Wi-Fi Article Round-Up: 2011/04/29

Here are a collection of Wi-Fi related articles that I have found useful, interesting, or enlightening. As always, for a complete list of articles check out my shared article feed from Google Reader.


My Stuff:

• I provided tips for Cisco CCIE Lab Exam Preparation for engineers considering or already studying for Cisco's expert level certifications.
• I ran down some of the more important features included in the Cisco Wireless LAN Controller 7.0.116.0 (J-MR1) code release. John Cox over at Network World was also very kind and linked to my post! Thanks John!
• I compiled Wireless Access Point Feature Matrices for most enterprise wireless network vendors for easier feature comparison.
• I continued my series on deploying an Aerohive wireless network with posts on the HiveManager Configuration Workflow and on completing a HiveAP Initial (Guided) Configuration.
• I started a series on Wi-Fi protocol analysis tips, beginning with the use of Wireshark Packet Colorization for easy visual identification of packets of interest, common frame exchanges, and anomalies in large trace files. I also detailed how to identify the SSID to BSSID Mappings on Cisco wireless equipment for focused analysis.
• I described how to use the Cisco Notification Service and IOS Software Checker tools to stay abreast of the latest information on Cisco products and security advisories.
• I was quoted in the press release for Fluke Networks AirCheck product version 1.2.
• I attended the CWAP version 2 beta course, along with many other Wi-Fi experts. Douglas Haider recapped both days of the class and a spectrum analysis location tip from Keith R. Parsons.

Industry Wi-Fi Articles:

• Secure Wi-Fi Hotspots are continuing to get a lot of attention, as they should. This is a necessary evolution to make Wi-Fi network access ubiquitous and secure for the next generation of mobile applications and services. When the EFF and BBB have come out criticizing the state of the industry, it's time to step up and develop a solution! How much more clear can it be... are the Wi-Fi Alliance and their industry leading members listening? Carrier Hotspots do not go far enough and leave out independent hotspot operators! Is this due solely to backroom financial deals, or are they just out of touch with their own customer's needs?!
• The Electronic Frontier Foundation (EFF) put out a call to action to support an open wireless movement (you can join by sending an email to the address provided).
• The Better Business Bureau cautioned users when using public Wi-Fi networks.
• GottaBeMobile threw out the idea of simplifying hotspot logins with NFC.
  
• Be sure to also read these excellent articles on the subject from the IBM ISS X-Force Team and Chris Byrd at RioSec. Highly recommended!
• Wi-Fi calling is gaining quite a following by current T-Mobile subscribers (and some technically inclined user on other carriers). Personally, I use Wi-Fi calling with Google Voice and Talkatone as an AT&T subscriber and have better voice service and call quality. I can't wait for this service to grow!
• Is Wi-Fi the glue that will hold the AT&T and T-Mobile merger together?
• WirelessWeek analyzed the rise of mobile VoIP and Over-the-Top VoIP providers building services for an increasingly mobile customer base.
• The Independent ran a story about fixing flaky mobile phone issues with Wi-Fi calling and UMA. PC Mag also gave kudos to Kineto, the application provider, proclaiming "Wi-Fi Calling is Awesome!"
• Jay Botelho lays out the Top Five Wireless Trends and how the line between cellular and Wi-Fi is being blurred.
• And interestingly, cellular providers are testing more of a micro-cell architecture similar to Wi-Fi in an attempt to fill in coverage holes and add capacity.
  
• The Enterprise Mobility Forum provided a great interview with the Chairman of AirWatch, a mobile device management solution provider, about the state of enterprise mobility and support for non-traditional devices within organizations. Also, ownership of mobility in the enterprise is a tricky subject.
  
• Mobile payments are coming, as Google, Mastercard, and Citigroup teamed up to develop an NFC payment system. Visa and Samsung are also getting into the NFC game for the 2012 Olympics (pun intended).
  
• Cellular data traffic offload to Wi-Fi continues to march forward in articles by Light Reading and Fierce Broadband Wireless.
  
• Wi-Fi continues to dominate, surpassing 10,000 certified products.

Techie Wi-Fi Articles:

• Marcus Burton, over at CWNP, grounded our expectations of 3-spatial stream access points (and rightly so), and provided an excellent overview of where Wi-Fi overhead comes from.
• Steve Williams highlighted issues with iPhone personal hotspots and co-channel interference. Personal hotspot capable devices are quickly becoming the bane of most network administrators, especially during large events.
• The Eye-Fi card support for Wi-Fi Direct has been released. And Wi-Fi Direct shipments are going to surge this year.
• Aruba released their AirMesh product, completing their acquisition of the Azalea Network product line.
• Cisco released Cisco Prime, their new management solution which includes Network Control System (NCS) for integrated wired and wireless management (way to go Saurabh!), and their Identity Services Engine (ISE) for contextual policy-based network security. ISE integrates with their larger TrustSec initiative.
• Proper wireless design is critical. Remember that Wireless Overkill Can Result in Poor Performance. This is often lost on many engineers. This would be a good opportunity for many to jump into the CWDP study guide!

