esight V300R001C10 WLAN Technical White Paper Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 V300R001C10 Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

2 2013. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China i

3 About This Document About This Document Purpose This document describes esight wireless local area network (WLAN) technical features from the following aspects: overview, implementation, function constraints, and typical applications. Intended Audience This document is intended for: Technical support personnel Maintenance personnel Symbol Conventions The symbols that may be found in this document are defined as follows. Symbol Description Indicates an imminently hazardous situation which, if not avoided, will result in death or serious injury. Indicates a potentially hazardous situation which, if not avoided, could result in death or serious injury. Indicates a potentially hazardous situation which, if not avoided, may result in minor or moderate injury. Indicates a potentially hazardous situation which, if not avoided, could result in equipment damage, data loss, performance deterioration, or unanticipated results. NOTICE is used to address practices not related to personal injury. ii

4 About This Document Symbol Description Calls attention to important information, best practices and tips. NOTE is used to address information not related to personal injury, equipment damage, and environment deterioration. Change History Changes between document issues are cumulative. The latest document issue contains all the changes made in earlier issues. This issue is the first official release. iii

5 Contents Contents About This Document... ii 1 Executive Summary Introduction Overview Service Control Management Flow Data Flow Implementation Integrated Management for Wired and Wireless Devices WIDS Wireless Intrusion Detection System WLAN Resource Synchronization User Access History Location Topology Region and AP Plan Spectrum Analysis Quick Interferer and Terminal Location Energy Saving Management Function Constraints Applicable Device Types Typical Applications Service Deployment Service Monitoring Service Adjustment Fault Diagnosis Fault Rectification Experience Conclusion A Acronyms and Abbreviations iv

6 1 Executive Summary 1 Executive Summary esight WLAN Manager provides integrated management for wired and wireless networks, and enables batch service deployment, adjustment, troubleshooting, and daily maintenance. 1

7 2 Introduction 2 Introduction A WLAN connects two or more computers or devices using the wireless telecommunication technology to provide fast Ethernet access. It allows terminals, such as computers, to access the network through a wireless medium instead of physical cables. This facilitates network construction and provides users with uninterrupted communication while moving around. Compared with a wired access network, a WLAN is easier to construct and requires lower construction and maintenance cost. WLANs are popular in industries such as medical, campus, aviation, retail, warehousing, and coal. On a WLAN, too many ACs and APs are deployed in a dispersed manner, increasing maintenance difficulties and maintenance costs. esight WLAN Manager manages devices on a WLAN in a centralized manner and implements visible monitoring on WLANs, which reduces WLAN maintenance difficulties and costs. By service deployment, esight WLAN Manager provides quick and end-to-end batch deployment for wireless services. By monitoring services, esight WLAN Manager helps users to quickly know the current wireless network quality, resource allocation, and load of network devices. By adjusting services, esight WLAN Manager helps users to expand the network capacity and to properly allocate and adjust device resources. By diagnosing faults, esight WLAN Manager quickly detects and locates faults and provides solutions for maintenance personnel. WLAN Manager provides integrated management for wired and wireless networks, and enables batch service configuration, adjustment, troubleshooting, and daily maintenance. Service deployment Establish service channels and management channels using the smart configuration tool Deploy services in batches using the configuration wizard Verify the deployment result in location topologies Service monitoring Monitor wireless devices, resources, interference, and user information on portals Display device resources, interference sources, and user information from multiple dimensions Display the network structure based on topology management Display the logical structure of wireless networks through service topologies View the signal coverage and display the interference source based on location topologies Service adjustment Optimize the radio frequency Adjust WLAN security configurations Fault diagnosis Troubleshooting Diagnose wireless terminal faults end to end Check network connectivity based on AP ping and AC ping Check the user access failure records based on the access history Troubleshooting Restart APs Replace APs Restore AP factory settings Report and performance Rich wireless service reports, clearly revealing the wireless network quality, wireless network traffic, and time and spatial distribution of wireless users in multiple dimensions AP resource statistical reports (regionbased statistics are supported), radio frequency statistical reports, and user statistical reports 2

