BRKEWN-2010 - Design and Deployment of Enterprise WLANs

San Jos, Costa Rica
Design and Deployment

of Enterprise WLANs
Isaac Estrada
Network Consulting Engineer WWWP
Advanced Services
Septiembre 12, 2013
2012
2011 Cisco and/or its affiliates. All rights reserved.
Cisco Connect
If you fail to Plan, you Plan to Fail
2012
Cisco
Cisco
Confidential
Connect
Agenda
Wireless RF Design Overview
Controller-Based Architecture Overview
Mobility in the Cisco Unified WLAN Architecture
Architecture Building Blocks
Deploying the Cisco Unified Wireless Architecture
Cisco Connect
Wireless RF Design
An RF site survey is the first step in the
deployment of a wireless network, and it is the
most important step to ensure desired operation.
Is a Site Survey even Needed?

Cisco Connect
WLAN Requirements
Business requirements
WLAN Applications:
Data (Email, Databases, Web, etc)

VoWLAN
Streaming video
Location Based Services
es
Security, QoS, WMM, etc
WLAN Client Types

Laptops
Smartphones
Tablets / Handhelds
Protocol Requirements
802.11b/g 2.4 GHz

802.11a 5 GHz
802.11n (2.4/5 GHz)
Protocol Pros and Cons
Cisco Connect
WLAN Requirements
Coverage and Capacity Requirements
RF Coverage Information:
RF coverage inside and outside
Identify and select RF coverage areas
User Density
Current and Future Wireless users and devices
Identify and classify correctly density areas (Cubicles,
Auditoriums, conference room, etc)
Mobile vs. Mobility
Expected Throughput
802.11b is typically 5.5 Mb/s

802.11g is typically 20 Mb/s
802.11g is typically 6 Mb/s with 802.11b clients present
802.11a is typically 22 Mb/s
802.11n expected (>100 Mb/s)
Cisco Connect
Pre Site Survey Analysis (Active)

Conducting a Spectrum
Analysis
Conducting Active Site Survey
Using the right Access Points and Antennas
AIR CAP3502E x
AIR-CAP3502E-x-K9
Cisco Aironet 3500 Series Access Point
AIR-CAP3502I-x-K9
AIR CAP3602E x
AIR-CAP3602E-x-K9
Post Site Survey Analysis (Passive)

WLAN Performance Analysis
Conducting Passive Site Survey
Controller-Based
Architecture
Overview
Cisco Connect
10
Agenda
Cisco Unified Wireless Principles
Cisco PI
Components
Wireless LAN Controller

Wireless LAN
Controllers
Aironet Access points

Management (Prime Infrastructure)
MSE
Mobility Service Engine (MSE)

Principles
Campus
Network
AP must have CAPWAP

connectivity with WLC
Configuration
downloaded to AP by WLC
Cisco AP
All Wi-Fi traffic is

forwarded to the WLC
Cisco Connect
11
Centralized Wireless LAN Architecture

What is CAPWAP?
CAPWAP: Control and Provisioning of Wireless Access Points is used between APs and
WLAN controller and based on LWAPP

CAPWAP carries control and data traffic between the two
Control plane is DTLS encrypted

Data plane is DTLS encrypted (optional)
LWAPP-enabled access points can discover and join a CAPWAP controller, and
conversion to a CAPWAP controller is seamless
Business
Application
Data Plane
Controller
CAPWAP
Wi-Fi Client
Access
Point
Control Plane
Cisco Connect
12
12
CAPWAP State Machine

AP Boots UP
Reset
Discovery
Image Data
DTLS
Setup
Join
Run
Config
Cisco Connect
13
13
AP Controller Discovery
Controller Discovery Order
Layer 2 join procedure attempted on LWAPP APs
(CAPWAP does not support Layer 2 APs)
Broadcast message sent to discover controller on a
local subnet
Layer 3 join process on CAPWAP APs and on LWAPP APs after
Layer 2 fails
Previously learned or primed controllers

Subnet broadcast
DHCP option 43
DNS lookup
Cisco Connect
14
14
Efficient CAPWAP Operation

Best Practices
Define the Wireless Access Point Device DHCP Scopes

Default router IP Address for Access Point scope
Helper address (forwarding UDP 5246 to the WLCs management
interface)
Domain name
Appropriate DHCP Lease timer for Aps
Pool sizes for WLAN devices in accordance to different types of
sites
If NAT is used, static 1-to-1 NAT to an outside address is
recommended
Cisco Connect
15
15
Mobility in the Cisco

Unified WLAN
Architecture
Cisco Connect
16
Mobility Defined
Mobility is a key reason for wireless networks
Mobility means the end-user device is capable of moving location in
the networked environment

Roaming occurs when a wireless client moves association from one
AP and re-associates to another, typically because its mobile!
Mobility presents new challenges:
Need to scale the architecture to support client roamingroaming can
occur intra-controller and inter-controller
Need to support client roaming that is seamless (fast) and preserves
security
Cisco Connect
17
17
Scaling the Architecture with Mobility Groups

Mobility Group allows controllers to peer with each other to support seamless
roaming across controller boundaries

APs learn the IPs of the other members of the mobility group after the CAPWAP
Join process
Controller-B
MAC: AA:AA:AA:AA:AA:02
Mobility Group Name: MyMobilityGroup
Support for up to
Controller-A
Ethernet in IP Tunnel
24 controllers,
24000 APs per
mobility group
Mobility Group Neighbors:

Controller-A, AA:AA:AA:AA:AA:01
Controller-C, AA:AA:AA:AA:AA:03

Controller-B, AA:AA:AA:AA:AA:02
Controller-C, AA:AA:AA:AA:AA:03
Mobility messages
exchanged
between
controllers
Controller-C
Data tunneled between
controllers in EtherIP (RFC 3378)


Controller-A, AA:AA:AA:AA:AA:01
Controller-B, AA:AA:AA:AA:AA:02
Mobility Messages
Cisco Connect
18
18
Scaling the Architecture with Mobility Groups

Mobility Domain
With Inter Release Controller Mobility (IRCM) roaming is

supported between 7.3 7.4 and 7.5
One
WLC Network
Mobility Group
24 WLCs in a
Mobility Group
Mobility Group (7.3)
72 WLCs in a
Mobility Domain
Cisco Connect
19
19
How Long Does an Client Roam Take?

