Funktionen, Einsatzszenarien, Designansätze und Roadmap Update

Transcription

1 ArubaOS-Switches Funktionen, Einsatzszenarien, Designansätze und Roadmap Update Holger Hasenaug, HPE Aruba, Consulting Systems Engineer MASE, CCIE #6343 May 02, 2017

2 Aruba Portfolio for Mobile-First Switching FlexNetwork 7500 FlexNetwork Software differentiation FlexNetwork 5940 Adv layer 3 Aruba 3810 Aruba 5400R v3 Light layer 3 Aruba 2930F Aruba 2920 Aruba 2540 Layer 2 Aruba 2530 Basics with merchant Si HPE ASIC, stacking Modular uplinks, internal RPS, SmartRate* Max performance and scalability, SmartRate Modular chassis Hardware differentiation 2

3 Aruba Portfolio for Mobile-First Switching FlexNetwork 7500 FlexNetwork Software differentiation FlexNetwork 5940 Adv layer 3 Aruba 3810 Aruba 5400R v3 Light layer 3 Aruba 2930F Aruba 2930M Aruba 2540 Layer 2 Aruba 2530 Basics with merchant Si HPE ASIC, stacking Modular uplinks, internal RPS, SmartRate* Max performance and scalability, SmartRate Modular chassis Hardware differentiation 3

4 Aruba 2930M Switch Series 4

5 Aruba 2930M Switch Series POE+ and non-poe models Dual Modular Power Supplies supported 2-port Stacking Module Modular 4-port10GbE SFP+, 1-port40GbE QSFP+, 4-port 802.3bz HPE Smart Rate uplink ports 1000BaseT/1G SFP Combo Ports Management Ports: Dual Personality RJ-45 or MicroB USB -1000GbaseT Out-of-band Ethernet port -USB port for memory stick (upload/download files) Secure with Clearpass Policy Manager Support Layer 3 Switching with Static, RIP and Access OSPF Support ArubaOS-Switch and Gen6 Aruba Provision ASIC Modular backplane Stacking up to 10 switch units 802.3bz HPE Smart Rate Support with Optional 4-port Module High Speed Connectivity With 10GbE and 40GbE uplinks On Prem management With AirWave support Cloud-manageable With Central support Up to 1440W of PoE+ With a second modular Power supply Hibernation mode to Reduce overall power Consumption and improve security IEEE 1588 v2 Precision Time Protocol HPE/Aruba Limited Lifetime Warranty HPE/Aruba Confidential 5

6 Aruba 2930M Switch Series - Rear View 2 Power Supply Slots Non PoE+: 12VDC 250W PSU PoE+ 54VDC 680W PSU 54VDC 1050W PSU Stacking Module Slot 2-port Stacking Module Front to back aiflow PSUs shared with 3810 series. No PSU included Fixed Fans Uplink / connectivity Slot 4-port 10G SFP+ module 1-port 40GbE QSFP+ module 4-port 1, 2.5, 5, 10G Smart Rate module Modules shared with 3810 series 6

7 Access layer deployments Large enterprise campus Medium enterprise campus 7

8 Moving up from the 2920 Aruba 2920 Aruba 2930M Aruba 2930F Layer 3 with static, RIP, Access OSFP Aruba 2920 Aruba 2930F Aruba 2930M +PIM, PBR and VRRP +PIM, PBR and VRRP Stacking 4 chassis (backplane) 4 chassis (VSF) 10 chassis (backplane) 10GbE uplinks SFP+ 10GbE uplinks -10GBASE-T x With Smart Rate module Smart Rate x x 40GbE uplinks x x Power Supply 1 x removable fixed 2 x removable PoE+ maximum 1440W Fixed: 370W 1440W MACsec x x SDN Optimized ClearPass AirWave & Central Aruba 2930M also supports Power Save Mode and IEEE1588v2 (Precision Time Protocol (PTP)) 8

9 Facing the competition Aruba 2920 Aruba 2930F Aruba 2930M Cisco 2960X Cisco 2960XR Layer 3 with static, RIP, Access OSFP x Stacking 4 chassis (backplane) 4 chassis (VSF) 10 chassis (backplane) 8 chassis 8 chassis 10GbE uplinks 10GBASE-T x With Smart Rate module Smart Rate x x x x 40GbE uplinks x x x x PoE+ maximum 1440W Fixed: 370W 1440W 740W 740W SDN Optimized x x Redundant PSU x Cloud and Local management x x x x Aruba 2930M also supports Power Save Mode and IEEE1588v2 9