Other IT Related Articles:

• Managing IT ... people is harder than it looks, and why many organizations get it wrong. 
• Matthew Norwood asks, if everyone has an angle then "Who Do You Trust?" when it comes to vendor or consultant pitches. A good reality check on taking information with a grain of salt and verifying claims.
• The stifling of digital media delivery models by big content producers proves they are still clueless as to what their consumers want, and are even strangling American innovation!
• Don't let your IT career get stuck in a rut, courtesy of Network World. Also, Aaron discusses the Four Stages of Expertise (In Your Mind), which is an interesting take on self-assessment psychology.
• Ethan Banks at PacketAttack stereotypes useless participants involved in incident resolution conference bridges. Absolutely hilarious, and accurate. Great job!
• Check out this interesting TED Talk on Cracking Stuxnet. Are you scared of the changing threat landscape yet?

Comic for the Week:
It's not "off-shoring", it's "best-shoring"...





Cheers (and happy reading),
Andrew

Use Cisco IOS Software Checker to Manage Vulnerabilities

Yesterday, Cisco announced a new security tool called the Cisco IOS Software Checker that allows administrators and support providers to quickly identify exposure to software vulnerabilities that have been announced by Cisco through Security Advisories and their PSIRT response team.

This can aid risk assessment efforts by reducing the labor and time involved in scouring historical security advisories, or maintaining an archived list of vulnerabilities that affect deployed platforms and software versions in your environment.

The tools is very easy to use, and the results appear accurate (although Cisco does reiterate that this tool does not replace the list of affected software versions and fixed versions listed in individual security advisory notices).

Note - This tools currently only supports devices running Cisco IOS software. Platforms such as the Wireless LAN Controllers or Adaptive Security Appliances are not supported.

To access the tool, navigate to the Cisco Security Center from the Cisco Homepage > Support > Cisco Security Center > Resources > Cisco IOS Software Checker.

Step 1 - Select the method to use within the tool
Three options exist:

1. Search by Cisco IOS Software Release - Select one or more software versions from the list.
2. Use Show Version Command Output - Copy and past the "show version" output from a device.
3. Upload a Text File from Your Local Workstation - If you have multiple software versions that you need to check, you can upload a file from your workstation that includes this list.

Step 2 - Select the Security Advisories to Search

This may include all previous security advisories, only the latest bundle, or a list of specific advisories.

Step 3 - Review the Results

A list of security advisories that affect the selections made in steps 1 and 2 are displayed for review.

This example shows the results for Cisco IOS version 12.3(8)JEA3 for Aironet wireless access points and all previous security advisories.

Revolution or Evolution? - Andrew's Take

This tool provides an easy method to review vulnerabilities that affect current software versions deployed in your environment, with links to each security advisory for more detail. Use this tool as a first step in assessing the risk to your environment, determining priorities, and developing action plans to remediate those risks.

Cheers,
Andrew

Cisco Wireless SSID to BSSID Mappings

Modern enterprise-grade wireless networks have the ability to provision multiple SSIDs on the same radios. This is very beneficial to support varying wireless requirements using the same physical infrastructure.

This is not a new concept, and has been around for quite some time. However, with the common practice by most wireless manufacturers to use a unique BSSID for every SSID, administrators often have to figure out which BSSID maps to each SSID when performing protocol analysis. This can get tricky at times, especially when SSIDs are not broadcast and client traffic is minimal. It may take a while for a protocol analyzer to capture a probe response or association response that includes the SSID. Manual verification of the BSSID can be quicker in some cases.

Cisco Autonomous BSSID Mapping
The older Cisco Autonomous access points gave administrators this capability, but with two slightly different configuration options. By default Autonomous access points supported multiple SSIDs overlaid on top of a single BSSID. This meant that only one beacon was sent out and supported all SSIDs configured on the radio. The restriction with this method was that only one of the SSIDs could be used in guest-mode, which was Cisco's terminology for broadcasting the SSID. It also made supporting different capabilities between SSIDs more difficult, since there was reliance on the client to perform active scanning and be able to correctly interpret differences between the beacon information and probe response information, if different.

The second option was to enable multiple-BSSID, which then created a unique BSSID for every SSID created on the radio. Additionally, since beacons are sent for every BSSID, SSID broadcasting could be configured independently for each. Enable multiple-BSSID globally with the command: dot11 mbssid, or on individual radios with the command: mbssid.

