Cisco Live! 2011 Wireless & Security Recap, and an Apple Rumor

Last week at Cisco Live! 2011 I attended several sessions related to wireless LAN products and would like to provide a review of the major technical announcements that I took away from these presentations. Due to the overwhelming amount of technical content provided over the course of the 6 days, I won't be providing detailed recaps of each session. However, there were several major announcements that could impact customer roadmaps that I would like to discuss.

You can also read my article on value of live events on professional development and networking on the Cisco Mobility Blog.

CCIE Wireless Version 2 - On Sunday, several of my peers attended a CCIE-W techtorial which discussed the changes to expect in v2 of the written and lab exams. I did not attend this session, but you can find excellent recaps of the information presented by Jason Boyers (IPExpert), George Stefanick (my80211.com), and Blake Krone (Digital Lifestyle). You can also find my previous review of the v2 blueprint changes.

Some of the interesting facts that I caught from other included the relative scarcity of CCIE Wireless engineers - only 45 total worldwide, and only 27 outside of Cisco. Small numbers indeed!

ISE / TrustSec Overview - Several salient details of the new ISE platform include:

• ISE bundles multiple systems under one product, including ACS, NAC Manager, NAC Server, NAC Profiler, NAC Collector, and NAC Guest Server. These roles can all be installed on a single ISE instance or split between multiple ISE instances.
• ISE is out of band and provides central policy definition and enforcement.
• ISE focused on determing both device and user identity for complete contextual policy definition and enforcement. It supports a myriad of EAP types, similar to the Cisco ACS product.
• ISE also provides policy management for non-802.1X capable clients via MAC Auth Bypass (MAB) and/or web-authentication, which is important for wired network security. 802.1X timeouts will need to be tuned much shorter than the default of 90 seconds to allow MAC Auth Bypass and DHCP processes for non-802.1X clients to continue un-interupted, prior to device profiling and policy enforcement. Pre-auth ACLs can also be defined to limit access until device profiling and policy assignment can occur (PXE boot is one scenario to consider).
• Flex-Auth aims to allow a single port-configuration to accommodate client devices of all types (802.1X, MAB, web-auth) to ease switch port management. Failover behavior betweent authentication types can be defined to meet customer requirements.
• ISE supports device profiling using many different methods, including 802.1X authentication parameters, MAC address OUI lookups, DHCP options via SPAN port / IP helper / proxy, reverse DNS lookups, HTTP user-agent via SPAN port / captive web portal on ISE, NetFlow v5/v9, and SNMP queries & traps.
• Device profiling is hierarchical, can define generic categories then drill into more detailed profiles if desired to apply more specific policies. (Example: IP Phones > Cisco IP Phones > Cisco 7960 Series).
• Device profiles can be created using combinations of gathered information from the previous bullet point to provide a more educated interpretation of what the device is. This should help reduce false positives and false negatives as well as make it difficult for someone to spoof multiple device capabilities.
• ISE fully supports RADIUS Change of Authorization (COA) which allows dynamic policy changes in the middle of client sessions if the environment changes. Previously, only support for initial policy assignment upon the initial network access attempt was supported. COA can include client disconnection, re-authentication, port bouncing, or port shutdown. Note that the WLCs support COA as of version 7.0.116.0 code.
• It supports authorization & policy management via dynamic VLAN assignment, dynamic ACL assignment, downloadable ACLs, and Security Group ACLs.
• ISE provides a new security paradigm based on Security Group Access (SGA). SGA relies on Security Group Tagging (SGT) which is hardware ASIC dependent. SGTs are assigned based on successful RADIUS authentication and attribute assignment back to the network access device.
• Older equipment such as the 3750 switches do not support full Security Group Tagging. Such platforms will rely on a software upgrade to support the SGT eXchange Protocol (SXP) which will relay IP address to SGT mappings to neighboring equipment which do support SGT. This allows end-to-end network-wide support for the Security Group Access model and a migration path without forklifting existing equipment. Note that the wireless LAN controllers will support SXP with code version 7.0.116.0 and later. For a full list of hardware and software compatibility, see the Cisco TrustSec SGA Solution Config Guide.
• SGA simplifies network security policy enforcment with ingress SGA tagging, and egress SGA enforcement based on both the source and destination SGT combinations. This reduces the need to distribute policy definition throughout the entire network, simply enforce security for central servers and data stores once at egress. See the solution guide linked above for more information.
• It currently does Not Support TACACS+, only RADIUS (focused on client authentication, not admin).
• ISE logging is much more detailed than the current ACS product, providing more information to troubleshoot authentication and policy management for clients.
• ISE and NCS management platforms are tightly integrated. The GUI looks very similar to provide consistency, and client reporting in NCS provides ISE specific authentication and profiling information for easier monitoring and troubleshooting.

