Branch Office Wireless LAN Design

Transcription

1

2 Branch Office Wireless LAN Design Rajat Tayal (Technical Marketing Engineer)

3 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot# 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

4 Agenda Wireless Controller and Access Point Portfolio Branch Deployment Options Evaluate FlexConnect Requirements and identify need for FlexConnect & AP Groups Design a Resilient, Secure, and BYOD enabled Branch Network Service-Ready Branch Provision and Operate Wireless Branch over WAN Deploying Small and medium branches using Cisco Mobility Express 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

5 DNA ready Wireless Controller Portfolio Large Enterprise Mid-size Enterprise Small Network Cisco vwlc 3000 APs Clients Flexconnect mode Cisco APs 64,000 clients 40 Gbps Mobility Express 50 APs/1000 Clients AP 18xx 100 AP/2000 Clients: AP2/3K Cisco APs 3000 Clients 4 Gbps Cisco APs 20,000 Clients 20 Gbps Up to 100 APs Up to 3000 APs Up to 6000 APs 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

6 Designed to be DNA Ready Industry s Most Comprehensive Indoor AP Portfolio: Enterprise Class Mission Critical Best in Class Indoor / High-powered Indoor Wall Plate / Teleworker 2x2:2SS 80 MHz 867 Mbps Performance Tx Beam Forming Integrated BLE Gateway 1 Max Transmit Power (dbm) per local regulations 2 3 GE Local Ports, including 1 PoE out 3 Local ports 802.1x ready 3 USB x3:2SS 80MHz 867 Mbps Performance Tx Beam Forming 1 GE Port Uplink USB 2.0 4x4:3SS 80Mhz 1.7 Gbps Performance Internal or External Antenna Tx Beam Forming 2 GE Ports Uplink USB 2.0 4x4:3SS 160 MHz 5 Gbps Performance 2.4 and 5GHz or Dual 5GHz 2 GE Ports Uplink CleanAir and ClientLink Internal or External Antenna Smart Antenna Connector USB 2.0 4x4:3SS 160 MHz 5 Gbps Performance 2.4 and 5GHz or Dual 5GHz 2 GE Ports Uplink or 1 GE + 1 mgig (5G) CleanAir and ClientLink StadiumVision Internal or External Antenna Smart Antenna Connector USB 2.0 Investment Proof Modularity DNA Ready RF Excellence CMX Centralized, FlexConnect or Mobility Express Dual 5 GHz Flexible Radio HDX Future Proof 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

7 Designed to be DNA Ready Industry s Most Comprehensive Outdoor AP Portfolio: New* ac Wave 2, MU-MIMO 2x2:2, 80MHz, 867 Mbps Ultra low profile Internal antenna only PoE (802.3af) power Centralized, FlexConnect, Mesh and Mobility Express ac Wave 2, MU-MIMO 3x3:3, 80MHz, 1.3Gbps (I) 2x2:2, 80MHz, 867Mbps (E/D) Internal or External antenna model (I/E) Internal directional antenna model (D) SFP Flexible Antenna Ports CleanAir and ClientLink Centralized, FlexConnect, Mesh and Mobility Express ac Wave 1 4x4:3 80 MHz; 1.3 Gbps External antenna model (EAC) Cable Modem model (IC/EC) SFP/GPS PoE Out 802.3at (Ext Ant. only) Flexible Antenna Ports CleanAir and ClientLink Modularity (Ext Ant. only) Centralized, FlexConnect and Mesh Cable Modem Version Only (IC/EC) DOCSIS 3.0, 24x8 Internal or External antenna DNA Ready RF Excellence CMX ac Wave Cisco and/or its affiliates. All rights reserved. Cisco Public

8 Unified Access: One Architecture, Multiple Deployment Options WAN Intranet MOBILITY EXPRESS Branch Single/Multi site networks Low IT footprints Virtual controller function on AP 11ac: 1800/2800/3800 FLEX CONNECT Branch Distributed network Highly scalable Controllers vwlc CENTRALIZED Large Campus Data center hosted controller Distributed enterprises Controllers Prime Infrastructure, Identity Service Engine, Connected Mobile Experiences 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 Unified Access: One Architecture, Multiple Deployment Options WAN Intranet MOBILITY EXPRESS Branch Single/Multi site networks Low IT footprints FLEX CONNECT Branch Distributed network Highly scalable Controllers vwlc Aironet Access Points 11ac Wave2 : 3800/2800/ ac: 3700/2700/ n: 3600/ 2600/ 1600/ 700i/700w CENTRALIZED Large Campus Data center hosted controller Distributed enterprises Controllers Prime Infrastructure, Identity Service Engine, Connected Mobile Experiences 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 8

10 Wireless Branch Deployment FlexConnect Deployment

11 Branch Office with Local WLAN Controller Options Small or Mid-size Branch WLCs WLC 2504, WLC 3504 Advantages Layer-3 roaming within the branch Cookie cutter configuration for every branch site Central Site WAN WLC 2504 WLC 3504 Backup Central Controller CAPWAP WLC 3504 Remote Site A Remote Site B Remote Site C 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 11

12 Branch Office Deployment Central Site FlexConnect Hybrid architecture Single management and control point Data Traffic Switching Centralized Switched Local Switched Traffic Switching is configured per AP and per WLAN (SSID) Standalone Mode will preserve local traffic Centralized Traffic Local Traffic WAN Centralized Traffic Remote Office 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

13 FlexConnect Glossary 01 Connected Mode When FlexConnect AP can reach Controller, it gets help from controller to complete client authentication 02 Standalone Mode When FlexConnect AP cannot reach Controller, it goes into standalone mode and does client authentication by itself 03 Central Switching Data traffic is tunneled back to WLC for an SSID 04 Local Switching Data traffic is switched onto local VLANs for an SSID 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 13

