vwlan Architecture The Next Generation Wireless Solution: Virtualizing the Wireless LAN

Transcription

1 vwlan Architecture The Next Generation Wireless Solution: Virtualizing the Wireless LAN

2 ADTRAN s Next Generation Secure Wireless Solution Market Evolution Today s enterprise communicates wirelessly. Users now carry multiple devices that need to connect to the enterprise Wi-Fi network from any point in the building and across the campus. These devices are mobile and are accessing applications that demand higher bandwidth. Wireless connectivity in the enterprise has moved from the access of convenience to the access of choice. Traditional enterprise wireless networks were designed before the explosion of Wi-Fi enabled devices and are now straining under the demand to support more devices, more access points, wider mobility, and greater bandwidth. A more scalable, cost-effective solution has emerged that leverages the power of virtualization to solve the scale challenges of the enterprise wireless network. ADTRAN has developed and introduced the next generation enterprise wireless solution: Virtual Wireless LAN (vwlan). vwlan eliminates the scaling constraints imposed on the enterprise wireless network by eliminating the hardware controller and instead virtualizing the control and management of the network to run as software on a hypervisor. This fundamental shift brings extraordinary benefits. Massive Scalability In conventional controller-based networks, scale is tied to a single purpose device which is the hardware controller. Adding more users and more access points causes the enterprise to buy a bigger controller or add additional controllers. The introduction of n, which increases bandwidth demand three to five fold, also drives the need to buy larger controllers. vwlan breaks this constant upgrade cycle. Most large hardware controllers support approximately 150 access points and 4,000 users. A single software instance of vwlan supports 1,500 access points and 48,000 users. In traditional controller-based networks, scale comes at a high price both in terms of opex and capex because a single-purpose server is required. This is not the case with vwlan. With vwlan, the controller is software on a hypervisor. The cost of this virtual control software is zero. Single Physical Controller Scaling Dimension Single Vitrual Controller 150 Access Points 1,500 4,000 Users 48,000 $25,000 Typical Cost $0 2

3 Compact Flash State-of-the-Art Security Virtualization not only unlocks cost effective scalability but it also enhances the security of enterprise wireless networks. Traditional controller-based networks have two security vulnerabilities. First, unwanted traffic actually enters the LAN through the thin, unintelligent access point. Only until the traffic reaches the controller is unwanted traffic discarded. Why bring unwanted and potentially harmful traffic onto the network? With conventional WLAN architecture, there is no other choice, but vwlan provides a more secure solution. vwlan uses intelligent access points that operate a stateful firewall. Unwanted traffic is turned away at the access point before it enters the network and becomes a security problem. Second, a centralized physical controller is a target for malfeasance. This device is in the data path and, therefore, serves as a convenient point to intercept traffic. vwlan eliminates this vulnerability by keeping the data sessions on the LAN. Only control traffic is centralized. And this centralization occurs in the enterprise data center as opposed to a single server. Reliability ADTRAN s vwlan brings wireless reliability to a whole new level. In vwlan, the user data stream or data plane is separated from the control information about the data sessions. This separation of the control plane and data plane increases the reliability. In the conventional controllerbased approach, any failure in the control plane interrupts the data plane. In vwlan, the data session is the priority. The control plane can be completely lost and the user data sessions remain intact. This separation of control and data allows vwlan to support hitless failovers. A secondary virtual control instance can back up the primary control. If an access point loses connection with the primary virtual control instance, it will realign with the secondary control. This re-establishment of the control plane takes place with zero packet loss to any of the data sessions. Optimized Performance With vwlan, n system capacity is no longer computed by the backplane capacity of the hardware-based controller; rather, it s determined by the aggregate throughput of the APs. This is a revolutionary change from traditional, centralized wireless LAN solutions. The vwlan distributed architecture enables over a 10x increase in the total capacity. Because the packet forwarding functionality is offloaded from the controller to the access point, the controller is free to now manage thousands of AP s and tens of thousands of users. LAN Switch Wireless Controller ILL303A VMware enabled Access Point Groomed Traffic Unwanted Traffic Control Traffic Data Center Virtual Contorl 3

