Extend mobility to remote branch networks with Aruba's new cloud services controllers and Aruba Instant
•Download as PPTX, PDF•
2 likes•3,490 views
Extend mobility to remote branch networks with Aruba's new cloud services controllers and Aruba Instant
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Extend mobility to remote branch networks with Aruba's new cloud services controllers and Aruba Instant
Similar to Extend mobility to remote branch networks with Aruba's new cloud services controllers and Aruba Instant (20)
More from Aruba, a Hewlett Packard Enterprise company
More from Aruba, a Hewlett Packard Enterprise company (20)
Recently uploaded
Recently uploaded (20)
Extend mobility to remote branch networks with Aruba's new cloud services controllers and Aruba Instant
- 1. #ATM15 | Extend mobility to remote branch networks March 2015 @ArubaNetworks
- 2. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved2#ATM15 | Agenda • Branch Solutions Overview • Branch Disruptions, Cost Savings • Cloud Services Controllers and Branch Services • Instant Solution Update @ArubaNetworks
- 3. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved3#ATM15 | Branch Solution Overview CSC IAP RAP INTERNET
- 4. 44#ATM15 | Branch Disruptions, Cost Savings
- 5. 5 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | Disruptive Changes for Branch IT ETHERNET/3G/4G LEGACY WAN CONNECTIVITY CLOUD APPS LOCAL APP SERVERS E3 By 2016, 30% of the advanced attacks will enter organizations via branch networks. Public cloud IaaS will grow to over $34B worldwide by 2018. CLOUD SECURITY ARCHITECTURES DEDICATED SECURITY APPLIANCES
- 6. 6 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | New Requirements for the Branch Network Unified role-based policies and network rightsizing WIRELESS + WIRED Threat management and secure guest access SECURITY WAN optimization, WAN health monitoring, and availability during failures WAN INTELLIGENCE Visibility and quality of services for business critical applications CLOUD PERFORMANCE
- 7. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved7#ATM15 | Cost Savings By Rightsizing The Branch Eliminate the need for separate WAN service router, firewall... One platform for wireless and wired clients with common policy enforcement Unified wireless architecture across campus and branch Deliver the all-wireless branch office with unified communications
- 8. 88#ATM15 | Cloud Services Controller Positioning
- 9. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved9#ATM15 | Branch Cloud Services Controller Positioning
- 10. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved10#ATM15 | Controller Portfolio
- 11. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved11#ATM15 | 7024 Cloud Services Controller 7024 Front View 24x 10/100/1000BASE-T PoE/PoE+ LCD Display 2x 10GbE 7024 Rear View Console USB Integrated Power Supply Ethernet OOB Performance • 4Gbps firewall • 3.3Gbps encryption • 32K firewall sessions Capacity • 32 APs • 2K client devices Network Interfaces • 24 x 10/100/1000BASE-T PoE/PoE+ • 400W PoE/PoE+ budget • 2x 10GBase-x (SFP+) • 1x USB for 3G/4G backup Management • RS-232 (RJ-45) + mUSB console • High-Availability RJ45 • USB for image/config files • Rack mount kit included • Dimensions: 1RUx 17.5”Wx 12”D • Minimum SW: AOS 6.4.3
- 12. 1212#ATM15 | Branch AOS Features & New opportunities
- 13. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved13#ATM15 | Aruba Cloud Services Controller Software Zero-touch provisioning WAN optimization WAN survivability WAN health checks Secured ports wired access Policy-based WAN routing Context based firewall (user, app, device, location, content, reputation)
- 14. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved14#ATM15 | Branch AOS Features & New opportunities Software and Cloud Services driving to Rightsized Branch IT • Branch device and services consolidation • Cloud security services. By 2016, 30% of advanced threats will enter via branches (Source – Gartner Branch Office Security) • Cloud and guest services drive the need for hybrid WAN architectures Branch Infrastructure Refresh Trends / Opportunities ARUBA 7005 ARUBA 7010 ARUBA 7024
- 15. 1515#ATM15 | BRANCH WAN SERVICES ArubaOS 6.4.3
- 16. 16 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | Zero Touch Provisioning Public Cloud HQ / DC 7240 (Master) 7240 (Standby) MAS Internet` Security UCC MDM Location Analytics Aruba 7000 CSC Activate Server Branch CSC boots up, sends DHCP Request to obtain IP Address. Branch CSC talks to Activate, obtains head end controller IP and branch mode (local or remote node) Branch CSC establishes a secure IPSEC tunnel with MC Branch CSC downloads both local and global configurations from the head end controller CSCActivate / Head-End Pre- Provisioning • Identify CSC and provision rules in Activate • Configure Remote Node in MC, local configurations can be replicated across branches (as it applies)