8 3.1 Overview esight WLAN Manager provides integrated management for wired and wireless networks, and enables batch service deployment, adjustment, troubleshooting, and daily maintenance. This helps users reduce cost in managing wireless networks. On enterprise networks, WLANs are deployed in AC + Fit AP mode, where ACs control services and manages Fit APs. esight delivers configurations to ACs through the Simple Network Management Protocol (SNMP) interface Service Control In service control, esight loads an AC and the connected switches. Then users enable the channels on the switches and configure basic AC information. 3

9 To add an AC to esight and configure the AC, perform the following steps: Add an AC through resource management. Use the smart configuration tool to configure the AC and switches, and enable service channels and management channels. Configure the following AC information in WLAN management: AP profile, radio profile, extended service set (ESS) profile, AP region, and AP whitelist Management Flow An AC delivers services to an AP, including template configurations and radio configurations. By WLAN service deployment, users can import predefined AP profiles (Excel files) in batches to deploy services. When an AP is started, it discovers the AC in unicast, multicast, or broadcast mode. In unicast mode, an AP can use any of the following methods to discover the AC: By the Dynamic Host Configuration Protocol (DHCP): An AP sends a DHCP request packet to apply for an IP address from the AC. The AC assigns an IP address to the AP by sending a DHCP response packet carrying the Option 138, Option 43, or Option 189 field that contains the AC IP address. This allows the AP to discover the AC. By the domain name service (DNS): An AP parses the DNS domain name to obtain the AC IP address and discover the AC. 4

10 3.1.3 Data Flow By static configuration: Configure a static AC IP address on an AP to discover the AC. The AP negotiates with the AC based on the AC IP address. When receiving a response from the AC, the AP establishes a Control and Provisioning of Wireless Access Points (CAPWAP) tunnel with the AC. The CAPWAP tunnel uses the Datagram Transport Layer Security (DTLS) protocol to transmit User Datagram Protocol (UDP) packets in encryption mode. The AP sends the AC a request to join the AC. The AC then determines whether to accept the AP and sends a response to the AP. The AP determines whether the current version is the latest based on the negotiation parameter. If the current version is not the latest, the AP upgrades to the latest version on the CAPWAP tunnel. After the version upgrade, the AP restarts, rediscovers the AC, re-establishes the CAPWAP tunnel, and joins the AC again. The AP sends a configuration status request to notify the AC of the current local configurations (including the antenna, radio, rate, channel, and power configurations). The AC then sends a response to the AP and updates the configurations immediately. The AP sends the configuration update result to the AC through a status change request. The AC obtains the AP configuration update result from the request and sends a response. An AP goes online properly and broadcasts data. After an AC delivers services to an AP through the management flow, the AP enters the normal state and works properly. In WLAN management, users can synchronize the AC to view its APs in the normal state and enter the WLAN service application phase. 5

11 3.2 Implementation Integrated Management for Wired and Wireless Devices The Link Layer Discovery Protocol (LLDP), a Layer 2 discovery protocol defined in IEEE 802.1ab, is used for link discovery. During network expansion, esight can use MIB interfaces to quickly obtain Layer 2 network topology information and topology changes from devices on which the LLDP function is enabled. AP and switch link discovery process An AP periodically sends multicast packets containing LLDP type-length-values (TLVs) that specify LLDP information to neighboring APs. If a neighboring AP also enables the LLDP function, the neighboring relationship is established. If an AP connects to a switch that enables the LLDP function through an uplink port, the switch is also a neighboring device. The AP sends LLDP information to the switch and receives LLDP multicast packets sent from the switch. esight obtains LLDP information about the AP through SNMP interfaces of an AC. In topology views, links between switches and APs are displayed, showing connection between wired and wireless devices. If both the AP and switch enable the LLDP function, the process of discovering LLDP topologies between the AP and the switch is as follows: 6

