A-to-Z Design Guide for the All-Wireless Workplace

Transcription

1 A-to-Z Design Guide for the All-Wireless Workplace Partha Narasimhan, Michael Wong March

2 #nomorephones 2 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

3 Wireless Devices Wireless Devices n / ac Wireless NIC driver updates Roaming behavior 11r, 11k, 11v capabilities 3 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

4 Wireless Office Requirements RF Aruba Solution Exchange Wireless Office Requirements High Availability Visibility Broadcast Suppression 4 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

5 RF Considerations ARM Channel / TX Power ClientMatch Band-Steering Spectrum Load-Balancing Sticky Client Moves Voice Aware.11v BSS transition Data Rates Remove lower rates Channel Width 20 / 40 / 80 / 160 MHz 5 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

6 ASE RF Solution Task-Oriented Configuration for RF Optimization 6 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

7 ASE RF Solution Generated Configuration can be pasted to controller 7 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

8 High Availability / 8

9 Controller High Availability Client State Sync AP Fast Failover VRRP Client State Info is shared by a pair of controller 2048 APs: under a second Transition Content ESSID stays up AP builds a primary tunnel and a standby tunnel 512 APs: ~9 sec Ensures that AP always have a controller available LMS / Backup LMS 512 APs: ~1min 20 9 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

10 Client State Sync 1. Client successfully authenticates and generates Key and PMK-SA (Role, VLAN) 2. Client info are synced between the controller pair 3. AP standby tunnel becomes active upon controller failure 4. Client is deauth and when it reconnects, it performs a 4-way key exchange Does not require full authentication to radius servers 5. Controller deployed in Active / Active Model Transition Content Active GRE X Local Master Standby GRE Active / Active Deployment Authentication Servers 10 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

11 Generated Configuration from ASE 11 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

12 Broadcast / Multicast 12

13 Wireless Requirements Design Criteria Mobility Mobile device don t disconnect and do not understand VLANs User are not physically constraint to space RF coverage Boundaries are less obvious Decisions, Decisions Single VLAN or VLAN Pool? How large should the broadcast domain be? L2 Mobility IP Mobility IPv6 Clients 13 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

14 Broadcast Domain Controlling broadcast propagation is important to reduce the amount of overhead Wired Network Broadcast Control with VLAN segmentation Physically Constraint (per floor) Finite number of ports 14 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

15 Problem: WLAN Broadcast Flow VLAN Unicast Frame Broadcast / Multicast Frame Unicast frames Unique for each client Broadcast / Multicast frames Clients connecting to same BSS (AP) use the same key Broadcast / multicast traffic is unnecessary flooded 15 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

16 Problem: Multiple VLANs Unicast Frame VLAN 10 VLAN 20 Broadcast / Multicast Frame Unicast frames Unique for each client Broadcast / Multicast frames Clients connecting to same BSS (AP) use the same key Clients can see broadcast / multicast from other VLANs 16 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

17 AOS Broadcast / Multicast Control broadcast-filter all Packets allowed if: Packets originating from the wired side with destination range of A station has subscribed to a multicast group broadcast-filter arp ARP will be flooded on the wired side and sent as unicast frame if there is a match in the user table DHCP converted to unicast IPv6 NS is treated in a similar fashion Transition Content Duplicate Address Detection Gratuitous ARP IPv6 DAD Enable IGMP snooping / MLD Learn IGMP membership Prune multicast flows if there are no subscribers Broadcast / Multicast Controls If DMO is enabled, multicast packets will be sent as CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

18 ARP Packet Flow Example (with broadcast control) VLAN ARP Unicast Frame Sta A: Who has IP ? Sta B: IP Broadcast / Multicast Frame Sta C: Unicast frames encrypted with PTK Unique for each client Broadcast / Multicast frames are not flooded ARP packet sent only to matching client entry in user table ARP packet from Client A is sent to Client B as unicast Client C does not get ARP packet 18 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

19 Bonjour and SSDP in the Enterprise Enable Airgroup to handle Zero Configuration Networking Multicast (Bonjour and SSDP) large campus without affecting Wi-Fi performance Well-known address for mdns is Well-known address for SSDP is CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

20 VLAN Pooling When should VLAN pool be used? Provide additional address space for non-contiguous Higher chance if public IP address is being used All VLANs in the pool should be the same size Controller will automatically convert IPv6 RAs to unicast Conversion of RAs to unicast is necessary to prevent client from getting address in wrong IPv6 prefix Unicast traffic may negatively affect battery life 20 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

21 Summary Keep it simple, use a single VLAN The cost of managing broadcast / multicast domain for multiple VLANs is expensive Use Airgroup to manage Bonjour (AirPlay) and SSDP (Chromecast / DLNA) behavior Avoid potential client misbehavior L2 Domain should match a contiguous RF footprint With Mobility, devices are not constraint to a physical space 21 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

22 Things to Keep in Mind Single VLAN can put additional requirements to uplink router Router should be able to handle large ARP table DHCP server scalability / redundancy 22 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

23 23

24 Voice / UCC Visibility Real time correlation between Call Quality and Wi-Fi Quality Lync SDN 2.1 additional session info provided 24 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

25 AppRF 25 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

26 Aruba Solution Exchange (ASE) Aruba Solution Exchange (ASE) Benefits Generate dynamic configuration Reduce time to make use of configuration Solution validates user input 26 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

27 ASE FAQ Who can access ASE? Customer, Partners, Airhead Social Users Is there a cost? ASE is free Documentation How can I get notification when a solution is updated? Follow the solution! 27 CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

28 Before You Go Give feedback! Sign up, save $200! atmosphere 2016 arubanetworks.com/atmosphere CONFIDENTIAL Copyright Aruba Networks, Inc. All rights reserved

29 @ArubaNetworks 29

30 THANK 30