Managing an Enterprise WLAN with Cisco Prime Network Control System (NCS)

Transcription

1 Managing an Enterprise WLAN with Cisco Prime Network Control System (NCS) BRKEWN

2 Agenda Understanding the need for Prime NCS Cisco Prime Network Control System (NCS) Cisco Prime NCS 1.1 deep dive Network Configuration Design & Planning Autonomous AP Support Identity Services Engine Scalability, Deployment Options and Services 2

3 Understanding the need for Prime NCS

4 Addressing Management and IT Challenges Network complexity Manual changes Where to start? What to configure? Which services? Maintenance plan Troubleshooting 4

5 Influx of Mobile Devices Creates IT Challenge IT Consumerization: Now a Reality Smartphone adoption is growing at 50%+ annually* By 2015, tablets will constitute 50% of laptop sales** ORGANIZATION TIME 5

6 The User to Device Ratio Has Changed IT Resources Stay The Same Fixed User Wired access One user: One device Mobile User Wireless access One user: Local devices Borderless User Anytime, Anywhere access One user: Many devices Access Evolution Early 90 s Late 90 s Today Effectively support users with box management Need for policy & control Need for operational efficiency 6

7 What is Cisco Prime A strategy for innovative management Supports enterprise and service providers Integrated lifecycle management across Cisco architectures and technologies Simplified and predictable network management Increased operations efficiencies 7

8 Cisco Prime for Enterprise Product Portfolio Endpoints Services NCS LMS Network CM NAM Cisco Prime Network Control System (NCS) Cisco Prime LAN Management Solution (LMS) Cisco Prime Collaboration Manager (CM) Cisco Prime Network Analysis Module (NAM) Cisco Prime Infrastructure 1.1 (NCS + LMS4.2) Unified Management Across Architectures, Networks, and Services 8

9 What is Network Control System (NCS)? Single platform for consolidated view of wired and wireless access infrastructure and endpoints Built on the foundation of Cisco WCS, provides complete lifecycle management of wired and wireless access networks Provides monitoring of endpoint security policy integration with Cisco Identity Services Engine (ISE) All existing functionality in WCS is supported in NCS Simplified and predictable network management Lowers total cost of ownership 9

10 Enhanced User Experience Designed to Work With How IT Approaches Problems Information architecture: Seamless navigation and workflows align to tasks Modern interaction behavior: Maintains context while performing network management tasks Smart tables & advanced filtering: Quickly view additional information without leaving the workflow Ever-present alarm views & browser: Always-on visibility to potential end-user problems to speed remediation 10

11 Single Integrated User and Access Dashboard Flexible platform: Accommodates new and experienced IT administrators Simple, intuitive user interface: Eliminates complexity User-defined customization: Display the the most relevant information 11

12 Unified User and Endpoint Services Correlated and focused wired / wireless client visibility Client health metrics Client posture & profile Client troubleshooting Client Reporting Unknown device ID input Clear view of the end-user Landscape Who is connecting Using which device Are they authorized 12

13 Comprehensive Wireless Lifecycle Management 13

14 Cisco Prime NCS1.0 Deep dive

15 Integrated Access Infrastructure Visibility Wired & wireless discovery and inventory Add / detect infrastructure devices such as switches, WLAN controllers and access points Comprehensive access infrastructure reporting View the access infrastructure as a whole or as discrete technologies Stolen asset notification Track when devices presumed stolen come back online 15

16 Controllers & AP s Discovery and learning of Devices Configuration of controllers, AP's and other managed devices are performed using the configure Tab Devices added to NCS populate templates and dynamically populate NCS with information on associated AP's and fields like RRM clients etc. 16

17 Discovery and learning of Devices Controllers can be discovered individually or using CSV, Zip file formats Any AP s associated to the respective controllers are auto detected and loaded into the NCS database. 17

18 Autonomous Adding Autonomous AP's same format as adding Controllers 18

19 Wired Adding Switches is also the same format as adding a Controller Devices supported and possible functions can vary depending on IOS version. Most Cisco Catalyst 2960, 2975, 3560, 3750 running [IOS12.2(50) SE], 4500 on [IOS12.2(50) SG] and 6500 series running [IOS12.2(33) SXI] or higher Note! For Context aware services read/write community access is required. 19

20 Network Configuration

21 Configuration Auditing Easy way to identify configuration gaps between WCS or NCS and WLC Manual on-demand audit capability Automatic audits based on configuration sync background task Allows easy reconciliation in the event of a configuration mismatch Helps ensure WLCs comply with configuration policies 21

