Breakout - Airheads Macau 2013 - Unified Access: Deploying Mobility Access Switches & Instant Topics Including: Platform Overview Software Defined Networking Aruba AP Interworking Role Based User Access ClearPass Policy Manager Integration

1. Unified Access: Deploying
Mobility Access Switches & Instant
Madani Adjali
November 14th
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
1
#airheadsconf

2. Agenda
Platform Overview
Software Defined Networking
Aruba AP Interworking
Role Based User Access
ClearPass Policy Manager Integration
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
2
#airheadsconf

3. Platform Overview
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
3
#airheadsconf

4. Introducing the Aruba
Mobility Access Switch Family
• Security to wired access
– Flexible role-based access
– Policy moves from wireless to wired
• Operational simplicity
– Low-touch installation and configuration
– Dynamic configuration of user policies
– Integration with Aruba APs
• Simplify the network
– Reduce VLANs in the closet
– Extend logical configurations
• 802.11ac Ready
– Scaled to support high-density
deployments
– PoE+ on every switch port
– 10GbE uplinks (S2500/S3500)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
4
#airheadsconf

5. Mobility Access Switch Capabilities
Access Point
AirWave
Management
Platform
Mobility Access
Switch
B. Integration with ClearPass
• Downloadable Role/ACL
• Captive Portal
C. Wired AP
Mobility
Controller
LAN Core
A. L2/L3
Forwarding
B. User-Role
Download
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
A. Ethernet Switch
• Layer 2/3 forwarding
• Native Role-based policy
enforcement
ClearPass Policy
Manager
5
C. Wired Access Point
• Tunneled Node
• Role-based policy
enforcement at Mobility
Controller
• Single policy for WLAN
and LAN
#airheadsconf

6. S3500 Mobility Access Switch
• Designed for Wired Access
–
–
–
–
24/48 Port Models
Wire-rate and non-blocking performance
Role-based access with user visibility
Per port PoE/PoE+
• ArubaStack
–
–
–
–
Stack up to 8 devices
Up to 384x GbE and 16x 10GbE
Single management IP address
Single configuration file
• Flexible Forwarding Options
– Traditional L2/L3 Switching
– Tunnel traffic to Mobility Controller
• Modular Components
SKU
Ports
PoE Budget
S3500-24F
24x1000BASE-x
Not Applicable
S3500-24T
24x10/100/1000BASE-T
Not Applicable
S3500-24P
24x10/100/1000BASE-T
400W | 689W
S3500-48T
48x10/100/1000BASE-T
Not Applicable
S3500-48P
48x10/100/1000BASE-T
400W | 689W
S3500-48PF
48x10/100/1000BASE-T
850W | 1465W
– Field replaceable AC power supplies
•
Optional redundant power supply
– Field replaceable fan tray
– Optional 4-port uplink module
•
1000BASE/10GBASE-x SFP/SFP+
PoE budget values are provided for single PSU and dual PSU configurations
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
6
#airheadsconf

7. S3500: Front and Rear Views
• Modular Components
S3500-48P Front View
LCD
– Power Supplies
– Fan Tray
– Uplink Module
• Management
Fixed 10/100/1000BASE-T Ports
Optional
Uplink Module
S3500-24F Front View
LCD
–
–
–
–
Console (RJ45 Serial)
Out-of-band Ethernet
USB Storage
LCD Display
• Dimensions & Airflow
– 1RU
– 1.75˝ (H) x 17.5˝ (W) x 17.5˝ (D)
– Front/Side to Rear Airflow
24x1000BASE-X SFP Ports
Ethernet
Out-of-Band
• Mounting Options
– 2 Post Rack (front & mid-mount)
– 4 Post Rack
– Wall Mount
S3500 Rear View
• Limited Lifetime Warranty
USB
Console
Field-Replaceable
Fan Tray
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Hot-Swappable Power Supplies
7
#airheadsconf

