Friday, October 25, 2013

Wi-Fi Alliance Voice-Enterprise Certification: Standardized Fast Secure Roaming


Two of the most important aspects of building a successful modern enterprise wireless LAN are enabling transparent user mobility across the network and strong security to protect sensitive corporate data. 

However, these two objectives have historically been difficult to achieve in tandem. A balancing act between mobility and security has caused an unpleasant trade-off for organizations due to the time-consuming processes that strong security methods require. On one hand, high performance mobility can be provided when relatively weak security is implemented with an Open or WPA2-Personal WLAN, but this leaves sensitive corporate data at higher risk of exposure. On the other hand, much stronger security can be implemented with WPA2-Enterprise, lowering the exposure risk of sensitive corporate data, but resulting in poor mobility performance due to the time-consuming 802.1X authentication process. Thus, the introduction of more secure Wi-Fi networks solved one problem (security) but created another (roaming performance).

The industry needed a high performance, yet secure, solution to this mobility problem. The answer lies with fast secure roaming. Pre-standard solutions, such as CCKM and OKC have been around for some time but have failed to realize widespread adoption, especially by client manufacturers. The Wi-Fi Alliance™ Voice-Enterprise certification program, introduced May 2012 and already appearing in major WLAN products, brings a standards-based fast roaming method to market, which serves to align infrastructure and client manufacturers on a common implementation method and provides the benefits of low-latency roaming performance while maintaining strong security with WPA2-Enterprise.

I dive deeper into the Voice-Enterprise certification program and implementation details of fast secure roaming in the new whitepaper, "Wi-Fi Alliance Voice-Enterprise Certification: Standardized Fast Secure Roaming" [PDF].

Whitepaper: Wi-Fi Alliance Voice-Enterprise Certification
(Click to Download)

Download this whitepaper to learn:
  • Challenges in providing both transparent user mobility and strong security
  • Requirements that products must pass to achieve Voice-Enterprise certification
  • Performance criteria that Voice-Enterprise products must achieve
  • Technical details of the Fast BSS Transition specification, based on IEEE 802.11r, for both controller-based and controllerless WLANs
  • Performance optimizations available with Radio Resource Measurement (802.11k) and Wireless Network Management (802.11v), both part of the Voice-Enterprise program
Cheers,

Friday, October 4, 2013

SSID Overhead - How Many Wi-Fi SSIDs Are Too Many?

One of the most commonly cited best practices among Wi-Fi professionals is to the limit the number of SSIDs you have configured on your WLAN in order to reduce the amount of overhead on the network and to maintain high performance. But there is not a lot of public data out there to really drive home this point when explaining it to another engineer, management, or a customer. Simply telling someone that they shouldn't create more than 'X' number of SSIDs isn't very convincing.

Therefore, I've created a visual tool to help you explain WHY too many SSIDs is a bad thing:

The Wi-Fi SSID Overhead Calculator
(Click Image to Download)
Wi-Fi SSID Overhead Calculator

This tool calculates the percentage of airtime used by 802.11 beacon frames based on the following variables:
  1. Beacon Data Rate - beacon frames are sent at the lowest Basic / Mandatory data rate configured on the WLAN. Beacons must be sent at a "legacy" data rate, meaning only 802.11a/b/g rates. Select the beacon data rate from the drop-down menu within the tool.
  2. Beacon Frame Size - beacon frames can vary in size based on the version of the 802.11 standard implemented (802.11a/b/g/n/ac) and features enabled on the WLAN (such as 802.1X authentication, CCX, 802.11r fast roaming, and 802.11u Hostpost 2.0). I recommend using a wireless sniffer to capture a beacon frame from your WLAN for use within the tool. Enter a beacon frame size that represents the total size of the MAC header and data payload.
  3. Beacon Interval - beacon frames are sent at a default interval of 102.4ms, but this may be modified in most enterprise WLAN products. Note that beacons are always sent at a multiple of the Time Units (TUs), where one TU equals 2^10 Kilomicroseconds (or 1.024 milliseconds). Therefore, 100 TUs equals 102.4ms. Enter the time interval between beacons, in milliseconds.
The calculation includes the inter-frame spacing (using WMM), physical layer preamble and header, MAC layer header, and data payload. It calculates the amount of time required for modulation of the bits over the air, but does not account for collisions or retransmissions. Technically, you wouldn't reach 100% airtime utilization on a Wi-Fi network because medium contention due to collisions and retransmission backoff result in a maximum airtime utilization of around 80-90%. But for SSID overhead planning purposes this level of detail is not required because the network will be equally degraded if we represent it with or without the collisions.

