企業無線網路安全解決方案. Eric Wu/ 吳章銘大中國區技術總監. China: Taiwan:

Transcription

1 企業無線網路安全解決方案 Eric Wu/ 吳章銘大中國區技術總監 China: Taiwan:

2 Agenda Aruba Profile WLAN Solution Evolution RF Site Planning Tools (3+1) RF Optimization Dynamic Tuning of RF setting RF triangulation location based services Wireless Security Control Personalized services and security for users, devices, and applications Aruba Product Line Page 2

3 Aruba Snapshot Founded February, 2002 Status Funding Investors Revenue Privately-held $84M in four rounds Matrix, Sequoia, Trinity, WK Technology Fund First 6 quarters have exceeded comparables of NetApp, NetScreen, and Foundry Innovations Mobility controllers Customers Employees Markets (adding over 100/quarter) 200 and counting Intersection of wireless, security and mobility Page 3

4 Managing Growth Dominic Orr President and CEO -Nortel -Alteon - BayNetworks -HP Pankaj Manglik Co-Founder and VP, Product Mgmt. -Alteon -Cisco -Instel Duston Williams CFO -Rhapsody -Western Digital Merv Andrade CTO -Cisco - Bombay Stock Ex Dave Butler VP, Sales -FORE Systems Keerti Melkote Co-Founder and VP, Marketing - Nortel/Shasta - Tahoe Networks -Cisco -Intel Page 4

5 Enterprise WLAN Challenges Three Problems Aruba Set Out to Solve Security issues and upgrades Mobility across access points Rogue access points OPEX of AP management RF spectrum management Large scale deployments Voice over Wireless LANs Security Issues Mobility Issues Battery Life Page 5

6 WLAN Solution Evolution

7 Fat/Smart Access Points Solution Fat/Smart Access Point: Single CPU Architecture loaded with all the WLAN features and functions Security, QoS,.. VPN termination MAC, Radio Example : Cisco Aironet Campus L2 Switch POE Security, QoS,.. VPN termination MAC, Radio Corp. Backbone Wired Network Network (Access Points Centric Loaded with WLAN features ) Corp. Backbone e.g, Cisco Aironet (IOS) Page 7

8 WLAN Switching - Appliance Model Encryption/Decryption (WEP, TKIP, AES) POE Ethernet Switch FLOOR 1 WLAN Management Intelligences Fit AP POE Ethernet Switch FLOOR 2 Corp. Backbone FLOOR 3 Ethernet Switch Wired Network FLOOR 4 Ethernet Switch Fit AP Full/Fit AP WLAN Appliance, most notably Vernier, BlueSocket, Reefedge,and Cranite Page 8 LAN Backbone Encryption/Decryption (WEP, TKIP, AES) - Lack Intelligent RF Management - No Wireless Intrusion Detection/Protection

9 Pioneered WLAN Switch Architecture Centralized Architecture Solves Security and TCO for WLANs Centralized WLAN Switch Management Policy Mobility Forwarding Encryption Authentication a/b/g Antennas Fat Access Points Thin Access Points Page 9

10 Centralized Encryption/Decryption - End-to-end secure communication GRE Tunnel GRE Encapsulation Encrypted packet Encrypted packet Encrypted WLAN Appliance or Server Normal Ethernet packet Fat/Fit AP Encrypted packet Unencrypted Encrypted Page 10

11 Traditional Wireless LANs: Complex Integration Process ACCESS FLOOR 2 4Upgrade IOS for WLSM 802.1x fast roaming DISTRIBUTION Blade for 5inter-VLAN mobility CORE DATA CENTER Configure RADIUS every 3time you add an AP EMPLOYEE GUEST FLOOR 1 GUEST 3 EMPLOYEE Page Add wireless VLANs WLSE everywhere Firewalls and VPN 6Blades for Security VLANs for AP and 2RF management

12 Aruba Network Architecture: Existing Network is a No Touch Zone IP-Based Tunneled Architecture Proves Most Successful Overlay Model ACCESS FLOOR 2 EMPLOYEE DISTRIBUTION CORE DATA CENTER GUEST Standby FLOOR 1 GUEST EMPLOYEE Page 12 VLANs

13 RF Site Planning Tools

14 Before Aruba Site Surveys Expensive Optimizing for coverage not capacity Time consuming About 2 hours for b/g and another 2 hours for a Never finished Need to repeat every 3 months Need to repeat if adding APs Need to repeat if neighbors add APs Not real-time - just a snapshot Required for location tracking using RF Fingerprinting Page 14

