Saturday, August 28, 2010

"Consumerization" of Enterprise Wi-Fi

An interesting shift in the perceived business value of Wi-Fi is beginning in enterprises large and small. Enterprises are realizing that Wi-Fi can enable much more than just employee mobility. Wi-Fi is being adopted for a range of services to enable deeper interaction and insight with consumers and guests, as well as to provide support for non-traditional business tools inside the organization.

I like to call this shift the "consumerization" of enterprise Wi-Fi. Let me explain.

Wi-Fi as a Consumer Commodity
Unlike most other technologies used within an organization, Wi-Fi is largely a consumer commodity. Most people don't have network switches, servers, firewalls, or other fancy networking equipment in their home (yes, all you IT geeks who read articles like mine are the exception). Wi-Fi is different.

Consumer Wi-Fi has an immediate and substantial value proposition for consumers. It is a gateway technology that increases consumer adoption of many other technologies that have value to people. It allows them to access the Internet while on the couch, or in bed; stream music from one room to another; it creates portability and flexibility for home offices, allowing people to move their office to another portion of the house. It's value to consumers is tremendous, largely because it give people freedom to interact with the Internet and consume content in the place and the method they choose. It breaks down barriers and allows people to interact on the web in their terms.

Wi-Fi as a Business Commodity
Enterprise Wi-Fi, on the other hand, has traditionally had a separate and distinct set of objectives. Enterprises view Wi-Fi as a resource to enable process efficiencies, reduce operational costs, increase employee productivity, or a combination of all the above. A retail store can reduce labor costs by ordering, tracking, processing, and updating product inventory through the use of handheld wireless scanners. Warehouses can increase efficiency by labeling pallets and product containers with bar-codes, allowing fork-lift and pallet-riders to identify the exact product and shelving locations quickly through back-end warehouse management databases rather than through manual processes. Office staff can attend meetings with laptops, make immediate changes to forecasts, documents, or processes, see how changes affect related systems, and make faster decisions resulting in faster time-to-market. Enterprises that can adapt to market changes faster inherently have a competitive advantage over rivals.

"Consumerization" of enterprise Wi-Fi is the use of the infrastructure investment in wireless network for indirect business benefits. The first step in this process was interaction at the customer level by providing Wi-Fi and Internet service for retail customers.

"Consumerization" First-Steps - Hotspots
I'm sure everyone is familiar with Wi-Fi hotspots. These have been around virtually since the inception of Wi-Fi, have peaked and faded in popularity within varying vertical markets, and typically have been adopted only to meet specific goals which usually include increased customer loyalty, increased in-store traffic, and increased customer spending (such as basket-size). Hotspots are meant to provide customers with a perceived value benefit for shopping at a retail establishment. If you're sitting in a coffee shop maybe you'll linger longer and buy more coffee; if you're in a book store maybe you'll sit and read online reviews of a book you're thinking of buying, etc.

I like to call this Wi-Fi as a service. It is a natural and obvious extension of enterprise Wi-Fi for consumer use. This was the first and most basic use of enterprise resources for uses outside of "getting business done." Hotpsots don't help the organization operate their business or run their business more effectively. However, they can provide business value if used correctly to drive higher sales and customer satisfaction. In an increasingly connected and mobile world, Wi-Fi hotspot service is not a competitive advantage anymore, it's become a basic requirement for many vertical industries.

Hotspots are a tried and true service, and are becoming ever more pervasive. In-flight Wi-Fi is now becoming common among all major U.S. airlines, and I can't remember the last time I stayed in a hotel that didn't offer Wi-Fi. (Just think, when was the last time you booked a hotel that didn't have Wi-Fi? Did you factor this into your reservation decision? If the hotel did not offer Wi-Fi, did you notice? Would you be willing to stay there again?) Cafes and coffee shops tend to be erratic in this regard, as many shops have found out the hard way that lingering users may not spend more and take valuable table-space away from purchasing customers.

Hotspot Expansion for Guest Networking
The next logical expansion of enterprise Wi-Fi was for use as a service to corporate guests. Many organizations struggled with a secure method to allow temporary access for visitors entering corporate offices. Many times vendors and partners need Internet access to demonstrate products features, give a presentation, or access information stored through a corporate VPN connection.

Utilizing the existing enterprise Wi-Fi infrastructure to allow secure guest access provides indirect business value by allowing the organization to interact with partners more effectively to achieve common objectives.

Beyond Hotspots - Customer Interaction and Business Analytics
The growth in consumer adoption of mobile technology, such as smartphones and feature-phones with Wi-Fi built-in, are prompting businesses to identify opportunities for value-added services through deeper integration with guests at the point-of-sale and within their stores. Retailers are exploring possibilities to connect with consumers at a localized level for real-time location tracking, marketing, product promotion, discount promotion, cross-selling, customer assistance, in-store navigation, and social networking through dynamic lists (such as shopping list management and gift registries).

There are two facets to wireless guest interaction in retail environments:
  1. Customer Interaction
    This largely involves extending the enterprise Wi-Fi network to guests, similar to a hotspot service, but building value-added business applications on top of the connection to provide highly relevant and personalized information to guests while in a brick-and-mortar store or at the point-of-sale. These solutions largely rely on building a secure architecture within the enterprise network to handle guest connections, as well as developing custom applications for various mobile platforms to allow the guest to take advantage of promotions and service offerings. Cellular networks are an obvious first choice to provide these services.