14 Configuring FlexConnect Local Switching

15 Step 1: Configure FlexConnect Mode on AP Enable FlexConnect mode per AP Supported APs: AP-1040, AP-1130, AP-1140, AP-1240, AP-1250, AP-1260, AP-1520, AP-1530, AP-1540, AP-1550, AP-1560, AP-1570, AP-1600, AP-1700, AP-1800, AP-2600, AP-2700, AP-2800, AP-3500, AP-3600, AP-3700, AP Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Step 2: Configure FlexConnect Local Switching on WLAN Only WLAN with FlexConnect Local Switching enabled will allow local switching on the FlexConnect AP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 Step 3: Configure Native VLAN on FlexConnect AP When connecting with Native VLAN on AP, L2 switchport must also match with corresponding Native VLAN configuration VLAN mapping can be performed per AP, per FlexConnect Group on WLC or using Cisco Prime Infrastructure templates 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 17

18 Step 4: Configure FlexConnect WLAN-VLAN Mapping Mapping of WLAN to VLAN can be done per FlexConnect AP or FlexConnect Group Or use Cisco Prime Infrastructure via configuration templates Each corresponding WLAN that is allowed to be locally switch should be allowed on the corresponding switchport Cisco and/or its affiliates. All rights reserved. Cisco Public 18

19 Configure FlexConnect VLAN Mapping Using Cisco Prime Infrastructure Prime Infrastructure provides simplified configuration to all FlexConnect APs with one Lightweight AP Template 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Evaluate FlexConnect Architectural Requirements

21 FlexConnect Design Considerations For Your Reference WAN Limitations Apply Deployment Type WAN Bandwidth (Min) WAN RTT Latency (Max) Max APs per Branch Max Clients per Branch Data 64 kbps 300 ms 5 25 Data 640 kbps 300 ms Data 1.44 Mbps 1 sec Data+Voice 128 kbps 100 ms 5 25 Data+Voice 1.44 Mbps 100 ms Monitor 64 kbps 2 sec 5 N/A Monitor 640 kbps 2 sec 50 N/A It is highly recommended that the minimum bandwidth restriction remains 24 Kbps per AP with the round trip latency no greater than 300 ms for data deployments and 100 ms for data + voice deployments Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 FlexConnect Design Considerations Feature Limitations in Standalone mode and Local Switching MAC/Web Auth in Standalone Mode IPv6 Mobility Service Discovery Gateway Native Profiling and Policy Classification FlexConnect Feature Matrix Feature Matrix for ac Wave 2 Access Points Cisco and/or its affiliates. All rights reserved. Cisco Public 22

23 Why do we need FlexConnect & AP Groups?

24 Understanding AP Groups Overview AP Groups is a logical concept of grouping AP s which deliver similar Wi-Fi services; these services can be: By physical location, and/or By functional services (data, voice, guest, etc..) AP Group 1 Central Site WLC5520 Same AP groups need to be defined in all WLC s of a mobility group Remote Site A WAN Remote Site B Scaling WLC-8540 WLC-5520 WLC-3504 AP Group 3 # AP Groups # WLAN (SSID) # VLAN (Interfaces) AP Group Cisco and/or its affiliates. All rights reserved. Cisco Public 26

25 AP Groups Configuration: Create a New Group 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

26 AP Groups Use Internet Per Location SSID Guest-Access AP Group 1 Central Site Corporate-Voice AP groups give the ability to enable Wi-Fi Services (WLAN) based on physical location Corporate-Data Central Site Corporate-Data, Corporate-Voice, Guest- Access Manufacturing Site Corporate-Data, Corporate-Voice, Scanners Store Corporate-Data, Guest-Access WAN Manufacturing Site Store AP Group 3 Scanners AP Group 2 Corporate-Data Guest-Access Corporate-Data Corporate-Voice 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 28

27 AP Groups Use Case Per AP Group WLAN to VLAN Mapping AP Group 1 Head Office Central Site VLAN-1 AP groups give the ability to statically map Wi-Fi service (WLAN) to VLAN based on physical location VLAN-2 VLAN-3 Users see the same Wi-Fi service on all sites. Admin can monitor and filter based on different IP@ each site Can also be used to have smaller Wi-Fi subnets Corporate-Data For example per floor subnets in a building. AP Group 2 Manufacturing Site Corporate-Data WAN/MAN AP Group 3 Store Corporate-Data 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 29

28 Understanding FlexConnect Groups Overview Central Site WLC5520 FlexConnect groups allow sharing of: CCKM/OKC fast roaming keys Local/backup RADIUS servers IP/keys Local EAP authentication AAA-Override for Local Switching Smart Image Upgrade FlexConnect AVC Remote Site WAN Remote Site Scaling WLC-8540 WLC-5520 WLC-3504 FlexConnect Groups AP per Group FlexConnect Group 1 FlexConnect Group Cisco and/or its affiliates. All rights reserved. Cisco Public 30

29 FlexConnect Groups and CCKM/OKC Keys Overview Central Site CCKM Keys CCKM/OKC keys stored on FlexConnect APs for Layer 2 fast roaming RADIUS Server The FlexConnect APs receives CCKM/OKC keys from WLC If a FlexConnect AP boots up in standalone mode, it will not get the OKC/CCKM keys from the WLC WAN FlexConnect supports r Fast Transition with local key caching FlexConnect Group 1 FlexConnect Group Cisco and/or its affiliates. All rights reserved. Cisco Public 31

30 Designing a Resilient Wireless Branch Network

31 FlexConnect Resiliency - WAN Failure WAN Failure Central Site FlexConnect APs will go to Standalone mode No impact for locally switched SSIDs Disconnection of centrally switched SSIDs clients Static authentication keys are locally stored in FlexConnect AP Lost Features RRM, WIDS, location, other AP modes Web authentication, NAC Remote Site WAN Application Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 36