See my previous posts for a review of Wireless Network Segmentation Options and Dynamic VLAN Assignment.

WLC Code Support - The legacy WiSM-1 and 4400 series controllers will not be supported on code versions 7.2 and later. The latest supported code version will be 7.0. Customers should plan accordingly and prepare for hardware upgrades in the near future if they intent on deploying new features. Note that sotware maintenance for bug fixes and security patches will continue on the 4400 platform until 2014 according to the EoL notice.

ELM aWIPS Limited HW Support - Enhanced Local Mode (ELM) WIPS will only be supported on 802.11n access points. I am not sure if this is due to hardware limitations or not, but this is a huge issue for existing customers looking to support this feature. ELM was designed for highly distributed environments where the cost of an overlay solution was prohibitive. In lieu of that target market, I would have to say that Cisco seems unwise to limit support to new 11n access points. I would venture that most retail or other distributed environments already have deployed wireless network, many with older 11a/b/g hardware. The whole value proposition of ELM to reduce hardware deployment costs gets thrown out the window with this move and really invites customers to evaluate the entire WIPS market which includes other overlay solutions. This can only be a bad move for Cisco!

RRM Modifications - Significant changes to the RRM algorithm have been made between WLC versions 4.2 to 7.0. These include fixes to eliminate pinning (the worst APs cannot improve and prevent other APs in the same RF group from being changed) and cascading (propagation of a single channel change across all APs in the RF group). For example, an AP channel change event can only cause subsequent changes to first-hop APs which are direct RF neighbors of the original AP modified. RRM is preferred over static channel and power assignments becuase most RF environments are dynamic and change over time. Cisco recommends that customers who had issues on older code versions re-evaluate the use of RRM in their environments with these enhancements.

RRM First-Hop Neighbors (purple) Are Allowed
To Change Channels, But Not 2nd-Hop Neighbors (blue)

Also, most RF designs using RRM should be designed to allow APs to operate at medium power levels (values 3-5) so that RRM can adjust power levels up or down as necessary. If the network is designed with minimal overlap and APs operate at maximum power level 1 all the time, then RRM can adjust power higher to compensate for coverage holes or AP failures.

BandSelect Recommendations In-Flux - The historical official recommendation from Cisco documentation, TAC, TMEs and other support personnel has been to disable BandSelect on voice WLANs to prevent roaming delays. Since BandSelect delays probe responses on the 2.4GHz radio, it can cause roaming delays that may impact performance of an active voice call. However, we heard from a few sources during multiple presentations that voice engineers within Cisco may have validated minimal impact to voice calls and recommending customers to turn it on the voice WLANs. No official change has been made to formal recommendations at this point, but may be an interesting topic to watch for changes in the future.

Cisco Stadium Wi-Fi - The new 3500p access point and 25137NP (36⁰ spot-beam dual-polarization antenna) provide focused coverage for stadium seating sections. This solution also incorporates changes to the RRM algorithm and Wi-Fi Clear-Channel Assessment (CCA) specific to supporting a high-density environment. Read more about it here.

Cisco Narrow Beamwidth Antenna Focuses on
Individual Stadium Seating Sections

Layer 3 Roaming Enhancement - New in code version 7.0.116.0 is support for layer 3 client roaming when clients have static IP addresses configured.

Redundant Controller Licensing - Cisco WNBU (Wireless Networking Business Unit) has heard customer requests for backup controller licensing instead of having to purchase redundant units with full licensing for the intended AP capacity required. However, this change has not yet been committed to by WNBU. If you are a Cisco wireless customer and deploy N+1 or N+N redundancy, you should contact your Cisco account team to formally request s this change and throw added pressure on the pile!

Multiple LAG Groups on WLCs - Cisco WNBU is also considering adding support for multiple link aggregation (LAG) groups on the controllers. This would allow more flexible deployment in scenarios where controllers need to connect to separate physical networks, most common in DMZ anchor controller deployments I would imagine. For instance one LAG group connects to physical switches that lead into the core and another LAG group leads to a different set of physical switches that lead to the Internet. Currently, the only way to do this is to not use LAG at all and use a single physical interface for each side of the connection. This limits throughput to 1Gbps maximum. Multiple LAG support is not yet committed to by WNBU, so once again, call your account team to formally request support if it's important to you as a customer.