    However, many retail locations, even in metropolitan and urban areas, lack acceptable cellular data service within the wall of the retail establishment. Expense to improve cellular coverage within retail locations, either through cellular repeaters or new IP back-haul solutions such as the recently announced MobileAccessVE and Cisco partnership, can be extremely cost-prohibitive. As such, organizations are looking to better utilize existing Wi-Fi infrastructure to facilitate these services rather than cellular.

    Extension of the Wi-Fi infrastructure is fairly straightforward, and typically involves deploying a new virtual network for guests which either terminates locally in the store or is tunneled through the WAN to a central location. In either method, many variables need to be designed, including ease of access to the network, backhaul data transport and associated expense, secure guest isolation from internal resources, customer opt-in process, legalize surrounding said process and organizational liability. The most complicated component in the solution is typically the customer opt-in process, account provisioning and management processes required for content personalization.

    Like many other corporate IT projects over the last few years, convergence is the name of the game. The goal is a converged user experience which seamlessly connects guests through multiple retail channels including brick-and-mortar stores, e-commerce, print advertising, electronic advertising, customer service, and social networks.

    Solutions in this space include large-scale hosted service from companies such as AT&T, T-Mobile, and Boingo. Organizations are also able to build out solutions on their own, but may lose some usability benefits that can be offered by hosted providers (such as native platform integration and automated connection for AT&T customers to their hosted networks).

  2. Business Analytics
    The ability to track and identify consumers as they enter and travel through a retail store can provide a wealth of business analytics that allow organizations to gather better insights into customer behavior. This data may include information including customer travel path through the store and product display effectiveness through evaluation of customer dwell time at specific locations. Businesses can use this information to optimize product displays and signage, optimal fixture placement, effectiveness of product placement at various locations, and effectiveness of promotional material. Further building on these business analytics, retailers can market and sell advertising within stores to create an additional stream of indirect revenue, selling digital signage time/space for example.

    Most of these solutions rely on real-time location services (RTLS) built on top of Wi-Fi, GPS, or cellular wireless networks. Additional unique methods exist to use platform-specific methods for locationing. One such solution, Shopkick, uses RF signals sent on frequencies that can be picked up by smartphone microphones for interaction with an installed application on the phone. Such applications blur the line between analytics and customer interaction, using one application to provide both functions.

    Business analytics may or may not tie into the customer interaction component if built. Without customer interaction, the business analytics can provide customer behavioral information without the need to involve the guest. Careful consideration is usually required to ensure privacy concerns related to customer location tracking are adequately addressed in the abscence of an explicit opt-in process.

    One detraction to deploying business analytics without customer interaction is the lack of visibility into customers without Wi-Fi enabled on their devices. Due to typical concerns over battery life, many consumers disable RF radios on mobile devices when not in-use.

    Solutions in this space are evolving very rapidly, and include many startup companies that can offer partial but not turn-key solutions. These include Shopkick, ZuluTime, and WherePRO.
Consumer Devices as Business Tools
Additionally, consumer grade devices are being driven into the enterprise by employee demand for support of devices such as the iPad and personal smartphones for business use. Traditional enterprise Wi-Fi has been limited to corporate-owned assets including desktops, laptops, voice handsets, video equipment, handheld scanners, etc. However, innovation in the consumer electronics and the explosion of Wi-Fi availability in these products, coupled with the demand by consumers for mobile Internet connections is driving new technology to be supported inside the enterprise.

Employees view acceptance of such technology in the enterprise as an extension of their increasing web-connected lifestyles, and required to maintain social ties and communication in today's digital society. Businesses are attempting to justify support for personal devices as an employee perk to attract new young talent, to retain existing talent, and to further employee productivity. Some studies have shown that allowing employees access to personal email, web surfing, and other non-work related activities for brief periods of time throughout the day, allows employees to re-focus on work related activities much faster and be more productive in their normal work. Striking a work-life balance while at work may go a long way to keep employee morale and satisfaction in their current position high.

Also, business uses for some consumer electronics cannot be denied. For instance the iPad platform is being used by many enterprises for varying uses, including by interactive marketing teams to design captivating new content on mobile platforms to better engage with consumers and changes in how people view and react to different advertising mediums. Smartphones of all types are being used to keep not only executives connected to corporate email, calendaring, and contacts, but by everyday staff to remain on top of workload an promote better time management. By supporting personal devices, IT departments can also realize expense reduction by removing the need to replace legacy systems, such as analog voice phones with digital VoIP phones, through the support of personal equivalents such as smartphones for corporate use. Many times a small stipend to employees for purchase of a supported device can be much more cost effective rather than buying all new corporate assets for every employee.