12 AP1 sends local status information to the switch through LLDP packets. The switch analyzes the received LLDP packets and stores them to the remote MIB database. Then esight extracts topology information. The switch sends local status information to AP1. AP1 analyzes the received LLDP packets and stores the analysis result to the remote MIB database. AP1 uploads LLDP neighboring information to the AC through CAPWAP channels. esight obtains the LLDP neighboring information about AP1 from the AC through SNMP interfaces, analyzes topologies, and determines the topology structure of the entire network. Unified display of links between APs and switches If both the AP and switch are added to esight, links between PoE switches and APs are displayed in physical topologies. The discovery process is as follows: The AP and PoE switch are added to esight. esight reads the MIB information about the PoE switch or AP and obtains the link information between all APs and PoE switches under the AC. esight adds the link information to Link Manager for users to view. esight adds the link to the physical topology and displays the link between the PoE switch and the AP. Discovery triggering scenarios for links between APs and directly-connected switches Adding ACs: AP resource synchronization is triggered when new ACs are added. When an AP is added to esight, discovery for links between APs and directly-connected switches is triggered. Adding PoE switches: When a PoE switch is added to esight, discovery for links of directly-connected PoE switches is triggered. If the peer end is an AP, the link between the AP and the PoE switch is displayed. Manually discovering APs, ACs, or PoE switches in Link Manager 7

13 3.2.2 WIDS Wireless Intrusion Detection System The Wireless Intrusion Detection System (WIDS) manages information about rogue devices, interferers, and attacks, and supports type-based recognition and alarm notification based on user-defined rules. Meanwhile, the WIDS allows users to take countermeasures against unauthorized devices, ensuring wireless network security. Information about rogue devices Display the list, classification, and distribution of rogue devices. Information about rogue clients Display the list, association, and distribution of rogue clients Attack information 8

14 Display information about attacks upon the current wireless network. Interferer information Display the interferer list, interference on APs, and interference relationships in the location topology by subnet. Rule definition Network administrators can classify and filter rogue APs and management alarms based on defined rules. Rule definition involves the following indicators: SSID, channel, field strength, impact scope, and attack behavior. Users can enable esight to generate alarms when rogue APs in compliance with defined rules are detected. Same or adjacent channel This rule is used to detect the channel deployment of APs, and detect rogue APs that operate in the same or adjacent channel. If rogue APs operate in the same channel 9

15 with normal APs, esight regards it as same-frequency interference; if rogue APs operate in an adjacent channel, esight regards it as adjacent-frequency interference SSID The service set identifiers of networks from unauthorized vendors or wireless networks established by individuals are similar to authorized SSIDs. For example, the SSIDs are the same or characters are similar (such as 0 and o). In this case, users may be deceived to log in to rogue wireless networks. An SSID rule can be used to detect rogue APs whose SSIDs are similar to the authorized SSIDs or when a specified rule (regular expression) is met. Signal strength Users can set field strength thresholds to recognize high-field-strength wireless signals that may interfere authorized APs. If the signal strength exceeds the specified thresholds, esight regards it as high-field-strength interference. Number of detecting APs Users can specify the threshold for the number of detecting APs rule to recognize wireless signals that may interfere with a large number of authorized APs. If the number of APs that detect a rogue AP exceeds the threshold, esight regards it as large-scale interference. 10

16 Attack behavior This rule is used to detect attacks from rogue APs on wireless networks. Users can define attack behavior rules to recognize rogue APs that attacked authorized APs. Rule classification Rules are classified into rogue, suspected-rogue, neighbor, suspected-neighbor, and interference. The rules are defined as follows: Rogue: high SSID similarity, high channel similarity, high field strength, wide signal influence, and attack behavior. Neighbor: adjacent channel, low field strength, and narrow signal influence. Discovery and clearing processes of rogue devices Discovery process 1) When detecting a rogue device or interferer, APs report the event to esight. If two APs detect the same rogue device or interferer at the same time, the two APs report the event respectively. 11