Time it takes for:
Client to disassociate +
Probe for and select a new AP +
802.11 Association +
802.1X/EAP Authentication +
Rekeying +
IP address (re) acquisition
All this can be on the order of seconds Can we make this faster?
Cisco Connect
20
20
Roaming Requirements
Roaming must be fast Latency can be introduced by:
Client channel scanning and AP selection algorithms
Re-authentication of client device and re-keying
Refreshing of IP address
Roaming must maintain security

Open auth, static WEPsession continues on new AP
WPA/WPAv2 PersonalNew session key for encryption derived via standard handshakes
802.1x, 802.11i, WPA/WPAv2 EnterpriseClient must be re-authenticated and new
session key derived for encryption
Cisco Connect
21
21
Layer 2 Roaming: Inter-Controller

VLAN X
WLC-2 Client Database
Client Data (MAC,
IP, QoS, Security)
WLC-1 Client
Database
WLC-1
WLC-2
Mobility Message Exchange
Roaming Data
Path
Client database
entry with new AP
and appropriate
security context
No IP address
refresh needed
Client Roams to a Different

AP
Cisco Connect
22
22
Layer 3 Roaming: Inter-Controller

VLAN X
WLC-1 Client
Database
VLAN Z
Client Data (MAC, IP,
P,
QoS,, Security)
y)
Client Data (MAC,

IP, QoS, Sec
Security)
Mobility Message Exchange
WLC-1
Anchor Controller
Data Tunnel
WLC-2 Client Database
WLC-2
Foreign Controller
Preroaming Data
Path
Client Roams to a
Different AP
Cisco Connect
23
23
Roaming: Inter-Controller
Layer 3
L3 inter-controller roam: STA moves association between APs joined to the different
controllers but client traffic bridged onto different subnets

Client must be re-authenticated and new security session established
Client database entry copied to new controller entry exists in both WLC client DBs
Original controller tagged as the anchor, new controller tagged as the foreign
WLCs must be in same mobility group or domain
No IP address refresh needed
Symmetric traffic path established -- asymmetric option has been eliminated as of 6.0
release
Account for mobility message exchange in network design
Cisco Connect
24
24
How Are We Going to Make Roaming Faster?
Eliminating the (re)IP address acquisition
challenge
Eliminating full 802.1X/EAP
reauthentication
Fast Secure Roaming

Standard Wi-Fi Secure Roaming
Note: Mechanism Is Needed to Centralize Key Distribution

802.1X authentication in wireless today requires three
end-to-end transactions with an overall transaction

time of > 500 ms
WAN
roaming client to reauthenticate, incurring an additional

500+ ms to the roam
Cisco AAA
Server
(ACS or
ISE)
2. 802.1X
Reauthentication After
Roaming
802.1X authentication in wireless today requires a
AP2
1. 802.1X Initial
Authentication
Transaction
AP1
Cisco Centralized Key Management (CCKM)

Cisco introduced CCKM in CCXv2 so widely available, especially with application specific
devices (ASDs)
CCKM ported to CUWN architecture in 3.2 release
In highly controlled test environments, CCKM roam times consistently measure in the 5-8
msec range!
CCKM is most widely implemented in ASDs, especially VoWLAN devices
To work across WLCs, WLCs must be in the same mobility group
CCX-based laptops may not fully support CCKM depends on supplicant capabilities
CCKM is standardized in 802.11r, Apple iOS 6.0
Cisco Connect
27
27
IEEE 802.11r Introduction

IEEE Standard for Fast Transition (FT)
Introduces a new concept of roaming where the handshake with the new AP is done even
before the client roams to the target AP.

The initial handshake allows the client and APs to do PTK calculation in advance, thus
reducing roaming time.

The pre-created PTK keys are applied to the client and AP once the client does the re-
association request / response exchange with new target AP.

802.11r provides 2 ways of roaming:
Over-the-Air
Over-the-DS (Distribution System)
The FT (Fast Transition) key hierarchy is designed to allow the client to make fast BSS
transitions between APs without the need to re-authenticate at every AP.

WLAN configuration will have new AKM type called FT (Fast Transition)
Cisco Connect
28
28
802.11r Fast Transition (FT)

WLAN Authentication Configuration
Legacy clients may not associate with a WLAN that has 802.11r
enabled along with 802.11i. If the driver or the supplicant that is
responsible for parsing the Robust Security Network Information
Element (RSN IE) is old and confused by the additional AKM
(Authentication Key Management) suites advertised in the IE (IE48),
the driver will not attempt to start the association process.
An iPhone with 6.0 iOS could

Authenticate to WLAN with
both of these AKMs. But
because of legacy clients this
is NOT recommended.
A non-6.0 iOS client cant
associate.
Due to this limitation, legacy clients cannot send association

requests to WLANs with a FT PSK or FT 802.1x configuration.
These legacy clients, however, can still associate with non-802.11r
WLANs.
Therefore the recommendation is to have a new unique WLAN. With
unique SSIDs for the addition 802.11r FT WPA clients. And an
additional WLAN for the 802.11r FT 802.1x clients.
2012
Cisco
Cisco
Confidential
Connect
29
Multiple WLANs for Multiple Auth Types Each with a Unique SSID
802.1x & 802.1x FT WLANs Unique

q SSIDs
2012 Cisco and/or its affiliates. All rights

g
reserved.
q SSIDs
PSK & PSK FT WLANs With Unique
Connect
Cisco Co
Cisco
Connec
nnectt
30
Designing a Mobility Group/Domain