10 Aruba 2930F Switch Series 10

11 Aruba 2930F Switch Series Stackable switch 5 models with SFP+ uplinks 4 models with SFP uplinks Fixed power supply Fixed uplinks VSF frontplane stacking (up to 4 units) Access OSPF Routing PIM, PBR and VRRP SDN Support 10G Uplinks 1G Uplinks 11

12 Aruba 2930F Switch Series Aruba 2930F 8G PoE+ 2SFP+ Switch (JL258A) 8 auto-sensing Gig-T ports 2 x 1/10Gbps SFP+ uplink ports 125W of PoE+ Power supporting 4 x 30W, 8 x 15.4W and 8 x 7W devices RJ-45 and USB micro-b Serial console ports Fanless design 12

13 Virtual Switching Framework (VSF) 5400R with VSF Simplify network operations Scalable performance Increases resiliency 5400R with VSF 2930F with VSF Available on Aruba 5400R and 2930F Aruba 5400R Up to 2 members Chain topology Aruba 2930F (requires AOS-Switch 16.03) Up to 4 members Chain and Ring topologies 13

14 Virtual Switching Framework (VSF) What? VSF: Virtual Switching Framework Stacking technology Stack interconnect using Ethernet interfaces Copper / Fiber / DAC 1G, 10G or 40 G Supported on Aruba 2930F Switch Series VSF up to 4 units VSF-ports: 1GbE or 10GbE port aggregation 2 units: chain topology only 3 or 4 units: ring topology Aruba 5400R Switch Series V3 modules only Chain topology: up to 2 chassis Up to 8 physical links per VSF link VSF-ports: 10GbE or 40GbE port aggregations (*) in each direction 14

15 Fast Software Upgrade minimizes downtime Minimizes downtime during upgrade on a 5400R VSF stack by upgrading the chassis sequentially while still allowing traffic to flow through other chassis WAN Router LACP Minimal downtime (< 2 seconds) during upgrade positions 5400R for high availability use cases in the campus core VSF Aruba 5400R Switch Available on 5400R VSF stack with LACP Aruba Mobility Controller 15

16 Backplane stacking (BPS) What? Stacking technology Stack interconnect using specialized hardware: stacking module and cables Supported on Aruba 3810 Switch Series Mesh topology: up to 5 units Ring topology: up to 10 units Stack port throughput*: up to 40Gbps Stack module throughput*: up to 160Gbps Aruba 2930M Switch Series Ring topology: up to 10 units Stack port throughput*: up to 25Gbps Stack module throughput*: up to 50Gbps Aruba 2920 Switch Series Ring topology: up to 4 units Stack port throughput*: up to 20Gbps Stack module throughput*: up to 40Gbps (*) in each direction 16

17 Aruba 2530 Switch Series 17

18 Aruba 2530 Switch Series Aruba G switch models Sep, Target End of sale of Aruba G switch models 18

19 Aruba 2540 Switch Series 19

20 Aruba 2540 Switch Series Pictures and Dimensions Product number Product name Dimensions JL354A Aruba G 4SFP+ Switch 442.5mm x mm x 43.95mm (17.4 x 7.9 x 1.73 ) JL355A Aruba G 4SFP+ Switch 442.5mm x mm x 43.95mm (17.4 x 9.7 x 1.73 ) JL356A Aruba G PoE+ 4SFP+ Switch 442.5mm x mm x 43.95mm (17.4 x 12 x 1.73 ) JL357A Aruba G PoE+ 4SFP+ Switch 442.5mm x mm x 43.95mm (17.4 x 12 x 1.73 ) 20

