Breakout - Airheads Macau 2013 - WLAN Management & Troubleshooting with AirWave Topics Include: AirWave overview Diagnosing client RF problems Proactive management Visual RF Reports Triggers & Alerts Rogue detection Configuration AirWave 8.0 Multi-Server

1. WLAN Management & Troubleshooting
with AirWave
Carl Mower, VP Network Management Engineering
November 2013
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
1
#airheadsconf

2. Agenda
Everything in this presentation
is from AirWave 7.7, unless
specially noted by:
AirWave overview
Diagnosing client RF problems
Coming
soon in
8.0
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
2
#airheadsconf

3. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
4
#airheadsconf

4. AirWave manages it all
Aruba
WLAN
Wired
Legacy
WLAN
Aruba
Networks
Migrate from
Cisco
Controllers &
APs
Instant
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
Any MIB-II
compliant
device
Motorola
Legacy
5
Outdoor /
Mesh
Monitor
network activity
Aruba
Users &
Devices
Aruba AP175
Classification &
reporting
Integration with
MDM
Aruba
AirMesh
#airheadsconf

5. Aruba Management Architecture
AirWave
• Long-term History & Trending
• WLAN Troubleshooting
• Visualization & Reporting
Controller (or VC)
• Centralized Radio Management
• Role based Policy Enforcement
APs / AMs
• 802.11 radios
• Integrated IDS/IPS
• Spectrum Analysis
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
6
#airheadsconf

6. Data Flow to AirWave
Airwave
Email, SNMP, Syslog
NMS
Controller
Virtual
Controller
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
7
#airheadsconf

7. AirWave Groups & Folders
Groups
Define Configuration Standard
Devices share config in Group
Defines polling intervals and protocol
Share same Firmware level on devices
Groups are non-hierarchical
Folders
Similar to Directory structure on your PC
Common monitoring, alerting
Control role based access
Hierarchical based organization
No limit on level depth
Every device associated with ONLY ONE Group and Folder
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
8
#airheadsconf

8. AirWave 7.7 & 8.0
AirWave 7.7
AirWave 7.7.6
– 10 new visibility features (see next)
– IAP GUI config
– Application visibility
– 7.3 switch config profiles
– No more Flash graphs
– Zero-touch config for switches
– Support 11ac, new APs, AOS 6.3
– Support for IAP 3.3
– SNMP  AMON for client & AP data
– VisualRF speedup
AirWave 8.0
Coming
soon in
8.0
– Separate firmware download & reboot
– Support for IAP 3.4 & 4.0
– Integration w/ Image Server
– Multi-server AirWave
– Added Cisco 1600 & 2600
– UI refresh including migration of
VisualRF to HTML5
– Run commands repeatedly
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
10
#airheadsconf

9. New Visibility Features Added in 7.7
1. Watched Clients – to show status of VIP clients
2. RF capacity dashboard – to show heavily-used radios/APs
3. Anomaly detection – to find anomalies in client counts or bandwidth used
4. Client steering table & report – to show ARM3.0 steering events
5. Graphs no longer in Flash – to enable AirWave on iPads
6. AppRF – to show PEF session data over time
7. Client health metric added to existing RF performance dashboard
8. Client health indications displayed for clients on VisualRF floorplans
9. Summarize reports by folder –show heaviest usage by folder/geography
10. Trigger enhancements – eliminate stale events
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
11
#airheadsconf

10. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
16
#airheadsconf

11. User “gmurphy” calls helpdesk…
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
18
#airheadsconf

12. Client Diagnostic View
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
19
#airheadsconf

13. Overlay: Client Location
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
20
#airheadsconf

14. Overlay: Heatmap
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
21
#airheadsconf

15. Overlay: Data Rate
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
22
#airheadsconf

16. Overlay: Client Health
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
23
#airheadsconf

17. Client Match Events
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
25
#airheadsconf

18. Client Match Events - Detail
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
26
#airheadsconf

19. Client Detail
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
28
#airheadsconf

20. Client Detail
Detailed information
for the selected client:
• Device info
• Current association
• Graphs
• Current location (VRF)
• Alerts for that client
• Client match events
• Radios that hear client
• Association history
• Device events
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
29
#airheadsconf

21. Radio Diagnostics
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
30
#airheadsconf

22. All Graphs in 7.7 Now HTML5
Graphs in AirWave 7.6 and earlier were Flash-based
All graphs in AirWave 7.7 are converted from Flash to HTML5
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
32
#airheadsconf

23. All Graphs in 7.7 Now HTML5
By clicking on a graph, can then zoom in/out, pan,
and hover (to get values for each point)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
33
#airheadsconf