17 2) esight listens to the event and synchronize rogue device or interferer data. 3) esight matches the synchronized data based on the rule priority. If one rule meets specified conditions, esight matches the rule. 4) esight generates an alarm if the alarm sending function is enabled in the matched rule. Clearing process 1) If the rogue device or interferer disappears and cannot be detected, the APs report the clearing event to esight. 2) esight listens to the event and synchronize rogue device or interferer data. 3) esight matches the synchronized data based on the preset rule. esight generates a clearing alarm if the alarm sending function is enabled in the matched rule. Synchronization process 1) Users manually initiate data synchronization. 2) esight synchronizes data, refreshes the data display, and matches the rule again for changed data. If the matched rule of a rogue AP changes: A. If the alarm sending function is disabled in the old rule but enabled in the changed rule, esight generates a discovery alarm for the rogue AP. B. If the alarm sending function is enabled in the old rule but disabled in the changed rule, esight generates a clearing alarm for the rogue AP. C. esight does not generate an alarm in other situations WLAN Resource Synchronization Manual resource synchronization esight WLAN Manager manages ACs, APs, users, and interference sources. These WLAN resources can be manually synchronized to hosts to ensure resource consistency. 12

18 Table 3-1 Resources that can be synchronized manually Operation Synchronized Resources Periodic Synchronization AC synchronization AP synchronization User synchronization Interference source synchronization AC interfaces AP profiles AP domains Radio profiles ESS profiles Whitelists AP resources Users Unauthorized APs Unacknowledged APs AP resources AC interfaces AP profiles AP domains Radio profiles ESS profiles Users AP resources AC interfaces AP profiles AP domains Radio profiles ESS profiles Unauthorized APs AP resources AC interfaces AP profiles AP domains Radio profiles ESS profiles Not supported Not supported Supported The synchronization interval is configurable. Not supported Automatic resource synchronization When receiving an alarm indicating that an AP is online or offline, esight automatically triggers synchronization of resources of APs under the home AC. When an AC is added to esight, esight automatically triggers synchronization of full resources under the AC. 13

19 3.2.4 User Access History Assume that 10,000 APs are deployed on the network and 15 users access an AP twice each day on average. Total 300,000 access records are generated each day. Devices report esight success or failure syslog logs generated during login to WLANs. esight periodically parses the log files. Network administrators can query the access history of all users. Access history query esight listens on port 514 and receives UDP packets on the port. The smart configuration tool delivers a command to request hosts to report syslog logs. When a user attempts to access a WLAN, the host sends the syslog log to port 514 through UDP packets regardless of the access result. esight periodically parses syslog log files, loads them to the database, and displays them to network administrators. Data storage and deletion A large amount of user access historical data will affect the system performance and occupy large space. To improve the system performance and free up the storage space, formulate appropriate storage and deletion policies. Storage policy: User access historical data is stored in different database tables by quarter. Deletion policy: Data is stored for a maximum of one year Location Topology Region and AP Plan A location topology displays the AP deployment plan in graphic mode and clearly displays the field strength coverage, interference distribution, and terminal access information by region. This helps users to identify coverage holes and network interferences. Creating a location on the location topology: Generally, a lower-level location maps a site, for example, a floor or region. Importing a background image: Import a background image for a floor or region. A background image is a site drawn based on a specified scale. Setting the scale: Set the scale to that of the imported background image to ensure that scale consistency. Deploying APs: Add APs to the current region and adjust AP locations in the background image. Configuring channel colors: Configure different colors for channels, for example, channels 1, 6, and 11 of 2.4 GHz frequency band based on the radio type. Configuring blocks: Mark blocks such as the wall and doors in the background image and configure block material types. Rendering the signal coverage: Display signal coverage based on signal strength, channel, or rate. 14