To view Autonomous BSSID mappings for either scenario, issue the following command:
show dot11 bssid

AP01#sh dot11 bssid
Interface      BSSID         Guest  SSID
Dot11Radio1   001c.0ed1.ac80  No   bridge
Dot11Radio1   001c.0ed1.ac80  No   wgb
Dot11Radio0   001c.0ed5.ac70  No   ccie


Cisco Unified BSSID Mapping
The newer Cisco Unified wireless network only allows one option, using multiple BSSIDs. Beacons are sent out for each SSID, and each can support varying capabilities.

To view Unified BSSID mappings using the controller, issue the following command:
show ap wlan { 802.11a | 802.11b } ap-name


(Cisco Controller) >show ap wlan 802.11a OFFICEAP01
Site Name........................................ voicepilot
Site Description................................. Voice Pilot Floor


WLAN ID         Interface          BSSID
--------         -----------        --------------------------
1               vlan102            b4:a4:e3:59:be:af
2               vlan103            b4:a4:e3:59:be:ae
4               vlan104            b4:a4:e3:59:be:ac
6               vlan105            b4:a4:e3:59:be:ab

To view Unified BSSID mappings from the access point, issue the following command:
show controllers Dot11Radio { 0 | 1 }

Vlan BSSID   Clients PSP Pri HT Encr  Key0 Key1 Key2 Key3 SSIDs MFP
   0n BEAF 0       0   0   0  0    0                     
   1  BEAF 0       1   7   3  2  204       x128           corp_ssid 0
   2  BEAE 1       0   0   3  2  224       x128           guest_ssid 0
   4  BEAC 3       0   0   3  2  204       x128           handhelds 0
   5  BEAB 4       2   4   6  0   24       x128           voice 0

This should help you make sense of all these BSSIDs you now support!

Cheers,
Andrew

Other Posts You Might Like:

• Limit SSIDs & Data Rates to Maintain Network Performance

Using Wireshark Coloring Rules to Enhance Wi-Fi Protocol Analysis

Two weeks ago I attended the Certified Wireless Analysis Professional (CWAP) version 2 beta class, held by CWNP Inc. The class was full of wireless LAN experts and was a great opportunity to share experiences and perspectives on wireless protocol operations (and to network with professionals in the field). Numerous times throughout the course attendees would exchange relevant details, tips, and tricks they found useful in real-world networks to analyze the environment. This allowed attendees to share valuable expertise they have acquired with others and promote knowledge sharing within the community.

I would like to share a few tips and tricks that I use with the broader Wi-Fi community as well.

Using Wireshark Coloring Rules to Enhance Wi-Fi Protocol Analysis
Speed up your protocol analysis kung-fu by using Wireshark coloring rules. By using packet colorization, engineers can quickly identify and find packets of interest that warrant deeper analysis within large trace files. Coloring rules can be defined in the View > Coloring Rules menu section.

Often times, engineers are using protocol analysis to either understand how a protocol operates or to troubleshoot an issue. Therefore, you may not know exactly what you're looking for until you find an anomaly or start digging deeper into a sequence of packet exchanges. When was the last time a support ticket came in with packet analysis level detail like "our handhelds are being de-authenticated by a rogue wireless IPS system"? Yeah, never.

In order to help you spot interesting packet exchanges during your initial scan of the packet trace, use coloring rules to visually distinguish common protocol exchanges and anomalies. Coloring rules use the same syntax as Wireshark Display Filters. As you find new protocol fields or interesting packets as you analyze various situations, simply create a display filter and copy it into a new coloring rule.

Here is an example of a packet trace where packet colorization indicates a station's probing (blue) and roaming (green) behavior.

Wireshark packet colorization visually identifies client probing and roaming behavior

Since most wireless networks are encrypted to meet security requirements, most protocol analysis will focus on layer 2 network operation. As such, the default coloring rules provided with Wireshark usually have little to no value for wireless engineers. Create your own custom coloring rules using Wi-Fi protocol fields found in the layer 2 header. Wireshark provides a WLAN display filter reference listing all of the available wireless fields for use in display filters.

Note - Coloring rules are applied in top-down order. If multiple coloring rules match the same frame / packet, then the higher rule is applied for colorization. Carefully select the order of coloring rules to highlight packets in the desired manner.

To help you get started, here are some of my favorite coloring rules / display filters (you download this text file and import it into Wireshark):

• 802.11 Bad FCS
  This indicates frames which were not received correctly. This is common in wireless protocol analysis due to signal differences that may exist between the intended receiver and the analysis station. These frames should be ignored as the information is likely corrupt and incorrect.
  
  wlan.fcs_bad == 1
  
  
• 802.11 Retries
  This indicates frames which were re-sent by the transmitting station, indicating RF collisions, interference or multipath. Retransmissions are common in all wireless networks, and engineers should baseline normal conditions in each environment to understand what level is abnormal. Real-time applications such as voice may require lower level of retries than other applications (typically <10%).
  