4 vwlan s Innovative Approach ADTRAN is the only company to provide wireless LAN control virtualized on software residing on either a hypervisor (e.g. VMware) or an appliance. vwlan removes the complexities and limitations of dealing with controller capacity by centralizing the management and control functions. Adding additional access points to the vwlan system is as easy as installing a software license, which can extend the coverage to thousands of APs. Designed from the start with support for intelligent distributed switching at the edge, the vwlan solution leverages existing switching infrastructure to handle Gigabit data traffic and provide an optimal mix of security, control and Quality of Service (QoS). This approach delivers wired equivalent performance through edge forwarding thus eliminating network complexity and disruptive upgrades. vwlan is easy to add to your existing network because it does not require network redesign, additional subnets or DHCP servers. vwlan integrates directly into your existing network and leverages your pre-configured VLANs at Layer 2 or existing Layer 3 networks. The wireless users receive the same IP address as the wired users, simplifying your network management for both wired and wireless users. Highly Scalable NAC Solution When designing a WLAN system for scalability and performance, it is important to evaluate every component in the system and optimize its behavior. ADTRAN designed its robust security modules to operate out-of-band or at the edge of the network in order to achieve wired-equivalent performance throughout the system. Flexible Role-Based Access Control and Policy Enforcement vwlan s policy enforcement permits a granular level of control over what each user is allowed to do on the network. Role-based privileges can be based on time, bandwidth use, and location. ADTRAN s unique role-based approach provides convenient management of privileges for different categories of users. User roles are managed by the central vwlan software but are enforced by the Bluesocket access points. Bluesocket 1840 Bluesocket 1800 Bluesocket 1840 NetVanta 1335 PoE NetVanta 1335 PoE Bluesocket 1800 Customer Data Center NetVanta 3458 PoE Bluesocket 1800 NetVanta 3448 PoE Bluesocket 1840 vwlan Bluesocket 1800 ILL258A 4

5 vwlan matches user permissions to your organizational structure. IT Administrators can define destinations (such as a finance server, router or IP address subnet), services (such as HTTP, FTP, POP3), user locations, time/date schedules, and available bandwidth to control which users have access to each resource. Multiple service and destination groups simplify policy creation and reduce the complexity and cost of the administration of large-scale networks. Also, vwlan is based on identity-based access control a single SSID can be used to support multiple roles eliminating the need to manage multiple SSIDs. Distributed Encryption The access points perform Layer 2 encryption/decryption for WPA/WPA2 using specialized hardware in the radio module. This approach ensures system scalability, especially with n data transfer rates. Endpoint Compliance BlueProtect is ADTRAN s integrated endpoint client scanning solution. With BlueProtect, IT Staff can be confident that client devices connecting to the corporate wireless network are safe and will not introduce threats into the network environment. The BlueProtect real-time end-point scanning software detects and scans any user attempting to log onto the network. BlueProtect traffic, including client scanning and remediation, is forwarded to the virtual control software while the client is deemed unclean. After completing the scan, the AP receives the updated role information and begins switching the client traffic locally. Managed via the administration GUI of vwlan, BlueProtect allows IT staff to monitor, control and enforce policies relating to the following: n Anti-Virus n Anti-Spyware n Firewall n Files/Registry n Custom Rules n Peer-to-Peer Applications n OS/Patch Level 5

6 Intrusion Detection, Worm Protection and Clientless Scanning Unlike signature-based tools or OS-specific scanners, vwlan has implemented real-time monitoring of Wi-Fi users data to detect malicious traffic based on the users actual behavior without requiring any client-side software. This enables administrators to automatically block network access to hackers or worm infected users even for zero-day attacks well before traditional signature-based tools have updates available. vwlan fully integrates clientless scanning, to provide a maintenance-free way to protect wireless devices from viruses, worms, Trojan Horses, spyware/malware and other threats and anomalies before they are allowed to log-on and gain access to the wireless LAN. Taking advantage of automated Web-based scanning, ADTRAN s vwlan is unique in providing trusted endpoint security, ensuring the user s device is free from viruses and worms, and has the required security and OS patches. RF Intrusion Detection System (RF IDS) is integrated into ADTRAN s Bluesocket APs and allows IT administrators to identify and contain rogue APs, rogue clients, ad-hoc networks and a host of WLAN DoS and spoofing attacks that threaten the security of your network. The smart AP contains an analysis engine, which pre-processes wireless data and then sends event reports to vwlan control software thereby minimizing the uplink bandwidth requirement and offloads the virtual control software from performing the analysis on the raw data. The APs can run in full time W-IDS mode to identify behavior based attacks or part-time mode where it can identify network events. 6