8. S2500 Mobility Access Switch
• Designed for Wired Access
–
–
–
–
24/48 Port 10/100/1000BASE-T
Wire-rate and non-blocking performance
Role-based access with user visibility
Per port PoE/PoE+
• ArubaStack
–
–
–
–
–
Stack up to 8 devices
Up to 384x GbE and 16x 10GbE
Single management IP address
Single configuration file
Stackable with S3500
SKU
• Flexible Forwarding Options
– Traditional L2/L3 Switching
– Tunnel traffic to Mobility Controller
• Integrated Components
– Built in fans for quiet operation
– Fixed 4-port uplinks
•
Ports
PoE Budget
S2500-24T
24x 10/100/1000BASE-T
Not Applicable
S2500-24P
24x 10/100/1000BASE-T
400W
S2500-48T
48x 10/100/1000BASE-T
Not Applicable
S2500-48P
48x 10/100/1000BASE-T
400W
1000BASE/10GBASE-x SFP/SFP+
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
8
#airheadsconf

9. S2500: Front and Rear Views
• Fixed Components
LCD
Display
– Built-in 4xSFP/SFP+ Uplinks
– Integrated Power Supply
• PoE Budget
S2500 Front View
– 400W
– PoE Priority Available
• Management
Fixed 10/100/1000BASE-T Ports
Ethernet
Out-of-Band
Fixed
4x 1000BASE-x/10GBASE-x
(SFP/SFP+) Ports
RJ-45 & Mini-USB
Console
Console (RJ45 & mUSB Serial)
Out-of-band Ethernet
USB Storage
LCD Display
• Dimensions & Airflow
S2500 Rear View
USB
–
–
–
–
– 1RU
– 1.75˝ (H) x 17.5˝ (W) x 12˝ (D)
– Side to side airflow
Integrated Fixed Fans
Power Supply
• Mounting Options
– 2 Post Rack (Front)
– Wall & 2-Post Mid Mount
• Limited Lifetime Warranty
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
9
#airheadsconf

10. S1500 Mobility Access Switch
• Designed for Wired Access
–
–
–
–
12/24/48 Port 10/100/1000BASE-T
Wire-rate and non-blocking performance
Role-based access with user visibility
Per port PoE/PoE+
• ArubaStack
– Stack up to 8 devices
– Single management IP address
– Single configuration file
• Flexible Forwarding Options
– Traditional L2/L3 Switching
– Tunnel traffic to Mobility Controller
• Integrated Components
– Built in fans for quiet operation (24P/48P)
– Fanless (12P)
– Fixed 2-port (12P) & 4-port (24P/48P)
uplinks
•
SKU
Ports
PoE Budget
S1500-12P
12x 10/100/1000BASE-T
120W
S1500-24P
24x 10/100/1000BASE-T
400W
S1500-48P
48x 10/100/1000BASE-T
400W
1000BASE-x SFP
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
10
#airheadsconf

11. S1500-24P/48P: Front and Rear Views
•
– Built-in 4xSFP Uplinks
– Integrated Power Supply
Mode LEDs and
Selector
•
S1500-48P Front View
PoE Budget
– 400W
– PoE Priority Available
•
Fixed
4x 1000BASE-X
(SFP) Ports
48x 10/100/1000 (RJ45) Ports
Fixed Components
S1500-24/48P Rear View
Features & Scaling
– Same features as S2500/S3500
– Reduced scaling vs. S2500/S3500
•
Management
– Console (RJ45)
– USB Storage
•
Dimensions & Airflow
– 1RU
– 1.75˝ (H) x 17.5˝ (W) x 12˝ (D)
– Side to side airflow
USB
Integrated Power Supply
•
– 2 Post Rack (Front)
– Wall & 2-Post Mid Mount
Console
•
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
11
Mounting Options
Limited Lifetime Warranty
#airheadsconf

12. S1500-12P: Front and Rear Views
•
Fixed Components
– Built-in 2xSFP Uplinks
– Integrated Power Supply
•
S1500-12P - Front View
– 8x PoE/PoE+ with 120W Budget
– PoE Priority Available
•
12x 10/100/1000Base-T
With 8x PoE/PoE+)
Mode LEDs and
Console
Selector
RJ-45 USB
2x 1000BASE-x
(SFP)
Cooling Vents on
Top and Bottom for
Fanless Design
•
Management
– Console (RJ45)
– USB Storage
Dimensions & Airflow
- 1.72" (H) x 13" (W) x 8.9" (D)
– Fanless
S1500-12P - Rear View
•
Mounting Options
– Desktop (Rubber feet included)
– Rack & Wall Mount (Included)
– Magnet Mount (Optional)
Integrated
Power Supply
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Features & Scaling
– Same features as S2500/S3500
– Reduced scaling vs. S2500/S3500
•
Security Lock Slot
PoE Budget
•
12
Limited Lifetime Warranty
#airheadsconf