22 Quick Audit Summary and Reconciliation Audit Summary Restore or Maintain Config 22

23 Audit Settings Audit Settings Audit Mode Basic Audit: Perform an audit on current WLC configuration and compare it with the configuration in NCS Template-Based Audit: Perform an audit on current WLC configuration with respect to applied templates, config groups background templates and then the configuration in NCS Audit On All Parameters: Audit on entire WLC configuration Selected Parameters: Audit on selected parameters from the templates 23

24 Configuration Auto-Provisioning What is Auto-Provisioning? Ability to automatically detect and configure new WLCs (locally or at remote sites) Allows detection based on multiple criterion: Hostname, MAC Address or Serial number (.cfg file on TFTP server) Adds WLC to NCS for further configuration after provisioning When Would You Use It? Large distributed deployments Limited IT resources Streamline operations and eliminate configuration mismatches 24

25 Controller Auto-Provisioning Monitor Only: Controllers matched by this filter will not be configurable by NCS in the auto provision process Filter Mode: Choose from hostname, MAC Address or Serial number to match the WLC Config Group Name: Add the auto-provisioned WLC(s) to their own config group for easier management since these might share common policies Input Device: Select from single or multiple devices to provision. Selecting CSV option provides a link to download a sample file to understand the syntax. Device Configuration: Other device parameters that can be configured at this stage. After hitting Submit, the filter is saved with one entry for the member you just added. At this point, you may add other members (WLCs) to this filter as well. This filter also creates a WLC config file in NCS s TFTP directory. Ensure your DHCP server s option 150 points to NCS Server 25

26 Scheduled Image Download to Controller Provides option to schedule software download (FTP/TFTP) to controllers. Task can be saved for future scheduling. Reboot can be scheduled at a future date/time. notification can be sent after completion of download. 26

27 Scheduling AP Pre-Image Download Provides option to schedule image download to AP. Reboot can be scheduled at a future date/time. notification can be sent after completion of download. 27

28 Design & Planning Map Layout Buildings, Floors Map Editor Real-time Heatmaps User Density not evenly distributed Public Venue differs to higher education 28

29 Easily Visualize the Planning Ideal RF Environment RF Prediction Tools Assist in Designing Optimal WLANs Integrated Planning Tool Import floor plans from 3 rd -party tools Configure access point placement, coverage, and other variables Generate equipment proposal Hierarchical Maps Design multiple buildings, floors, regions Location and Voice Readiness Tools View performance and coverage estimates Instant Access to Tools Eliminate improper RF designs and coverage problems Hierarchical Maps Planning Tool Built-in tools perform site-surveys, RF reassessments and RF readiness evaluation 29

30 Planning Overview Launching the Planning and Editing Tools Create a new Campus/Building Create a floor plan Pick Planning Mode from the drop-down menu 30

31 Planning Mode High Level Options Planning Mode High-Level Options Add AP: Allows adding new Access Points to the Map Delete AP: Remove existing Access Points from the Map Map Editor: Edit the floor plan to draw objects such as light/thick walls, light/heavy doors, cubicles, glass, coverage areas, perimeters, markers, etc. Synchronize with Deployment: Pull in currently deployed and placed Access Points on the floor to tweak existing deployment Generate Proposal: Generates a document that maybe provided to a 3 rd party deployment company; additionally, also provides various heatmaps 31

32 Planning Tool Map Editor! Accounts for objects and obstacles on a floor plan Scaling for a precise RF propagation model display Attenuation characteristics for objects also obstacles help predictive engine Helps specify areas and regions such as: Coverage Area and Markers - used for location notifications Perimeter - defines the outer boundary Location Inclusion, Exclusion Regions and Rails - used for location events and notifications Objects and obstacles that may be specified: Walls (Light and Heavy) 2dB and 13dB Cubicle (Walls) 1dB Doors (Light and Heavy) 4dB and 15dB Glass (doors, windows, walls) 1.5dB 32

33 Planning Select Map Properties Wireless Planning layout Add obstacles like high attenuating walls lifts etc. AP types, antenna etc. Examples AIR-ANT2410Y AIR-ANT2422DG Scaling, Orientation, Azimuth and position are all important parameters 33

34 Planning Tool Options Specify AP Prefix and AP Placement method (automatic vs. manual) Selecting AP type determines the antenna choices available for both the 2.4GHz and 5GHz band Enable planning mode for advance options for data, voice, location and others Location with monitor-mode factors in AP(s) that could be deployed to augment location accuracy Both the Demand and Override options allow for planning for any special cases where there s a highdensity of client presence such conference rooms or lecture halls Select the protocol (band) and minimum desired throughput per band that s required for this plan Data and Voice provide safety margins for design help. Safety margins help design for certain RSSI thresholds (detailed in online help). Location typically requires a denser deployment than data and the location checkbox helps plan for the advertised location accuracy 34