21 Aruba 2530, 2540, 2930F Switch Series portfolio comparison Feature / Switch Aruba 2530 with 10GbE uplinks (EOS Sep 17) Aruba 2540 with 10GbE uplinks Aruba 2930F with 10GbE uplinks Software Layer 2 Layer 2 and basic L3 with static and RIP Layer 2 and L3 with static and RIP, Access OSPF Routing No 256 Static Entries. 2,000 Dynamic IP Routes RIP only 256 Static Entries. 10,000 Dynamic IP Routes. Access OSPF v2/v3, VRRP, PBR, PIM SM/DM Stacking No No VSF Stacking up to 4 switches 10 GbE uplinks Fixed 2 x 10GbE SFP+ Fixed 4 x 10GbE SFP+ Fixed 4 x 10GbE SFP+ Power Supply Internal fixed up to 370W PoE+ Internal fixed up to 370W PoE+ Internal fixed up to 370W PoE+ PoE+ Fixed power supply up to 195W on 24 port and up to 370 W on 48 port Fixed power supply up to 370W on both 24 and 48 port Fixed power supply up to 370W on both 24 and 48 port Operating Temperature 0 45 degrees Celsius 0 45 degrees Celsius 0 45 degrees Celsius Forwarding Capacity 88 Gbps Gb/s 128 Gbps 176Gbps 128 Gbps 176Gbps Throughput 65.4 Mpps 101 Mpps 95.2 Mpps 112 Mpps 95.2 Mpps 112 Mpps AirWave, ClearPass Policy Manager Yes Yes Yes Aruba Central Yes Yes Yes ZTP AirWave (DHCP) AirWave (Activate & DHCP), Central AirWave (Activate & DHCP), Central Static IP visibility on RADIUS Acc. No Yes Yes Time Domain Reflectometry (TDR) No Yes Yes 21

22 Aruba 2530, 2540, 2930F Switch Series portfolio comparison Feature / Switch Aruba 2530 with 10GbE uplinks (EOS Sep 17) Aruba 2540 with 10GbE uplinks Aruba 2930F with 10GbE uplinks Role Based Access Control (RBAC) No Yes Yes IPv6 ND Snooping No Yes Yes DHCP IPv6 Snooping No Yes Yes Source MAC based ARP attack detection (ARP throttle) No Yes Yes DHCP Server No Yes Yes SDN (OpenFlow) No No Yes Tunnel Node to Mobility Controller No No Yes VXLAN No No Yes IP SLA (UDP Jitter for Voice) No No Yes Q-in-Q No No Yes Intelligent Mirroring (Remote Mirroring, MAC Mirroring) No No Yes Private VLAN No No Yes Rapid-PVST Instances

23 ArubaOS-Switch Software Update Better together 23

24 Aruba Mobile-first architecture: an integrated campus solution Aruba switches are an integral part of the Aruba mobility solution Infrastructure Smart Rate (2.5/5Gbps) Auto AP detection VSF / BPS Switch + AP 10/40GbE uplinks Rogue AP isolation Full PoE+ 24

25 Smart Rate Enable full ac Wave 2 bandwidth Multi-rate gigabit Ethernet ports 1, 2.5, 5 and 10GBASE-T PoE+ at 1, 2.5 and 5 Gbps operation Available on AP-335 and AP M 5400R switch 2930M New 802.3bz standard Standard for multi-rate (2.5/5Gbps) gigabit Ethernet Ratified: September 2016 Smart Rate > 802.3bz will be a software update (availability June 2017 with ArubaOS-switch 16.04) Aruba 3810 Switch 2.5 or 5 Gbps Aruba AP-330 Aruba 5400R Switch 2.5 or 5 Gbps Aruba AP

26 Aruba AP auto detection LLDP: aruba-ap AP profile Untagged and tagged VLAN list CoS value Ingress and egress bandwidth % PoE priority level PoE max power Speed and duplex mode MTU AP is connected to the switch on the port If profile is enabled for device type aruba-ap Switch uses LLDP to identify the device The device introduces itself as aruba-ap If profile has been configured the port receives the configuration stored in the device-profile <name> If not, the port receives the configuration stored in the default-ap-profile 26

27 Rogue AP isolation If the Aruba IAP detects a rogue AP Sends the rogue device s MAC address to the switch using an LLDP extension TLV On the switch The rogue MAC is stored in the system logs A rule is added to the ACL table to block all traffic to and from that MAC address Rogue AP isolation whitelist: Manually configured Devices that may be reported as rogue but should be allowed Instant AP LLDP: rogue-ap-mac: <mac> Intruder AP 27