Design Considerations
Less roaming is better clients and apps are happier
While clients are authenticating/roaming, WLC CPU is doing the processing
not as much of a big deal for 5508 which has dedicated management/control
processor
L3 roaming & fast roaming clients consume client DB slots on multiple
controllers consider worst case scenarios in designing roaming domain size
Leverage natural roaming domain boundaries
Mobility Message transport selection: multicast vs. unicast
Make sure the right ports and protocols are allowed
Cisco Connect
31
31
Architecture
Building Blocks
2012
Cisco
Cisco
Confidential
Connect
32
CUWN Release - Key Controller Features
Unified Access WLAN Infrastructure
s/w release
May 2012
Sep 2012
Dec 2012
7.2MR1
7.3
7.4
7.5
AP 2600
802.11n G2
AP1600
802.11n G2
AP3600
11ac module
Outdoor AP
AP3600
Security Module
AP 700
Outdoor AP Internal Antenna
Uni Band Antenna
Outdoor AP Honeywell
integration
WLC 8500
Target customer - SP
Virtual Controller
802.11r
L2 Fast Roaming
ISE - Flex integration

Flex / Local Mode parity with
ISE
Local and
FlexConnect support on RAP
Scale Flex7500
6K APs
Bonjour Services Directory

Phase 1
Guest Anchor on WLC8500
AP neighbor list
(Subset of 802.11k)
Scale WLC 2500
FlexConnect Split Tunneling
HA Licensing, N:1
802.11r Flex Modes
802.11w (local mode)

Protected Mgmt Frame
Bi-directional rate-limiting
Voice/Video:
11n CAC
OEAP 600 Split Tunneling

Profiling and Policy on WLC
Controller Resiliency- AP SSO

HA Licensing
PMIPv6 on WLC
Application visibility and control

(AVC)
May 2013
Controller Resiliency
Client SSO
Over any L2
Bonjour Services Directory
Phase 2
FlexConnect Additions:
LAG on Flex7500, WLC 8500,
WLC 2500
FlexConnect with Mesh

PEAP / EAP-TLS
AAA ACL and QoS
802.11w
Guest Anchor on WLC2500

Cisco Connect
33
Controller Product Portfolio

Multi-architecture capable
Support Flex and Local-mode
Features / Performance
New
(7.3)
WiSM2
5500
500 APs
7000 Clients
2500
50 APs
500 Clients
SRE WLCM2
1000 APs
15000 Clients
8500
6000 APs
64000 Clients
FlexConnect
New
(7.3)
50 APs
500 Clients
Flex7500
Virtual Controller
3000
6000 Aps
30000
64000 Clients
New
(7.3)
200 APs
3000 Clients
Scale (# of clients, APs)

20
2
2012
Cisco Connect
34
BEST
IN CLASS
Cisco Aironet Access Points

MISSION
CRITICAL
ENTERPRISE
CLASS
TELEWORKER
New
Q2FY
13
Enterprise Class Performance

Video/Voice/Multi-Media
Any Device/BYOD
Optimised
Client Scalability
RF Interference Mitigation
High Client Density

Investment Protection
802.11ac Support
HD Video/VDI
Best In Class Security
Basic Connectivity
Deployment Flexibility
Entry Level
Sm/Med
Sm/Med/Large
Med/Large Enterprise
Cisco Connect
35
35
Cisco Aironet 802.11n Indoor Access Point

AP Model
(availability)
3600 Series
2600 Series
1600 Series
(Q4)
600 Series
1.3 Gbps
450 Mbps
300 Mbps
300 Mbps
.11n: 4X4:3
.11ac: 3x3:3
3X4:3
3X3:2
2X2:2
CleanAir
ClientLink
ClientLink 2.0
ClientLink 2.0
ClientLink 2.0
BandSelect
VideoStream
Rogue AP Detection
Adaptive wIPS
OfficeExtend
FlexConnect
Wireless Mesh
Autonomous
802.3af
802.3af
802.3af
100 to 240 VAC, 50-60

Hz
802.11 a/b/g/n/ac
802.11 a/b/g/n
802.11 a/b/g/n
802.11 a/b/g/n
Max Data Rate

Radio Design
(MIMO: Spatial Streams)
Power
Wi-Fi Standards
20
2012
12 Ci
C
Cisco
isco and/or
isco
and/
and
d/or
/or its
it affiliates.
affili
affi
ffiliat
ff
li tes All rights
liates
right
righ
i hts
ts reserved.
reserved
reser
d
Cisco
Connect
Cisc
Ci
o Connec
Co
C
nnectt
36
36
Which Version Should I Use? 6.0, 7.0, 7.2, 7.3, 7.4 ?

WLC 5508 supports 6.0, 7.0 and 7.2 & 7.3
WLC7500, WiSM-2 and WLC2504 only
supported in 7.0 onwards

7.0.220 is the latest MD AssureWave (Blue
Ribbon)
Please note the current revision of 7.0-
7.0.235.3 which is the recommended one for

you today
AP3660+11ac (7.5), AP1600(7.4), AP2600 (7.3),
AP 3600(7.2)
Cisco Connect
37
37
Deploying the
Cisco Unified
Wireless
Architecture
2012
Cisco
Cisco
Confidential
Connect
38

Client Profiling
High Availability
Understanding AP Groups / RF Groups
Application Visibility
Branch Office Designs
Guest Access Deployment
Home Office Design
Cisco Connect
39

Client Profiling
High Availability
Home Office Design
Cisco Connect
40
Client Profiling
ISE offers a rich set of BYOD features: e.g. device identification,
onboarding, posture and policy