15 RF Plan Page 15

16 Phase Two Planning Setting Channels Page 16

17 Phase Two Planning Setting Channels Page 17

18 Phase Three Planning Setting Output Power Page 18

19 No more site surveys Dynamic Heat Maps Place the APs on a floor plan and see the results in real time Significantly reduce labor costs by eliminating manual walkabouts for RF fingerprinting Automatic location tracking Real-time views on Signal-to-Noise Ratio (SNR) Interference Coverage at specific data rates Layered views for comprehensive visualization Views of cross floor RF leakage Page 19

20 RF Optimization Dynamic Tuning Of RF Settings

21 Self-Healing Wi-Fi x WLAN switch detects AP failure Page 21

22 Self-Healing Wi-Fi Switch automatically reconfigures AP to extend coverage to compensate Plug and Play APs download original config Page 22

23 Load Balancing Wi-Fi Connections Move 1,2 and Page 23

24 RF triangulation location based services

25 Removing Rogue Access Points Locate the rogue AP Rogue AP Air Monitors Page 25

26 RF Locate Page 26

27 Aruba 800 Switch 與 Aruba 52 Access Points 測試報告 作者 : 陳世揚工研院交大網路測試中心 Aruba Networks 推出的方案要讓企業更樂於導入 WLAN 設備, 它能集中化管理許多 AP, 具有動態 RF 能力 安全控管與 IDP 能力,NBL 這次評估的 Aruba 800 和 Aruba 52 的確實令我們看到它的優異之處 NBL Review Highlights 1. 具備圖形化的 RF 規劃, 其 APM 能動態配置 Channel 與 Power Level 2. 實現 RF Heat Maps( 等強度涵蓋圖 ) 能及時顯示 AP 的部署情形 3. 能識別是否有危險的 AP, 並偵測 Ad-Hoc Wireless Bridge 和多種攻擊 4. 可定位無線裝置, 並精確到 3 公尺範圍以內 5. 能依不同身分, 給予如地點 時間 頻寬合約 與應用協定等的控管 6. 支援 WPA 連線的 Seamless 漫遊, 甚至在使用 Switch 失效備援的情況下 Page 27

28 Wireless Intrusion Detection Intrusion Detection and Prevention Hackers Can Trap Users, Grab Data and Pretend to be Valid Users Page 28

29 Classification Corporation with Aruba WIDS Neighboring Company or Public Hotspot Valid BACKBONE Parking Lot Interfering Rogue Page 29

30 Safety with Aruba (Rogue Prevention) AP detection See all APs AP classification Are they neighbors? Or are they a threat? Rogue destruction Stop users from accessing rogue APs and leave neighbors alone Page 30

31 Per Role, User, Device Firewall, QoS, Bandwidth Contracts

32 Enabling Policy-based Network Access Custom Service Delivery Based on Who, What, When, Where and How Identity aware I am Matt Green, the employee Device aware I am Matt Green with a laptop with no viruses or worms Resource aware I am Matt Green with a laptop using VoIP Time aware I am Matt Green with a laptop using a soft phone at 1:40 p.m. Location aware I am Matt Green with a laptop using a soft phone at 1:40 p.m. in the clinic Page 32

33 Intelligent Secure Access Edge Switch Web Authentication Authenticate users via web-based portal Redirects all client logons to web page Capture guest user access Customizable web page Built-in Internal User Database Works with external AAA servers Page 33

34 Managing & Tracking Wireless Devices

35 Seamless Mobility and Role-based Secure Access Control Fast Roaming <10 msec, AP-AP intra-switch <20 msec, AP-AP inter-switch Utilizes Proxy Mobile IP and Proxy DHCP (no client config needed) Authentication and Role Assignment 802.1X PEAP, TTLS, TLS Browser Based Captive Portal VPN IPSEC, PPTP Interoperable with Existing RADIUS, LDAP & RSA Secure ID USERNAME John Doe PASSWORD <One Time Password> USERNAME John Doe PASSWORD <One Time Password> ROLE Employee AUTHENTICATION RSA SecurID FIREWALL POLICY Don t allow on Finance Subnets Subnet A Wired Intranet Subnet B ROLE Employee AUTHENTICATION RSA SecurID FIREWALL POLICY Don t allow on Finance Subnets Page 35

36 RF TROUBLESHOOTING

37 Wireless RMON Statistics Per station, per AP aggregate stats Retry rates Error rates Fragmentation rates Bandwidth rates Per station/ap raw stats Packet byte counts Frame size stats Protocol type stats Page 37

