Campus Automation A Secure University IoT Solution

Transcription

1 Campus Automation A Secure University IoT Solution Omar González Systems Engineer

2 Why Focus on the Campus Network? Some innovation occurring in the Data Center and the WAN; but its not yet extending into the Campus. Meanwhile the demands on the Campus are growing: IoT, mobility & cloud Securing IoT/ users / devices Real-time requirements (realtime analytics, AI, VR) Extreme is focused on delivering innovation to the Campus Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

3 Edge Automation: Zero-Touch User & Device Attachment Integrates Extreme Edge products & connection services with next-generation Fabric Core Fabric Attach extends Fabric Connect services to EXOS and ExtremeWireless Edge Leverage Extreme s dynamic role based policy control and automation and orchestration to secure auto-attachment of users/devices to Fabric-based services Customers Extreme, Avaya, and netnew now have more design & product options EXOS switches Fabric Connect ExtremeWireless 3900 APs Zero-Touch Edge = IoT-Ready Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

4 Core & Aggregation Automation: Dynamic Service Creation Status Quo Automated Campus Hop-by-hop provisioning Changes any moves, adds, changes a require Core configuration Needs Change Window & prone to human error Edge-Only Provisioning Zero-Touch Core & Aggregation No Change Window: service provisioning onthe-fly Application Servers Video Surveillance Servers Eliminate Change Windows, Decrease Risk, & Increase Agility

5 Automated Security: Policy-based Service Creation & Access Individual end-to-end segments deliver secure traffic separation: Hyper- Segmentation Isolate critical applications, information or users Denies Hackers the borderless environment that they use to hop from one compromised system to the next Leverage Extreme policy and/or control to secure auto-attachment of Users/Devices to hyper-segment Enables granular control over who and what has access to a segment Both hyper-segmentation and policy enforcement for auto-attach are dynamic Customer / Patient Records Financial Systems Application Servers Security Enhanced Without Increasing Complexity

6 Enhanced Security with Stealth: Keeps topology hidden. What you can t see you can t attack Without Stealth Capability All network nodes and devices can be viewed Video Surveillance Cameras Video Surveillance Cameras With Stealth Capability There is no reachability in or out of a segment. Customer / Patient Records Financial Systems Video Surveillance Servers Video Surveillance Servers

7 Enhanced Security with Hypersegmentation: Prevents Lateral Movements Creating Dead Ends for Hackers Campus VLAN s and ACL s Without Hyper-Segmentation Isolation is fragmented and limited in scale VLAN Chaining With Hyper-Segmentation Zones effortlessly reach across entire network Micro-segmentation in the data center Application Servers Customer / Patient Records Financial Systems Application Servers

8 Multicast with 28X Better Scale by Eliminating Complex PIM Protocols Camera Recording Multicast Application Status Quo (PIM based multicast) Complex to configure Slow recovery (overlays) Strains CPU Low scalability Complicated troubleshooting Camera Recordin g Multicast Applicatio n With Extreme (PIM free multicast) Simple to configure Fast recovery Fast performance Removes scalability limitations Simplified troubleshooting

9 The Fabric Connect Difference - Quantified & Validated Simple Secure 4-10 Protocols to 1 1/10 Resources & 1/10 Time 28x Better Multicast scaling Isolates traffic end to end Contains breaches Secure IoT When you look at Fabric Connect, you ll say, It can t be that easy, but I m telling you it works. - Promedica I feel a big weight lifted off my shoulders. I am no longer worried about a possible violation Black Oak Casino Agile 11x Faster Time to Service Automated IoT Plug & Play Elastic Networks Previously we needed a lead time of up to six weeks. Today we can implement similar tasks within days. - Fujitsu Resilient Hands off Core 7x Faster Time-to-Repair 2500x Faster Reconverge The reconvergence of the Fabric solution is lightening fast. Not a single call dropped and no one even noticed the outage. - Franciscan Alliance 2017 Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

10 Fabric Connect is Simple: From 4-10 Protocols to 1 Traditional MPLS Fabric Connect Benefits: OSPF STP Extreme Fabric Connect 1 Protocol (IEEE/ IETF Shortest Path Bridging) Faster to Deploy Increased Stability Easier Troubleshooting Faster Resiliency Lower Costs

11 Just one Protocol for any Network service Extreme Fabric Connect Layer 2 Virtualized Services 1 Protocol (IEEE/ IETF Shortest Path Bridging) Layer 3 Virtualized Services (multiple routing & forwarding Instances) Fully Optimized IP Routing and IP Multicast

12 What We Are Announcing: Components of the Automated Campus Extreme Management Center VSP 8600 VSP 8404C EXOS ExtremeWireless 3900 APs Fabric Connect Fabric Attach Automated, Secure, Policy-enabled Campus Architecture World-Class Support 2017 Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

13 Why ExtremeWireless Access Points Latest in ac wave 2, MU-MIMO technology High Density Applications: Flow-based Flexibility, deployment modes, broad choice of APs Application Visibility and Control Consolidated Policy Enforcement Fabric Attach Client support in release 3912i Wall Plate 11ac Wave 2 2x2:2 SS Dual band & radio 1.6 Gbps capacity MU-MIMO IoT & Cloud-Ready! 3916i 11ac Wave 2 2x2:2 MU-MIMO IoT & Cloud-Ready! Dual band & radio Integrated BLE 4.0 IoT Cloud-Ready! 3935i/e 11ac Wave 2 4x4:4 MU-MIMO 802.3at & 802.3af (power save mode) 2.5Gbps 90K pps Cloud-Ready 3965i/e 11ac Wave 2 4x4:4 MU-MIMO Dual-radio 2.5Gbps 90K pps Integrated or external antennas Cloud-Ready! 13