28 ArubaOS-switch version New PoE+ power reservation behavior & more extensive PoE show commands Old behavior before 16.03: When the switch port is configured in poe-alloc-by-usage mode (default) and PoE+ LLDP is enabled (default), even when a PoE+ AP is only drawing 5-8 Watt per port, the power reserved on the port is as per LLDP requested power. Disadvantage: This limits the total number of such APs that will be powered by the switch. New behavior with 16.03: The power reservation on the port is now as per the actual used power and not per LLDP requested power. Advantage: This allows more APs/devices to be powered on than before 28

29 Practical example PoE+ power reservation behavior comparision AOS-switch and earlier AOS-switch Aruba G PoE+ Switch Aruba 203H Access-Point max. three Aruba 205H Access-Points powered excluding USB, POE PSE 203H Access-Point: Power consumption (excluding USB, POE PSE): 7-13 W Power consumption (including USB, POE PSE): 25.5 W Power requested via LLDP (always): 25.5 W max. five to eight Aruba 205H Access-Points powered excluding USB, POE PSE 29

30 Aruba Mobile-first architecture: an integrated campus solution Aruba switches are an integral part of the Aruba mobility solution Control Switch + ClearPass + mobility controllers Tunneled node SDN (controllers) 802.1X / MAC / Portal RBAC: RADIUS/TACACS Captive portal with Clearpass Local user role Infrastructure Smart Rate (2.5/5Gbps) Auto AP detection VSF / BPS Switch + AP 10/40GbE uplinks Rogue AP isolation Full PoE+ 30

31 ClearPass Integration Features Server Initiated Captive Portal using VSA Ability to send a URL string dynamically using a VSA to support a Captive Portal workflow for guest access. Port Bounce VSA Ability to send a VSA to shutdown a port from 0-60 seconds to facilitate VLAN changes. Consolidated Client View Enhance the switch per-auth type CLI client view to provide consolidated client view with all auth types. New RADIUS Dictionary Update existing ClearPass dictionary for HP Enterprise including new VSAs for ArubaOS-switch integration. 31

32 Customizable Portal Features Your branding and data fields Advertising mobile app, more Integration with 3 rd party billing & property management systems Portal per department, location Social login, MAC cache, QoS 32

33 Support for Role Based Policy in ClearPass ClearPass Use external context to define granular policies User / role Device fingerprint OS version Health checks Jailbreak status Time Date Location Trusted or untrusted network Wired, Wi-Fi, VPN enforcement All Specifications Subject to change without notice 33

34 Recap: Per Port Tunnel Node (PPTN) Aruba Mobility Controllers Aruba Switches Mobility Controller used as unified policy enforcement point for both Wired and Wireless clients Aruba-OS Switch setups a tunnel to the Mobility Controller Tunneled Node encapsulates frames from clients to the Controller Each Switch consumes one license on the Mobility Controller Centralized Application Control and Visibility 34

35 What is Per User Tunnel Node (PUTN)? Per User Tunnel Node feature allows us to redirect specific Wired user traffic from Switches to the controller to enforce Firewall policies, perform Deep Packet Inspection and Bandwidth control Aruba AP Aruba Mobility Controllers Tunnels PUTN feature will work with Standalone, MD (non-cluster) and Cluster Mobility Controllers 5400R Combined with Cluster feature, we can achieve clustering capabilities such as scalability, performance, reliability, redundancy and load balancing 3810M Supported from AOS 8.1 and AOS-Switch version 35

36 Per User Tunneled Node* Secured and flexible control of access layer With Aruba ClearPass download or switch configuration, only traffic from specific user/device role is sent to the Controller Policies (e.g. QoS, ACL, rate-limit) are enforced at Tunneled Node ports Access to Controller s applications Users can access Controller s applications such as stateful firewall and Aruba AppRF Higher availability and scalability Load balance to multiple controllers for high scalability Stateful failover to standby management module for high availability Available on the Aruba 5400R with v3, 3810, 2930F, 2930M Requires AOS 8.1 or later in the controllers Aruba AP Tunnels 3810, 2930F/M Aruba Controllers 5400R * Requires future ArubaOS-Switch software update available Q

37 Differences between Per Port and Per User Tunneled Node Feature Details Per Port Tunneled Node Per User Tunneled Node User Traffic User Auth Modes supported on Mobility Controller All Traffic on the Tunneled interface will be forwarded to the controller User Authentication done at the controller. Controller decides the user-role for the wired users Standalone, MD (non-cluster) mode Switch Support Aruba 2920, 2930F, 2930M, 3800, 3810, 5400R AOS-Switch Version AOS Mobility Controller Version or higher 8.1 or higher User traffic only forwarded to controller, if Switch finds the redirect attribute in the user-role User Authentication done by the Switch. Switch will send user-role information to the controller. Standalone, MD (non-cluster), cluster Aruba 2930F, 2930M, 3810, 5400R 37