Enterprises must be able to strike a balance between enabling use of these new technologies while maintaining corporate security of sensitive data. Increasingly, support for personally-owned devices is gaining support within organizations, which lack corporate policy control. Segmentation of personal devices from corporate data may be warranted, or require access through a secure method such as a VPN which does not allow transfer of data to the personal device. This will allow employees to use these devices for business and personal uses while maintaining corporate control over intellectual property. Additional security mechanisms will need to be considered to ensure such secure access policies are followed, including wired port security, wireless access control, device asset verification when connecting to the network through NAC/NAP systems, and network intrusion prevention systems for monitoring and attack mitigation.

There is no doubt that Wi-Fi networking has provided substantial benefits to enterprises over the last decade. However, the future is rapidly changing as our society changes and people consume content in an increasingly mobile fashion. Over the next few years, expansion of enterprise Wi-Fi networks to provide increased business analytics, customer interaction, and acceptance of personal electronics for corporate use will take a firm hold. Many startups are pitching products to meet these needs today. Time will tell which solutions can establish meaningful interaction with consumers and provide business value.

Wi-Fi engineers should be prepared to address the challenges posed by this increasing "consumerization" of enterprise Wi-Fi.


Saturday, August 21, 2010

Virtual APs Will Make You Look Like a Fool

Virtual APs are nothing new...

That being said, the landscape HAS changed. Windows 7's ability to run virtual APs is about to make the threat vector a WHOLE lot easier for hackers to make mince-meat of your network security. You're 802.1x authentication.... kiss it goodbye; your WPA2-AES encryption.... doesn't mean a thing.

Authorized network users will connect to your network using whatever security you have in-place, then virtualize, bridge and re-broadcast the connection. You thought rogue APs were tough to handle. You ain't seen nothin' yet!

The tools and resources for everyday users to turn your network against you are growing by the minute, and you had better be prepared to make some changes. Connectify has been around for a while, but requires specific adapters. Now this website makes it even simpler and configures Windows for you. For dedicated hackers, how about a whole web-based (cloud based SaaS) solution to manage a whole swarm of devices.

Things just got interesting, in a big way! I can see botnets of infected Windows 7 machines heading toward my network, eager to connect, virtualize, and bridge connections. They're coming, and chanting "virtualize, virtualize" while in lock-step formation like a platoon of soldiers ready to blow your network to pieces.

How will you prepare your wireless network? For starters:

  1. Don't let users have access to network credentials. How will they get on then? Transition away from PEAP user authentication to something based on the device or company asset, rather than user accounts. Try PEAP using machine accounts, or EAP-TLS using machine certificates.
  2. Secure the operating system. Hard drive encryption, anti-virus... you know the usual suspects.
  3. Remove local admin access from your users! If they can't configure virtual APs on company assets, they're stuck trying to bring in personal devices.
  4. Prevent personal devices from connecting. If you've implemented point #1, then you've gone a long way to making this a reality. Common everyday users won't know how to dig machine credentials or certificates out of a system. Dedicated hackers, well they're another story.
  5. Deploy a NAC/NAP solution to control access to internal network segments.
  6. Deploy WIPS/WIDS solutions to monitor your airspace and alert on virtualized hosts.
None of this is foolproof, but it's a start. Security ain't easy. The "Defense-in-Depth" strategy for this threat is going to take a lot of layers, get to building! After all, we don't want these virtual APs to make you look like a fool.

If you have other suggestions, please feel free to share!


Scalable Guest Account Provisioning

One question that always seems to come up when discussing guest wireless access is the problem of account management. Many smaller organizations are looking to implement guest connectivity solutions but struggle with the administrative overhead of managing accounts for potentially very large amounts of guests. Typically, these responsibilities are delegated to the help desk department, since architects and engineers shouldn't be performing these tasks.

Let's face it, for most organizations the staff members placed on the help desk are either just beginning their careers and are fairly inexperienced, are tinkerers with technology but not really IT professionals, or have been placed on the help desk from some other completely unrelated department since they just weren't working out in their previous position (I've seen some horrible cases of this in the education sector).

Three options exist with the Cisco Unified architecture to manage guests, depending on the scalability required as well as the technical proficiency of help desk staff.

1.) Controller Lobby Admin
This is the most basic solution, which is not really scalable, but may fit for a very small organization that doesn't require high availability and failover. The anchor controller can store local usernames and passwords for guest accounts right on the network hardware itself. The help desk staff login directly to the wireless controller (... that just sent shivers down my neck typing it!) and provision guest accounts. Help desk staff can be limited to guest account creation only (highly advisable) by assigning them the lobby admin role, either with a local account or through TACACS+ or RADIUS.

2.) WCS Lobby Ambassador
This is one option to begin scaling the solution for mid-size organizations. If multiple anchor controllers exist for redundancy, possibly in different data centers, a method to provision accounts on all of the anchor controllers simultaneously should be implemented. Otherwise, help desk staff would need to login to each and every anchor controller to create the same guest account. OUCH! And let's not even mention possible user-error when creating multiple copies of the same account.

With this method, help desk staff are assigned a lobby ambassador role on the WCS server, again either locally on the WCS server or through TACACS+ or RADIUS. This has the benefit of not requiring help desk staff to login directly to the network equipment (YEAH!). They simply login to the WCS server, create the guest account once, and push the configuration template to the appropriate anchor controllers.