32 FlexConnect Resiliency - WAN Failure WAN Failure Central Site FlexConnect APs will go to Standalone mode No impact for locally switched SSIDs Disconnection of centrally switched SSIDs clients Static authentication keys are locally stored in FlexConnect AP Lost Features RRM, WIDS, location, other AP modes Web authentication, NAC Remote Site WAN Application Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 36

33 FlexConnect Resiliency N+1 HA Scenario WLC Failure scenario with N+1 HA FlexConnect APs will go to Standalone mode No impact for locally switched SSIDs Disconnection of centrally switched SSIDs clients CCKM roaming allowed in FlexConnect group Secondary WLC Central Site WAN Primary WLC FlexConnect AP will then search for backup WLC; when backup WLC is found, FlexConnect AP will resync with WLC and resume client sessions with central traffic Remote Site Application Server Client sessions with Local Traffic are not impacted during resync with Backup WLC 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

34 FlexConnect Resiliency N+1 HA Scenario WLC Failure scenario with N+1 HA FlexConnect APs will go to Standalone mode No impact for locally switched SSIDs Disconnection of centrally switched SSIDs clients CCKM roaming allowed in FlexConnect group Secondary WLC Central Site WAN Primary WLC FlexConnect AP will then search for backup WLC; when backup WLC is found, FlexConnect AP will resync with WLC and resume client sessions with central traffic Remote Site Application Server Client sessions with Local Traffic are not impacted during resync with Backup WLC 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

35 FlexConnect Resiliency N+1 HA Scenario WLC Failure scenario with N+1 HA FlexConnect APs will go to Standalone mode No impact for locally switched SSIDs Disconnection of centrally switched SSIDs clients CCKM roaming allowed in FlexConnect group Secondary WLC Central Site WAN Primary WLC FlexConnect AP will then search for backup WLC; when backup WLC is found, FlexConnect AP will resync with WLC and resume client sessions with central traffic Remote Site Application Server Client sessions with Local Traffic are not impacted during resync with Backup WLC 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

36 FlexConnect Resiliency N+1 HA Scenario WLC Failure scenario with N+1 HA FlexConnect APs will go to Standalone mode No impact for locally switched SSIDs Disconnection of centrally switched SSIDs clients CCKM roaming allowed in FlexConnect group Secondary WLC Central Site WAN Primary WLC FlexConnect AP will then search for backup WLC; when backup WLC is found, FlexConnect AP will resync with WLC and resume client sessions with central traffic Remote Site Application Server Client sessions with Local Traffic are not impacted during resync with Backup WLC 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

37 FlexConnect Resiliency SSA HA Scenario WLC failure scenario with SSO True Box to box High Availability i.e. 1:1. Sub-second failover to StandBy WLC Configuration(AP database, Client Run state etc.) information on Active is synched to Standby WLC FlexConnect AP will NOT transition to Standalone because SSO kicks in AP will continue to be in Connected mode with the Standby (now Active) WLC Centrally Switched SSID will never go down Central Site WAN Standby Active Application Server Remote Office 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

38 FlexConnect AAA Survivability Local Backup RADIUS Local Backup RADIUS Central Site Normal authentication is done centrally Central RADIUS On WAN failure, AP goes to Standalone mode and authenticates new clients with locally defined RADIUS server Existing connected clients stay connected Clients can roam with CCKM fast roaming, or Re-authentication Local Backup RADIUS Remote Site WAN 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

39 FlexConnect AAA Survivability Local Backup RADIUS Local Backup RADIUS Central Site Normal authentication is done centrally Central RADIUS On WAN failure, AP goes to Standalone mode and authenticates new clients with locally defined RADIUS server Existing connected clients stay connected Clients can roam with CCKM fast roaming, or Re-authentication Local Backup RADIUS Remote Site WAN 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

40 FlexConnect AAA Survivability Local Backup RADIUS Local Backup RADIUS Central Site Normal authentication is done centrally Central RADIUS On WAN failure, AP goes to Standalone mode and authenticates new clients with locally defined RADIUS server Existing connected clients stay connected Clients can roam with CCKM fast roaming, or Re-authentication Local Backup RADIUS Remote Site WAN CCKM Fast Roaming 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 43

41 FlexConnect - Local Authentication Central Site Local Authentication Central RADIUS By default FlexConnect AP authenticates clients through central controller Local Authentication allow use of local RADIUS server directly from the FlexConnect AP even when WAN is UP Local RADIUS WAN Remote Site FlexConnect Group 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 47

42 FlexConnect - Local Authentication Configuration 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

43 FlexConnect Group: Local EAP Authentication Local Backup Authentication Normal authentication is done centrally On WAN failure, AP authenticates new clients with its local database Each FlexConnect AP has a copy of the local user DB Existing authenticated clients stay connected Central RADIUS WAN Central Site Clients can roam with: CCKM fast roaming, or Local re-authentication Supported Security Types Release Version LEAP 6.0 EAP-FAST 6.0 PEAP 7.5 EAP-TLS 7.5 Remote Site FlexConnect Group Cisco and/or its affiliates. All rights reserved. Cisco Public 49

44 FlexConnect Group: Local EAP Authentication Local Backup Authentication Normal authentication is done centrally On WAN failure, AP authenticates new clients with its local database Each FlexConnect AP has a copy of the local user DB Existing authenticated clients stay connected Central RADIUS WAN Central Site Clients can roam with: CCKM fast roaming, or Local re-authentication Supported Security Types Release Version LEAP 6.0 EAP-FAST 6.0 PEAP 7.5 EAP-TLS 7.5 Remote Site FlexConnect Group Cisco and/or its affiliates. All rights reserved. Cisco Public 49