Customers who do not deploy ISE but still require some of ISE
features directly in WLC:
Native profiling of identifying network end devices based on protocols like
HTTP, DHCP
Device-based policies enforcement per user or per device policy on the
network.
Statistics based on per user or per device end points and policies
applicable per device.
Cisco Connect
41
Client Profiling on WLC

WLC-based local policy consists of 2 separate elements.
Profiling can be based on:
Role - defining user type or the user group the user belongs to.
Device type e.g. Windows, OS_X, iPad, iPhone, Android, etc.
EAP Type - check what EAP method the client is getting connected to.
Action is policy that can be enforced after profiling:

VLAN - override WLAN interface with VLAN id on WLC
QoS level override WLAN QoS
ACL override with named ACL
Session timeout override WLAN session timeout value
Time of day policy override based on time of the day, else default to WLAN.
7.5 release contains 88 pre-existing profiles:
Cisco Connect
42
42
Configuring Client Profiles

Client profiling uses pre-existing profiles in the controller
Custom profiles are not supported in this release

Wireless clients are profiled based on the MAC OUI, DHCP,HTTP user agent
DHCP is required for DHCP profiling, Webauth for HTTP user agent
7.5 release contains 88 pre-existing profiles:

(Cisco Controller) >
show profiling policy summary
Number of Built-in Classification Profiles: 88

ID
Name
Parent Min CM Valid
==== ================================================ ====== ====== =====
0 Android
1 Apple-Device
2 Apple-MacBook
3 Apple-iPad
4 Apple-iPhone
None
None
1
1
1
30
10
20
20
20
Yes
Yes
Yes
Yes
Yes
/
Cisco Connect
43
43
Local Client Profiling Configuration

At the WLAN level, enable Local Client Profiling (DHCP and HTTP)
DHCP required is checked automatically when selecting DHCP profiling
config wlan profiling {local | radius} {dhcp | http | all} <wlan ID>
(Cisco Controller) >config wlan profiling local all enable
20
2012 Cisco and/or its affiliates. All rights
g
reserved.
1
Cisco Connect
on
nn
44
44
Client Profiles
When profiling is enabled, a client Device Type can be shown on WLAN.
(Cisco Controller) >
show client summary devicetype
Number of Clients................................ 3
MAC Address
AP Name
Status
Device Type
----------------- ---------------- ------------- --------------------------------
14:10:9f:ea:b8:c2 AP3600MM
c8:d7:19:34:7e:dd AP3600MM
d8:d1:cb:9a:28:f8 AP3600MM
20
2012
12 C
Cisco
isco and/or
and/or its affiliates.
affiliat
affi
liates
liat
es. All rights
righ
g ts reserved.
rreser
eserved
eser
ved.
Associated
Associated
Associated
OS_X-Workstation
Windows7-Workstation
Apple-iPhone
Cisco Connect
45
45
Security Local Policies
Cisco
Connect
C
isco Co
onne
46
46

Client Profiling
High Availability
Bonjour Gateway
IPv6 Deployment with Controllers
Home Office Design
Cisco Connect
47
47
Controller Redundancy
Most Common (N+1)
Redundant WLC in a geographically
WLAN-Controller-1
separate location
Layer-3 connectivity between the AP
connected to primary WLC and the

redundant WLC
APs Configured With:

Primary: WLAN-Controller-1
Secondary: WLAN-Controller-BKP
WLAN-Controller-2
NOC or Data Centre

Primary: WLAN-Controller-2
WLAN-Controller-BKP
WLAN-Controller-n
Redundant WLC need not be part of

Primary: WLAN-Controller-n
the same mobility group

Configure high availability (HA) to
detect failure and faster failover

Use AP priority in case of over
subscription of redundant WLC
Cisco Connect
48
48
Controller Redundancy High Availability

High Availability Principles :
Primary WLC
AP is registered with a WLC and

maintain a backup list of WLC.
AP use heartbeats to validate WLC
connectivity
AP use Primary Discovery message to
validate backup WLC list
When AP loose 3 heartbeats it start join

process to first backup WLC candidate
Candidate Backup WLC is the first alive

WLC in this order : primary, secondary,
tertiary, global primary, global secondary.
AP does not re-initiate discovery

process.
Secondary WLC
New Timers 7.2

Heartbeat Timeout
1-30 secs
Fast Heartbeat Timer
1-10 secs
AP Retransmit Interval
2-5 secs
AP Retransmit with FH Enabled
3-8 Times
AP Fallback to next WLC
12 secs
Cisco Connect
49
49
HA-SKU as secondary WLC (AP-SSO disabled)

This feature enables HA-SKU controller as secondary controller
HA-SKU controller allowed for use as secondary controller for 90 days without nagging
If HA feature disabled the controller used as secondary controller for the maximum capacity of
supported APs.
Note: HA-SKU ; 5508 50AP, WiSM2 100AP, 7500/8500 300AP will work as Standby
Primary Controller-5508 #1
License Count: 100
APs connected: 90
Primary Controller WiSM-2 #2
License Count:500
APs connected: 500
Primary Controller -2500 #3

License Count: 75
APs connected: 25
Backup Controller -5508

WLC Max AP support : 500
Cisco Connect
50
50
HA-SKU as secondary WLC - configuration
Cisco Connect
51
51
High Availability AP SSO support 7.3/7.4

Model is 1:1 (Active : Hot-Standby)
AP information synced to the standby.
Supported on 5500 / 7500 / 8500 and WiSM-2
Synced when AP Joins or its configuration

changes.
Same hardware and software version
AP CAPWAP re-join is avoided on switchover.
Two new interfaces

Redundancy Port
Redundancy Management Interface
Same management IP on Active and Standby
Static & dynamic system configurations
synced to standby.
y
Detection time : 5-996 msec for box failover ,
3-4 seconds for management gateway failover

Back-to-back Connectivity on the Redundancy
Port between the two WLCs

Clients are de-authenticated on failover ; forced
to re-associate
Effective service downtime = Detection time + Switch Over Time