38 Aruba Mobile-first architecture: an integrated campus solution Aruba switches are an integral part of the Aruba mobility solution Network management ZTP AirWave IPsec to AirWave Device/interface monitoring Switch + AirWave + Central ZTP Central Configuration management Firmware upgrade Control Tunneled node 802.1X / MAC / Portal Internal captive portal Switch + ClearPass + mobility controllers SDN (controllers) RBAC: RADIUS/TACACS Local user role Infrastructure Smart Rate (2.5/5Gbps) Auto AP detection VSF / BPS Switch + AP 10/40GbE uplinks Rogue AP isolation Full PoE+ 38

39 Network management for the mobile-first campus AirWave Central IMC Unified multi-vendor wired + wireless access network management Cloud-based wired + wireless access network management Advanced wired topology management for the core 39

40 ArubaOS-Switch 16.xx Integration Management AirWave Discover switches Basic monitoring Full config. mgmt. CLI Window Firmware Upgrade Support for 2540 Wired user visibility Policy ClearPass RADIUS/TACACS+, 802.1X, MAC Auth, Int. Captive Portal Dynamic VLAN / ACL / CoS / Rate- Limit Attrib.; CoA & Disconnect Ext. Captive Portal Redirect CoA Initiated Port Bounce User Role Static IP User Visibility Zero Touch Provisioning Zero Touch Provisioning (ZTP) with AirWave using DHCP ZTP with Aruba Activate ** IPSec support for Airwave connection** Activate firmware upgrade Cloud Mgmt. Aruba Central Support for 2920 and 2930F Full configuration & management from the cloud Support for 2540 and 3810M Partial Config Management (CLI Window) Wirelessoptimized Rogue AP detection with IAP Auto configure VLAN, PoE priority/power User View CLI command Trust QoS Per-port Tunneled Node ** ** IPsec, and Activate-based ZTP are not supported in 2530, Tunneled node is not supported on 2530, 2620 and

41 L3 Features on 2930F/2930M Access OSPF is already supported on 2920 and 2930F in OSPF routing between LAN access and the next layer Support OSPFv2, OSPFv3, and ECMP Scalability Supports one OSPFv2 and one OSPFv3 area concurrently in the same switch with max of 8 x L3 VLAN interfaces Recommended max of 200 routes PIM SM/DM, PBR and VRRP was added to 2930F in to support customers looking to deploy L3 features at access. PIM v4 Sparse and Dense modes limited to 16 interfaces and 200 routes Policy Based Routing next hop limited to 16 VRRPv2 for IPv4 supported VRRPv3 for IPv4 and v6 with maximum VRs limited to 128 Aruba 2920 switch series have Access OSPF only. No support for PIM, PBR and VRRP. 41

42 Points to remember Chassis based product: was the last release for old 8200 chassis with v1/v2 modules (EoS mid 2015) was the last release for old 5400 chassis with v1/v2 modules (EoS end 2015) It s the right time to upgrade customer to newer Aruba 5400R switch chassis with v3 modules Aruba 5400R Stackables: F and 2930M switch series have best price/feature performance incl. stacking, routing, IPv6 security, per user tunneled node features incl. on premise management with Airwave/IMC and Cloud basedmanagement with Central. Aruba 2930F Aruba 2930M 42

43 Investment protection with warranty and no software licensing Hardware Warranty Original Owner Lifetime Replacements NBD Shipment Software Updates Posted Releases Phone Support (Best Effort, Product Conformance) 24x7 for 90 Days 8x5 for Lifetime hpe.com/networking/warrantysummary 43

44 Roadmap Aruba 2930 series - major platform for wired access Future Q2 CY16 Q4 CY F 8-port ZTP built-in code Q1 CY F Stacking (VSF) AOS-S Q2 CY M launch AOS-S More 2930M models 2930F launch AOS-S Announcement: May 1, 2017 Availability : May 6th Literature, training, IRIS aligned on May 6th 44