38 Remote troubleshooting I ve got a performance problem, start capturing packets WAN Page 38

39 SOHO and Road Warrior Access MOBILITY Key Features Remote AP with Centralized and Distributed Termination (FlexMAC ) Multi-SSID Support Remote Site Survivability Remote Location GUEST CORP Guest Internet Access INTERNET Employee Internet Services DMZ Corporate HQ CORP Wired Port Tunneling (AP70) Plug and Play NAT Traversal Mobile Edge Client VOICE Remote AP connected to any Ethernet port with Internet connection All security policies centrally defined and enforced at the mobility controller VOICE Page 39

40 企業無線網路安全機制重點整理 無線管理機制 提供無線 AP 及無線網卡使用者偵測及定位功能, 並以圖形方式顯示 提供頻寬管理功能, 可依據使用者帳號設定可用頻寬 提供三度空間 Site Survey 工具, 可設定多樓層, 自動建議無線 AP 提供自動頻道選擇功能, 可控制無線 AP 自動選擇頻道以減少干擾 無線網路安全 提供系統安全認證機制 提供 Wireless IDS/IPS 功能 提供 Wireless Firewall, VPN 加密功能 可即時辨識合法 非法及鄰近無線 AP 並有效阻絕非法無線 AP 的使用 支援其他廠牌的無線 AP 的安全控管 提供內建 User 資料庫, 並可支援外部 RADIUS 及 LDAP 認證 無線應用最佳化 提供無線 AP 負載平衡功能, 可依照連線數量及使用率做負載平衡功能 提供自動涵蓋損毀無線 AP 之無線信號範圍 (Self Healing) 功能 其他 提供廣域漫遊功能 支援 HA 備援架構

41 Q & A You re Not Alone

42 Product Line

43 Aruba Mobility Controller Family Same Value Proposition Across All Platforms Scalable and Flexible: - 200: 6 APs - 800: 4 and 16 AP Options : Support for 48 APs : Scales from 48 to 512 APs Performance & Capacity (800MB 8GB full feature) Full Redundancy Options Single Mobility Network - Up to 32,000 Access Points

44 Scalability and Performance Aruba 5000/6000 Aruba 2400 Aruba 800 Aruba 200 Deployment: Campus Building Branch Size 3U 1U 1U 1U Access Points 256/ or 16 6 Users 4096/ Clear text 8 Gbps 2 Gbps 1 Gbps 1 Gbps Encrypted (3DES) 7.8 Gbps 760 Mbps 380 Mbps 200 Mbps

45 Wireless Access Point Family Same Value Proposition Across All Applications Single Band (802.11a or b/g) Dual-Band (802.11a/b/g) Auto-Discovery (Plug n Play) Multi-Service - Multi-Band Wireless AP - Remote AP - Branch Office AP -Air Monitor AP 70 AP 80M Centrally Managed - RF Parameters - Security Parameters - Service Definition - Version Management - Regulatory Domain AP 41 AP AP 60/61 61 AP 65 AP 65 Low End / Low Cost High End / High Feature Integral / Detachable Antenna Versions

46 Aruba Access Point Family Single Radio Dual Radio Outdoor APs Software Configurable a or b/g AP / Air Monitor / Remote AP Ideal for Dense Office, Home Office and/or Air Monitor Deployments Internal or External Antenna Options Low Cost Dual-Radio a/b/g Ideal for Campus / Remote / Branch Office AP High Availability Features (AP70) Wired and Wireless Security (AP70) Extensible USB Interface Port (AP70) Dual-Radio a/b/g AP or WDS Bridge (Point-Point & Multi-Point) Fully Environmentally-Hardened Design : Desert, Snow, Rain, Harsh Environment

47 Aruba Mobility Management System Software Distributed or Embedded on MMS Appliance Mobility Management System Software Dashboard view of entire network Monitoring with drag and drop Flexible reporting RF planning and visualization Location tracking Supported on Intel server running RedHat Linux MMS Software Mobility Management System Appliance MM-100 High Performance Dual Intel Xeon Processors Dual network interfaces High-availability RAID storage Mobility Management system Software pre-installed MM-100 Appliance centralized, scalable monitoring, data collection and reporting

48 Why Aruba? Simple Deployment and Management Access Point Density (Performance) Structured Deployment (Out of Ceiling) Centralized Operations Most Secure Solution Wireless Intrusion Detection & Prevention Integrated Policies Identity, Encryption, Resource, Application, Location, Time, Centralized Encryption and Enforcement Enterprise-Class Resiliency Modular, Scalable Controller Platform High-Availability Architecture Programmable for Future Services

49 Broad Market Acceptance Over 1000 Enterprise Customers Worldwide High Tech Education Healthcare Government Financial Other Novell

50 Q & A You re Not Alone