45 FlexConnect Group: Local EAP Authentication Local Backup Authentication Normal authentication is done centrally On WAN failure, AP authenticates new clients with its local database Each FlexConnect AP has a copy of the local user DB Existing authenticated clients stay connected Central RADIUS WAN Central Site Clients can roam with: CCKM fast roaming, or Local re-authentication Supported Security Types Release Version LEAP 6.0 EAP-FAST 6.0 PEAP 7.5 EAP-TLS 7.5 Remote Site CCKM Fast Roaming FlexConnect Group Cisco and/or its affiliates. All rights reserved. Cisco Public 49

46 FlexConnect Group: Local EAP Authentication Configuration Define users (max 100) and passwords Select supported Security protocols i.e. LEAP, EAP-FAST, PEAP or EAP-TLS Cisco and/or its affiliates. All rights reserved. Cisco Public 52

47 Designing Secure & BYOD Enabled Branch Network

48 FlexConnect Peer-to-peer Blocking

49 Local Switching Peer-to-peer Blocking Starting from 7.2 Central Site Overview Support for Peer-to-Peer blocking in FlexConnect AP Apply for clients on same FlexConnect AP P2P blocking modes : disable or drop For P2P blocking inter-ap use ACL Remote Site WAN Application Server Standalone mode support 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 55

50 FlexConnect AAA VLAN & QoS Override

51 FlexConnect AAA VLAN Override Starting from 7.2 Description RADIUS Central Site AAA VLAN Override with local or central authentication Up to 16 VLANs per FlexConnect AP VLAN ID must be enabled per AP or FlexConnect Group Application Server WAN Remote Site FlexConnect Group 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

52 FlexConnect AAA VLAN Override Starting from 7.2 Description RADIUS Central Site AAA VLAN Override with local or central authentication Up to 16 VLANs per FlexConnect AP VLAN ID must be enabled per AP or FlexConnect Group Application Server WAN Remote Site VLAN 3 QoS = Silver FlexConnect Group 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

53 FlexConnect AAA VLAN Override Starting from 7.2 Description RADIUS Central Site AAA VLAN Override with local or central authentication Up to 16 VLANs per FlexConnect AP VLAN ID must be enabled per AP or FlexConnect Group Application Server WAN Remote Site VLAN 3 QoS = Silver VLAN 7 QoS = Platinum FlexConnect Group 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 58

54 FlexConnect AAA VLAN Override For Your Reference Configuration IETF 65 IETF 64 IETF 81 WAN ISE Create Sub-Interface on FlexConnect AP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 61

55 VLAN Based Central Switching Central VLAN 3 Go to Default VLAN ID Overview Central RADIUS While doing AAA VLAN Override with local switching: If VLAN ID does not exist at the AP, the traffic is central switched to the central VLAN ID VLAN 3 VLAN 7 WAN VLAN 7 does not Exist on this WLC If the central VLAN ID does not exist, the traffic is centrally switched to the default VLAN ID of the WLAN Remote Site VLAN 3 does not Exist on this AP VLAN 7 does not Exist on this AP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 62

56 FlexConnect AAA QoS Override Starting from 7.5 Description Dynamically assign QoS levels and/or bandwidth contracts for local switching, centrally authenticated WLANs Web-authenticated WLANs and 802.1Xauthenticated WLANs supported Order of precedence for Rate Limiting parameters AAA override QoS Profile of AAA override Local WLAN configuration QoS Profile of local WLAN configuration Vendor ID/Vendor Type Attribute [14179\002] Aire-QoS-Level [14179\004] Aire-802.1P-Tag [14179\007] Aire-Data-Bandwidth-Average- Contract [14179\008] Aire-Real-Time-Bandwidth- Average-Contract [14179\009] Aire-Data-Bandwidth-Burst- Contract [14179\0010] Aire-Real-Time-Bandwidth- Burst-Contract 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 63

57 AAA Override Deployment Scenario Problem Statement Map clients to specific vlans based on their function Central Site VLAN 20 WAN Application Server Function VLAN ID Engineering 11 Marketing 21 Function VLAN ID Sales 31 Engineering 10 Marketing 20 Sales 30 Remote Site A Application Server Remote Site B VLAN 20 does not exist 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 64

58 VLAN Name Mapping at FlexConnect Group Starting from 8.1 Central Site WAN Remote Site A VLAN ID Remote Site B VLAN ID Cisco and/or its affiliates. All rights reserved. Cisco Public 65

59 VLAN Name Mapping at FlexConnect Group Starting from 8.1 Flex Group A VLAN Name Engineering 10 Marketing 20 Sales 30.. VLAN ID HR 160 Central Site WAN Remote Site A VLAN ID Remote Site B VLAN ID Cisco and/or its affiliates. All rights reserved. Cisco Public 65

60 VLAN Name Mapping at FlexConnect Group Starting from 8.1 Central Site WAN VLAN Name Engineering 10 Marketing 20 Sales 30 VLAN ID Remote Site A VLAN ID Remote Site B VLAN ID Cisco and/or its affiliates. All rights reserved. Cisco Public 65

61 VLAN Name Mapping at FlexConnect Group Starting from 8.1 Central Site WAN Flex Group B VLAN Name Engineering 11 Marketing 21 Sales 31.. VLAN ID HR 161 VLAN Name Engineering 10 Marketing 20 Sales 30 VLAN ID Remote Site A VLAN ID Remote Site B VLAN ID Cisco and/or its affiliates. All rights reserved. Cisco Public 65

62 VLAN Name Mapping at FlexConnect Group Starting from 8.1 Central Site WAN VLAN Name Engineering 10 Marketing 20 Sales 30 VLAN ID Remote Site A VLAN ID Remote Site B VLAN ID VLAN Name Engineering 11 Marketing 21 Sales 31 VLAN ID 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 65

63 VLAN Name AAA Override - Solution Starting from 8.1 Aire-Interface-Name or IETF Tunnel-Private-Group-ID Central Site VLAN NAME= Marketing WAN Application Server Remote Site Remote Site VLAN Name VLAN ID VLAN Name VLAN ID Engineering 10 Marketing 20 VLAN 20 Engineering 11 Marketing 21 Sales 31 Sales 30 Remote Site A VLAN 21 Remote Site B 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