45 Discover 2017 Las Vegas June 5 8

46 Vielen Dank

47 ArubaOS-Switch

48 Aruba software integration features AirWave ClearPass Access-Points ZTP (DHCP/no IPSec) Template-based configuration/mgmt Firmware Upgrade Ext. Captive Portal Redirect to ClearPass using server-initiated framework CoA Initiated Port Bounce Rogue AP detection Auto add VLAN Set PoE priority 48

49 Support for AirWave Network Management Zero Touch Provisioning (ZTP) Firmware Upgrade Management and Monitoring Reduce time and cost for initial deployment Simplify upgrading switch software Enable switch remote management and trouble-shooting 49

50 Support for ClearPass Policy Manager Server-initiated Captive Portal Port Bounce Provide on-boarding and access control Allow ClearPass to change policy and VLAN of active users 50

51 Configure Switch when Aruba AP is Detected Set PoE priority Rogue AP Containment Auto VLAN configuration Ensure power to AP has highest priority Block traffic and shut down the port connected to rogue AP Automatically add VLAN from AP 51

52 New features Private VLAN Role Based Management Instrumentation Enhancements BFD MVRP IPv6 ND Snooping NTP client provides network security by restricting peer-to-peer communication to prevent a variety of malicious attacks allows multiple levels of login for switch management With 16 pre-defined levels, but can be modified by customers improves instrumentation and supportability of the switch for easier diagnostics and trouble-shooting monitors link connectivity and reduces network convergence time for OSPFv2 and VRRP IEEE standard (part of 802.1Q-2011) for dynamic registration and deregistration of VLANs enables IPv6 Neighbor Discovery inspection/snooping per VLAN Detects host liveliness using Neighbor Unreachability Detection Network Time Protocol (RFC 5905) as either IPv4 or IPv6 clients Supports max of 8 associations, dynamic or configured 52

53 New features ARP throttling OpenFlow enhancements TDR RIPng Password complexity VxLAN RADIUS availability enhancements monitors number of ARP packets send from each host (MAC address) Shut down port or send warning if exceed max configurable number matches TCP flag and TCP/UDP port range detects faults in copper cable such as opens and shorts IPv6 version of Routing Information Protocol (RIP) allows administrator to set password rules such as expiration period, max number of attempts, valid password encapsulation (tunneling) protocol for overlay network that enables a more scalable virtual network deployment tracks the availability of RADIUS servers and speed up the reauthentication process when servers become available again 53

54 New features IGMPv3 LLDP over OOBM Increased VLAN and MSTP REST complies to RFC 3376 IGMPv3 supports Link Layer Discovery Protocol (LLDP) over the OOBM ports supports 4096 simultaneous VLAN and 64 MSTP instances supports REST management interface for certain configuration and access to switch resources Feature Preview Mode allows customers to access switch features that are not yet Generally Available for early preview Multicast enhancements improves performance of multicast replication (only available in Preview Mode) 54

55 New features ACL grouping Bonjour and Chromecast Gateway Schedule Job enhancements Allows multiple ACL s to be grouped together to save memory resource, resulting in increased number of ACL s that can be supported Allows Bonjour and Chromcast service advertisement to cross subnets Adds more functionality to schedule job feature such as repeat job, group Job, and event triggered job 55

56 New features by platform (16.01) Last release Last release R/v (KB) 5400R/v2 (compat. mode) (KB) 3800 (KA) 2920 (WB) 2620 (RA) 2530 (YA/YB) 5400/v2 (K) 5400/v (K) (A) (K) Support for AirWave No No No No Support for ClearPass Auto Config with Aruba AP Virtual Switching Framework Yes: CoA Port Bounce No: Captive Portal Redirect No No No No 5400R/v3 only No No No No No No No No No No Private VLAN No No No No No Role Based Mgmt No No No No No Instrumentation Enhancements No No No No BFD No No No No No No No No MVRP No No No No No 56

57 New features by platform (16.01) Last release Last release R/v (KB) 5400R/v2 (compat. mode) (KB) 3800 (KA) 2920 (WB) 2620 (RA) 2530 (YA/YB) 5400/v2 (K) 5400/v (K) (A) (K) IPv6 ND snooping No No No No No NTP client No No No No ARP Throttling No No No No No OpenFlow enhancemts 1 Already supported Already supported Already supported No No No No No TDR 2 No No No No No No No No RIPng No No No No No Password Complexity No No No No VxLAN No No No No No No No No RADIUS avail enhancement No No No No No 1) TCP flag matching and TCP/UDP port range 2) TDR not supported on Smart Rate ports 57