Notice how I stated the appropriate anchor controllers? This is one of the key drawbacks of this method. You have to rely on the help desk staff to be able to select the correct controllers to push the guest account configuration to. This leaves the window open for configuration mistakes, with guest accounts pushed to other production controllers. 

Also, help desk staff are required to create a controller template for each guest user, which is definitely not an intuitive procedure.

3.) NAC Guest Server
This is the big kahuna of guest account management. These appliances can handle administrative roles through local user account, active directory integration, LDAP, or RADIUS. Guest account settings can be emailed or an SMS message can be sent to them. It acts as a RADIUS server for user authentication from the controllers. Best of all, your help desk staff does not need to login to any system related to network operation or control. The help desk staff could even be completely taken out of the picture if guest account provisioning is delegated to authorized employees in your network.

Scalability is in full force with this solution. Multiple anchor controllers can be deployed, and simply point guest authentication to the NAC guest server(s) via RADIUS. Simple, familiar, and reduces the opportunity for user-error.

If you're a large organization looking to roll out scalable wireless (or wired) guest access, check out this appliance on Cisco's website. From personal experience, it rocks!

- Andrew

Thursday, August 19, 2010

Update on Voice MAC Optimization Bugs with 11n APs

There are a few outstanding Cisco bugs regarding the Low Latency MAC feature on wireless LAN controllers when 802.11n access points are used. Today, I happened to check in on these bugs and found out that one of them is closed (resolved).

For quick recap, low latency mac enables the wireless AP to quickly age out voice packets ins QoS user priority 6, reducing the number of re-transmission attempts down to 3. This helps clear out AP buffers and prevent sending voice packets that are of no more use in the voice conversation.

The two bug IDs are CSCsy66246 and CSCtc73527.

CSCsy66246 - 1250 doesn't downshift rates for retries when low latency mac is enabled.

Essentially, low latency mac does not work for any 802.11n APs since they don't downshift data rates appropriately when re-transmitting frames. This affects all of Cisco's 802.11n APs, not just the 1250 AP referenced. This bug is still open (unresolved).

CSCtc73527 - Make Low Latency MAC a no op for 11n APs, till CSCsy66246 is addressed.

This bug is a follow-up to the first bug ID, and states that the low latency mac feature should be re-coded to prevent 802.11n APs from making use of the feature until the first bug is fixed. Essentially, this is a workaround for the first bug so that customers can still enable low latency mac on their network for older 802.11a/b/g radios, and the 802.11n radios will simply ignore the feature.

This second workaround bug has been fixed as of code version This is somewhat good news. Customers can now safely enable low latency mac in a mixed AP environment for benefit on 802.11a/b/g APs without worrying about negative side-effects of the first bug on the 802.11n APs.

Verification can be seen when enabling low latency mac on the controller. The following warning is displayed:

(Cisco Controller) >config advanced 802.11a voice-mac-optimization enable 
This feature is not supported for 1140/1250/3500 platforms if more than 3 data rates are enabled.

Now... just to get that first bug fixed!

- Andrew

Sunday, August 15, 2010

Wi-Fi Tip: Multipath Troubleshooting

Ever been in a problem situation where Wi-Fi clients are having all sorts of trouble staying connected reliably in a specific location. Their connection to your network is like a bad relationship: on-again, off-again. You've racked your brain, consulted your peers, verified adequate coverage, looked for interference and found none, updated client drivers, verified clients work in other locations without issue, but still can't figure out what is going on?

Perhaps you even suspected a multipath issue? But how can you verify?

Multipath is notoriously hard to identify with any degree of accuracy. The best we can do is evaluate symptoms and rely on gut instinct most of the time (unless your company has TONS of mullah and is willing to buy an oscilloscope).

So, what are the symptoms of multipath:

  • Everything listed in the first paragraph :) no really!
  • Clients have issues only in a localized area
  • Area is complex, with large amounts of metal or other reflective, refractive, or scattering material
  • Clients connect, seemingly with great signal at a high data rate
  • The data rate deteriorates quickly, with seemingly nothing changing. This is called excessive data rate shifting, and is bad, bad, bad for wireless network performance!

So you ask, how can we verify multipath is the issue? Really, without an oscilloscope to identify slight variations in RF signal propagation (called inter-symbol interference), the best we can do is test solutions and see if they resolve the issue.

Try these solutions, and see if they help client performance:

1.) Disable the higher data rates (5.5, 11, 9, 12, 24, 36, 48, 54 Mbps).

Wait, what!? Don't we want clients to send data at the highest rates for best performance? Normally, yes. But if multipath is causing transmission errors, then the higher data rates may perform worse than lower data rates because of signal encoding, even if coverage and signal strength are excellent. Remember, signals encoded with lower data rates contain more error correction bits (coding-ratio). This is counter-intuitive unless you understand the fundamentals of the physical layer encoding mechanisms.

Leaving only 1, 2 or 6 Mbps enabled helps the client and AP by maximizing error-correction capabilities and reducing the complexity of signal amplitude and phase shifting that must be recognized.

Here's an example of what I mean with 802.11a/g encoding. Focus on the modulation and bits per transition columns for encoding complexity, and on the coding ration column for error correction. The coding ratio dictates how many bits are dedicated to data versus error correction.