64 FlexConnect ACL VLAN Mapping & Per- Client ACL

65 FlexConnect ACL VLAN Mapping Starting from 7.2 Overview FlexConnects ACL are applied per VLAN FlexConnect ACL are Ingress / Egress oriented Starting from 7.5 FlexConnect ACL support AAA-returned Client ACL ACL Scale 512 FlexConnect ACL per WLC 16 ingress ACL per AP 16 egress ACL per AP 64 ACL rules per ACL No IPv6 ACL WAN Remote Site Central Site Application Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 72

66 FlexConnect Access Lists Configuration Create FlexConnect ACL FlexConnect ACL rule creation is similar to rule creation for Local Mode AP Cisco and/or its affiliates. All rights reserved. Cisco Public 73

67 FlexConnect ACL VLAN Mapping Configuration FlexConnect ACL per AP FlexConnect ACL can be applied per AP using VLAN Mappings configuration Cisco and/or its affiliates. All rights reserved. Cisco Public 74

68 FlexConnect ACL VLAN Mapping Configuration FlexConnect ACL per FlexConnect Group FlexConnect ACL can be applied per FlexConnect Groups per VLAN in the ACL Mapping tab Cisco and/or its affiliates. All rights reserved. Cisco Public 75

69 FlexConnect Split Tunneling (Using FlexConnect Split ACL)

70 FlexConnect ACL Split Tunneling Starting from 7.3 Overview Split tunneling allow some traffic to be locally switched although the WLAN is defined as centrally switched Split tunneling is using a NAT/PAT feature with ACL to perform the local switching Split tunneling is using the AP for the NAT/PAT feature FlexConnect AP CAPWAP WLC Central Traffic NAT/PAT ACL WAN Central Server Local Traffic Local Printer 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 77

71 FlexConnect ACL Split Tunneling Configuration Create a centrally switched WLAN Flex Local switching should not be checked Define Flex ACL to match traffic to be locally switched Central subnet Local subnet 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 78

72 FlexConnect ACL Split Tunneling Configuration Per Access Point 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 79

73 FlexConnect ACL Split Tunneling Configuration Per FlexConnect Group 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 80

74 Deploying BYOD with FlexConnect Local Switching (Using FlexConnect WebPolicies ACL)

75 Bring Your Own Device(s) : The New Normal 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 82

76 BYOD - Device On-boarding in FlexConnect Example: Apple ios Device Provisioning 1 Initial Connection Using PEAP WLC ISE CA-Server 2 Device Provisioning Wizard Client Reconnects 3 Future Connections using EAP-TLS WLC ISE CA-Server 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 83

77 Deploying BYOD with FlexConnect Wireless Summary 802.1x/EAP Authentication ISE FlexConnect AP CAPWAP WLC DHCP Server WAN Web Server WiFi Association 802.1x/EAP Request Inside CAPWAP URL + ACL Redirect Inside CAPWAP 802.1x/EAP Response Inside CAPWAP Radius Access-Request Radius Access-Response Access-Type: Access-Accept URL-Redirect-ACL=FlexACLWebPolicy, URL-Redirect= ) Unknown Device, Redirect to registration 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 88

78 Deploying BYOD with FlexConnect Wireless Summary DHCP Request ISE FlexConnect AP CAPWAP WLC DHCP Server WAN Web Server DHCP Request Inside CAPWAP DHCP Lease RADIUS-Accounting host-name=myipad dhcp-class-identifier=apple Device is an ipad Inside CAPWAP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 89

79 Deploying BYOD with FlexConnect Wireless Summary URL-Redirect ISE FlexConnect AP CAPWAP WLC DHCP Server WAN Web Server HTTP Request HTTP Request Redirected to WLC by AP URL-Redirect Inside CAPWAP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 90

80 Deploying BYOD with FlexConnect Wireless Summary Registration & Provisioning ISE FlexConnect AP CAPWAP WLC DHCP Server WAN Web Server Device Registration & Provisioning Device is Registrered Trigger Change-of-Auth EAP DeAuthentication EAP Authentication RADIUS Change-of-Authorization 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 91

81 Deploying BYOD with FlexConnect Wireless Summary Device Access ISE FlexConnect AP CAPWAP WLC DHCP Server WAN Web Server 802.1x/EAP Request/Response Inside CAPWAP Radius Access-Request Radius Access-Response Device is Registrered And Provisioned Allow Access DHCP Request/Response Inside CAPWAP Web Traffic 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 92

82 - Summary of FlexConnect ACLs VLAN-ACL Applied on the interface of the FlexConnect AP AAA returned Client ACL Applied on the interface of the AP Split Tunnel ACL Allow some traffic to be locally switched 93 Web Policies ACL BYOD with FlexConnect 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 93

83 Service-Ready Branch

84 FlexConnect VideoStream

85 Video Multicast Delivery Challenges Technical Challenges Multicast packets (UDP) are sent as broadcast packets over the air per standard Broadcast packets do not use error correction: fire and forget Broadcast packets are sent at data rate mandatory to all clients connected to the WLAN 1 Mb for B/G (400K actual) 6 Mb for A (2.7 Mb actual) Video Server B/G N Default B/G mandatory data rates Data Rates M0 M1... M14 M15 Video Impact Choppy, Unreliable Video Video Stream does not utilize n/ac High Throughput data rates Heavy utilization of channel due to high rate of very slow packets Video delivery is not reliable causing poor Quality of Experience 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 98