58 New features by platform (16.01) Last release Last release R/v (KB) 5400R/v2 (compat. mode) (KB) 3800 (KA) 2920 (WB) 2620 (RA) 2530 (YA/YB) 5400/v2 (K) 5400/v (K) (A) (K) IGMPv3 No No No No No LLDP (OOBM) No No No No No 4K VLAN No No No No No No 64 MSTP No No No No No No REST/JSON No No No No Multicast enhancements No No No No No No No No Preview Mode No No No No No No No ACL grouping No No No No No Bonjour/ Chromcast GW No No No Schedule Job No No No No 58

59 Other small enhancements in Increase maximum password length for local user from 16 to 64 characters New options added to CLI command for RADIUS to configure replay protection for dynamic authorization messages "positive-time-window" and "plus-or-minus-time-window". New <logging> option is added to static IP routing configuration CLI command to turn ON logging facility for IP traffic destined to blackhole Added CLI checks to prevent Private VLAN and VxLAN from being configured simultaneously. Per port enable fault-finder link flap detection added 59

60 ArubaOS-Switch

61 Support for AirWave Network Management Zero Touch Provisioning (ZTP) Management and Monitoring Support IPSec and Activate-based ZTP* Additional management, configuration, and monitoring capabilities * Activate ZTP Not supported in 2530/2620 See note on installation and Activate loading requirement 61

62 Support for ClearPass Policy Manager User Role* New AAA deployment model using switch-based policies (e.g., VLAN, ACL, QoS, and rate limit). Enhancement to ClearPass support and Captive Portal MAC Auth user visibility, support Captive Portal in 5400/v1 modules and 3500 * User Role does not require ClearPass but it is easier to manage and deploy with ClearPass 62

63 Integration with Aruba Controllers and AP Tunneled Node* provide tunnel to transport network traffic on a per-port basis to Aruba Controller. Authentication and network policies will be applied and enforced at the Controller Trust QoS Set QoS policy when Aruba AP is connected * Tunnel Node is not supported in 2530/2620, see platform matrix for more details 63

64 New features by platforms (16.02) Last release Last release R/v (KB) 5400R/v2 (compat.mod e) (KB) 3800 (KA) 2930F (WC) 2920 (WB) 2620 (RA) 2530 (YA/YB) 5400/v2 (K) 5400/v (K) User role YA only No No N/A N/A Tunneled node No No No No N/A N/A Activate ZTP No No No No N/A N/A IPsec for ZTP No No No No N/A N/A ClearPass Captive Portal Avail in previous release Avail in previous release Avail in previous release Avail in previous release Avail in previous release Avail in previous release Avail in previous release (A) (K) N/A N/A Aruba Central No No No No No No No N/A N/A Latency Measure No No No No N/A N/A Access OSPF full OSPF Avail full OSPF Avail full OSPF Avail No No No No N/A N/A Trust QoS YA only No No N/A N/A 64

65 Other small enhancements in Port-based MAC authentication Dynamically changing from client-based (every MAC authenticated on a port port) to port-based (first MAC open port for all MACs) MAC authentication using RADIUS VSA HP-Port-Auth-Mode-MA. Use case: switch-to-switch or AP-to-switch authentication. LLDP Authentication bypass with AP Username VSA in RADIUS Accept packets recognized and shown in show port-access clients. Used by Web Authentication with Clearpass Log Blackhole/NULL Route AirWave Management Platform (AMP) Server MIB Changes Add 'no CoS' to Device Profile Add MTU to Device Profile ACL Logging Match configurations persistent using the write memory Tunneled Node enhancement: fallback to switching and CoA Trap generation with hardware removal/insertion TCP Push Preserve mode is set to DISABLED by default. 65

66 ArubaOS-Switch

67 Features in ArubaOS-Switch VSF on 2930F Fast Software Upgrade on 5400R IP SLA for Voice Aruba Integration Features L3 Features on 2930F 2930F supports up to 4 members on a VSF stack. Supported on 1G and 10G links. Reduced downtime on 5400R stacks with VSF during software upgrade. Support for measuring voice quality metrics to address the top use case for performance monitoring in the Campus. Central support for 2540 and 3810 and several better-together features. Details in a separate slide. Support for PIM, PBR and VRRP on 2930F. 67