  wlan.fc.retry == 1
  
  
• 802.11 Probing
  This indicates when wireless clients are probing for infrastructure access points in preparation for a future roaming event. Behavior will vary between client devices, and can impact battery life for highly mobile clients. Additionally, poor roaming implementations can be identified if clients wait too long to probe for new access points and complete a roaming event prior to application impact.
  
  wlan.fc.type_subtype == 0x04 || wlan.fc.type_subtype == 0x05
  
  
• 802.11 Roaming (802.11 authentication, (re)association, and EAPoL / EAP)
  This indicates when a wireless client roams to a new access point and can be useful to analyze total time required by a client to complete a roam, time to complete various stages of a roam (association, EAP authentication, 4-way handshake, etc.), or to diagnose at which stage in the process a roam fails.
  
  wlan.fc.type_subtype <= 0x03 || wlan.fc.type_subtype == 0x0b || eapol

A few others that I like include 802.11 fragmentation, de-authentication, and unencrypted data.

The saying goes "you're only as good as the tools you use". Take the time to invest in your tools and learn how to properly use them to be a better engineer.

Cheers,
Andrew

P.S. A huge thanks to Kevin, Marcus, and Abbey at CWNP Inc. for organizing such a great course! The CWNP program is the best in the industry. I always look forward to the high quality content your company produces and the fostering of such a great wireless community!

Other Posts You Might Like:

• CWAP Beta Course Recap by Douglas Haider (@wifijedi)
• Locating Wireless Devices Through Spectrum Analysis by Douglas Haider (@wifijedi)

Aerohive HiveAP Initial (Guided) Configuration

Once armed with HiveAPs that are provisioned and have successfully connected to the HiveManager system, and a working knowledge of the HiveManager configuration workflow, we are ready to create and deploy an initial configuration to our HiveAPs.

Administrators can opt to configure the HiveAPs through the Guided Configuration or the Advanced Configuration. I recommend that administrators use the guided configuration until they are comfortable and fully understand all of the settings contained in the advanced configuration section.

Guided Configuration

As the HiveManger online help system states:

"When you first start using HiveManager, the number of configuration objects can be somewhat overwhelming. Common questions that arise at this stage are "What do I need to configure?" and "Where do I begin?"

HiveManager Guided Configuration Section

Luckily, the HiveManager Guided Configuration takes the administrator through the basic configuration steps required to setup HiveAPs to get a WLAN up and running. Navigate to the "Configuration" section of HiveManager. The Guided Configuration section will be visible along the left side of the screen (shown right).

To create a basic configuration to get up-and-running, we'll tackle the basic settings for each of the four objects described in the HiveManager workflow, as well as provide an overview of the optional settings in each section. Note - we will configure individual "HiveAPs" at the end, as it makes a bit more sense to do this last.

Additionally, the HiveManager Help system is context-sensitive, so if you get stuck or need to lookup an item you are unfamiliar with you can simply select Help > HiveManager Help from the upper right corner.

Note - Configuration of these profiles does not affect the current operation of the wireless network until they are applied to HiveAPs and the updated configuration is pushed out, which is covered at the end of this article.

User Profiles

Create a new user profile which controls the default settings applied to users mapped to this profile. User profiles can be applied to users statically through SSID assignment or dynamically through RADIUS assignment based on returned attributes by the server.

Basic settings include the default VLAN access and the Attribute Number used for RADIUS policy assignment of users into the correct user profile. RADIUS attributes 64, 65, and 81 are used for both VLAN and User Profile assignment, with different values of-course (shown below).

Mapping LDAP User Groups to Local User Profiles with RADIUS Attributes

Optional settings in this section include GRE or VPN tunneling for station isolation (guest WLANs) or other security requirements, L2/L3 firewall policies, QoS settings for rate limiting, queuing, and call admission control (CAC), user profile availability schedule (day & time restrictions), and SLA settings for throughput and airtime fairness.

It should also be noted that many of the settings nested within these main objects are linked to corresponding Advanced Configuration objects. These links can be followed by clicking on the "Plus" (Add) or "Notepad" (Modify) icons next to the configuration item. Once the advanced item has been configured, the user is returned to the main object to continue configuration where they left off. 

Link to Add or Modify an Advanced Configuration Item

SSID Profiles

Within the SSIDs configuration section, administrators define logical wireless networks that control the methods by which client and access points communicate with each other, which often includes authentication and encryption settings (as shown below).

SSID definition and security settings configuration in HiveManager

Advanced Access Security Settings can be displayed where indicated by the red line by clicking the link in the figure above. This allows the administrator to fine-tune Group and Pairwise (User) encryption key lifetimes and timers, including an option to enable Proactive / Opportunistic Key Caching (PKC/OKC).