86 Video Multicast Delivery Solution Starting from 8.0 Technical Solution Data Rates Video Impact IGMP state monitored for each client. Only send video to clients requesting Sent as unicast to individual clients at their data rate B/G Multicast packets replicated at AP Video Server N M0 M1... M14 M15 Smooth, Reliable Video delivered to multiple clients Quality of Video protected in varying channel load conditions Prioritizes Business Video (QoS Gold) over other video ( Best-effort ) Default B/G mandatory data rates 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 99

87 FlexConnect Application Visibility and Control

88 How AVC solution works on wireless? AireOS 8.1 App Visibility & User Experience Report AireOS 8.1 App BW Transaction Time Static Netflow WebEx 3 Mb 150 ms Citrix 10 Mb 500 ms AP NBAR on AP Deep Packet Inspection Perf. Collection & Exporting Visibility and User Experience Control DPI engine (NBAR2) identifies applications using L7 signatures AP collects application info and export it to controller/switch every 90 seconds Advanced reporting tool aggregates and reports application performance Use QoS to control application bandwidth usage to improve application performance 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 110

89 AVC on FlexConnect APs Katana Gen2 AP, NBAR Engine 23, PP 14 Stateful context transfer on roam BRANCH Gen2 AP Netflow Export from AP to WLC WAN Real-time information for last 90 seconds Flow ID App Name Packets 1 WebEx Msft-Lync Skype 660 Deployment Type WAN Bandwidth ( Min) WAN RTT Latency(Max) Max Aps per Branch Max Clients per Branch Data + Flex AVC 75 Kbps 300 msec Cisco and/or its affiliates. All rights reserved. Cisco Public 111

90 Monitoring AVC Statistics per FlexConnect Group Per Client AVC Statistics Per FlexConnect Group AVC Statistics 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 117

91 Operating the Wireless Branch

92 Branch Office Provisioning

93 Network Plug-N-Play Simple, Secure, Scalable Ships equipment Installer Reseller/Partner Site-1 Today s Process Central Staging Facility Network Admin Site-2 Install OS Install Config Prime device Site-3 Installer 2 Business Network Challenges Direct Costs Shipping after Configuring device Pre Provision Travel Projects/Sites costs for IT installer 1 Network Admin Complexity Config errors Different products / processes Install & Power-on devices Security Site(s) 3 3 rd party not secure Time/Productivity Monitor device installation Network Admin Manual process Shipping, Storage, Travel 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 120

94 Network Plug & Play Discovery options DHCP Server 01 DHCP Option 43 PnP String: 5A1D;B2;K4;I ;J80 DNS Server 02 DNS Lookup pnpserver.localdomain ---- e.g (PnP Server) CAPWAP 03 CAPWAP CAPWAP based WLC discovery for AP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 121

95 Branch Provisioning with PnP Server PID Serial # Hostname WLC IP address AP Mode Flex Group name AIR-CAP3702I- A-K9 RFD0PP2 T025 AP-Store FlexConnect FlexGrp1 PnP Server Places AP in appropriate flexgroup/default Apply relevant flex configs to AP Day 0 Network Admin Network Admin pre provisions branch APs in PnP server. WLC IP (Prim/Sec/Ter) AP Name AP Mode (Flex) AP Group Name Flex Group Name Installer Day 1 Remote Installer on branch Mount and cable devices Power-on * Resources required for PnP: 64 Gb RAM, 500 Gb Storage Scale: 10,000 devices 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 122

96 Branch Office Upgrade over WAN

97 Upgrading a FlexConnect Deployment Concerns Sites using FlexConnect AP are usually sites with low WAN bandwidth Each site may have small number of AP, but an enterprise may have a lot of branches Upgrading ~6000 AP through a low bandwidth WAN is a challenge : Time needed to download all the AP firmware Exhaust of the WAN link Risk of failures during the download Goal is to minimize downloads over WAN 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 124

98 FlexConnect Smart AP Image Upgrade Starting from 7.2 Firmware Image Overview Smart AP Image Upgrade use a «master» AP in each FlexConnect Group to download the code. Other FlexConnect AP download the code from the master locally New Cisco Prime Central Site Old New Primary New Old Secondary Wireless LAN Controller 1. Download WLC upgraded firmware (will become primary) 2. Force the «boot image» to be the secondary (and not the newly upgraded one) to avoid parallel download of all AP in case of unexpected WLC reboot 3. WLC elects a master AP in each FlexConnect Group (can be also set manually) Remote Site-1 WAN Remote Site-N Master AP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 125

99 FlexConnect Smart AP Image Upgrade Description (Contd.) 4. Master AP «Pre-download» the AP firmware in the secondary «boot image» (will not disrupt the actual service) Can be started group per group to limit WAN exhaust 5. Slave AP «Pre-download» the AP firmware from the Master AP 6. Change the «boot image» of the WLC to the new image 7. Reboot the controller AP Firmware Image Remote Site-1 Old Primary New Secondary Cisco Prime Old Primary WAN Central Site AP Firmware Image New Secondary Firmware Image New Old Primary New Old Secondary Wireless LAN Controller Remote Site-N Master AP 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 126

100 Bringing All Together FlexConnect Best Practices

101 FLEX CONNECT FlexConnect Best Practices Enable FlexConnect Groups CCKM/OKC Key sharing for Voice deployments Enable Smart AP Image Upgrade Design for Resiliency VLAN Support and configure Native VLAN at Group VLAN-WLAN Mappings at FlexConnect Group Level VLAN Name override Consistent configuration across Primary and Backup WLCs 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 130

102 Wireless Branch Deployment Cisco Mobility Express

103 Cisco Mobility Express: Simple by Design Controller Function embedded into the access point Runs WLAN Controller on access point Investment Protection - Add controller without changing Access Point Mobile app/webui/pnp to configure up to 100 access points Best Practices activated by default Simple UI monitors, manages and troubleshoots your network Simple, Fast IT Flexible Enterprise Class 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 133