24. Run CLI command(s) at intervals
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
35
#airheadsconf

25. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
37
#airheadsconf

26. Application Visibility
Collections of 9-tuples:
• Source-IP
• Source-port
• Destination-IP
• Destination-port
• Protocol
• Device type (Win7, iPad, iPhone…)
• Role (employee, guest…)
• ESSID (production, guest…)
• Location (folder)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
39
#airheadsconf

27. Application Visibility: Overview
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
40
#airheadsconf

28. Application Visibility: by Destination
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
41
#airheadsconf

29. Application Visibility: by ESSID
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
42
#airheadsconf

30. RF Performance
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
44
#airheadsconf

31. RF Performance
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
45
#airheadsconf

32. RF Capacity
2 radios were
“heavily utilized”
80-100% of the
time.
(“Heavily utilized” is
80%+ utilization).
(Only “on time” is
considered. That is,
blocks of time the
radio is doing
something, not the
middle-of-the-night).
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
47
#airheadsconf

33. RF Capacity
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
48
#airheadsconf

34. RF Capacity
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
49
#airheadsconf

35. Watched Clients
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
51
#airheadsconf

36. Network Deviations
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
53
#airheadsconf

37. Network Deviations
Anomalies illustrated for
clients and bandwidth.
Shown here, the current
reading (blue, green),
plotted against 40-week
average +/– one
standard deviation.
Average for any given
period of time, (for
example, noon-12:10 on
a Friday), is calculated
for that same time-period
(noon-12:10) for the
previous 40 Fridays.
(Average is NOT simply
the previous few days).
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
54
#airheadsconf

38. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
56
#airheadsconf

39. VisualRF
Review Coverage
Heatmaps
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
58
#airheadsconf

40. VisualRF
Visualize Rogue
AP Location
Locate Interference
sources
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
59
#airheadsconf

41. VisualRF
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
60
#airheadsconf

42. VisualRF 8.0: FlashHTML5 for iPad
In AirWave 8.0, VisRF moves to HTML5.
Coming
soon in
8.0
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
61
#airheadsconf

43. VisualRF 8.0: HTML5
Coming
soon in
8.0
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
62
#airheadsconf

44. VisualRF 8.0: HTML5
Coming
soon in
8.0
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
63
#airheadsconf

45. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
65
#airheadsconf

46. Custom & Pre-Defined Reports
20 pre-defined reports to choose from…
…or make a custom report from any combination of the 170+ “sections” available above
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
66
#airheadsconf

47. Custom Reports
Filter custom reports by:
• Folder
• Group
• [Infrastructure] Device type
• ESSID
• End-user role
• Client: OS, chipset, manufacturer
Also:
• Pick report range (start, end)
• Schedule recurring report execution
• Email report
• HTML, CSV, PDF
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
67
#airheadsconf

48. Custom & Pre-Defined Reports
Now to highlight 4 reports…
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
68
#airheadsconf

49. RF Health Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
70
#airheadsconf

50. RF Health Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
71
#airheadsconf

51. RF Health Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
72
#airheadsconf

52. RF Health Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
73
#airheadsconf

53. Client Session Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
75
#airheadsconf

54. Client Session Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
76
#airheadsconf

55. Client Session Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
77
#airheadsconf

56. Client Session Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
78
#airheadsconf

57. Client Session Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
79
#airheadsconf

58. Client Session Report
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
80
#airheadsconf

59. Client Steering Report
Client match actions by:
• Folder
• AP
• Client
Details of each match
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
82
#airheadsconf

60. Client Steering Report
Client Steering Report
• Steers by device type
• By steering reason
• By band (11ac, n-5G, n-2.4)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
83
#airheadsconf

61. PCI Compliance Report
Shows results of an audit
of the WLAN against
specific PCI
requirements.
For each PCI
requirement, shows
failing cases, (if any).
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
85
#airheadsconf

62. Most by Folder (Region) Report
Summarize max
concurrent clients and
utilization by folder.
When each folder
represents a geographic
location, useful to find
“busiest” locations.
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
87
#airheadsconf

63. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
89
#airheadsconf

64. Triggers
35 different trigger
types.
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
91
#airheadsconf

65. Triggers
Configurable attributes common to all triggers:
• Severity (normal, warning, minor, major, critical)
• Limit by folder
• (If folder specified…) do/do-not include sub-folders
• Limit by group
• Notes
• Alert via Email (if so: specify sender Email and 1+ recipients)
• Alert to NMS (if so: select 1 or more destinations)
• Optionally suppress future alerts until first is acknowledged
Also, limiting conditions unique to each trigger type
A few select triggers and their unique conditions are highlighted…
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
92
#airheadsconf