Rumor Apple will Support Fast Roaming in iOS 5 - There was also a very interesting rumor that was brought up in Wednesday's "Design and Deployment of Enterprise WLANs" that Apple may support 802.11r Fast BSS Transition (fast roaming) in it's upcoming release of iOS5. If this turns out to be true it will be a major improvement for support of Apple mobile devices including the iPhone, iPod Touch, and iPad in an enterprise environment. In a corporate setting these devices are much more likely to be leveraged as a converged devices supporting voice and video integration with corporate PBXs and video collaboration systems which require fast roaming for uninterrupted sessions.

Support for 802.11r should also officially come in Cisco WLC code version 7.2, although hooks have been in the WLC since the first 7.0 train release of 7.0.98.0.

Cheers,
Andrew

Cisco CCIE Wireless Lab Version 2.0 Announced

Updated 2011-05-20. Cisco has released the updated Lab Equipment and Software list.

Today Cisco announced the release of version 2.0 of the CCIE Wireless Lab Exam. The new version will go into effect on November 18, 2011, and adds several topics to the lab that were not included in the first version, updates software used in the lab, and swaps some legacy end-of-life equipment with newer product models or replacements. The new written and lab exam blueprints are available for candidates, and the lab exam hardware and software list have also been released.

Given that the pass rate on the CCIE Wireless lab exam is really low, this gives Cisco and CCIE candidates an opportunity for course correction. It appears the pass rate is only around 13%, but Cisco stopped reporting official numbers last year so it's hard to be sure. Also, this doesn't give us insight into the number of attempts that candidates are requiring in order to pass. I'm sure Cisco gained a lot of information into why candidates were failing the lab, and from what I've heard in the candidate ranks it appears that most are stumbling on the wired network integration and wired quality of service sections.

Here is a summary of the major changes and new topics candidates will need to be prepared to encounter.

New Software 

• WLC updated from version 4.2 to 7.0.116.0. Cisco purposefully waited until 7.0 maintenance release 1 was publicly available before announcing the lab exam update.
• Autonomous updated from version 12.3(8) to 12.4(25d)
• WCS updated from version 4.2 to 7.0
• ACS server updated from version 4.2 to 5.2. Candidates will need to learn the new ACS software interface since there was a major overhaul between 4.x and 5.x versions.
• Cisco AnyConnect client replaces Cisco ADU and SSC client supplicants.

New Hardware 

• 5500 Series Wireless LAN Controller (the WiSM and 4400 Series have been removed)
• 1260, 1040, and 3500 Series APs (the 1240 and 1250 Series have been removed)
• 3300 Series Mobility Services Engine (MSE) (the 2700 Series Location Appliance has been removed)

New Lab Exam Topics

• VSS - Virtual Switching System on the Catalyst 6500 series platform used to pool multiple physical switches into one logical virtual switch.
• Static Multicast Routing. PIM and IGMP were on version 1, but static multicast routing is a new addition.
• IPv6 subnetting and static routing (on the wired network). I find this particularly interesting since Cisco only supports IPv6 bridging on their wireless equipment right now, and not even that when using H-REAP)
• Basic PKI for dot1x and web-auth. This was inferred in version 1, but is now explicitly called out as a requirement.
• Unified AP Locally Significant Certificates (LSC) obtained from a corporate / enterprise PKI system, rather than relying on the Manufacturer Installed Certificate (MIC).
• OfficeExtend for remote and teleworker access points.
• AP Groups used for SSID availability, which replaces WLAN Override from version 1.
• WLAN load-balancing, BandSelect, and Passive Client support.
• H-REAP local auth, groups, and address learning by the WLC.
• ClientLink (Beamforming)
• CleanAir (Spectrum Analysis)
• VideoStream (Multicast Optimization)
• Mesh networking
• WCS Virtual Domains
• WCS High Availability
• Wireless Intrusion Prevention Services (WIPS) with the MSE appliance.
• Context Aware Services (CAS) with the MSE appliance replaces location tracking with the 2700 appliance from version 1.

The big items in this list that are really new to version 2 are VSS, IPv6, LSC, OfficeExtend, BandSelect,  Passive Client support, ClientLink, CleanAir, VideoStream, Mesh, and WIPS.