13. Power over Ethernet Support
• All “P” models support PoE on all ports
– Both IEEE 802.3af (PoE), IEEE 802.3at (PoE+) & Pre-Standard
– Ready for PoE+ devices today (e.g. 11ac APs)
• Share PoE budget across ports
– PoE draw automatically negotiated by connected device
– Minimize design and configuration effort
• Ability to limit PoE output per port
– Helps manage PoE usage with limited PoE budgets
• Prioritize PoE availability during a power loss
– Ensure critical devices remain available
– Ports set to low (default), high or critical
– Aruba APs automatically recognized and set to “high”
• Efficient use by defining PoE time-of-day profiles
– Shut-off PoE during non-use hours and/or days
– Power cost savings and physical security
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
13
#airheadsconf

14. S1500/S2500 PoE Budget
S1500-12P
150W PSU with
120W budget
S1500/S2500-24P/48P
580W PSU with
400W budget
Max Power
at Device (W)
Max Power at
Switch (W)
Number of Devices
Supported
Number of Devices
Supported
802.3af
12.95
15.4
7
25
802.3at
25.5
30
4
13
AP-92/93
8
8.35
8
47
AP-93H
9
9.45
8
42
AP-104/105
12.5
13.4
8
29
AP-114/115
13
13.98
8
28
AP-124/125
16
17.5
6
22
AP-134/135
12.5
13.4
8
29
AP-224/225
15
16.3
7
24
AP-175
18
20
6
20
Class/AP
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
14
#airheadsconf

15. S3500 PoE Budget with 600W P/S
PSU 0 (600W)
(standalone)
400W budget
PSU 1 (600W)
(redundant)
400W budget
PSU 1 (600W)
(load sharing)
689W budget
Max Power at
Device (W)
Max Power
at Switch (W)
802.3af
12.95
15.4
25
25
44
802.3at
25.5
30
13
13
22
AP-92/93
8
8.35
47
47
48
AP-93H
9
9.45
42
42
48
AP-104/105
12.5
13.4
29
29
48
AP-114/115
13
13.98
28
28
48
AP-124/125
16
17.5
22
22
39
AP-134/135
12.5
13.4
29
29
48
AP-224/225
15
16.3
24
24
42
AP-175
18
20
20
20
34
Class/AP
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Number of Devices Supported
15
#airheadsconf

16. S3500 PoE Budget with 1050W P/S
PSU 0 (1050W)
(standalone)
850W budget
PSU 1 (1050W)
(redundant)
850W budget
PSU 1 (1050W)
(load sharing)
1465W budget
Max Power at
Device (W)
Max Power
at Switch (W)
802.3af
12.95
15.4
48
48
48
802.3at
25.5
30
28
28
48
AP-92/93
8
8.35
48
48
48
AP-93H
9
9.45
48
48
48
AP-104/105
12.5
13.4
48
48
48
AP-114/115
13
13.98
48
48
48
AP-124/125
16
17.5
48
48
48
AP-134/135
12.5
13.4
48
48
48
AP-224/225
15
16.3
48
48
48
AP-175
18
20
42
42
48
Class/AP
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Number of Devices Supported
16
#airheadsconf

17. Features & Capabilities Overview
Platform / Layer 2 Features
Routing / Branch Features
• Spanning Tree
- Multiple Spanning Tree (MSTP)
- Rapid PVST+
• Link Aggregation Group
• Hot Standby Link
• L2 Generic Router Encapsulation
• Voice VLAN
- LLDP-MED
- CDP Fingerprinting
• Port Security
- DHCP Snooping, DAI & IPSG
• Quality of Service
- Strict Priority Queuing
- 1 Rate Tri-Color Policing
• Ethernet OAM 802.3ah
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
• Routed Virtual Interfaces (RVI)
• Static Routing
• OSPFv2
- MD5 Authentication
- Route Filtering
• Policy Based Routing
• Virtual Router Redundancy Protocol
• L3 Generic Router Encapsulation
• Multicast
- PIM-SM
- IGMP Snooping/MLDv1
• Network Address Translation
• Stateful Firewall
• Site to Site VPN
- Includes OSPF over VPN
17
#airheadsconf