7 Convergence Results in a Simple, Higher Performance Network vwlan tightly integrates with the wired network to guarantee wired-equivalent performance for high bandwidth and time sensitive applications. Adding vwlan to your existing network is a simple plugin rather than requiring time-consuming reconfigurations. All data traffic in the system is handled by the APs and switched directly onto the Layer 2 network. If the user s role specifies a particular VLAN, their traffic is tagged appropriately. vwlan provides high-performance subnet roaming so that users can roam anywhere (keeping their original IP address) and continue passing traffic without interruption. Subnet roaming is handled by tunneling traffic between APs rather than forwarding traffic to a central controller. All user traffic from their original subnet is forwarded to the client, regardless of where they are on the network. Seamlessly Roam Anywhere The thoughtful design and distributed nature of vwlan made it both possible and easy to support highly versatile and complex deployment scenarios with amazingly simple configuration, planning and integration effort. vwlan enables wireless users to truly be anywhere and still have access to their native VLAN or home network without requiring any complex integration or switch configuration. vwlan tracks user location and session information at the AP level to guarantee seamless roaming, wherever the client roams. Seamless roaming means that a client s security key material and role information is present in the roamed-to AP before the client arrives at the AP thus the client maintains their authentication state and IP address. In this example, the client is assigned location 1 based on their assigned role (i.e. Student). Location 1 was learned by AP2 to be on VLAN 51. When the client roams from AP-2 to AP-5, the vwlan knows that AP-5 doesn t support location 1 and therefore must tunnel the client s traffic back to AP-2. vwlan leverages its integrated RF management functionality to detect and organize adjacent APs into groups called vneighbor clusters. vwlan proactively shares client information between APs in the vneighbor cluster (roles, 802.1x keys and session information). The innovation around vneighbor guarantees scalability, as a client roams between APs, the vneighbor cluster follows the client, updating newly adjacent APs and removing the session information from the non-adjacent APs NetVanta 1534P Data Center NetVanta 1335P Bluesocket 1840 AP 3 vwlan on VMware ILL295A Layer 3 Tunnel Bluesocket 1800 AP 1 Bluesocket 1800 AP 2 Bluesocket 1840 Bluesocket 1800 AP 5 AP 4 ipad ipad Layer 3 Roam 7

8 High Availability With Less Complexity The vwlan high availability approach is both unique and innovative. It allows customers to have the confidence to deploy large wireless networks without the concern of a service disruption. This high availability solution is designed to provide uninterrupted wireless LAN service and hitless failover Zero Packet Failover Event. This high availability scheme is based on installing a primary vwlan software and a Hot-standby vwlan software. Both vwlan instances can be deployed anywhere as long as the ADTRAN Bluesocket access points have Layer 3 connectivity to them (same building, across campus or over the Internet.) If a Bluesocket AP is unable to communicate with the primary vwlan software it will seamlessly failover to the secondary vwlan software, guaranteeing that existing authorized users will not lose a single packet and new users will be redirected to the secondary vwlan software for authentication. The high availability scheme can also be used for seamless software upgrades to the system. Instead of scheduling a maintenance window to perform a software upgrade, the hot-standby vwlan instance can be upgraded and then a forced failure can be performed on the primary vwlan instance where all the APs transition to the hot-standby vwlan instance. After the primary instance is upgraded, all the APs automatically return to the primary vwlan again without disruption to the user. Quality of Service for VoIP and Video n is a shared bandwidth technology, so network contention becomes an issue as the number of users and network traffic increases. ADTRAN overcomes this problem by providing administrators fine-grained bandwidth and wireless LAN prioritization with QoS controls to ensure low latency performance for voice and video. ADTRAN s unique stateful packet inspection allows administrators to identify and secure dynamic, real-time voice protocols such as SIP, H.323 and SCCP and provides a complete platform for converged voice, video and data over a single wireless LAN infrastructure. Primary Data Center Backup Data Center Private Network ILL304A 8

9 Traffic Handling vwlan offers many class/quality of service components including bandwidth management, packet prioritization, airtime fairness and packet remarking to assure each user s traffic is handled appropriately to provide the highest level of performance. Bandwidth Management vwlan provides granular bandwidth management at the AP including: n Ability to limit bandwidth on a per user basis n Ability to limit bandwidth in the downstream (to the client) direction n Ability to limit bandwidth in the upstream (from the client) direction WMM/ Packet Prioritization When Wi-Fi Multimedia (WMM) is enabled, frames contain a prioritization based on application. It is useful to prioritize and assign wireless traffic to certain roles. The APs prioritize traffic based on the input wired packet QoS tags (either 802.1p or DSCP or the greater of the two), or can prioritize to a static value. Airtime Fairness Airtime Fairness is integrated into all ADTRAN Bluesocket n APs. This algorithm guarantees that bandwidth is shared among clients in a mixed environment (legacy a/b/g and n clients) providing optimal network performance. The Airtime Fairness algorithm factors in the user s role when determining fairness. If the administrator would like to bias users in a particular role higher than users in another role, the algorithm uses the bias when allocating tokens for transmission. For example, an administrator could de-prioritize traffic for guests allowing corporate users more airtime to send wireless traffic. Packet Remarking Packet remarking is useful when the upstream network (i.e. switches/ routers) is CoS aware of 802.1p or DSCP p uses the VLAN header to apply a priority on a packet (0-7 where 7 is highest priority). DSCP uses the IP header to apply a priority on a packet (0-63, where 63 is the highest). Alternately, the administrator can choose to set a static 802.1p or DSCP mark for all traffic in the role. This is useful for roles like IP Phones or other voice devices. vwlan was designed with simplicity as a key design goal because ADTRAN believes that managing your WLAN solution should not require a lot of time. vwlan has integrated guest access, management and reporting, as well as a host of other services. 9