Revolution or Evolution? - Andrew's Take
The CCIE Wireless lab exam was already extremely tough and had a comparatively low pass rate versus other CCIE tracks. The inclusion of many new wired network technologies and protocols have undoubtedly expanded the scope of the lab exam. Coupled with the feedback that I am hearing from candidates, the wired integration seems to be the stumbling block for most candidates, and the expansion of wired requirements in the lab may make it even harder to pass. Time will tell come November and beyond as candidates begin taking the new version. My recommendation is for traditional RF and wireless engineers to be fluent in wired networking technologies, as the Cisco CCIE Wireless is as much about wired networking as it is about wireless (and even less so about actual RF engineering, really). Candidates with strong route/switch background seem to be fairing a bit better at the exam in my estimation due to the exam structure and topics.

Cheer (and happy studying),
Andrew

Other Posts You Might Like:
- Cisco CCIE Lab Exam Preparation
- Lab Version 2 by Jerome Henry (FastLane)
- Cisco CleanAir Review

Cisco CCIE Lab Exam Preparation

Image courtesy of EnterpriseITPlanet.com

I recently completed the CCIE certification program by passing the CCIE Wireless lab exam. Having been on this journey for the better part of a year and a half and achieving success, I thought that I would share some of my experiences and tips. Ultimately, everyone's journey to acquiring their digits will be different. But some of the same underlying themes and methods are applicable for everyone.

Here are some of my recommendations for those interested in pursuing CCIE certification:

10. Love the Track You Select
I think this is a fairly obvious one. You have to love the technology and have a passion for it. You will be devoting a large amount of time into studying and if you don't love the subject, then you won't stick with it. If  you want the CCIE certification solely to enhance your resume, get a better job, or get better pay, chances are you won't succeed. Granted, some might, but most won't. Every CCIE that I meet has a genuine passion for the technology; the resume, job, and pay benefits are icing on the cake.

9. Join a Community
Attempting to study alone is possible, but definitely much harder. Try to find a community of others studying for the same track as you. This will allow you to benefit from the various strengths of individual study group members. Each person will have different backgrounds, experience, and perspective. By learning from other's strengths, you strengthen your understanding of the topics you may be weak in. Additionally, a study group will shorten the amount of time you spend researching topics and allow you to focus on absorbing the knowledge, not hunting for answers. These communities exist is many different forms, from local Cisco User Groups to bootcamp classmates and online discussion boards (such as Twitter). Get involved, and do it early on in your studies!

8. Know Your Learning Style
Take the time to understand how you learn best. What is the most effective method for you, individually, to understand and commit knowledge to memory? Often times you can recognize your learning style by recollecting your "AHA!" moments. What made the light bulb go off and allowed you to truly grasp a topic?

Perhaps your a aural learner and like webinars or electronic training material. Instead, you could be a visual learner and classroom training or a bootcamp would be more beneficial. Or maybe you learn best when reading printed material and pouring over design guides, whitepapers, and tech notes should be your focus. And let's not forget the most important method for a CCIE candidate, tactile learning. The lab exam is 100% hands-on, in the equipment, building working networks.

Whichever method is your focus, understand that you will likely need to combine all the methods in some fashion during your studies. There is no one single source for all the information you will need to pass the CCIE lab exam. A single week-long bootcamp will not magically make you and "expert", there is simply too much material to cover for it to be all-encompassing.

7. Essential Study Preparation
Take the time up-front to understand where the information you need resides. Build a list of sources and keep the list updated as you progress through your studies. The first and most important source is the lab exam blueprint. This should form the outline for your studies, and serve to shape and focus your attention on the topics relevant to the exam. The CCIE lab is notoriously broad, in all tracks. There are already a ton of topics, features, and nuances to know to pass the exam; don't make it even harder by studying topics outside of the scope of the blueprint. The one exception to this is fundamental concepts that must be understood for more advanced in-scope topics.

I would suggest that candidates document their research and findings thoroughly by taking notes as they study. As a first step, consider creating the document outline directly from the lab exam blueprint. By taking notes you will absorb and retain the information more thoroughly. Additionally, summarizing information into a condensed format is essential for reviewing topics again in the future. Make no mistake, you will be re-visiting every topic on the blueprint multiple times. The last thing you want to happen is to research the answer to a question, only to come across the same question again and waste time re-discovering the answer.

6. Invest in Your Future
Often one of the biggest hurdles for CCIE candidates to overcome is the financial outlay required not only to sit for the lab exam, but also to acquire the required study materials. There is no easy way to avoid spending money up front to prepare for a CCIE exam. Candidates will require books, training, and equipment at a minimum. Some candidates may be fortunate to work in a large Cisco environment and have access to these resources readily at hand; others may not and have to purchase materials on their own.