It should also be noted that Aerohive has developed a unique feature called Private Pre-Shared Key (PPSK), that enables the provisioning of unique PSKs to individuals, rather than sharing a single WPA/WPA2 PSK with everyone on the same network. This prevents users from eavesdropping on each other, makes network access revocation tied to individual users, and eases access revocation by eliminating the need to update PSKs on all workstations any time an individual user access is revoked. This is a great feature for small businesses with growing user bases to maintain network security and manageability without having to invest in enterprise class authentication with 802.1x/EAP. Often times small businesses struggle with the expertise, expense, and support involved with deploying an 802.1x solution, and this helps them transition and scale until they are ready. PPSKs are also useful in guest networking scenarios as an alternative to an open network, typically with a clerk, concierge, or attendant providing guests with unique PSKs upon arrival at the establishment.

User profiles are also assigned to users connected to this SSID. In the User Profiles for Traffic Management section, define the default user profile for all users accessing this SSID. Optionally, if using WPA/WPA2 802.1x (Enterprise) also select the user profiles that are allowed to be dynamically assigned to users by a RADIUS server. If the RADIUS server does not return a user profile attribute, or returns a non-selected user profile from the list, then the default user profile is applied. For advanced security, strict enforcement of selected user profiles available for dynamic assignment can be applied, and can be configured to instruct the access point to either disconnect the user, ban the user for period of time (e.g. 60 sec.), or ban the user forever. This is a great security feature which allows a single RADIUS server (or server cluster) to handle authentication for multiple user groups while still enforcing strict network access policies. This prevents SSID hopping whereby a valid user who authenticates successfully connects to a different SSID to gain higher privileged network access rights.

Optional settings in the SSID profile include radio data rates for both 2.4 GHz and 5 GHz network bands, denial of service prevention settings, traffic filtering for management access and client-to-client traffic handling, SSID availability schedules (day & time restrictions), and several advanced configuration settings such as maximum client limit, DTIM period, fragmentation threshold, Wi-Fi Multimedia (WMM), SSID broadcast / hiding, and U-APSD power save.

WLAN Policies

The WLAN policy is the top-level object underneath which all other configuration objects are stored (except for individual HiveAP settings), and are pushed to HiveAPs to apply the operational network settings. As such, the WLAN policy ties together many objects which have previously been configured with a few new ones.

After giving the WLAN policy a name and description, define the Hive that will be used for all access points which are assigned this WLAN policy. A Hive essentially allows multiple HiveAPs to coordinate distributed wireless network control plane and data plane operations, forming a virtual software controller using Aerohive's Cooperative Control architecture. This includes forwarding and routing paths, consistency of QoS and firewall policy enforcement, layer 2 and layer 3 client roaming, and radio frequency and power management. Hive members may be on the same subnet or different subnets. It is recommended that all HiveAPs which clients can seamlessly roam between (without disconnecting) be included in the same Hive.

Configuring a WLAN Policy in HiveManager

Next, add one or multiple SSID profiles to the WLAN policy, which defines the SSIDs that will be pushed to the HiveAPs for network access. Also define the default management interface VLAN and native (untagged) VLAN for the HiveAPs. These VLAN settings help administrators segment management traffic from user traffic to meet performance and security requirements common in most organizations.

Optional settings in the WLAN policy include HiveAP physical interface traffic filters, service settings for application layer gateway (ALG) and WIPS, management servers for SNMP, syslog, DNS, NTP, and location services, QoS classification and marking, dynamic airtime scheduling, VPN service settings for identity-based tunneling (guest DMZ termination for example), and statistics collection settings.

Note - QoS classification and marking is performed globally within the HiveAP, but QoS queuing structures are defined per user-profile.

Note - If you plan on assigning HiveAPs static IP addresses, ensure that DNS servers are defined in the WLAN policy applied to the AP so that it can resolve and connect to HiveManager.

Individual HiveAP Settings

In addition to User, SSID, and WLAN Policy settings, unique settings can be configured for individual HiveAPs. Select the "HiveAPs" link from the Guided Configuration section, which will redirect to the Monitor > HiveAPs screen. Be sure to select the "Config" option button before drilling into an AP to modify the configuration instead of viewing statistics.

Once in an individual HiveAP, administrators can configure various settings that are typically unique to a single AP. These include host name, map location, assigned WLAN policy, radio modes (access, bridge, mesh), and static channel and power settings.

Configuring individual HiveAP settings

Note - To assign a WLAN Policy to multiple HiveAPs at once, select the check boxes next to each HiveAP in the Monitor > HiveAPs screen and click the Modify button. A subset of HiveAP settings are available for configuration across the selected APs.

Optional settings include configuring the built-in captive web portal and RADIUS functions, DHCP or static IP address assignment, static layer 3 roaming neighbors (beyond the dynamically discovered Hive members), administrative security credentials for console access and CAPWAP security to HiveManager, layer 2/3 routing, VLAN tag settings (override WLAN policy), and HiveAP classification (for use in variable substitution with network objects).

Updating the HiveAP Configuration

Now that all four of the Guided Configuration sections have been completed, it's time to deploy the configuration to HiveAPs.