10 Simplification Through Integration Integrated Guest Access Unlike traditional networking equipment that requires 3rd party products for guest access, vwlan includes a fully integrated guest access solution. Guest accounts can be created by any staff member in an organization authorized to do so. Staff members could include receptionists, hotel staff, event organizers etc., all of whom could access the system and create guest accounts and print receipts for them. The administrator accounts reside in the vwlan server software and the privileges can be setup to allow the guest admin to create only guest accounts (all the other vwlan configuration is hidden from them). A super-guest admin can then run reports based on the guest accounts that were created. Reporting Unlike traditional networking gear that has little persistent storage (NVRAM), and relies on remote syslog servers for report generation, vwlan stores historical data for longterm report generation. Example reports are: RF Management ADTRAN s RF management functionality, DynamicRF, ensures that your entire WLAN system is appropriately setup with a balance of channels and power. DynamicRF reduces the effort to setup and maintain your wireless network. The system detects any non-optimal environmental conditions such as: n General interference or noise n Co-channel interference introduced by a neighboring AP n Loss of connectivity to an AP n Poor wireless client characteristics (low RSSIs, multiple failures or retries) n High user load In addition, DynamicRF either automatically adjusts the RF parameters or provides the administrator with a list of recommended changes. RF management accounts for both 20 Mhz and 40 Mhz wide channels when performing its calculations. n Bandwidth Reports (per User or Role) n User Reports (per User/MAC/IP, Role, SSID, or AP) n Inventory Report n Guest Access Creation and Usage Reports n System Performance over Time Report 10

11 Summary ADTRAN s next-generation vwlan architecture unifies wireless and existing wired networks to produce a truly integrated and optimized networking solution. vwlan enables customers to dramatically reduce the cost of deploying and operating large-scale Wi-Fi networks while providing wired-equivalent performance to wireless users, with seamless roaming and enterprise-class security and policy management. vwlan architecture was designed around a concept of simplified scalability. In the era of wireless advancements including n, voice, and larger wireless networks, maintainability and total cost of ownership are at the forefront of new network designs. vwlan removes the complexities of dealing with controller capacity by centralizing the management and control functions. Further, security and mobility are distributed at the edge of the network, the logical placement in networks that are designed for scalability and high availability. Adding additional access points to the vwlan system is as easy as installing a software license, which extends coverage to thousands of APs without needing to worry about controller capacity. vwlan provides a flexible solution that can operate in multiple deployments from a branch office to a large campus environment while offering low cost of ownership and optimal performance. Remote offices deployments are demanding more from WLAN networks and vwlan responded by integrating flexibility into the security and data forwarding modules. The security architecture was integrated into vwlan providing Network Access Control (NAC), authentication server integration, enhanced guest access, and policy enforcement. These security features were optimized for performance and scalability. vwlan s identity-based access control removes restrictions that were part of traditional WLAN solutions and provides more flexibility in managing wireless access. vwlan s distributed mobility solution handles subnet roaming at the edge, while its sophisticated control software works at the core to determine the optimal tunneling endpoint and guarantees seamless mobility. The algorithm incorporates intelligent tunnel load balancing, a Subnet Discovery Protocol (SDP), and even a mechanism to detect and accommodate for misconfigurations in the wired infrastructure to guarantee that wireless users can always access the network. The Bluesocket APs incorporate ADTRAN s award winning fairness algorithm to provide optimal voice performance in a mix mode deployment. WLAN systems, especially in large campus environments, are expected to provide minimal downtime as they support a significant number of users and critical applications. vwlan addresses this requirement by providing a seamless, high availability solution that is transparent to the wireless users (with zero packet loss) while also providing flexible deployment options. Finally, the integrated management module provides a rich set of visual tools for analyzing the state of the system and troubleshooting internetworking issues. The integrated management solution includes location maps, health summary, enhanced reporting, notifications, and summary of the overall RF environment. 11

12 ADTRAN, Inc. 901 Explorer Boulevard Huntsville, AL P.O. Box Huntsville, AL fax Pre-sales Support Post-sales Support 888 4ADTRAN ( ) General Information 800 9ADTRAN TL ADTRAN is an ISO 9001, ISO 14001, and a TL 9000 certified supplier. EN1689A January Copyright 2012 ADTRAN, Inc. All rights reserved. ADTRAN believes the information in this publication to be accurate as of publication date, and is not responsible for error. Specifications subject to change without notice. ADTRAN is a registered trademark of ADTRAN, Inc. and its affiliates in various countries. All other trademarks mentioned in this document are the property of their respective owners.