Whatever the situation, understand that the money spent is not wasted, it's an investment in your future. The amount of risk involved in that investment is entirely up to you and your dedication to the goal. This psychological hurdle, if not overcome, can devastate your chances of passing the exam. Don't hadicap yourself by worrying about the money. If you truly have the willpower to follow through and succeed, your investment will pay for itself exponentially.

5. Study One Task at a Time
Many candidates get anxious about the volume of material included in the lab. While that is certainly true, don't get caught up in the enormity of the exam. If you follow #7 above, then you have a collection of small and manageable learning tasks and an outline to follow. Without an outline to focus you on specific tasks, it's easy to wander between topics and get distracted. Focus on individual tasks, take notes, and complete each task before moving onto the next one. Take it day by day, task by task, and before you know it you will have filled in the entire outline you created.

The one item that I suggest you depart from this advice is regarding lab date scheduling. Be sure to schedule your lab exam well in advance for a few reasons. First, setting a definitive date will help you focus and drive for the finish line in your studies. Second, book a lab date that fits into your schedule. Some tracks are notoriously harder to get a date than other (especially Wireless). Booking it well in advance may be the only option you have, and it sucks to be ready only to find out you will have to wait 4-6 months and stay prepared the entire time. Trust me, it happened to me.

4. Check Your Ego
Put simply, don't assume you know everything. Even if you have worked with the technology for the last decade, review everything in the blueprint and your outline again. Often times I hear of candidates who proclaim they are XYZ experts, only to find out that the way they have always understood or implemented the technology is only one of several valid methods, or worse that they were wrong.

Take the time to review the fundamentals, even if they are not directly on the lab blueprint. Fundamental theory often guides practical implementations, even if differences exist. Knowing the fundamentals will help you synthesize and retain the material more effectively, as well as be better prepared to respond to ambiguous or scenario-based questions (such as the OEQs).

3. Be Willing to Sacrifice
You have to put in the effort and the hours to succeed. Those digits are not given away, they are earned the old-fashioned way - through hard work and commitment. This will mean spending many long nights in the study lab, missing dinners, skipping out on movie nights, and making the exam your top priority. Candidates with spouses, children, or other family responsibilities will find this especially difficult. For these individuals, striking an appropriate balance will be crucial. You will need the support of your family throughout this endeavor, so make sure everyone is on-board with your new schedule. It's likely that exam preparation will consume a year or more of your life.

2. Confidence
You will know more about the track you are studying than almost anyone else. As of today, there have only been 28,000 or so CCIEs, ever! You will be in rare company if you pass. Take that attitude into the exam, after all the act of passing the exam only confirms the knowledge that you have already acquired. The exam does not magically make you an expert, your studies have accomplished that. All that is left is to prove what you already know.

It's my firm belief that most people never even attempt the lab exam because of the psychology involved. Self-impressions and confidence can go a long way to achieving the success you have envisioned for yourself. Act the part and be a self-fulfilling prophecy.

1. Endure Disappointment
Three simple words: Never Give Up! Chances are good that you will NOT pass on your first attempt. Heck, chances are for many people that they won't pass on their second attempt either. Don't get discouraged. Everyone must run the lab gauntlet. There is so much more to the lab exam than just configuring equipment.

Once in the room, the candidate must deal with the anxiety of the exam that has built up over the last year, digest a completely foreign lab topology, correctly analyze and interpret questions and scenarios presented in the workbook, and be fast as lightning configuring the equipment. Oh, and there is the devious little bugger of time management. Even if you know the technology cold, just taking the lab exam for the very first time will kick your butt and you will fail. The candidate will have to deal with mis-direction, ambiguity, and repetitive or out of order tasks. If you're not prepared to deal with each of these, you will fail.

Obviously everyone wants to pass on their first attempt, and that is a great goal to have. But don't let your success or failure on your first attempt dictate the outcome. Be resilient and fill in the gaps exposed if you fail.

Andrew's Take
Overall, if there is one piece of advice that I can give prospective candidates, it would be this:
Prepare mentally and the rest will follow!

Cheers,
Andrew vonNagy
CCIE™ #28298 (Wireless)

This material is not sponsored or endorsed by Cisco Systems, Inc. Cisco, Cisco Systems, CCIE and the CCIE Logo are trademarks of Cisco Systems, Inc. and its affiliates. The symbol ™ is included in the Logo artwork provided to you and should never be deleted from this artwork.