20 3.2.6 Spectrum Analysis Routine devices, such as microwave ovens and Bluetooth devices, may interfere wireless networks. Users can view the signal interference information around APs in the NMS. Users can judge the signal quality and surrounding interference sources on spectrum charts. Before WLAN deployment or during operation and maintenance, users can check the interference strength of channels in specific environments on spectrum charts, and avoid using channels with strong interference, which ensures access quality. Spectrum charts include real-time FFT, spectrum density, channel quality trend, channel quality spectrum, and device duty cycle charts. 1) Real-time FFT chart: Displays the latest interference strength information at different frequencies. 2) Periodic spectrum chart: Displays the interference strength information at different frequencies within a specific time segment 15

21 3) Signal quality trend chart: Displays the percentage of interference strength that is less than -70dbm. A higher percentage indicates a better signal quality. 4) Signal quality spectrum chart: Displays the signal quality information at different frequencies within a specific time segment 5) Duty cycle: The percent of the time used by channels to send information of the total time, used to describe the idleness of a channel. A higher duty cycle indicates higher channel usage 16

22 3.2.7 Quick Interferer and Terminal Location Locating indoor Wi-Fi devices relies on the Received Signal Strength Indication (RSSI), involves offline and online stages. Offline stage: Divide the location area into several even grids, calculate the field strength of each AP in each grid (considering obstacle attenuation during transmission), dissemination process to consider ), calculate the field strength differences between every two APs, and store "grid coordinates and RSS differences" into the database. Online stage: The location server calculates the differences of RSSI reported by APs, compares with that in the database, and determines the device location based on certain algorithms. esight supports the quick location of rogue devices (rogue AP, rogue clients, Ad Hoc, and bridges) and interferers (cordless phones, cordless phone bases, Zibee devices, microwave ovens, Bluetooth devices, game controllers, 2.4/5 GHz wireless video players, and baby monitoring devices). esight displays rogue devices and interferers in the location topology. 17

23 If the number of rogue devices and interferers exceeds 500, they are displayed as black dots in the location topology. esight records historical terminal track data and supports the playback of the moving tracks in the location topology. 18

24 3.2.8 Energy Saving Management Users can define energy saving policies to close wireless signals in terms of the radio frequency, SSID, and AP. Energy saving policies can be implemented immediately or periodically. 1) Closing a radio frequency When defining energy saving policies, network administrators can deliver commands to an AC to close a radio frequency or AP. 2) Closing an SSID When defining energy saving policies, network administrators can deliver a selected ESS profile to an AC to close an SSID. 3) Closing an AP When defining energy saving policies, network administrators can close an AP by delivering configurations to a PoE-enabled switch connecting the AC and AP. 3.3 Function Constraints Applicable Device Types Device Type SPU ACU Version V1R3 V2R1 V2R2 V2R1 V2R2 19

25 Device Type Version S9700 V2R1 V2R2 AC6605 V2R1 V2R2 V2R3 AR150 AR200 AR1200 AR2201 AR2202 AR2204 AR2220 AR2230 AR2240 AR3260 WS6603 V2R3 V1R3 3.4 Typical Applications The core competitiveness of esight WLAN in the following aspects helps users comprehensively manage wireless networks and resources: service deployment, service monitoring, service adjustment, fault diagnosis, and report statistics. 20

26 3.4.1 Service Deployment Deployment Configuration Verification Establish service channels and management channels using the smart configuration tool Implementing simple and easy service deployment using the configuration wizard Verify the AP running status based on the location topology plan 21

27 3.4.2 Service Monitoring Maintenance and monitoring on portals The portal-based monitoring enables users to conveniently monitor wireless device resources, interference sources, and wireless users. Users can view statistics about ACs, fit APs, SSIDs, STAs, and unauthorized APs in resource management and view wireless resource topologies in WLAN service topology views and location topology views in the AC/AP network and region deployment dimensions. AC 22