35 Planning Tool Customize Plan Default suggestions after running the planning tool present AP deployment choices and ability to switch between data and signal strength heatmap Clicking an AP in the plan allows customization (added, deleted or simply modify properties) before a proposal may be generated 35

36 Planning Tool Proposal Proposal Contents: Floor Plan Details Disclaimer/Scope/Assumptions Proposed AP Placement Coverage and Data Rate Heatmap Coverage Analysis 36

37 Importing Planning designs WCS 7.0x or NCS 1.0 onwards supports 3 rd party planning tools and Site Survey imports for single or multi-floor structures RF design completed using external application adding RF losses and known criteria AP positioning calculated on RF propagation and known signal characteristics of antenna and AP models Actual AP positioning from Site Survey data can also be directly imported into NCS. Floor plans, AP coordinates and configuration, RF calibration and planning information can be exported to a tar file and imported into NCS, an entire Campus or individual components can selected when performing these tasks. 37

38 Maps Layout Default View of Campus, Buildings, and Floors can be easily changed with the Quick Filters Hierarchical Layout for easy navigation Adding Campus or Buildings are made easy with the drop-down menu actions through an easy wizard that walks you through provisioning floor plans and APs Building view provides a quick glance in to floors status and alarm summary for easier troubleshooting 38

39 Maps Layout Floor View Commonly used map actions are ever-present in icon format Quickly Add/Remove Layers that may be placed on the floor plan and heat maps Display and locate interference sources and zone of interference Mouse-over on objects on the map provides quick object summaries 39

40 NCS Map Export/Import Provides ability to export maps from one NCS to target NCS. Can select all maps or subset. Export/import of map includes both map and AP s placed on MAP. Exported via tar gzipped XML file. Import process ungzips/untars XML file automatically. 40

41 NCS Real-Time Heatmaps NCS Provides: AP-to-AP RSSI measurements reflected in heatmaps Option for selecting between dynamic (real-time) or predictive heatmaps 41

42 Real-Time Heat Maps + Rx Neighbors Provides list of neighboring AP s and RSSI value that they hear the selected AP 42

43 Autonomous AP Support

44 Monitoring Autonomous APs 44

45 Autonomous AP Reports Provides visibility into operation of aios AP s 45

46 Autonomous Clients 46

47 Standalone Access Point Monitoring and Migration aios aios aios Fault monitoring, Configuration, Reporting of standalone (autonomous) access points Monitor all Cisco IOS -based Cisco Aironet standalone models Monitor Integrated Services Router access points 800, 1900, 2900, and 3900 series Easily upgrade and migrate Cisco Aironet standalone access points (individually or as groups) Migrate Standalone Access Points CAPWAP WLAN Controller 47

48 Identity Services Engine Integration

49 NCS and ISE Integration NCS leverages ISE API for posture assessment and report generation Ability to drill-down to an individual clientlevel security details Ability to troubleshoot client connectivity issues 49

50 NCS + ISE: Client Posture and Profiling ISE determines client to be Microsoft Workstation based on device fingerprinting Client authenticated using 802.1x via ISE 50

51 Client Troubleshooting: Wireless Client 51

52 Client Troubleshooting: Wired Client 52

53 ISE Troubleshooting Tools 53

54 ISE Integrated Troubleshooting Audit Network Device Configuration Are my switchports properly configured to support 802.1X, MAB, Is my switch properly and Web configured Authentication to per Cisco support AAA and other ISE best services practices? including Posture, Profiling, and Logging? 54

55 ISE Alarms Predefined and custom alarm settings Schedule-based Non-stop (any time) or per custom day/time range Visual notification from every page in ISE UI with quick drill-down Send notifications externally via Syslog or . 55

56 Scalability, Deployment Options and Services

57 Scaling Complete lifecycle management of hundreds of wireless LAN controllers from a centralized location Rich monitoring and troubleshooting for Cisco Catalyst Switches Device Visibility into key performance metrics interface ports, endpoints and users and switch inventory WCS Devices Supported NCS Devices Supported Cisco Lightweight Access Points 3,000 15,000 Cisco Wireless LAN Controllers * Cisco Autonomous Access Points 1,250 5,000* Cisco Switches 0 5,000 * No licensing count 57

58 Appliance-Based Solution Physical Appliance Hardware and software (OS and NCS pre-installed) from Cisco 15,000 lightweight AP s 5,000 aios AP s 5,000 switches Cisco hardware appliance Not supported on WLSE hardware Virtual Appliance VMware image (OS + NCS) Supported on: VMware ESX/ESXi version 3.5 VMware ESX/ESXi version 4.1 Large: 15K/5K/5K Medium: 7.5K/2.5K/2.5K Small: 3.5K/1K/1K High-end: 8x2.93GHz CPU/1GB DRAM/300GB HD Standard: 6x2.93 GHz/14 GB/200 GB Low-end: 4x2.93 GHz/8 GB/150 GB 58