(Network recovery/convergence) + Client re-association time
Stateful HA with Client SSO

Clients information is synced to the Standby
Client information is synced when client moves to RUN state.
Client re-association is avoided on switch over

Fully authenticated clients(RUN state) are synced to the peer.
The intermediate client state events are not synced
Transient clients are dis-associated after switch over.
E
Effective
service downtime = Detection time + Switch Over Time
((Network
Network recovery/convergence)
Cisco Connect
53
53
HA Connectivity on 5500 / 7500 / 8500 WLC

5500/7500/8500 WLC have dedicated
Redundancy Port which is used to

synch configuration from Active to
Standby WLC
Keepalives are sent on RP port from
Active Controller
WLC 5500
RP 1
Redundancy
Port
Connectivity
Standby to Active WLC every 100 msec

(default timer) to check the health of
Active WLC.
Flex 7500
ICMP packets are also sent every one
second from each WLC to check
reachability to gateway using
Redundant Management interface.
Hot Stand-by Controller
RP 2

Active Controller
Hot Stand-by Controller
High Availability Connectivity on WiSM-2 WLC

WiSM-2 WLC have dedicated
Redundancy Vlan which is used to

synch configuration from Active to
Standby WLC
Keepalives are sent on Redundancy
Vlan from Standby to Active WLC every

100 msec (default timer) to check the
health of Active WLC.
To achieve HA between WiSM-2 WLCs
it can be deployed in single chassis OR

can also be deployed between multiple
chassis using VSS as well as by
extending Redundancy Vlan between
two chassis.
Slot 8: Active WiSM-2

Slot 9: Hot Stand-By WiSM-2
Web-GUI Configuration
CLI Configuration Commands

configure interface address management <ip-address> <subnet-mask> <gateway>
configure interface address redundancy-management <ip-address> peer-redundancy-management <ip-address>
configure redundancy unit [primary | secondary]
configure redundancy mode [sso | disable]
configure redundancy timer keep-alive-timer <interval> (default 100 milli-sec)
configure redundancy timer peer-search-timer <timeout> (default 120 sec)
Supported HA Topologies 7.5

1.
Two 5508 , 7500 or 8500 connected via back-to-back RP port in the same data center
2.
Two 5508 , 7500 or 8500 connected via RP port over L2 VLAN/fiber in the same or different data
center
3.
Two 5508, 7500 or 8500 connected to a VSS pair.
4.
Two WiSM-2 on the same chassis
5.
Two WiSM-2 on different chassis with redundancy VLAN extended over L2 network
6.
Two WiSM-2 on different chassis in VSS mode
Cisco Connect
58
58
WLC 5508/7500/8500 Back-to-back RP Connectivity

Configuration on Primary WLC:
configure interface address management
9.5.56.2 255.255.255.0 9.5.56.1
configure interface address
redundancy-management 9.5.56.10
peer-redundancy-management 9.5.56.11
configure redundancy unit primary
configure redundancy mode sso
Configuration on Hot Standby WLC:

9.5.56.3 255.255.255.0 9.5.56.1
configure redundancy unit secondary
Management GW is monitored with 12 pings ( ~15 sec)
Cisco Connect
59
WLC 5508/7500/8500 RP Connectivity via Switches

Configuration on Primary WLC:
9.5.56.2 255.255.255.0 9.5.56.1
configure redundancy unit primary
Configuration on Hot Standby WLC:

9.5.56.3 255.255.255.0 9.5.56.1
configure redundancy unit secondary
.
RTT Latency : 80 ms or less default ; Bandwidth: 60 Mbps or more ; MTU: 1500
Cisco Connect
60
WiSM-2 connectivity over L2 Redundancy VLAN

Configuration on Cat6k
wism service-vlan 192 ( service port VLAN )
wism redundancy-vlan 169 ( redundancy port VLAN )
wism module 6 controller 1 allowed-vlan 24-38 (data
VLAN )
Cisco Connect
61
WiSM-2 in a VSS Pair

Virtual Switch System (VSS)
Switch-1
(
(VSS
Active))
Control Plane Active
Data Plane Active
Switch-2
(
y)
(VSS
Standby)
VSL
Failover/State Sync VLAN
Control Plane Standby
Data Plane Active
FWSM Active
FWSM Standby
WiSM-2 Active
WiSM-2 Backup
Cisco Connect
62
62
WLC 5508/7500/8500 Connected to VSS Pair

Cisco Catalyst VSS Pair
L3 Core
Catalyst
VSS Pair
L2/L3
Distribution
Cisco 5508
Standby
Cisco 5508
Cisco 5508
Standby
Cisco 5508
Access
SSO Behavior and Recommendations

RTT latency on Redundancy Link : 80 milliseconds or less. 80% of keepalive timer.
Preferred MTU on Redundancy Link : 1500 or above.
Bandwidth on Redundancy Link : 60Mbps or more.
5500 / 7500 / 8500 : RP Connectivity between Active and Standby
Via Switches ( 7.5 )
Back-to-back ( 7.3, 7.4, 7.5 )
WiSM-2 : single 6500 chassis OR different chassis using VSS setup/extending redundancy VLAN.
Recommended to have Redundancy Link and RMI Connectivity between WLCs on different
switches or on different L2 networks
Keepalive/Peer Discovery timers should be left with default timer values for better performance
Default box failover detection time is 3 *100 = 300+60 = 360 +jitter (12 msec)= ~400 msec

Client Profiling
High Availability
Home Office Design
Cisco Connect
65
65
AP-Groups - Default AP-Group

The first 16 WLANs created (WLAN IDs 116) on the WLC are included in the
default AP-Group
Default AP-Group cannot be modified
APs with no assignment to an specific AP-Group will use the Default AP-Group
The 17th and higher WLAN (WLAN IDs 17 and up) can be assigned to any AP-
Groups
Any given WLAN can be mapped to different dynamic interfaces in different AP-
Groups
WLC 2106 (AP groups: 50), WLC 2504 (AP groups:50)
WLC 4400 and WiSM (AP groups: 300),