The tool also takes into consideration the number of co-channel APs within the physical area. All access points, either from your WLAN or a neighboring WLAN, contribute to the overhead on the channel. Remember, Wi-Fi operates in unlicensed spectrum and everyone shares the airtime!

I have also included a subjective rating of the amount of overhead into the following categories:
  • 0-10% = Low Overhead
  • 10-20% = Medium Overhead
  • 20-50% = High Overhead
  • >50% = Very High Overhead

You should ALWAYS attempt to keep your WLAN at low overhead (0-10%). 

If you have an existing deployment that falls within the medium overhead range (10-20%) you might consider methods to consolidate SSIDs and reduce the amount of overhead as your WLAN needs evolve over time. 

If you have an existing deployment that falls within the high overhead range (20-50%) you are likely experiencing significant performance problems on your WLAN already and should investigate immediate methods to consolidate and eliminate SSIDs at the earliest possible time.

If you have an existing deployment that falls within the very high overhead range (>50%) it is likely that you are in a highly congested area and will need to coordinate the WLAN configuration with your neighbors in order to reduce the amount of overhead to a reasonable level. This is common in dense urban / downtown areas and in multi-tenant buildings. 

I hope this tool proves useful. Enjoy!

Cheers,
Andrew 

Monday, August 26, 2013

Picking the "Right" Wi-Fi Solution for Your Organization

How should an engineer or IT manager go about picking a Wi-Fi network solution? This can be a complex question to answer and involves evaluating products between multiple vendors or even separate products within one vendor's offering when they offer multiple distinct product lines.

Unfortunately, many customers, partners, and professionals in our industry tend to focus a majority of their time on one factor: speed. My friend Bradley Chambers summed up the inadequacy of speed tests recently when he wrote about his thoughts on Wi-Fi bake-offs, whereby a customer solely focuses on speed tests to pick a Wi-Fi solution:
One of the trends I've been noticing among schools is that they are holding "bake-offs" in order to pick their new WiFi vendor. I am concerned that the majority of these tests revolve around speed. Speed is important, but it's just part of the solution. The speed only test also ignores real world situations.
I agree that it's not all about speed. Wi-Fi chipsets and hardware have come a long way since the early days. It's increasingly hard to differentiate on hardware and speed, as all enterprise Wi-Fi products perform very similarly. The real differentiation and value of Wi-Fi solutions over the next few years will revolve around software innovation. Today, these include mobile device onboarding, dynamic security, location tracking, presence, big data and analytics. Tomorrow, who knows. But you can be assured that software solutions sitting on-top of an intelligent network will be the driving force for Wi-Fi's second-wind, leading to significant market growth over the next 3-5 years.

Bear with me while I ramble on about what I consider the most important aspects to focus on when selecting a Wi-Fi solution. Let me be very clear in saying that this is NOT a comprehensive list -rather it is simply a high-level starting point so you can remain focused on what's most important. Engineers tend to relish the details, writing RFPs that list hundreds of features and get into the minutiae of Wi-Fi technical specifications. That's great, however the Wi-Fi solution must be properly framed in the light of what you're trying to accomplish as an organization and understanding what role mobility plays and how the Wi-Fi network contributes to those broader objectives.