As a precautionary step, review the configuration audit status of the access points prior to deployment to verify accuracy of the updated configuration that will be pushed to the AP. To do this, navigate to the Monitor > HiveAPs screen, ensure the "Monitor" radio button is selected, and click the red triangle next to a HiveAP to view the configuration audit.

Viewing HiveAP configuration audit details

If satisfied with the configuration items, check the box next to every HiveAP to be updated and select the Update > Upload and Activate Configuration button. Configure the desired settings which instructs how HiveManager peforms the upload, including either a complete or delta upload and activation schedule, then click the save icon. The settings section will roll upwards, allowing the administrator click the Upload button and push the settings to the HiveAPs.

Configuring the HiveManager Upload Settings

The user will be redirected to the HiveAP Update Results screen, which will show the progress of the upload and report any issues that may occur.

Viewing HiveAP Update Results

If successful, the settings configured in HiveManager are now active on the HiveAPs and the wireless network should be fully operational.

Cheers,
Andrew


Other Posts You Might Like:

• Aerohive HiveAP Provisioning Basics
• Aerohive HiveManager Configuration Workflow
• Wireless Tech Field Day - Day 1 Recap (MetaGeek, Cisco, Aerohive)
• Wireless Network Segmentation Options
• Dynamic VLAN Assignment
• The Shift to Smart APs is on the Horizon

Aerohive HiveManager Configuration Workflow

Now that the Aerohive HiveAPs have been provisioned so they can discover and connect to a HiveManager management server, let's dive into how HiveManager handles configuration workflow, object definition, and nesting. This will serve as a foundation to prepare us to deploy an initial configuration to our HiveAPs.

The HMOL dashboard shows a new access point is connected

Initial Configuration State
Log into the HiveManager dashboard to get started. If you're using Aerohive's cloud management service, connect to HiveManager Online (HMOL) at https://myhive.aerohive.com and login using your supplied account credentials. From the "Navigate myHive" splash page, select "HiveManager Online" to access the management console. Once there, you should see the new access point listed in the Dashboard.

Navigating over to the Monitor - HiveAPs section, you can see that the access point connection details. You can also get to this page by clicking the "Number of New APs" hyperlink from the Dashboard.

The HiveAP monitor page shows the access point connection details

On this screen, notice that the AP is currently connected (green chain-link), the connection is secured (green padlock), and it is in Portal mode which integrates directly with the Ethernet network, as opposed to a Mesh Point that uses a wireless backhaul into the network through other mesh points or a portal.

Hovering over the red triangle in the audit column displays the pop-up message telling you that no configuration has been pushed to the AP yet. The red triangle alerts administrators that the current configuration on the AP does not match the desired configuration based on HiveManager templates assigned to the AP. Two green squares in the audit column would indicate that the configuration matches the defined template and no action is necessary.

HiveManager Configuration Workflow
Before jumping into the configuration, it's important to understand the workflow used within the system to define configuration items and how items relate to one another. Many enterprise wireless vendors implement a logical nesting, or roll-up, of foundational configuration items into larger groupings / profiles which then are applied to the equipment. This allows for creation of multiple profiles and easier testing, verification, and deployment.

The HiveManager configuration workflow consists of the following configuration items, nesting relationships, and profile objects which are then assigned to individual HiveAPs:

It is readily apparent from this workflow that configuration of four main objects is required:

1. User Profiles
2. SSIDs
3. WLAN Policies
4. Managed HiveAP Settings

Now that we have an understanding of the logical workflow and object nesting within HiveManager, we are prepared to define and deploy a working configuration to our HiveAPs.

Cheers,
Andrew

Wireless Access Point Feature Matrices

Many customers have confusion around which access point model to select based on various factors including pricing, feature sets, performance, and other factors. This is true for almost every vendor product line, but especially so with large vendors and complex website navigation. With multiple product offerings in very similar technology space, customers are often confused about product differentiation that is almost always not apparently clear in documentation.

In fact, most vendor marketing material and product data sheets gloss over technical differences, focusing on marketing literature on the "positive" side of the equation for each and every product they have. As a customer, how are you to distinguish amongst multiple offerings, each touting how they enhance your business and deliver unparalleled services above the competitors?

Vendors carefully develop product features to ensure clear product segmentation, establish differentiated pricing levels, and maintain profit margins. This information is available, albeit sometimes in hard-to-find locations.