WLC 5508 & WiSM-2 (AP groups: 500),
WLC 7500 (AP Groups : 500)
Cisco Connect
66
66
AP-Grouping in Campus
VLAN 100
VLAN 100
VLAN 100
Access
Si
Si
Si
Si
Si
Si
Distribution
CAPWAP
Core
Si
Si
Si
Si
Si
VLAN 100 /
21
Si
Si
Distribution
Si
Access
Single
SSID =
Employee
Internet
Data Centre
WAN
WLC-1
WLC-2
Cisco Connect
67
67
AP-Grouping in Campus
AP-Group-1
VLAN 60 /23
AP-Group-2
AP-Group-3
VLAN 70 /23
VLAN 80 /23
Access
Si
Si
Si
Si
Si
Si
Distribution
CAPWAP
Core
Si
Si
Si
Si
VLAN 100
/21
Si
Si
VLAN 60
VLAN 70
VLAN 80
Si
Si
Distribution
Access
Single
SSID =
Employee
Internet
Data Centre
WAN
WLC-1
WLC-2
Cisco Connect
68
68
Default AP-Group
Network Name
Default AP Group
Only WLANs 116 Will Be

Added in Default AP
Group
Cisco Connect
69
Multiple AP-Groups
AP Group 1
AP Group 2
AP Group 3
Cisco Connect
70
70
RF-Profiles
7.2 and 7.3 Release
RF Profiles allow the administrator to tune groups of APs sharing a common
coverage zone together.

Selectively changing how RRM will operate the APs within that coverage zone
RF Profiles are created for either the 2.4 GHz radio or 5GHz radio
Profiles are applied to groups of APs belonging to an AP Group, in which all APs in the
group will have the same Profile Settings
There are two components to this feature:

RF Profile New in 7.2 providing administrative control over:
Min/Max TPC values
TPCv1 Threshold
TPCv2 Threshold
Data Rates
High Density
Client Load Balancing
Cisco Connect
71
71
Low Density Profile

A normal profile can be built
to match your exact Criteria

You may wish to increase the
mandatory data Rate to
match your coverage (higher
if dense, lower if sparse)
Change the RRM coverage
thresholds to match your
exact architecture
Make a custom load
balancing plan that suits the

environment
Cisco Connect
72
72
High Density Profile

For High Density, RF profiles
will differ significantly
Higher Mandatory data Rate,

More Disabled Rates
Enforce Minimum Power

TPCv1-2 thresholds hotter
Cisco Connect
73
73
High Density Profile cont.

Custom Fixed Mcast
parameters
Higher Load Balancing
window
Higher BandSelect
thresholds (prevents a
lot of un-necessary
work)
Cisco Connect
74
74
RF-Profile in Campus
RF-Profile-1
VLAN 60 /23
VLAN 61 / 23
Si
Si
RF-Profile-2
RF-Profile-3
VLAN 70 /23
VLAN 71 /23
VLAN 80 /23
VLAN 81 /23
Si
Si
Si
Access
Si
Distribution
LWAPP/CAPWAP
Core
Si
Si
Si
Si
Si
Single
SSID =
Employee
VLAN 60
VLAN 61
VLAN 70
VLAN 71
VLAN 80
VLAN 81
WLC-1
Si
Si
Distribution
Access
Internet
Data Centre
WAN
Si
WLC-2
Cisco Connect
75
75
Multiple RF-Profiles
RF Profile -1
RF Profile -2
RF Profile -3
Cisco Connect
76
76

Client Profiling
High Availability
Home Office Design
Cisco Connect
77
77
Application Visibility & Control

Congestion!
WLC
WAN
Real Time
Interactive
Non-Real Time
Non-Business
What applications are in the air?

Why is my key application running slow?
How do I support a new application for a set of users?
Cisco Connect
78
78
NBAR supported features

Classification : Identification of Application/Protocol, supports Stateful L4 - L7 classification. WLC

can classify 1039 applications.
AVC (Application Visibility Control): Provides visibility of classified traffic and also gives an option to
control the same, using Drop OR Mark (DSCP) action.
Action DROP (Traffic for that application will be dropped)
Action MARK (Particular applications can be marked with different QOS profiles available on WLC OR
administrator can custom define DSCP value for that application)
AVC Marking overrides all other QoS markings

NetFlow: Updating NBAR stats to Netflow collector like Cisco Prime Assurance Manager (PAM).
NBAR is supported on 2500, 5500, 7500, 8500 and WiSM2 controllers on Local and Flex Mode APs
WLC can support 16 AVC profiles
WLAN can support only 1 AVC profile and each profile can contain 32 rules, thus each WLAN can
support 32 application actions of mark or drop.
Cisco Connect
79
Enabling AVC
AVC enabled on per WLAN basis
Global summary of top

applications on Controller
Monitor screen
Cisco Connect
80
80
AVC Profile
Custom AVC
Profiles created to
do traffic shaping
Apply the custom profile per WLAN
Cisco Connect
81
81
Netflow Monitor
Configuring Netflow Exporter on the Controller and apply to WLAN
Connect
Cisco C
Cisco
Co
onnect
nect
82
82
AVC Summary
Application Statistics per WLAN with more details UP/Down Streams
Cisco Connect
83
83

Client Profiling
High Availability
Home Office Design
Cisco Connect
84
84
Branch Office Deployment

FlexConnect
Central Site
Centralized
Traffic
Hybrid architecture
Single management and control point
Centralized trafic
Local traffic
HA will preserve local traffic only
Centralized
Traffic
WAN
Local
Traffic
Remote Office
Cisco Connect
85
85
FlexConnect Design Considerations

