5 New call path is established transparently Client software initiates handoff based on CMIR event triggers 47

48 Other Upcoming Innovations New HW products Cisco 1430 Autonomous PTP/PTMP Wireless 5GHz, 40 MHz wide band, SISO Mbps data rate Cisco 5500 Controller Up to 500 APs, 8 GE ports, flexible licensing Cisco ISR 890W SW news a/b/g/n MIMO Integrated AP FE/GE WAN, 8port FE LAN switch features of AP 1250, autonomous and unified OfficeExtend AP Plug&Play TeleWorker Solution based on 1130s & 1140s and WLC 5500 Voice over Indoor Mesh support Only for Enterprise Mesh, Up To 2 Hops 48

49 Summary The World Is Changing Rapidly, Mobility Is the Key Unified Wireless Network Evolve to a Mobility Services Architecture Cisco as a Trusted Partner 49

50 Architektura a služby moderní bezdrátové sítě NW2/L2 Pavel Křižanovský 50