18. Features & Capabilities Overview
Authentication & Security
Aruba Portfolio Integration
• Role Based User Access
• User Derived Roles
- MAC Address Variable Match
- DHCP Signature Match
- LLDP/CDP Phone Match
• AAA Authentication
- 802.1x
- MAC Auth
- Captive Portal (Internal/External)
• External Authentication Servers
- Radius
- TACACS+
- LDAP
• Radius Fail-Open
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
• Aruba Activate
• Mobility Controller
- Tunneled Node
- AirGroup
- Auto AP PoE Prioritization
- Auto AP QoS Trust
• Instant AP
- Auto AP PoE Prioritization
- Auto AP QoS Trust
- Rogue AP Enforcement
- VLAN Sharing
• ClearPass Policy Manager (CPPM)
- Downloadable Roles & ACLs
- Redirect to ClearPass Guest
18
#airheadsconf

19. ArubaStack
•
Supported on All Platforms
– S2500/S3500
•
Includes mixed family ArubaStack support
which creates cost optimized wiring closets
– S1500
•
Join Up to 8 Mobility Access
Switches
– 10GBase-X or DAC
– 1GBase-X
– Up to 10km Links
•
Closet 1
Simplified & Cost Optimized
10GBase-SR/LR/LRM
– Single management IP address
– Single configuration file
•
Flexible Access Architecture
ArubaStack
extends a single
managed stack
across wiring
closets
– Extend stack across wiring closets and&
buildings
– Right-size number of uplinks to
distribution/core
•
Built-in Redundancy
– Automatic insertion/removal
– Optimized traffic forwarding
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Closet 2
19
#airheadsconf

20. AirWave Management Platform &
Mobility Access Switch
• Hardware Monitoring & User Visibility
– Inventory and Uptime
– Visibility Into Wired Network Usage
– SNMP Trap and Syslog Support
• Software Configuration & Firmware Management
– Configuration Changes
– Configuration Backups
– Firmware Upgrades
• Reporting
– Compliance Reporting
– Report and Track Wired Users
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
20
#airheadsconf

21. Aruba Activate
• Automates Product
Installation
1. Customer Enables Service
& Inputs Provisioning Rules
Hi Mobility
Access Switch!
• Automates Software
Updates
Aruba
Activate
3. When TFTP fails, the Mobility
Access Switch attempts to
contact Activate. Mobility
Access Switch sends Serial
Number and system MAC
address.
• Inventory Management
Hi Mobility
Access Switch!
4. Airwave responds
with Airwave IP, Shared
Secret, Group Name
and Folder Name.
Help me Aruba
Activate, you’re my only
hope!
Hi Airwave!
TFTP? Are
Configure
you there?
Me!
Airwave Management Platform
5. Mobility Access Switch contacts Airwave and
provides Shared Secret, Group Name and Folder
Name.
Headquarters Location
6. Airwave contacts Mobility Access
Switch and pushes down group
configuration
Simplify and enable rapid deployment
Mobility Access Switch
Yippie! All
Configured!
Branch Location
2. Mobility Access Switch first
attempts to download a configuration
via TFTP
1. Connect device 2. Verify LEDs GREEN 3. Move to new location 4. Repeat steps 1  3
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
21
#airheadsconf

22. Software Defined Networking
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
22
#airheadsconf

23. Software Defined Unified Access
Access Policy
Analytics
Content
Mobility State
Network Apps
Performance
SDN Control Plane
Onboard New Apps,
BYOD & Guests
ClearPass
Flow Awareness,
App Services
Controller
Monitor Wi-Fi, Wired
& WAN
AirWave
Simplify Network Ops
User
Personalized Experience
Management Location
IT
VPN
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
23
#airheadsconf

24. Airgroup Today
Guest VLAN: 999
Campus-PSK VLAN: 100-104
Campus-802.1x VLAN: 200-204
VLAN 400
VLAN 500
Mobility Controller
Airwave Management
Platform (Optional)
ClearPass Policy
Manager (Optional)
Multicast DNS traffic is forwarded via
GRE to Mobility Controller to provide
AirPlay/AirPrint services between
VLANs and between Wired/Wireless.
Core/Distribution
Registered
to: User X
Role Faculty
Guest
Registered
to: User B
Role Student
Guest
Registered
to: User X
Role Faculty
Registered
to: User A
Role Student
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Guest
Registered
to: User B
Role Student
Registered
to: User C
Role Student
Registered
to: User Y
Role Faculty
*New in AOS 7.2
24
Registered
to: User C
Role Student
#airheadsconf