2.) Install 802.11n equipment

Newer 802.11n equipment handles multipath much better than legacy 11a/b/g equipment due to the benefits of MIMO and MRC (maximal ratio combining). Even if clients cannot be replaced, upgrading only the infrastructure should help communication improve.

3.) Reduce the amount of overlapping coverage

If there are too many APs in one area, and multipath is present, transmissions from every AP will create even more multipath. Ensure only 2-3 APs can be heard at a signal level of -85dBm or greater in any one location. This will help reduce the amount of multipath in the environment. This can be accomplished by reducing AP transmit power, or by completely turning off APs. If turning off APs creates coverage holes in other locations, a re-design of the network layout may be required.

4.) Install material that absorbs RF signals

If you can cover the metal or other reflective surfaces with material that will absorb the RF signals, rather than let them bounce around, then multipath should be reduced, improving network performance. This may be hard, if not impractical, to achieve since most environments that have multipath issues require those problem surfaces to operate in a specific fashion that prevents absorptive material from being installed. But it's worth a last-ditch effort!

Hope this helps some of your troubleshooting efforts!


Saturday, August 14, 2010

Wi-Fi Tip: Channel Utilization Best Practice

For best performance of latency-sensitive applications over wireless, such as voice, plan to keep RF channel utilization under 50%. This is not a hard-and-fast rule, but a best practice for most networks supporting data and voice.

Check out these resources for more info:
Cisco Voice over WiFi Troubleshooting Checklist
Wireless LAN Professionals Podcast #10 - Designing for Voice


Tuesday, August 10, 2010

Cisco Mobility Tunnel Client Authentication

Auto-anchor mobility (also called guest-tunneling) is used to force client data traffic on wireless LANs through a pre-determined set of anchor controllers. This can be beneficial to improve load-balancing and security for guests.

In normal roaming conditions, clients are anchored to the first controller which they join on the network. If a client roams to a different subnet, the new controller tunnels user data back to the anchor controller which they first joined. This behavior may not be ideal.

In auto-anchor mobility mode, a subset of a mobility group is specified as the anchor controllers for a WLAN. You can use this feature to restrict a WLAN to a single subnet (typically in a DMZ or other firewalled network segment), regardless of a client’s entry point into the network. Clients can then access a guest WLAN throughout an enterprise but still be restricted to a specific subnet.

Auto-anchor mobility is dependent on configuring mobility group peers between multiple controllers, configuring identical WLANs on both controllers, and assigning mobility anchors to the WLAN. On the foreign WLC (the one which terminates LWAPP/CAPWAP APs) you assign the anchor WLC in the DMZ as the mobility anchor. 

On the anchor controller in the DMZ you assign itself as the mobility anchor for the WLAN, effectively telling it that it will be the termination point for the tunnel.

In a traditional guest access scenario with a completely open wireless network (no 802.1x/EAP or PSK), in which case only web authentication is performed, the captive portal and authentication are performed by the anchor controller as shown above.

However, I have noticed an oddity when enabling a secure wireless network with auto-anchor mobility. The foreign controller performs all layer 2 authentication and security for the client, including 802.1x/EAP or PSK authentication. In a way this makes sense, since the foreign controller maintains the LWAPP connections to APs which must encrypt/decrypt client traffic. Therefore, the foreign controller must receive the PMK from the AAA server upon successful authentication to be able to send it to the AP serving the client for PTK negotiation during the 4-way handshake.

We can confirm this is the case by monitoring the AAA authentication logs, in this case from Cisco ACS. In my lab setup the foreign controller has IP and the anchor controller has IP The authentication log clearly shows the authentication originating from a NAS at IP, the foreign controller.

So, when using the auto-anchor mobility (guest tunneling) feature on Cisco controllers, remember that layer 2 security is handled by the foreign controller and layer 3 security is handled by the anchor controller. Strange but true!


Thursday, August 5, 2010

Wireless QoS Part 5 - Contention Window and Final Thoughts

Read the Entire Wi-Fi Quality of Service 5-Part Series:
  1. Part 1 - Background Information
  2. Part 2 - IEEE 802.11e Principles
  3. Part 3 - User Priorities, Access Categories and Queues
  4. Part 4 - Arbitration Interframe Spacing
  5. Part 5 - Contention Window and Final Thoughts
Part 5 - Contention Window and Final Thoughts
The third major QoS design change implemented as part of the 802.11e amendment and WMM certification is replacement of the PHY-specific contention window scaling with PHY / QoS Access Category specific values. Just as with AC dependent AIFS values, contention window values are now AC dependent and will provide a statistical advantage for higher priority frames.

The Contention Window

Once the station has waited the appropriate arbitration inter-frame space time, it randomly selects a value for its random backoff timer. The timer value must be within the Contention Window values defined for the priority queue. Each of the 4 priority queues has a defined Contention Window range, initially defined as ranging from 0 to CWmin, where CWmin varies between each of the queues.

Once the appropriate AIFS time has been waited, each station begins decrementing the random backoff timer by one for every slot time that passes. If another station begins transmitting before its timer has reached zero, the station defers access until the medium is available again, at which time it continues decrementing the timer from where it previously left off. Once the timer reaches zero, the station is allowed to transmit the frame over the air.

