Waterloo School District Wireless Network Infrastructure Project Additional Information

Transcription

1 Waterloo School District Wireless Network Infrastructure Project Additional Information This sheet of additional information has been issued in response to RFP-related questions asked by vendors, in order to ensure that all vendors have access to the same information for developing proposals. Existing Wi-Fi System We currently use an Aerohive Networks Wi-Fi system consisting of sixty-six AP120 units used mostly in classrooms and office areas, six AP170 units used for five outdoor locations and our swimming-pool area, and one AP330 and seven AP350 units used mostly in large indoor areas. Cloud-based, Virtualized, and AP-based Controllers We are comfortable running a cloud-based controller or management system. Our current wireless system does not have a centralized local controller and is managed entirely through a cloud-based application. We have a fully redundant VMware vsphere 6.0 cluster in place that could potentially host a virtualized controller or management system on-site. We would also be comfortable with a solution where controller functionality is hosted on one (or more) access points, so long as it scales to our installation size and otherwise meets our needs. Any management system or controller solution must be able to present all APs as a single cohesive system under one management interface, with at least a 15% margin for potential future growth. Splitting the APs into two or more independent wireless systems in order meet maximum device limitations is not acceptable. If the proposed system uses dedicated controller hardware, a redundant controller option should be included in the proposal as a separate, optional item, since it would not be eligible for E-rate funding. Controller Installation and Configuration In the RFP, we stated that we would need a quantity of one of Any controller equipment and management software required for operation of the system. We also stated that The Vendor will be responsible for initial installation and configuration of any required controller and management system software to work with the WSD network. Our ultimate goal with both of these statements is to ensure that the district has a functioning Wi-Fi system at the end of the project. We realize that different Wi-Fi solutions from different manufacturers handle controller and management functions differently. Some of these solutions may require high levels of product-specific knowledge and expertise to initially install and configure, while others require less. We have the following expectations: The vendor will perform any required initial installation of controller hardware or software. The vendor will work with the district IT department to configure the system so that it interoperates with the rest of the district network. Once the system is configured, deploying an access point should be a matter of plugging it in to a properly configured switch port, registering it with the system, and pushing down a configuration through the management interface. We will have a properly-configured, well-functioning Wi-Fi system, once the project is complete, and that if the new school year starts and we find that the system isn t performing as expected due to the system

2 configuration, the vendor will work with us to resolve this without additional charge. Any such configuration issues should be resolved by the end of the second week of the new school year (September 15, 2017). At the end of the project, the District Network Administrator and District Network Technician will have the knowledge to perform day-to-day management of the system. Support/License Term The district would like to see both three-year and five-year support/licensing options, however, any term over three years would need to qualify under E-rate Category 2 Funding as basic maintenance. Existing Switch Ports and Wired Infrastructure Most of the new access points will be in-place replacements for existing access points, and thus will not require an additional switch port. In the case of new access point installations, there are enough 1Gbps 802.3at-powered switch ports available in each wiring closet to accommodate new APs. There was a large wiring project in the 90 s that installed Category 5 UTP cable throughout the district. There are also a few areas where network drops were added more recently and that use Category 6 or 6A cabling. During the installation of our current Wi-Fi system, we generally utilized this existing cabling by taking a cable that had been terminated in a wall jack, pulling it up above the ceiling, and using it to connect an AP. We would re-use these existing network connections or perform a similar repurposing of wall-jack terminated connections when possible while installing new APs. The district IT department has a Fluke CableIQ Qualification Tester. This was used during the installation of access points in our existing system to verify the capability of network connections to successfully perform to specification when carrying power over Ethernet and 1000BASE-T network connections. We will re-verify each network drop used for wireless APs during installation of the new equipment. We realize that some wireless APs are able to utilize multiple gigabit Ethernet connections or connections faster that one gigabit for backhaul traffic. We may eventually use that extra backhaul throughput in some AP installations if it is available, however, it is crucial that any APs proposed be able to operate with all features enabled using a single 1000Base-T Ethernet connection and 30-watt 802.3at PoE input. Current SSID and VLAN Structure We currently use two SSIDs, WSD Private and WSD BYOD. WSD Private is used to connect district owned and managed devices using a WPA2 Personal access scheme with a shared PSK. WSD BYOD is used to connect student and staff-owned devices that are not under district control and utilizes an Aerohive-proprietary Private PSK system. Moving forward, the district will transition away from a bring-your-own-device model of access to a one-to-one model of access using district-owned devices, though BYOD will continue to be supported, at least for staff. As part of this transition, we plan to move away from our current Private PSK system to WPA2 Enterprise, using an 802.1x supplicant to authenticate users against their Universal Password credentials in edirectory through FreeRADIUS. We successfully used such an authentication mechanism while initially piloting BYOD several years ago. Depending upon the flexibility of FreeRADIUS to handle multiple authentication mechanisms, the district may eventually move to a single SSID for all devices in the future, using of mix of username/password authentication for end-user devices and certificate-based authentication for infrastructure devices. This would not be part of the initial implementation of a new wireless system, however. Wireless Authentication and Web Filtering The district uses a Palo Alto Networks PA-3020 firewall, which also acts as a web filter. In the case of Windows devices connecting to the WSD Private SSID or through a wired connection, the firewall is able to determine the logged-in user