28 Fit AP In the physical topology, users can check connections between devices, and monitor the device and link status. The WLAN service topology displays the logical connections between and detailed information about ACs, Fit APs, STAs, and rogue APs. In the service topology, users can monitor the alarms and status of wireless devices and diagnose faults by the ping operation. 23

29 In the WLAN location topology, users can view the current hot spots and radio coverage, mark the location of illegal interferences and conflicts, and collect statistics on wireless network resources by region or location. 24

30 In report management, users can view various statistics reports, such as the wireless online user detail report by location, wireless online user stat. report by location, radio wireless online user detail report by location, radio wireless online user stat. report by location, AP access rate stat. report by location, and AP access rate detail report by location. In addition, users can view the user login fail rate stat. report and user login count stat. report in the Linux + Oracle environment. The following is an example of the AP Ethernet Port Rate Stat. Report. 25

31 3.4.3 Service Adjustment If a coverage hole exists on the network, users can quickly deploy services on new APs in esight to cover hot spots. To enhance security, users must quickly modify the authentication policy and change passwords in esight. 26

32 When a carrier's APs or private APs occupy the planned channel and interfere with APs on the live network, users can quickly change the channel in esight if negotiation is unavailable Fault Diagnosis End-to-end wireless user fault diagnosis Network fault diagnosis esight can check the network quality for online users in the user, SSID, AP, and AC dimensions. Figure 3-1 User fault diagnosis 27

33 Figure 3-2 SSID fault diagnosis Figure 3-3 AP fault diagnosis 28

34 Figure 3-4 AC fault diagnosis Fault Rectification During WLAN debugging or after online AP upgrade, network administrators can remotely restart APs in batches in esight. During WLAN network debugging or when APs are configured incorrectly, network administrators can remotely restore APs to factory settings in batches in esight. When a hardware fault occurs on an AP on the network, users can quickly replace the AP and retain the original service configurations. 29

35 Figure 3-5 AP-related operations in the location topology view Figure 3-6 Fit AP resource management operations 30

36 4 Experience 4 Experience Service monitoring WLAN provides graphical monitoring for users to view information about the network-wide physical resources, rogue APs, statistics, and performance. Service adjustment WLAN quickly implements the following services to ease network management: authentication policy modification, password change, channel change, and covering coverage holes for new APs. Fault diagnosis WLAN provides unified management for wired and wireless networks through topology management, allows users to perform the ping operation on ACs or APs to obtain link information and check the link status, and helps users to locate and rectify faults based on the alarms (such as communications alarms and environmental alarms). Fault rectification When a hardware fault occurs on an AP on the network, users can quickly replace the AP and retain the original service configurations. 31

37 5 Conclusion 5 Conclusion WLAN management provides an end-to-end configuration wizard to help users deploy or adjust services rapidly in batches. During troubleshooting, WLAN management provides effective methods for fault notification, fault locating, and troubleshooting. During service monitoring, WLAN displays logical architecture of wireless networks in service topology, displays radio signals in location topology, and provides the performance and report statistics function to monitor the current network status. In general, WLAN management provides a comprehensive solution for routine maintenance and network adjustment, which greatly improves network management efficiency. 32

38 A Acronyms and Abbreviations A Acronyms and Abbreviations Acronyms and Abbreviations AC AP Full Name Access controller Access point CAPWAP Control and Provisioning of Wireless Access Points DHCP DNS DTLS Dynamic Host Configuration Protocol Domain name service Datagram Transport Layer Security ESS Extended service set FOA First office application MIB Management information base NE Network element PoE Power over Ethernet SNMP STA Simple Network Management Protocol Station UDP User Datagram Protocol 33

39 A Acronyms and Abbreviations WLAN Wireless local area network 34