If a collision occurs where two stations transmit at the same time, no acknowledgment of the frame will be received and the station will increment its retry counter and increase its contention window according to the binary exponential backoff algorithm, up to a maximum contention window size of CWmax. The stations must then wait the appropriate AIFS time, select a new random backoff timer using the new contention window range, and proceed as before.

Similar to AIFS, the differences in the contention window values serve to prioritize traffic in higher priority queues by allowing them to wait shorter time intervals before being allowed to transmit over the air. The CWmin and CWmax values vary based on the PHY and the AC queue in use.

For review, the DCF (non-QoS) contention window values are:

  • 802.11b    aCWmin 31    aCWmax 1023
  • 802.11g    aCWmin 31    aCWmax 1023 (when 802.11b stations are present)
  • 802.11g    aCWmin 15    aCWmax 1023
  • 802.11a    aCWmin 15    aCWmax 1023
  • 802.11n    aCWmin 15    aCWmax 1023

Notice how the contention window range is the same across all OFDM PHYs, with legacy CCK PHY being the only dissimilar value. Traffic prioritization is therefore very coarse, and is based not on application traffic but on the PHY used for transmission. Effectively, all frames in a legacy DCF Basic Service Set (BSS) have the same priority and access to the medium. This can lead to problems, especially for latency sensitive applications such as voice and videoconferencing.

The new EDCA contention window values vary based on the Access Category (AC) and are derived from the DCF base values shown above. These values are administrator configurable, with default values defined as:

  • AC_VO (Voice)       CWmin = (aCWmin+1)/4 – 1   CWmax = (aCWmin+1)/2 – 1
  • AC_VI (Video)       CWmin = (aCWmin+1)/2 – 1   CWmax = aCWmin
  • AC_BE (Best Effort) CWmin = aCWmin             CWmax = aCWmax
  • AC_BK (Background)  CWmin = aCWmin             CWmax = aCWmax
Note – Default values for non-AP QoS stations are defined in IEEE 802.11e amendment section and the current IEEE 802.11-2007 standard section

The default EDCA contention window values for the 802.11b PHY in a QoS BSS are defined as:
  • Voice Queue        CWmin = 7      CWmax = 15
  • Video Queue        CWmin = 15     CWmax = 31
  • Best Effort Queue  CWmin = 31     CWmax = 1023
  • Background Queue   CWmin = 31     CWmax = 1023
The default EDCA contention window values for the 802.11g/a/n PHY in a QoS BSS are defined as:
  • Voice Queue        CWmin = 3      CWmax = 7
  • Video Queue        CWmin = 7      CWmax = 15
  • Best Effort Queue  CWmin = 15     CWmax = 1023
  • Background Queue   CWmin = 15     CWmax = 1023
Notice the differences from legacy DCF contention window ranges. In a QoS BSS, each queue clearly has differentiated access to the medium. For instance frames in the voice queue will initially select a random backoff timer between 0 - 3, versus frames in the video queue which will initially select values between 0 - 7. In this manner, frames in the voice queue have a statistically greater chance of selecting a random timer value that is lower than frames in the video, best effort, and background queues. It is still possible that a frame from a lower priority queue will select a lower random backoff timer, but most of the time they will not. 

Also, notice how the maximum contention window range for voice and video are still relatively small compared to the other queues. On a heavily utilized network, as retransmission attempts increase, the statistical advantage for voice and video frames gets even better. 

The CWmin and CWmax values are encoded in exponent form, base 2, then decremented by 1 in the EDCA Parameter Set information element, and each field is 4 bits long. Therefore, the minimum contention window values is 0 and the maximum value is 32,767. However, in practice the typical maximum value is never set above 1,023.

Contention Window Scaling
Contention window scaling between CWmin and CWmax is easier to understand when illustrated. For the first transmission attempt, the random backoff timer is set to a value between 0 – CWmin. Only when a retransmission is required due to the lack of a returned frame acknowledgement will the possible range grow. For the first and each subsequent retransmission attempt, the contention window will double by a power of 2. This is called binary exponential backoff. Once the window grows to CWmax, it will grow no further. Subsequent retransmission attempts will use the largest contention window range when selecting a random backoff timer value until the frame is either successfully transmitted (and acknowledged) or the maximum number of retransmission attempts is reached (typically somewhere between 7 and 64 attempts; Cisco APs default to 64 attempts for example).

As an interesting side note, when optimizing networks for VoWLAN, many vendors have a feature to quickly age out latency-sensitive voice frames after fewer retransmission attempts. This is done because a voice packet that is delayed too long will be useless to the receiver since it cannot insert it back into the voice stream if it processed and sent the analog stream to the human recipient past the point where the frame was delayed. On Cisco equipment, this feature is called Low Latency MAC, it applies only to voice frames in the Voice Access Category, and it only attempts 3 retransmissions for voice frames before dropping them.

(Figure 2-5 courtesy of “Voice over Wireless LAN 4.1 Design Guide” page 2-7, by Cisco Systems)

Putting it all Together
Therefore, the design of priority schemes for IEEE 802.11 wireless networks are dictated by the definition 8 user priorities mapped to 4 access categories, 4 priority queues, Arbitrated Inter-Frame Spacing (AIFS) values for each queue, and Contention Window values for each queue. Higher priority traffic waits less time statistically before being allowed to transmit a frame over the network. 