14 Performance ExtremeWireless Wave 2 Portfolio Specialized AP + Camera Mid-Tier Outdoor ($2,495) Value Outdoor Outdoor Wall Plate users/ap 2x2:2 50 users/ap 2x2:2 Higher-Ed, Healthcare, VIP Cost Offices Effective 50 users/ap 2x2:2 SLED, EMEA, APAC 2017 Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved Value Tier Converged Wi- Fi & Video 11ac W2, 2x2:2 SLED Healthcare, Stadiums Price users/ap 11ac W2, 4x4:4; 3xMU-MIMO Higher-Ed, K-12, Healthcare, Arenas, Manufacturing 3917 Entry-level outdoor Ideal for dense deployment scenarios Ideal for dense Service, pt-2-pt deployment scenarios antenna offerings Service, pt-2-pt antenna offerings -40C to 70C oper temp/ip67/nema6 Stadiums, Healthcare, Manufacturing -40C to 60C oper temp/ip67/nema6 Stadiums, Healthcare, Manufacturing

15 AP391x as Thread Border Gateway ( /November) First Enterprise Access Points to feature support for Thread Thread ( is an based technology for vendor-agnostic device mesh inter-connectivity Forum spearheaded by Google and other large adopters intending to simplify the deployment of IOT devices (Sensors, controls) Access Point becomes IPv6 Gateway Router for Thread mesh network IPv6 over Spearhead Innovation in IOT building automation Current Spec targeting home automation use cases Smart Locks, Smart Switches, Smart lamps Thread Enabled devices in market by End of Spec focusing on Enterprise automation HVAC, Lighting, Temperature, Presence detection, building security Adoption proliferation from home to enterprise. Requires AP391x Leverage KW41 for Alternate function to BLE 2017 Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

16 IOT: Manage Thread Border Gateway Thread devices are essentially IPv6 addressable devices. Devices hop through each other to provide intra-network connectivity AP operates as a Leader, Router, Gateway Router (6LwPAN to IPv6/NAT64)

17 Intelligence: 360º View of the Automated Campus Visibility & Control Actionable Business Insights Manage with a 360 View Unify security of wired and wireless network Get in-depth visibility and control over users, devices, applications Enable secure access and set granular policies Integrate with major MDM and security solutions ExtremeControl ExtremeConnect Correlating network and application performance with user and device activities Speeds up troubleshooting by separating network from application performance Secure your network by monitoring shadow IT, malicious and unwanted applications ExtremeAnalytics Zero touch provisioning + Alarm and event management Configuration, inventory and change management Capacity planning Discovery and topology ExtremeManagement Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

18 Extreme Management Center Components (Demo) ExtremeControl Role-based granular network access control and priority Flexible assessment Compliance enforcement Guest & remediation portals User & end-system tracking Automated incident response ExtremeAnalytics Layer 7 application visibility and control 1,000s of fingerprints for port independent app. detection Dashboards, diagnostics and troubleshooting Status, performance and threat reporting ExtremeManagement Alarm and Event management Configuration, inventory & change management Zero touch provisioning Capacity planning Discovery & topology ExtremeConnect Enables automation & integration with VMware, MS, OpenStack, BYOD, MDM, Security, NGFW, etc. Provides direct access to Management Center Open API Build-Your-Own-Integration 18

19 Enterprise-Class Product Portfolio Breadth End-to-End Solution Software, Support, and Services Insights, Efficiency Access Intelligence Mobility Campus Secure Flexible Data Center Agile Adaptable Places in the Network

20 The New Extreme Networks

21 #3 Enterprise End-to-End Networking Vendor* Aerohive *Source Dell Oro

22 Expanding Verticals and Technology Capabilities Extreme Zebra Avaya Brocade Education Healthcare Public Sector Retail Transportation / Logistics Education Healthcare Public Sector Hospitality, Sports, and Entertainment Manufacturing Hospitality Manufacturing Public Sector Enterprise Data Center Customers

23

24 Competitive Environment ACI, Catalyst product line Forklift anyone? Transition to Cisco DNA looks very similar to transition to Nexus. Will customers have to do yet another forklift upgrade? Expensive Opex model for s/w Cisco moving away from perpetual licenses for strategic software Complexity ACI notoriously complex; do you want to take this complexity to the campus! Aruba Series / HP switches What Fabric do you want? 7 different fabrics mainly DC centric DevOps approach for Campus Lacking the plug and play simplicity of Fabric Orphaning H3C customers? Increased focus and attention on Aruba is leaving H3C customers feeling abandoned. MetaFabric / Virtual Chassis 2 Fabric 4 No Scalable Campus Fabric Virtual Chassis Fabric for small implementations only (32 nodes only) Lack of Enterprise focus Only seem to pursue large enterprise opportunities Confusing Fabric story 5 fabrics for different purposes / different parts of the network Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved

25 Thread operation Characteristics Network Type: Mesh Band: 2.4GHz ISM Distance: meters Max nodes: Latency < 100ms Radio: DSSS, O-QPSK modulation Throughput: 250 kbps Up to 32 active routers Transport: User Datagram Protocol (UDP) IP Routing: 6LoWPAN IPv6 over low power Wireless Personal Area Networks IEEE Standard: (PHY-MAC Layers) 16 x 2MHz channels 2017 Extreme Networks, Inc All rights Extreme reserved Networks, Inc. All rights reserved