Customers looking to make decisions amongst multiple wireless access point product lines should reference the following vendor product matrices:

Cisco Aironet Access Point - At A Glance 
(Linked from Products > Wireless > Aironet 1040 > Product Literature > At-A-Glance > Cisco Aironet Access Point PDF)

Aruba Access Point Product Line Matrix 
(Linked from Products > Access Points > Access Point Product Line Matrix)

Ruckus ZoneFlex Specifications Matrix 
(Linked from Products > ZoneFlex Indoor > Product Wizard)

Aerohive Corporate Brochure
(Linked from Resources > Datasheets & Brochures > Aerohive Corporate Brochure)
(For detailed specs on each model, see the individual HiveAP Datasheets)

Motorola Wireless LAN Solutions At-A-Glance
(Linked from Resource Library > Wireless LAN > Enterprise WLAN Infrastructure At-A-Glance PDF)

HP E-802.11n Access Point Series Data Sheet
(Linked from HP > Networking > Resource Finder > Data Sheets)
(For detailed specs on each series, see the individual data sheets)

Other Vendors:
Meraki Compare 802.11n Access Points
Meru Individual Access Point Data Sheets
Xirrus Wi-Fi Array Product Summary
Juniper Trapeze WLAN Access Point Compare Family Models
Siemens Enterasys HiPath Wireless Access Point Data Sheet

Use these comparison tables as a reference when planning network upgrades, expansions, or new deployments.

Cheers,
Andrew

Cisco WLC 7.0.116.0 New Features

Cisco just released wireless LAN controller code version 7.0.116.0, which includes a laundry list of new features. Many of these new features have been in development for quite some time, and both partners and customers have been anxiously awaiting several.

Visit Cisco's website to see the full release notes for this code version.

Here are some of the notable new features and what they will mean for customers:

• WIPS Enhanced Local Mode
  This feature places a subset of Adaptive WIPS capabilities into access points operating in Local or H-REAP modes. Traditionally, Cisco aWIPS required Monitor mode APs. Now customers can get most of the benefits of an in-depth aWIPS deployment with the same access points that service client connections, without having to spend additional money on dedicated monitor APs. The solution still requires the WCS and MSE platforms, but can reduce CapEx and OpEx costs for customers. It is designed primarily for retail customers with distributed branch offices needing to maintain PCI compliance in the face of expanding mobile retail initiatives.
  
  By my count, ELM supports detection of 35 of 48 attacks available in the full aWIPS solution (~73%). The majority of missing attack detections are comprised of some RF DoS and Zero-Day attack detection capabilities, which are arguably not the most severe attacks (DoS) and are notoriously hard to baseline against false-positives / negatives (Zero-Day).
  
  Additionally, the focus of ELM attack detection is on the current operating channel of the AP, and has limited visibility into off-channel attacks through RRM off-channel scanning. This makes sense since the network infrastructure is performing double-duty serving clients and detecting attacks. This should not be an issue for larger network deployments with multiple APs covering most or all of the available channels. For smaller installations, this could present a serious problem however, and reduce effectiveness of the solution. However, this solution is arguably aimed at the larger retail deployments where the expense of deploying dedicated Monitor mode APs has been a problem.
  
  All in all, larger customers should take a look, while smaller customers will probably opt for a dedicated WIPS solution.
  
  
• H-REAP Fault Tolerance
  Cisco has been improving Hybrid REAP mode functionality in leaps and bounds in order to compete in distributed WLAN architecture scenarios, with the likes of Aerohive's Cooperative Control, Aruba's Instant virtual controller, Motorola's Adaptive APs, etc.
  
  H-REAP fault tolerance improves operation by removing the requirement for H-REAP mode APs to reboot when moving from standalone back to a connected state. Previously, H-REAP APs move into standalone mode without affecting locally-switched clients, but when re-joining a controller they were required to reboot and download a complete configuration which caused a service disruption during the fail-back process. Now the AP is able re-join the controller without impacting client service or rebooting, assuming it can verify the configuration matches.
  
  In addition, H-REAP WAN latency may now exceed 100ms (upwards of 2 seconds) provided customers use H-REAP Local Authentication of clients using the internal user list pushed to the access points.
  
  
• H-REAP Opportunistic Key Caching (OKC)
  Previously, H-REAP access points only supported CCKM key caching for fast roaming. Now it supports both CCKM and OKC, which should provide much broader support for fast roaming with many more clients in typical customer environments. Note that both CCKM and OKC still require the 802.1x/EAP key derivation to be completed through the controller. Any keys derived while the H-REAP AP is in standalone mode (disconnected) will not support fast roaming between multiple APs.
  
  I will also be awaiting 802.11r Fast BSS Transition support in H-REAP APs once broader market support and adoption are achieved through the Wi-Fi Alliance Voice Enterprise Certification (due out in 2011).
  
  
• Cisco Identity Services Engine (ISE) Support
  Cisco's next-generation ISE product provides context based access controls and integrates several services into a cohesive platform, including the Cisco Secure ACS authentication and Network Admission Control (NAC / Clean Access) products. This platform enables organizations to enforce network access policies based on a combination of user and device identity, and will be integrated into wireless, switch, and router platforms with software updates.
  