WAN Limitations Apply
Deployment
Type
WAN Bandwidth
(Min)
WAN RTT
Latency (Max)
Max APs per

Branch
Max Clients per

Branch
Data
128 kbps
300 ms
25
Data+Voice
128 kbps
100 ms
25
Data
128 kbps
1 sec
Monitor
128 kbps
2 sec
N/A
Data
1.44 Mbps
1 sec
50
1000
Data+Voice
1.44 Mbps
100 ms
50
1000
Monitor
1.44 Mbps
2 sec
50
1000
Cisco Connect
86
Economies of Scale for Lean Branches

Flex 7500 Wireless Controller
Key Differentiation
WAN Tolerance
High Latency Networks
Access Points
300 - 6,000
WAN Survivability
Security
Clients
64,000
Branches
2000
Access Points / Branch
100
Deployment Model
FlexConnect
Voice CAC
Form Factor
1 RU
OKC/CCKM
IO Interface
2x 10GE
Upgrade Licenses
100, 200, 500, 1K
2012
012 Cisco and/or its affiliates
affiliates. All rights reserved
reserved.
802.1x based port authentication

Voice support
Cisco Connect
87
87
Understanding FlexConnect Groups

Central Site
FlexConnect groups allow sharing of:

CCKM/OKC fast roaming keys
Local/backup RADIUS servers IP/keys
Local user authentication
Local EAP authentication
AAA-Override for Local Switching
Smart Image Upgrade
WAN
Remote Site
Remote Site
Scaling information
Flex 7500
Cluster
FlexConnect Group 2
Scaling
Flex
7500
CT-5508
WiSM2
CT-2504
FlexConnect
Groups
2000
100
100
30
AP per Group
100
25
25
25
FlexConnect Group 1
Cisco Connect
88
88
EAP-TLS/PEAP Overview
Local Authentication on FlexConnect AP
New
(7.5)
FlexConnect AP contacting RADIUS Server

FlexConnect AP acting as RADIUS Server
EAP Methods when AP acting as RADIUS Server: LEAP, EAP-FAST, PEAP, EAP-TLS
PEAP and EAP-TLS Support in
Standalone Mode
Local Authentication
Continued support for RADIUS Servers on FlexConnect Group.
RADIUS Server Configuration takes precedence over FlexConnect AP acting as RADIUS
Server.
Access points 1040, 1140, 1520, 1550, 1600, 3500, 3600, 2600, 1250, 1260, are supported
Cisco Connect
89
89
PEAP/EAP-TLS Web-GUI
New
(7.5)
Enable AP Local Authentication

Radius Server configured on the FlexConnect group takes precedence over AP
Local Authentication
Cisco Connect
90
90
Local Switching Access Lists

Central Site
Support for ACL in FlexConnect local
switching mode
ACL mapped to local VLAN per AP or
FlexConnect Group
WAN
512 FlexConnect ACL per WLC

16 ingress ACL & 16 egress ACL per AP
64 ACL rules per ACL
Remote Site
Application
Server
No IPv6 ACL
New in 7.2
Cisco Connect
91
91
Local Switching Access Lists Configuration

ACL rule creation and application for FlexConnect is
identical to WLC rule creation for Local Mode

Step 1
Step 2
Click to add
ACL rules
New in 7.2
Step 3
Provision to assign separate
Inbound & Outbound ACLs
Cisco Connect
92
92
Local Switching Peer-to-Peer BlockingCentral Site

Support for Peer-to-Peer blocking in
FlexConnect AP
WAN
Apply for clients on same FlexConnect
AP
Remote Site
P2P blocking modes : disable or drop

For P2P blocking inter-AP use ACL or
Application
Server
Private VLAN fonction

New in 7.2
Cisco Connect
93
93
FlexConnect AAA VLAN Override

Central Site
AAA VLAN Override with local or
central authentication
Up to 16 VLANs per FlexConnect AP
Central RADIUS
VLAN 3
VLAN 7
WAN
VLAN ID must be enabled per AP or
FlexConnect Group
Application
Server
Remote Site
If VLAN ID does not exist, default
VLAN is used
VLAN 3
QoS and ACL Override is
VLAN 7
not supported.
FlexConnect Group 1
New in 7.2
Cisco Connect
94
94
FlexConnect AAA VLAN Override

IETF 65
IETF 64
IETF 81
VLA
N 10
9
WAN
ISE
Create Sub-Interface on
FlexConnect AP
New in 7.2
Cisco Connect
95
95
New in
7.2.110
External WebAuth with Local Switching

Central Site
Provides L3 Web Redirect from locally
switched vlan
Reduces WAN traffic by locally
switching guest traffic
Flexible and centralized web portal
creation for multiple sites
WebServer
WAN
Internet
Remote Site
Provides flexible use of Conditional and
Splash Page Web Redirect

FlexConnect AP must be in Connected
state with Centralized Controller to work
VLAN
503
VLAN 7
FlexConnect Group 1
Cisco Connect
96
96
FlexConnect ACL Split Tunneling

Split tunneling allow some traffic to be locally switched although the WLAN is
defined as centrally switched

Split tunneling is using a NAT/PAT feature with ACL to perform the local
switching
Split tunneling is using the AP IP@ for the NAT/PAT feature
FlexConnect AP
NAT/PAT
ACL
CAPWAP
WLC
Central Traffic
WAN
Central Server
Local Traffic
Local Printer
Cisco Connect
97
97
FlexConnect and AP1500 (Outdoor)

L3/L2 switch
Local or
FlexConnect
RAP
(Root
ot A
AP)
P)
Backhaul 5GHz
MAP
(Mesh AP)
Controller
Indoor AP Parity with Outdoor RAP (1520 & 1550) only

Local Mode
FlexConnect Mode
No MAP functionality in this release
Flex Mode will have support for Central and Local Switching