68 Aruba Integration Features in ArubaOS-Switch Additional Platforms on Aruba Central Firmware Upgrade on Aruba Activate Static IP Visibility Aruba Central Enhancements Airwave Enhancements Support for 2540 and 3810 on Aruba Central* Latest firmware from MyNetworkingPortal will be available on the Aruba Activate portal when switch connects. RADIUS accounting for clients with static IP address. Several enhancements including CLI Window and ability to monitor Syslog and SNMP via external tools Support for 2540 and Wired user visibility. * No Aruba Central support on 2530 and Aruba Central already supports 2920 and 2930F 68

69 New features by platform (16.03) Last release Last release Last release R/v3 (KB) 3810 (KB) 5400R/v2 (compat. mode) (KB) 3800 (KA) 2930F (WC) 2920 (WB) 2540 (YC) 2620 (RA) 2530 (YA/YB) 5400/v2 (K) 5400/v (K) (A) (K) VSF 2 member VSF available already No No No Yes (4 members) No No No No No No N/A N/A Fast Software Upgrade for VSF Yes No No No No No No No No No No N/A N/A IP SLA for Voice Yes Yes No No Yes No No No No No No N/A N/A Basic L3 features (OSPF, PIM, PBR. VRRP) Advanced L3 available already Advanced L3 available already Advanced L3 available already Advanced L3 available already Yes OSPF (one instance) No No No No Advanced L3 available already N/A N/A Aruba Central Support No Yes No No Already supported Already supported Yes No No No No N/A N/A Static IP Visibility Yes Yes Yes Yes Yes Yes Yes No No No No N/A N/A 69

70 Other small enhancements in DHCP Snooping modification Federal Government certifications Hiding sensitive information IPsec added Job Scheduler modification LLDP disable sending out the management IP addresses as part of LLDP TLVs OpenFlow enhancements Warning message for configuring PoE allocate-by-value REST (Additional REST APIs) show interface command enhancements show power-over-ethernet command enhancements show system commands enhancements TCP Push Preserve modification VLAN range command addition 70

71 Trainings and Documentation 71

72 Deep dive technical web-based trainings for partners ArubaOS-Switch v16.01 Technical Training ( ) EMPLATE%2CCERTIFICATION%2CCURRICULUM%2COFFERING%2CPACKAGE ArubaOS-Switch v16.02 Technical Training ( ) EMPLATE%2CCERTIFICATION%2CCURRICULUM%2COFFERING%2CPACKAGE ArubaOS-Switch v16.03 Technical Training ( ) EMPLATE%2CCERTIFICATION%2CCURRICULUM%2COFFERING%2CPACKAGE 72

73 ArubaOS-switch Documentation: Hardware: Quick Setup Guide and Safety/Regulatory Information Installation and Getting Started Guide Modules Installation Guide (for some models only) Rail Mounting Kit Installation Instructions (for some models only) Fan Tray Replacement Instructions (for some models only) Power Supply Guide (for some models only) Transceiver Guide Software Feature and Commands Index Software Feature Support Matrix Software cont.: Basic Operation Guide Management and Configuration Guide Access Security Guide Advanced Traffic Management Guide Multicast and Routing Guide IPv6 Configuration Guide Power over Ethernet (PoE/PoE+) Planning and Implementation Guide OpenFlow 1.3 Administrator Guide Service Insertion Guide Event Log Message Reference Guide MIB and Trap Support Matrix REST API and JSON Schema Reference Guide MAS Feature Integration Reference Guide Comware CLI Commands in Provision Software HPE ProVision Switch Software Troubleshooting Guide 73

74 Reading path for HPE ArubaOS-Switch documentation 74

75 14_AIRHEADS COMMUNITY 40K+ Mitglieder 12% or 4,500 Mitglieder EMEA + 1K Mitgliederzuwachs pro Monat Community für: Kunden/Partner/Mitarbeiter/ Influenzer 117k Forumeinträge 7200 akzeptierte Lösungen Durchschnittliche Antwortzeit ca. 18 min 2.6 Mio. Besuche in 2015 Deutschsprachige Airheads Gruppe unter: Channel-Group-German/gp-p/Germany 75