  ISE addresses customer needs for granular access control beyond VLANs and IP subnet policies, acknowledging the need for deeper insight into the context of the client session to drive policy enforcement. A common scenario for this today might be differential network and application access based on user and device, differentiating access by an employee on a laptop versus an iPad. ISE is part of the Cisco TrustSec solution.
  
  
• VLAN Select
  This feature enables pooling of multiple VLANs into a group for assignment to a single WLAN SSID or AP Group. Large wireless installations have traditionally required a single large subnet and broadcast domain to accommodate the number of wireless clients on a single SSID, dynamic VLAN assignment, or the use of multiple SSIDs which can introduce roaming latency and problems. VLAN Select allows client connections to a single SSID to be round-robin load-balanced into multiple network VLANs to reduce subnet size and broadcast / multicast forwarding concerns.
  
  Another use-case for VLAN Select is with guest termination in a DMZ environment. Large guest networks also traditionally required large subnets or multiple anchor controllers to segment the client population into smaller broadcast domains. This resulted in additional CapEx to buy more anchor controllers, since a single anchor controller could only use a single VLAN attached to a WLAN. Now, multiple VLANs can be tied to the same WLAN through VLAN Select, reducing the need for multiple anchor controllers.

I have update my post on H-REAP Deployment Guidelines and Feature Limitations to include these new enhancements, as well as a few others including security feature integration with Cisco switches. It's worth a read to review the current state of H-REAP functionality and limitations with the new 7.0.116.0 code release.

Cheers,
Andrew

The Cisco Notification Service

Have you found yourself wondering how you can be notified when the next release of Cisco code becomes available, or when critical field notices, security advisories, or end of sale notices are released? Rather than relying on word of mouth or constantly checking Cisco's website, try using the Cisco Notification Service.

The Cisco Notification Service allows existing Cisco customers with a valid CCO login to subscribe to product notifications when they are released via email or RSS. Here is how to set them up.

1.) First, login to your CCO account and navigate to the Support > View All Support Tools and choose Cisco Notification Service from the list.

2.) You will land at the Cisco Notification Service - Profile Manager page. Here you can see that I have two existing notifications. To create a new one, select Add Notification. This will create a new notification profile attached to your CCO account.

3.) Give the new notification a name, delivery method, and delivery interval. Click Continue.

4.) Select the topic type. Options include notifications that are product-centric, alert-centric, or related to bug IDs. For this example, I have chosen product-centric.

5.) Next, select the topic from the tree. In this case, I have selected the 5500 Series Wireless LAN Controller.

6.) Select the sub-topics for which you would like to receive notifications. Note that not all sub-topics can be chosen simultaneously within a single selection; multiple sub-topic definitions can be defined within the same profile however.

7.) Finish the sub-topic selection by specifying any additional filter information as necessary. In this case, I have opted to be notified for any software version released.

8.) The sub-topic configuration is now complete. Select Add Another Topic to add more sub-topics to this notification profile if desired (for instance if some selections were mutually exclusive in step 6 above). When finished, select Finish.

That's it. The new notification profile has been added to your account. It may be in the Pending state until email verification is completed.

Now you can receive important product, alert, field notices, end of sale notices, or bug ID updates as they are released for the products or topics that you care about without having to manually check Cisco's website.

Cheers,
Andrew

Defined - Technical Strategery

Strategery
From Unwords.com http://www.unwords.com/unword/strategery.html

(n.) To defeat an enemy through the use of a large amount of bombs, munitions, or other explosives or projectiles.

Origins: From strategy or strategic and trajectory. Originally used in a Saturday Night Live comedy show skit to make fun of President Bush's less than stellar abilities to pronounce words.

From Wikipedia.org http://en.wikipedia.org/wiki/Strategery

a term of art among them [Bush White House staff] meaning oversight of any activity by president Bush's political consultants.

Technical Strategery
The oversight of any description by management of technical concepts or projects, by engineers to prevent the misrepresentation of said concepts or projects.

Technical strategery may be employed to prevent any of the following situations:

• Misrepresentation of key technical concepts by non-technical persons to broader audiences
• Creation and use of imaginative, but often non-existent, technical acronyms or terms by management
• Failure to level-set customer expectations with realistic outcomes, deliverables, and timelines
• The promise of unachievable services, features, or outcomes by management
• Improper alignment of resources for project development or implementation
• Failure to understand "what" technical staff day to day responsibilities entail by management
• Solution design that does not meet business or customer requirements
• Scope creep or direction change of existing technical projects that require complete solution re-design (often due to shiny new consumer tech adoption by C-Level execs; knows as the i-Device phenomenon)
• Selective listening by non-technical persons when too many acronyms or technical concepts are presented (also know as "dumbing-down the presentation")
• Misunderstanding of required versus optional technical components
• Expense reduction through removal of required technical components

Note - the inverse of Technical Strategery is known as Technical Bewilderment.

Cheers,
Andrew