- 17. 17 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | Intelligent WAN / PBR • Policy based routing to multiple WAN links (MPLS, Internet, 3G/4G) for cost savings and improved WAN usage, performance • WAN health check monitors loss and latency on WAN links, Redundancy with multiple next hops on WAN health or performance issues • Selective traffic routing to Active-Active HQ/DC (DC1, DC2 etc.) IKE IPSEC tunnels (Cellular is Standby) • Routing inside tunnels, L3 GRE over IPSEC – Corporate (IPSEC) Vs. Guest (L3 GRE) Public Cloud HQ / DC 7240 7240 MAS Internet` Aruba 7000 CSC CSC
- 18. 18 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | WAN Optimization (Compression) • WAN compression (hardware enabled) between CSC (70xx) and 72xx Campus Controllers • 15-25% average payload compression expected on traffic between branch and HQ/DC • The Master to Branch Cloud Services Controller traffic over IPSEC will be compressed and decompressed, Encrypted traffic has NO compression HQ / DC 7240 7240 MAS Aruba 7000 CSC CSC
- 19. 19 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | Intelligent WAN / Bandwidth Contracts • Application or App Category bandwidth contracts on WAN Uplinks • Limit App or App category bandwidth on non-critical applications (E.g. Social Media, Entertainment etc.) • AppRF / DPI and Advanced QoS to prioritize app/app categories on WAN uplinks Public Cloud HQ / DC 7240 7240 MAS Internet` Aruba 7000 CSC CSC Business Low Business Critical
- 20. 20 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | WAN Authentication Survivability AirWave ClearPass Aruba 7000 CSC Aruba 7000 CSC HQ / DC 7240 7240 Auth TLS Survivability: Local caching of client credentials, clients will stay connected on WAN failure. Back-Up PSK SSID: Switches from 802.1X SSID to PSK SSID on WAN failure, useful for new clients.
- 21. CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved Aruba / Palo Alto Integration Data Center Aruba CSC w/ PA Global Protect PA Gateway / Portal Branch (US) Aruba CSC w/ PA Global Protect Branch (Shanghai) 1 1 Aruba CSC w/ PA Global Protect 2 Aruba CSC w/ PA Global Protect 2 2 Private Cloud On Firewall failure or de- commission, traffic will get re- routed to FW with the next highest priority 3 PA Gateway Aruba 72xx MC SAAS Pre-Provisioning:- - Install PA certificates at 72xx (MC) - Configure PA portal IP under PAN options in the MC under Configuration -> Branch -> Smart Config -> WAN
- 22. 2222#ATM15 | Instant Solution Update
- 23. 23 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | Transition Content App category Individual app Web category Web reputation Allow/deny QoS Throttle Log Blacklist ON-BOARD DPI o Depth - common apps o LAN traffic CLOUD-BASED WEB POLICY ENFORCEMENT o Breadth - less common apps o Web traffic Granular Visibility & Control with AppRF New Feature: DPI + Web Policy Enforcement
- 24. 24 CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved#ATM15 | Granular App Visibility & Control Deep Packet Inspection Web Inspection • Single point of control for all traffic • Eliminate need for dedicated web filtering solution for wireless clients (CIPA compliance for K-12 in US)
- 26. CONFIDENTIAL © Copyright 2015. Aruba Networks, Inc. All rights reserved 26 Customer Quotes! “Before Aruba, it was very complicated and expensive to provide network services and remain HIPAA-compliant at our 100-plus branch locations.” “Collapsing a half dozen network appliances into one zero-configuration cloud services controller offers a tremendous cost savings.” “The medical devices we develop literally saves lives, so we have no tolerance for best-effort technology.” 70 LOCATIONS $3 BILLION ANNUAL REVENUE 1100 STORES $5 BILLION ANNUAL REVENUE 100 LOCATIONS $1 BILLION ANNUAL REVENUE
- 27. 27#ATM15 |
- 29. CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved Solution Overview Deployment Type Key Requirements Solution Telecommuter • Security (esp. environments with strict security requirements Banks, Insurance firms, Government, etc.) • Consistency of Architecture and Network operations for customers with controller based network in their campus RAPs Branch Office • Enterprise WLAN for branches with existing WAN services/switching infrastructure. Instant Branch Office • Branch-in-a-box (unified architecture with wireless, wired ports, and UTM services) • Advanced WAN Services • Consistency of Architecture and Network operations for customers with controller based network in their campus Cloud services Controllers