59 Diagnostic Tools Client Analysis Wired & Wireless Virtual Domains Location Tools 59

60 Client Troubleshooting Tool An easy way to identify client-related issues from within NCS, without the need for extensive WLC debugs Look at the client s current state (and at what stage of the connection they might be having issues at) Allows for real-time troubleshooting and log retrieval from the WLC Allows for looking up historical, and relevant client and AP events Allows integration with ACS View Server for authentication log retrieval 60

61 Client Troubleshooting Tool (contd..) But, first things first common problems: Watch out for misconfigured clients (common areas are WLAN profile settings, authentication and encryption settings, and any advanced extensions that might not be required Ensure WLC settings match the provisioned client profiles (security, SSID broadcast, WLAN override, etc.) Ensure data rate settings on the WLC (Mandatory, Supported and Disabled rates) Look for client exclusion settings (easy way to find excluded clients is via the quick filter in Monitor Clients page 61

62 Client Troubleshooting Launch Points Multiple Launch points to initiate client troubleshooting tool allows for diverse workflow integration 62

63 Client Troubleshooting Examples Identify whether the problem occurs at or higher layers Suggestions on where to look and how to potentially resolve the error condition(s) 63

64 Client Troubleshooting Examples Provides visibility into logs, event history, and related CleanAir information 64

65 NCS: Wired Client Troubleshooting Client connectivity status/issues 65

66 Unknown Users Assign username to client on network not authenticated via ISE. 66

67 Virtual Domains What They Are (or do) Quick way to partition NCS objects Allows users to be mapped to separate virtual domains at the time of creation Separate Reports, Controllers, Access Points, Search, Templates, Config Groups, Alarms and other objects What They re Not (or don t do) Not necessarily a complete replacement for RBAC (for example, via TACACS+) If none specified, users are added to the root virtual domain by default Don t separate Google Earth Maps, Auto-Provisioning, MSEs, and Ethernet Switches Objects may be assigned to multiple domains at the same time root domain is a superset of all sub-domains Avoid changing configurations from multiple domains management simple Not all objects are available at the root level objects such as Search and Reports are domain specific Only the root domain may configure location, and any other notifications For more caveats, visit: uration/guide/5_2virtual.html 67

68 Location Accuracy Tool Example Test with Clients, Tags, Exciters Determine Accuracy Probability, Correct Deployment Schedule Accuracy Tests BRKAGG-2011 BRKEWN Cisco Systems, Inc. All 2012 rights Cisco reserved. and/or its affiliates. Cisco All Public rights reserved. Cisco Public 68

69 Reporting

70 Section Agenda: Reporting Report LaunchPad Report Customizations Multi-Level Filtering Customizing Report Output Multi-Level Sorting in Report Output Report Scheduling 70

71 Report LaunchPad Report LaunchPad Easy Drill-Down Callouts Report Descriptions 71

72 Report Customization Multi-Level Filters Customized Reports 72

73 Graphical Report Content Graphical Reporting Graphical Summaries 73

74 NCS + ISE: Report Cross-Launch New set of reports launched from NCS cross-launches reports in ISE. 74

75 NCS + ISE: Report Cross-Launch 75

76 Spectrum Analysis Integration into NCS Prime Configuration Spectrum Expert 76

77 Spectrum Analysis NCS Direct Launch CleanAir status and icon representing Spectrum Expert support Clicking on Icon launches SE application installed on local PC 77

78 Spectrum Expert 78

79 Key Takeaways Wired/wireless access infrastructure and endpoints need to be managed together WCS and NCS provide full lifecycle management NCS builds on the features/functionality of WCS and adds wired management Easy migration from WCS to NCS both platform and learning curve 79

80 Helpful Links Cisco Prime Network Control System (NCS) Datasheet ps11682/ps11686/ps11688/data_sheet_c html NCS Learning Modules _support_online_learning_modules_list.html TACACS+ Configuration Example ech_note09186a f7c.shtml 80

81 Q & A

82 Complete Your Online Session Evaluation Complete your session evaluation: Directly from your mobile device by visiting and login by entering your username and password Visit one of the Cisco Live internet stations located throughout the venue Open a browser on your own computer to access the Cisco Live onsite portal Don t forget to activate your Cisco Live Virtual account for access to all session materials, communities, and on-demand and live activities throughout the year. Activate your account at any internet station or visit 82

83 83

84 84