104 Cisco Mobility Express: Access Point Support AIR-AP1815I/M-x-K9C AIR-AP1852-x-K9C AIR-AP3800-x-K9C AIR-AP1562-x-K9C AIR-AP1815w-x-K9C AIR-AP1832-x-K9C AIR-AP2800-x-K9C AIR-AP1542-x-K9C Cisco and/or its affiliates. All rights reserved. Cisco Public 134

105 Mobility Express WLAN Deployment Branch solution for small, medium or distributed enterprise DNA Center Small/Medium Office Policy Automation Assurance Security ISE CMX Distributed Enterprise Mobility Express Mobility Express Controller Based 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 135

106 Positioning Cisco Mobility Express K-12 Education Hospitality Retail Small/Midsize offices Use innovative learning tools and bring a largeschool experience to smaller sites Connect to customers through loyalty applications and offer revenue-generating services Accept mobile payments and offer your services to customers everywhere Provide robust Wifi to employees along with guest access. Same experience as bigger office DNA ready for Small to Medium size, Single or Multi site deployments 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 136

107 Branch Site with Cisco Mobility Express Overview Network Plug and Play Prime Infrastructure ISE Central Site Mobility Express is based on FlexConnect Architecture Supports Central Authentication, Local Switching PnP, ISE, and Cisco Prime at Central Site Advantages WAN Cookie cutter configuration for every site Independent or centralized manageability of each site Site A Site B Site C 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 137

108 Deploying Cisco Mobility Express Depending on the deployment, Mobility Express capable Access Points can be connected to an access port or a trunk port on the switch. Management traffic is always untagged. VLAN 10 v20 v30 v40 VLAN 10 VLAN 20 VLAN 30 VLAN 40 v10 v10 Contractor Guest Employee v10 If Access Points and WLANs are all on the same network, Mobility Express capable Access Points can connect to an access port on the switch port. v10 Contractor Employee Guest v10 If Access Points and WLANs are all on different VLANs, Mobility Express capable Access Points will connect to a trunk port on the switch and traffic for individual WLANs will be switched locally on to local VLANs Cisco and/or its affiliates. All rights reserved. Cisco Public 138

109 Deployment methods for Cisco Mobility Express 01 OTAP Over-the-Air-Provisioning 02 Command Line Interface Setup Wizard using CLI 03 Network Plug and Play Using APIC/Network Plug and Play 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 139

110 Over the Air Provisioning Cisco Wireless App Provision Monitor Laptop 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 140

111 Setup Wizard CREATE ADMIN ACCOUNT SET UP YOUR CONTROLLER CREATE WIRELESS NETWORK CONFIRM SETTINGS 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 141

112 Deploying using APIC-EM/Network Plug and Play 01 Private Cloud APIC-EM controller can be reached by Mobility Express Access Point in customer premises. Access Point can then download the controller configuration file from Network Plug and Play service. 02 Cisco Cloud Redirect Cloud based redirecting service which redirects Mobility Express Access Point to an APIC-EM controller residing in customer premises. These APs can download the controller configuration file from Network Plug and Play app service Cisco and/or its affiliates. All rights reserved. Cisco Public 142

113 Network Plug and Play Private Cloud ip dhcp pool pnp_device_pool network default-router option 43 ascii "5A1N;B2;K4;I ;J80" Master AP running PnP Agent LAN/WAN LAN PnP Server PnP Server uses self signed SSL certificate DHCP Request DHCP response with APIC-EM IP address in DHCP option 43 PnP Agent initiates HTTP communication with the PnP and sends the device UDI PnP Agent installs local trustpoint for the server SSL certificate PnP Agent initiates HTTPS communication with the server and sends the device UDI Master AP reboots and will run the controller configuration after it comes back up HTTP PnP work request with device serial number (UDI) HTTPS PnP work request with device serial number (UDI) PnP Server receives UDI and sends server SSL certificate over HTTP PnP Server receives UDI and sends ME controller configuration over HTTPS 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 143

114 Cisco Mobility Express Features

115 Evolution of Cisco Mobility Express MAR, 2017 AireOS 8.4 JUL, 2017 AireOS 8.5 DEC, 2017 AireOS 8.6 FEB, 2016 AireOS 8.3 MR1 AUG, 2016 AireOS 8.3 SEP, 2015 AireOS 8.1 MR2 DEC, 2015 AireOS 8.2 Setup Wizard via CLI Software Update HTTP NTP Pool support Support on 2800 & 3800 Internal DHCP server support Software Update cisco.com CMX Cloud Support SNMPv3 Support Serviceability improvements Site Survey Support on 1562 AP Scale -100 APs/2000 clients Day 0 using PnP Application Control Support for Apple Features Guest WLAN Enhancements MAC Filtering Lobby Ambassador Expert View Conversion Support in UI Support for Fastlane in UI TACACS+ and RADIUS Support ACL Enhancements Configuring External Antennas CALEA Passpoint Centralized NAT AP Groups RF Profiles 802.1x on Access Points AP Global Credentials Preferred Master Save Configuration Notification TLS Secure Tunnel 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 146

116 WLAN Support Supports maximum of 16 WLANs. WLAN Options: Open WPA2 Personal WPA2 Enterprise (External RADIUS, AP) NOTE : AP indicates Master AP and the authentication is done by the Controller. For Guest WLANs, a number of capabilities are supported: CMX Guest Connect Internal Splash Page External Splash Page For Internal and External Splash Page, a number of Access Types are supported. They are as follows: Local User Account Web Consent Address RADIUS WPA2 Personal 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 147

117 Application Visibility and Control Cisco Mobility Express can identify signatures of applications. It runs NBAR Engine 2 and Protocol Pack 14 As part of control action, applications can be: Drop Rate Limit Mark For Mark, one can select DSCP as Platinum, Gold, Silver, Bronze or Custom. If custom is selected, one has to specific he DSCP value. For Rate Limit, one can specify the Average Rate and Burst Rate for the application. Simplified workflow to create AVC profile and apply it to WLAN 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 148