Editor's Notes
- Make networks mobility-defined instead of fixed
- WAN architectures are fundamentally disrupting the branch networks. The traditional legacy technologies such as T1/E1/T3/E3/ISDN/PRI have been the dominant WAN circuits for several decades. The legacy connectivity have finally started moving to Ethernet and Broadband internet, 3G/4G and LTE technologies. The slow adoption of new generation have been largely due to long term service contracts tied with ISP’s for decades. Gartner and Dell’Oro predicts that by CY18 Ethernet and Broadband technologies would dominate (80%) branch WAN connectivity. Branch office security is becoming critical for distributed enterprises with branch and remote offices and locations. As of today, all the branch traffic gets routed back to a corporate DC or HQ for security needs such as URL Filtering, Content Filtering, AV/AP, Malware, Advanced Persistent Threats (ATP) etc. Gartner predicts that enterprise will invest now in branch office security. By 2016, 30% of the advanced threats will enter via branches (Source – Gartner Branch Office Security). The recent security breaches at the big retailer – Target and others have spurred interests among the CSO and network security team to re-architect the security. Distributed enterprises are looking at cloud databases to filter and get reputations on web content, URL, applications and application categories. Customers are open to cloud security solutions for APT, Anti-Malware and legacy security needs such as Anti-Virus and Anti-Phishing. Customers are moving from dedicated security appliances at branches to cloud security solutions. Advanced Threat is handled by cloud e-mail providers and is already in place for most distributed enterprises and branch networks. Migration from MPLS circuits to Hybrid WAN (MPLS plus Broadband Internet, 3G/4G/LTE) and pure Broadband Internet WAN connectivity solutions. The traditional MPLS circuits have been expensive and customers are looking for cost effective WAN transport as the branch office traffic needs are exploding. Remote branch offices and retail locations have to provide value added guest services for customer and client loyalty. The application needs are fundamentally shifting. Applications are more and more residing in the cloud such as Box, Office 365, and SFDC etc…The newer voice technologies such as Lync are also hosted in the cloud for many distributed enterprises. The traffic patterns are no more the traditional HQ bound traffic but much more distributed to Cloud, Internet, and SAAS security databases and to lesser extent distributed data centers. The MPLS circuits are costing roughly $1000 per branch for distributed enterprises in large cities such as SF and about half the amount - $500 for 2nd tier and 3rd tier cities such as Kansas.
- Some real-world examples customers have shared with us: Retail branches want to have the ability to do role-based routing of traffic so that they can route guest traffic over one DSL link while routing Point-of-Sale and other business apps across a different DSL link. Many branches are leveraging cloud-based services like content filtering and would like to be able to deliver this more cost effectively at the branch. WAN compression has high value to help enable the move from legacy leased lines to lower cost DSL/3G/4G where compression becomes critical.
- WAN Optimization: 4 components compression, caching, de-duplication, TCP acceleration WAN Health: performs circuit test to the Master Controller (e.g. 72xx); today latency, throughput, loss; in future will test MOS/Jitter Hybrid WAN: policy based routing now; voice failover future Cloud Sec. Svcs: PA Global Protect Agent integrated in CSC so we can directly talk to FW; customer needs to already have PAFW at HQ or cloud. Saves installing the GPPA on every client.
- AppRF based PBR will be a beta feature. PBR based on AppRF or App Category will not work on NATed scenario such as URPF features turned on at the ISP Route based on User role, VLAN route the traffic Senthil Govindan PBR not supported on tunnel interfaces
- Master – Local mode Deafult is turned on both soid comptrApplication, application category, priority based routing Routing inside tunnels, routing to multiple next hops on WAN link status or latency issues Bandwidth Reservations / Rate limit non critical apps
- Pre-Provisioning:- Install PA certificates at 72xx (MC) Configure PA portal IP under PAN options in the MC under Configuration -> Branch -> Smart Config -> WAN
- Make networks mobility-defined instead of fixed