Since wireless is shared medium, and medium contention is distributed among all clients under DCF and EDCA, higher priority traffic cannot be guaranteed to be able to transmit before lower priority traffic from other stations, or even internally within a station between its internal queues. 802.11e and WMM only provide for a statistical advantage for higher priority traffic. On average, higher priority frames will wait less time prior to transmission and have greater access to the medium than will lower priority frames. In a shared medium, there is no such thing as a guarantee!

The IEEE 802.11e AIFS and CWmin values are illustrated in the following figure, based on the 802.11b PHY.

(Figure 2-8 courtesy of “Voice over Wireless LAN 4.1 Design Guide” page 2-10, by Cisco Systems)

External Resources
Be sure to check out these additional references for more information on 802.11 arbitration (medium contention), 802.11e, and WMM:

There are many other features in the 802.11e and WMM certification relating to QoS, such as Transmit Opportunities (TXOP), (Un)Scheduled Automatic Power Save Delivery (APSD), WMM Power Save, etc.

As a wireless network administrator / engineer / architect / consultant, understanding the fundamentals of 802.11 wireless network medium arbitration and frame prioritization is essential to planning, designing, implementing, and supporting a production network. Wi-Fi networks are mission-critical for many organizations these days, and skilled wireless IT staff is typically hard to find. Arm yourself with the knowledge and skills and you'll be sure to find success following you!


Wednesday, August 4, 2010

Wireless QoS Part 4 - Arbitration Interframe Spacing

Read the Entire Wi-Fi Quality of Service 5-Part Series:
  1. Part 1 - Background Information
  2. Part 2 - IEEE 802.11e Principles
  3. Part 3 - User Priorities, Access Categories and Queues
  4. Part 4 - Arbitration Interframe Spacing
  5. Part 5 - Contention Window and Final Thoughts
Part 4 - Arbitration Interframe Spacing
The second QoS design change implemented as part of the 802.11e amendment and WMM certification is replacement of the one-size-fits all Distributed Inter-Frame Spacing (DIFS) for all data and management frames, with Arbitration Inter-Frame Spacing (AIFS) which is dependent on the access category and queue of the frame waiting transmission.

Arbitration Inter-Frame Spacing (AIFS) defines different inter-frame gaps for traffic from each of the 4 priority queues. This replaces the original DCF Inter-Frame Spacing (DIFS) which defined only a single inter-frame gap value for all data frames. Using AIFS, each frame awaiting transmission must wait until the medium is declared to be available through Clear Channel Assessment (CCA) and the Network Allocation Vector (NAV), not discussed here for brevity. Once the medium is available, each logical station (one for each priority queue) must wait the defined inter-frame space time based on the queue to which the traffic is assigned.

Each of the 4 priority queues has a defined inter-frame space value corresponding to the priority assigned to the queue. For example, the Voice queue is the highest priority and as such has the lowest inter-frame space timer. The AIFS timers assigned by IEEE 802.11e are all defined as 1 Short Inter-Frame Spacing (SIFS) value plus a variable number of slots times (AIFSN) which are defined by the physical layer encoding method in-use (CCK, DSSS, OFDM).

The AIFS Number (AIFSN) values are administrator configurable, with default values defined as the following:
  • Voice Queue                 1 SIFS + 2 * slot time (AIFSN = 2)
  • Video Queue                 1 SIFS + 2 * slot time (AIFSN = 2)
  • Best Effort Queue          1 SIFS + 3 * slot time (AIFSN = 3)
  • Background Queue        1 SIFS + 7 * slot time (AIFSN = 7)
Note – Default values for non-AP QoS stations are defined in IEEE 802.11e amendment section and the current IEEE 802.11-2007 standard section

Therefore, the default AIFS values for each PHY are as follows:

Note – 802.11g and 802.11n when operating in the 2.4 GHz spectrum use long slot times when legacy 802.11b is present, and use the short slot times when no legacy stations are present. This is done for backwards compatibility.

Here is an illustration of AIFS in action, with [X] representing sample User Priorities for differentiated inter-frame spacing between access categories. Clearly, frames with UP = 0 (AC_BE) will wait a longer IFS than frames with UP = 6 (AC_VO), thereby prioritizing voice AC traffic.

(Figure 2-9 courtesy of “Voice over Wireless LAN 4.1 Design Guide” page 2-11, by Cisco Systems)

The AIFSN field within the EDCA Parameter Set information element is 4 bits long, with a minimum value of 2 defined in the standard and a maximum value of 15 based on the field length limitation.

In this manner, arbitration inter-frame spacing allows a statistical advantage for traffic in higher priority queues because those frames are not required to wait as long prior to decrementing their random backoff timers.

We're almost, but not quite, finished with the technical details of wireless QoS. In my final post, I'll detail enhancements to the contention window value selection, which determines the random backoff range used by stations prior to transmitting. I'll also wrap it all up together in a nice bow, and provide a few very useful external links for further reading.