25. Flow Steering Tomorrow
OF
• Virtual paths per
user/app
• Unified access on
multi-vendor network
• Stitching flows
across roles
OF
OF
OF
OF
OF
OF
OF
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
OF
OF
25
OF
OF
OF
#airheadsconf

26. Aruba AP Interworking
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
26
#airheadsconf

27. Aruba AP Interworking
Hi! You’re critical to the network
so I’m going to set your PoE
priority to high!
Auto PoE Prioritization (IAP/CAP)
Hi! I’m an
Aruba AP!
Hi! You’re an extension of the
access layer so I’m going to
trust your QoS markings
Auto QoS Trust (IAP/CAP)
Hi! I’m an
Aruba AP!
I’ll shut it down! I’ll block its
traffic if I find it on trunk or
shutdown the access port
Rogue AP Enforcement (IAP)
ALERT! I’ve found a
Rogue AP!
VLAN Sharing (IAP)
Alright, I’ll automatically add
them to our trunk port. Thanks!
I’ve created 3 VLANs!
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
27
#airheadsconf

28. Begin Demo 1
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
28
#airheadsconf

29. Role Based User Access
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
29
#airheadsconf

30. Aruba AAA View Of The World
Our Mobility Access Switches see…
Manufacturers
Via MAC OUI
MAC
Addresses
Usernames/P
asswords
Operating Systems
Via DHCP
Fingerprinting
IP Phones
Via Device-Type
Fingerprinting
And our security enforcement model uses…
User-roles
…provisioned locally or dynamically
which simplifies AAA deployments
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
30
#airheadsconf

31. What is User-Role?
A user-role is a container that consists of:
•
•
•
•
•
•
VLAN ID
Access Control Lists
QoS Profile
Policer Profile
Captive Portal Settings
VoIP Profile
…A user-role can be referenced locally or passed
down via a Radius Vendor Specific Attribute
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
31
#airheadsconf

32. How Do I Implement User-Roles?
•User Derivation Rules
• Manufacturers by Vendor OUI
– Instead of pre-populating a user database or a static MAC bypass list
with MAC addresses from the same vendor, create a UDR to match on
the Vendor’s OUI (first 6 digits or 24 bits) and assign a VLAN or userrole.
• Operating Systems by DHCP Fingerprinting
– Operating systems and some classes of devices utilize unique DHCP
messages (e.g. the options they request, the order of the options). A
UDR can be created to match on that unique fingerprint or signature
and assign a VLAN or user-role.
• IP Phone by Device-Type Fingerprinting
– IP Phones and AAA don’t always get along. Device-Type fingerprinting
allows you to match on an IP Phone’s LLDP/CDP “phone” capability
announcement so you can create a UDR to assign a VLAN or user-role.
No External Radius Required!
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
32
#airheadsconf

33. How Do I Implement User-Roles?
•Traditional AAA Services
• 802.1x
– For clients with 802.1x compatible supplicants, 802.1x provides secure
access using usernames/passwords and/or certificates. Authenticated
users can be assigned a default user-role or a specific user-role.
• MAC Authentication
– For network assets that do not support 802.1x, MAC authentication can
be used to allow access to the network. Authenticated users can be
assigned a default user-role or a specific user-role.
• Captive Portal
– For guest clients, a web page can be provided so that they can login
and gain access. Guest users can then be assigned a specific user-role
limiting their network access.
Supported with Internal and External Auth Servers!
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
33
#airheadsconf

34. Begin Demo 2
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
34
#airheadsconf

35. ClearPass Policy Manager
Integration
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
35
#airheadsconf

36. ClearPass Policy Manager Integration
Context
•
•
•
•
•
Policy Definition
Policy Enforcement
User: Joe Smith
Role: Guest
Device: Apple iPad
Date: M-F, 8am-5pm
Access: Internet
2. ClearPass Policy
Manager returns Role
& Policy for
User/Device
1. User provides their
credentials and other
context to Authenticate
Mobility
Controller
802.11n AP
Mobility Access
Switch
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
ClearPass
3. Role & Policy pushed
to the Mobility Controller
for Role & Policy
Enforcement**
3. Role & Policy pushed
to the Mobility Access
Switch for Role & Policy
Enforcement
**Roadmap
36
#airheadsconf

37. Begin Demo 3
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
37
#airheadsconf

38. Thank You
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
38
#airheadsconf

39. MACAO
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
39
#airheadsconf