Client Profiling
High Availability
Bonjour Gateway
IPv6 Deployment with Controllers
Understanding FlexConnect AP Deployment
Understanding Branch Controller Deployment
Home Office Design
Cisco Connect
99
99
Branch Office WLAN Controller Options

Number of Users: 100500
Number of APs: 525
WCS
E-Mail
Headquarters
MPLS
ATM
Frame Relay
Branch
Office
Appliance controllers
Cisco 2504-12
Cisco 5508-12, 5508-25
Internet VPN
Small
Office
Integrated controller
WLAN controller module (WLCM-2) for ISR G2
Virtual WLC (vWLC)
Number of Users: 20100

Number of APs: 15
Cisco Connect
100
100
Branch Office WLAN Controller Options

Cisco 2504 or vWLC***
WCS
E-Mail
Branch
Office
Headquarters
MPLS
ATM
Frame Relay
Small
Office
Cisco Unified Wireless Network with controller-
based
Multiple Integrated WAN options on ISR
Internet VPN
Consistent branch-HQ services, features, and
performance
Standardised branch configuration extends the
WLCM-2 or vWLC**
unified wired and wireless network

Branch configuration management from central
WCS
**AP Count Vary Depending on Channel

Utilisation and Data Rates
Cisco Connect
101
101

High Availability
Home Office Design
Cisco Connect
102
102
WLAN Controller Deployments with EoIP Tunnel

Internet
Use of up to 71 EoIP tunnels to logically segment and
DMZ or Anchor
Wireless Controller
transport the guest traffic between remote and anchor

controllers
Other traffic (employee for example) still locally bridged
at the remote controller on the corresponding VLAN

No need to define the guest VLANs
on the switches connected to the

remote controllers
Original guests Ethernet frame maintained across
CAPWAP and EoIP tunnels
Cisco ASA
Firewall
EoIP
Guest
Tunnel
CAPWAP
Wireless
LAN
Controller
Redundant EoIP tunnels to the
Anchor WLC
With 7.4 release 2504 series EoIP connections can
terminate 10 EoIP tunnels

Guest
Guest
Cisco Connect
103
103

High Availability
Home Office Designs
Cisco Connect
104
104
Home Office Design

OEAP AP
Cisco controller installed in the DMZ of
the corporate network

WLC 5508/WiSM-2 / WLC7500
WCS
E-Mail
OfficeExtend AP (OEAP) installed at
teleworkers home
Corporate access to employee over
Headquarters
centrally configured SSID

Family Internet access over a locally
configured SSID
Internet VPN

reserve
Cisco Connect
105
105
Summary Key Takeways

RF Plan and Design base on Business requirements
Take advantage of the standards (CAPWAP, DTLS,802.11 i, e, k, r..)
Wide range of architecture / design choices
Brand new controllers (WiSM-2, WLC 7500,WLC 8500, WLC 2504, Virtual
WLC) portfolio with investment protection

Take advantage of innovations from Cisco (CleanAir, BandSelect,
ClientLink, Security, CCX, FlexConnect, etc)

Ciscos investment into technology Cisco Prime, ISE, New hardware,
Cloud controller
Cisco Connect
106
106
Thank you.
Cisco Connect
107

BRKEWN-2010 - Design and Deployment of Enterprise WLANs

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

BRKEWN-2010 - Design and Deployment of Enterprise WLANs

Încărcat de

Drepturi de autor:

Formate disponibile

San Jos, Costa Rica

Design and Deployment

Septiembre 12, 2013

If you fail to Plan, you Plan to Fail

Is a Site Survey even Needed?

Data (Email, Databases, Web, etc)

WLAN Client Types

802.11b/g 2.4 GHz

2012 Cisco and/or its affiliates. All rights reserved.

802.11b is typically 5.5 Mb/s

2012 Cisco and/or its affiliates. All rights reserved.

Pre Site Survey Analysis (Active)

Conducting Active Site Survey

Using the right Access Points and Antennas

Post Site Survey Analysis (Passive)

Conducting Passive Site Survey

2012 Cisco and/or its affiliates. All rights reserved.

Wireless LAN Controller

Aironet Access points

Mobility Service Engine (MSE)

AP must have CAPWAP

All Wi-Fi traffic is

Centralized Wireless LAN Architecture

WLAN controller and based on LWAPP

Control plane is DTLS encrypted

conversion to a CAPWAP controller is seamless

CAPWAP State Machine

Previously learned or primed controllers

2012 Cisco and/or its affiliates. All rights reserved.

Efficient CAPWAP Operation

Define the Wireless Access Point Device DHCP Scopes

Mobility in the Cisco

2012 Cisco and/or its affiliates. All rights reserved.

the networked environment

2012 Cisco and/or its affiliates. All rights reserved.

Scaling the Architecture with Mobility Groups

roaming across controller boundaries

Mobility Group Neighbors:

Mobility Group Neighbors:

Data tunneled between

controllers in EtherIP (RFC 3378)

Mobility Group Neighbors:

Scaling the Architecture with Mobility Groups

With Inter Release Controller Mobility (IRCM) roaming is

Mobility Group (7.3)

Mobility Group (7.4)

Mobility Group (7.5)

How Long Does an Client Roam Take?

2012 Cisco and/or its affiliates. All rights reserved.

Roaming must maintain security

2012 Cisco and/or its affiliates. All rights reserved.

Layer 2 Roaming: Inter-Controller

Mobility Message Exchange

Client Roams to a Different

Layer 3 Roaming: Inter-Controller

Client Data (MAC,

Mobility Message Exchange

WLC-2 Client Database

controllers but client traffic bridged onto different subnets

How Are We Going to Make Roaming Faster?

Eliminating the (re)IP address acquisition

Fast Secure Roaming

Note: Mechanism Is Needed to Centralize Key Distribution

end-to-end transactions with an overall transaction