[begin rant] For instance, don't choose a Wi-Fi solution because it's 2% faster than a competing product but it doesn't offer the key feature your business really needs. That's a recipe for disaster! Does that 2% speed bump really matter when management or your business partners can't use the solution in the way they need to?  This underscores a deeper trend that many IT organizations fall into, where they try to force technical solutions into place that don't fundamentally meet organizational needs. This could be due to the familiarity they have with a certain vendor's products, fear of change, or lack of desire to continue learning new and different skills. I've seen too many IT organizations and individual engineers be so head-down into the technology that they fail to lookup to try to understand the solutions that the business is asking for and take the time and effort to research the right technical product fit. It's laziness, pure and simple. I challenge these types of engineers to be better than that! [end rant]

Now that I'm off my soapbox, here is how I recommend you go about picking a Wi-Fi solution:

1.) Suitability - What are the critical features and functionality for your business or environment?
Vendors have tons of features, but only a few are likely to be really critical for YOU! Identify those capabilities that will really enable your WLAN to do what you need it to do. For example: retailers need great guest / social WiFi and analytics; K-12 education needs Bonjour and simplicity; healthcare needs great voice service and location tracking; warehousing needs fast roaming and super high availability; Universities need great BYOD workflow and policies and high density. These are obviously generalizations, but you get my point. Identify the vendor and product that is the best fit for your needs! This comes first, ALWAYS!

2.) Simplicity - How complex (or simplified) is the solution?
When designing the network, how complex is network integration? Do you need an expert to design redundancy, failover, traffic flow optimization, tunneling, security and separation between user and device roles. When problems do arise, which they will with every vendor, how easy is it to diagnose where the problem lies and how to correct it? Or do you need to pay a contractor or VAR to come out and figure it out. Vendors might offer similar capabilities, but how have they built their product to do so? There are a lot of differences under the hood that can make your life easier, or more difficult, which cannot easily be identified through RFP check-boxes. Take the time to dig-in to the solution offerings you are evaluating and run through some sample scenarios that you face everyday. Also try to identify how the solution interacts with the larger network and application environment and how it might be affected by outside influences.

3.) Stability - What is the vendor's (or product line's) track-record for hardware and software stability?
How much QA goes into code releases? Does the vendor expect customers to be beta testers to find bugs? How does the vendor design for high availability and how complex is the setup? How many pieces are part of the architecture that all need to be designed for HA? Does the vendor include functionality inside the WLAN or do they require more servers or appliances to integrate which all require separate design for HA? If a failure does occur, what is the potential scope of impact? Is it one AP, one location, or potentially your entire environment? Does the vendor have a strategy for minimizing the scope of impact? What holes exist in that strategy?

4.) Strategy - What confidence do you have in the vendor's strategy?
How do vendors approach product development? Are they experts in your industry, do they have thought-leaders that really take the time and effort to understand your business problems, where your market is going (not their market), and what solutions will enable customers of your type to succeed? In essence, do they have the customer's needs in mind, or are they twisting the current buzzword soup of the day to match their existing product offerings? There is a big difference! I look for vendors that really understand what I'm trying to accomplish and have tailored product offerings to meet those needs.

5.) Sticker Price - What value do you place on the solution that meets your needs?
Make sure the vendor you choose meets the criteria listed above for suitability, simplicity, stability, and strategy... THEN work on negotiating a price that works for you! Many IT organizations are ill-equipped to evaluate the true value that technology solutions have in their organization due to the fact that they don't adequately understand the impact to the business. IT solutions are increasingly enabling new business services that are required to compete and succeed through market transitions (just take retail and healthcare as two shining examples of this today). Viewing IT spend as an expense-center just doesn't cut it anymore. More often than not, the business teams hold the purse strings and are in a much better position to identify the value IT solutions bring and calculate true ROI. Don't place pricing first, otherwise you could easily end up wasting money on a solution that doesn't meet your needs. If that happens, any amount of money spent is wasted, even if its cheaper than other solutions. You'll end up being dissatisfied and ripping and replacing with another solution.


So, just remember The 5 S's for Evaluating Wi-Fi Solutions:
  1. Suitability
  2. Simplicity
  3. Stability
  4. Strategy
  5. Sticker Price


Cheers,
Andrew