Monday, August 2, 2010

Wireless QoS Part 3 - User Priorities, Access Categories, and Queues

Read the Entire Wi-Fi Quality of Service 5-Part Series:
  1. Part 1 - Background Information
  2. Part 2 - IEEE 802.11e Principles
  3. Part 3 - User Priorities, Access Categories and Queues
  4. Part 4 - Arbitration Interframe Spacing
  5. Part 5 - Contention Window and Final Thoughts
Part 3 - User Priorities, Access Categories and Queues
The first QoS design change implemented as part of the 802.11e amendment and WMM certification, are User Priorities, Access Categories, and Queuing Structures.

The IEEE 802.11e amendment defines 8 user priorities (UP) for class of service (CoS) definition. These user priorities were established for layer 2 data link frame prioritization in alignment with earlier CoS standards including 802.1D (based on the work within the 802.1p task group).

These 8 user priorities are grouped into 4 access categories, containing two user priorities each. User priority 0 is placed into the Best Effort AC instead of the Background AC for backwards compatibility with non-QoS stations. This was done to preserve compatibility, as the IEEE deemed QoS functionality as an optional component for certification citing the lack of need for QoS by many legacy devices and applications. The mapping between 802.1D, 802.11e UP, and Access Category is show below.

(Table 9-1 courtesy of the IEEE Std. 802.11-2007 section on page 253)

As an example implementation, the relationship between User Priority, Access Category, and Cisco’s AVVID architecture standard (which provides different guidelines for voice and video than the IEEE standards) is detailed in the table below. Also referenced are the default markings applied by the Cisco Unified wireless network.

(Table 10-6 courtesy of “Voice over Wireless LAN 4.1 Design Guide” page 10-33, by Cisco Systems)

Queuing Structure
4 priority queues are established to prioritize data frames within each station. These 4 priority queues align with the 4 access categories mentioned previously. Each frame that a station wishes to transmit is classified and placed into one of the appropriate queues.

The inter-frame spacing and random backoff timers are calculated independently and decremented in parallel for each queue. If an internal collision occurs, whereby frames from two or more queues are ready to transmit at the same time, the higher priority queue is granted access to transmit and the other queues act as if a physical collision occurred during transmission, increment their retry counter, and increase their contention window values according to binary exponential backoff. In this manner, one physical station emulates four logical stations, one for each traffic queue. The following figure illustrates these priority queues.

(Figure 2-7 courtesy of “Voice over Wireless LAN 4.1 Design Guide” page 2-10, by Cisco Systems)

Through user priorities, access categories, and queuing structures, the 802.11e amendment and WMM certification provides differentiated classification of frames and the framework for frame prioritization. In the next two posts, I'll describe how frame prioritization occurs through Adaptive Inter-Frame Spacing and Contention Window scaling.


Wireless QoS Part 2 - IEEE 802.11e Principles

Read the Entire Wi-Fi Quality of Service 5-Part Series:
  1. Part 1 - Background Information
  2. Part 2 - IEEE 802.11e Principles
  3. Part 3 - User Priorities, Access Categories and Queues
  4. Part 4 - Arbitration Interframe Spacing
  5. Part 5 - Contention Window and Final Thoughts
Part 2 - IEEE 802.11e Principles
Now, let's dig into the guiding principles behind wireless QoS design and the 802.11e amendment. This is part 2 of this series on wireless QoS, building on the background information from the first post in this series, which described the original Distributed Coordination Function (DCF) 802.11 medium contention protocol.

802.11e and WMM QoS Overview

The amended IEEE 802.11 wireless protocol supports a priority scheme that can provide up to 8 priority classes for traffic. This work was done as part of the IEEE 802.11e working group and was added as an amendment to the standard. Certifications of compliance with portions of this amendment are done by the WiFi Alliance through the WiFi Multimedia (WMM) certification process.

802.11e defines 8 user priorities for Quality of Service (QoS) of wireless traffic. These 8 user priorities are grouped into 4 Access Categories (AC) defined as Voice, Video, Best Effort, and Background. Each access category contains 2 different user priorities.

The design of this priority scheme is based on three major changes to the operation of the original 802.11 Distributed Coordination Function (DCF), which is now called Enhanced Distributed Coordination Access (EDCA). The three major changes are:

  1. Establishment of 4 priority queues for traffic (Access Categories), implemented on a per-station basis

  2. Arbitrated Inter-Frame Spacing (AIFS) values for each of the 4 priority queues to replace the single Distributed Coordination Inter-Frame Spacing (DIFS) value previously used for all data and management frames

  3. Random Backoff timers defining Contention Window minimum (CWmin) and maximum (CWmax) values for each of the 4 priority queues

Further information on WMM certification can be found the Wi-Fi Alliance website. In addition, the IEEE 802.11e amendment and current 802.11-2007 standard can be found on the IEEE website.

In future posts, I'll detail each of these design changes and how they're implemented. We'll also see why wireless QoS provides a statistical advantage for higher priority traffic, but cannot go so far as to perform or guarantee strict priority queuing due to the use of a shared medium and distributed contention among multiple stations. This is a fundamental difference for those familiar with QoS on wired switches, which have the ability to implement strict priority-queues over a contention-free full-duplex link.