118 Site Survey Cisco Mobility Express supports internal DHCP server and operates without a pingable gateway. This enables Site Surveyor to take the Access Point powered by a Battery Pack and a client device to perform an active survey. For Site Survey, one must configure the controller. This can be done via CLI or UI. NOTE: Recommendation is to use Release 8.4 or later on the Mobility Express AP for Site Survey Cisco and/or its affiliates. All rights reserved. Cisco Public 149

119 Cisco Mobility Express Software Update

120 Software Update Transfer Modes 01 TFTP Requires external TFTP server to be configured with AP images 02 HTTP Local AP image file upload. Works if all Access Points are the same type Cisco.com SFTP(Release 8.7) Update directly from cisco.com. Requires SmartNet contract on Master AP and valid cisco.com account Recommended option for s/w updates over WAN. Requires external SFTP with AP images 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 152

121 Software Update Methods TFTP HTTP Cisco.com Requires external TFTP server to be configured with AP images Local AP image file upload. Works if all Access Points are the same type Update directly from cisco.com. Requires SmartNet contract on Master AP and valid cisco.com account 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 153

122 Cisco Mobility Express HA - Master Election

123 Mobility Express Failure of Access Point running the controller function Controller and APs in the same L2 broadcast domain. Based on FlexConnect architecture. Master election is based on set of priorities. Uses VRRP. HA considerations: No impact for connected clients on locally switched SSIDs Fast roaming allowed within FlexConnect group for already connected clients What about new clients? Static keys are locally stored in FlexConnect AP: new clients can join if authentication is PSK Lost features RRM, CleanAir Web authentication 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 155

124 Master Election Overview Master Election is a mechanism to elect a new Cisco Mobility Express CAPABLE Access Point to run the controller function incase of a failure CAPABLE means AP Image type is MOBILITY EXPRESS IMAGE and AP Configuration is MOBILITY EXPRESS CAPABLE To have redundancy, you must have two or more Mobility Express capable Access Points in your network VRRP is used to detect the failure of Master AP which initiates the election of a new Master. Failover typically takes 60-90s. Master Election is based on priorities 1. User Defined a. User Defined Master b. Next Preferred Master 2. Automatic a. Most Capable Access Point b. Least Client Load c. Lowest MAC Address 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 156

125 Master Election Process AIR-AP1852I-B-K9 Most capable Access Point vs AIR-AP2802I-B-K9 P P AIR-AP1852I-B-K9 AIR-AP1852I-B-K9 AIR-AP3802I-B-K9 AIR-AP1852I-B-K9 Least Client Load P MASTER AP Lowest MAC address AIR-AP13702I-B-K9 AIR-AP3702E-B-K9 AIR-AP2702I-B-K Cisco and/or its affiliates. All rights reserved. Cisco Public 159

126 Cisco Mobility Express Branch Solution for Appliance-less WLC-Based Networks for up to 100 APs Ease of Deployment with Scale Manage up to 100 access points, 2000 clients Best practices on by default Management simplicity with mobile app Day0 PnP with config & image download AVC & CMX Cloud Understand what is running on your network Bidirectional rate limit per WLAN/SSID/Client Engage with Guests via Wi-Fi Onboarding Presence Analytics Apple & Cisco Features Optimized Wi-fi connectivity Priority for business critical applications MSP & Multi-site Deployment BYOD integration RLAN support Walled Garden support New software download SFTP 802.1x support on AP with EAP-TLS and EAP- PEAP DNA Center & Prime Support DNA automation/ assurance EFT starting in March 2018 DNA GA in July 2018 Prime enhancements for managing multi-sites with zero touch AP/WLC onboarding with PI 3.4 DNA Ready for Small to Medium Size, Single or Multi site Deployments 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 160

127 Summary Cisco Mobility Express is virtual Wireless LAN Controller embedded on 11ac Wave 2 Access Points. No need for a separate controller h/w Ideal for small to medium sites supports up to 100 Access Points, 2000 Clients Simplicity is the motto Quick and Easy to setup, Simple Controller WebUI even for advanced features, Best Practices are enabled out of the box, Redundancy with Master Election, Manageability via PI. References: Cisco Mobility Express - Cisco Mobility Express Deployment Guide Cisco and/or its affiliates. All rights reserved. Cisco Public 161

128 VoD Links Faster Innovation Reduce Cost & Complexity Cisco CMX Solution CMX Hyperlocation vs RSSI Demo Cisco Dual 5GHz Wi-Fi Cisco Aironet AP-3800 RF Excellence Digital Network Architecture with Wave2 with ac Cisco Aironet Series Flexible Radio Assignment TechWiseTV: Apple and Cisco: Fast-Tracking the Mobile Enterprise Prioritised Business Apps Apple and Cisco: Three Solutions Coming Together WiFi Optimised Feature Lower Risk Fastlane App Demo Cisco APIC-EM Wireless PnP Demo bu66pu Cisco Aironet Plug and Play Cloud Redirection Wireless LAN Controller Dashboard Review Cisco Wireless Mobile App WLC Advanced UI Client Troubleshooting ISE Simplified Wireless Setup Cisco Wireless TrustSec Demo Cisco Wireless Netflow Lancope Integration Demo OpenDNS Integration with WLC Cisco and/or its affiliates. All rights reserved. Cisco Public 164

129 Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1. Find this session in the Cisco Live Mobile App 2. Click Join the Discussion 3. Install Spark or go directly to the space 4. Enter messages/questions in the space cs.co/ciscolivebot# 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

130 Please complete your Online Session Evaluations after each session Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt All surveys can be completed via the Cisco Live Mobile App or the Communication Stations Complete Your Online Session Evaluation Don t forget: Cisco Live sessions will be available for viewing on-demand after the event at Cisco and/or its affiliates. All rights reserved. Cisco Public