3 by periodically querying edirectory for updated networkaddress attribute values on user accounts via LDAP and using that information to build an internal table that maps IP addresses to users. The firewall is then able to apply user or group specific filtering policies to traffic based on those mappings. In the case of BYOD devices, the Private PSK used to connect the device to the WSD BYOD SSID allows our existing wireless system to determine which user is connected and pass their traffic to a specific backhaul VLAN based on a user to group mapping within the Private PSK account. In this way, Intermediate and Middle School student traffic, High School student traffic, and staff traffic are mapped to specific VLANs, and appropriate filtering policies can be applied on the source VLAN/subnet of the traffic passing through the firewall. In the case of school-owned, non-windows devices such as Chromebooks and ipads that connect to the WSD Private SSID, all traffic originating from the associated wireless VLAN/subnet that passes through the firewall and that isn t able to be matched against a known user by the firewall is instead mapped to the Elementary Student web-filtering policy, as that is the most restrictive. The transition to a one-to-one deployment model using WPA2 Enterprise to authenticate users against their edirectory Universal Password credentials should provide better visibility as to which users are using which school-owned, non- Windows devices on the district wireless system. Ideally, I would like for this user information to feed from the wireless system to the firewall, in order to build a more complete IP-address-to-user mapping table within the firewall for the purpose of applying user and group specific firewall policies and simpler reporting. Our current Aerohive wireless system is potentially able to accomplish this using syslog reporting from the access points to the firewall, though we do not currently have this functionality configured. Since we will move from Aerohive Private PSK to WPA2 Enterprise, it is important that any wireless solution proposed be able to apply differentiated policies to users connected to a single SSID. This includes the ability to apply different rate limiting and VLAN-mapping based on attributes supplied by a RADIUS server during user authentication. Outdoor/Weatherized APs and Antennas We have five outdoor APs currently, and will add two more as part of this project. Each of the four APs currently attached to the main building are Aerohvie AP170 units and utilize a Terrawave M MP1D43602 antenna. These APs are powered via an 802.3at capable switch port and also utilize an in-line lighting arrester device. The AP on the press box building is also an Aerohive AP170, but uses two Terrawave M MP1D43602 antennas. One of these antennas has only the 5GHz leads connected and is pointed toward another AP and antenna on the main building to form a mesh connection. The other antenna is has only the 2.4GHz leads connected and is pointed West, across the football field, to provide Wi-Fi coverage in that area. This AP is powered via an 802.3at in-line power injector located in inside the press box building and uses an in-line lightning arrester device. Along with the ability to maintain a wireless mesh backhaul connection to the wireless network in the main building while relaying coverage for the football field and track area, the press box AP also needs to be able capable of providing an 802.1q Ethernet trunk potentially connect a local switch within the press box to multiple internal VLANs. Although it is located indoors, the AP for the pool area does need to be a weatherized unit due to the corrosive environment. Omni-directional antennas are fine for this location, so long as they are weatherized units. We will handle the installation of new outdoor wireless APs and antennas in existing locations, as these should be simple replacements of AP and antenna equipment, utilizing existing mounting polls, network drops, and grounding. Installation of wireless APs and antennas in the two new outdoor locations will be contracted out by the district, and are outside the scope of this RFP. We felt that including these additional installations in this RFP would introduce unnecessary complexity in the bidding process and reduce the number of potential RFP responses received by the district.

4 Outdoor antennas included in proposals should provide similar coverage to those currently installed in the case of existing AP locations and should provide coverage adequate to supply service in the indicated areas in the case of new AP locations. The blue ovals are meant as guides, and we realize that no antennas are likely to project a signal in that exact shape. We do expect new antennas to be quoted for all outdoor installations, even if the existing antennas models would potentially be compatible with the proposed APs. An additional outdoor map that differentiates existing (orange) and new (cyan) AP installations is included at the end of this document. Orange arrows indicate the aim of existing Terrawave M MP1D43602 antennas and cyan ovals indicate the general area of coverage desired for the new AP installations.

5