66. Triggers
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
93
#airheadsconf

67. Triggers: Device Down
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
94
#airheadsconf

68. Triggers
Device Down
• Limit number of outstanding down events
• Must be down X minutes
• Suppress thin-AP-down when controller down
• Suppress device-down when upsteam device is down
• By device type (AP, controller, RAP, switch…)
• Minutes down threshold
Device Up
• Auto acknowledge corresponding down event
• Match by device type (AP, controller, RAP, switch…)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
95
#airheadsconf

69. Triggers
AP Usage
• Direction: up, down, combined
• Threshold & duration to measure
Channel Utilization
• Interference %
• By radio type (11ac, 11a, 11b, 11g, 11n, …)
• Time busy, receiving, transmitting
Radio Noise Floor
• By device type (AP, controller, RAP, switch…)
• Noise floor
• By radio type (11ac, 11a, 11b, 11g, 11n, …)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
96
#airheadsconf

70. Triggers
Device Event
• Event contains sub-string
• Event type (syslog, SNMP trap)
• SNMP trap category (HW, IDS, client security, AP security, rogue…)
• Syslog category and/or severity
Radio Down / Radio Up
• By radio type (11ac, 11a, 11b, 11g, 11n, …)
802.11 Frame Counters / 802.11 QoS Counters
• 110+ different counters by threshold
New client discovered
New device discovered
• By device type (AP, controller, RAP, switch…)
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
97
#airheadsconf

71. Triggers
Interface Usage
• Interface label, mode, name
• Interface speed in / out (Mbps)
• Interface type
• By radio type (11ac, 11a, 11b, 11g, 11n, …)
Config Mis-match
Device Resources
• By device type (AP, controller, RAP, switch…)
• CPU or memory threshold
Rogue Device Classified
• By classification (valid, neighbor, rogue, …)
• Confidence level
• Threat level
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
98
#airheadsconf

72. Alerts
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
100
#airheadsconf

73. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
102
#airheadsconf

74. Rogue: Rules
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
104
#airheadsconf

75. Rogue: Add a Rule
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
105
#airheadsconf

76. Rogue: Rules
Detected on WLAN, LAN
Detecting AP Count (at least, at most)
Encryption Type
Network Type (Infrastructure, AdHoc)
Signal Strength
SSID (matches, does not match, regex)
Detected Client Count
IP Addresss
Manufacturer
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
106
#airheadsconf

77. Rogue: List
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
107
#airheadsconf

78. Rogue: List Columns
Classification (rogue, neighbor, valid)
Threat Level
Classifying Rule
Controller Classification
Heard on Wire?
Number of Detecting APs
SSID
Signal Strength
Encryption Type
Wireless Channel
Radio Vendor
First, Most-recent Discovering AP
First, Most-recent Discovery Date/Time
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
108
#airheadsconf

79. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
110
#airheadsconf

80. IGC: Just like Instant embedded UI
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
112
#airheadsconf

81. IGC: can add a note to any field
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
113
#airheadsconf

82. IGC: multi-edit
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
114
#airheadsconf

83. Switch config
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
116
#airheadsconf

84. Zero-Touch Provisioning
Site A - Configuration A
Site B – Configuration B
Site C – Configuration C
Instant AP connects to AirWave
server via HTTPS and
associates to the Site A group
Instant AP connects to Aruba
Activate via HTTPS and
downloads provisioning
details
Aruba Activate™
1
Secure Data Center
2
10 a.m.
Site C
Site B
Site A
10:02 a.m.
3
AirWave™
10:07 a.m.
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
AirWave pushes the latest
software image and Site A
configuration
118
Aruba Instant™
#airheadsconf

85. Device Configuration Management
Discover Devices
Analyze Device
Audit
Configuration
AirWave can Discover, Audit and
Fix configuration mismatches or
settings to the managed devices
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
120
#airheadsconf

86. Config Compliance Graph
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
121
#airheadsconf

87. Agenda
AirWave overview
Diagnosing client RF problems
Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
123
#airheadsconf

88. Current single-server architecture
UI
report gen
swarm handler
database
SNMP trap recvr
AMON recvr
AW-RRD
config gen/audit
work
queue
ALC workers
Visual RF
SNMP pollers
message bus
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
125
#airheadsconf

89. Multi-server architecture
Coming
soon in
8.0
database
database master
database backup
OpenTSDB
OpenTSDB
OpenTSDB
worker machine #1
UI
worker machine #2
worker machine #3
config gen/audit
report gen
Visual RF
Visual RF
Visual RF
ALC workers
ALC workers
ALC workers
AMON recvr
swarm handler
SNMP pollers
SNMP trap recvr
work queue via [distributed] RabbitMQ message bus
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
126
#airheadsconf

90. Thank You
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
127
#airheadsconf

91. Macau 2013
CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved
128
#airheadsconf