Airheads Macau 2013 - WLAN Management & Troubleshooting with AirWave

WLAN Management & Troubleshooting
with AirWave
Carl Mower, VP Network Management Engineering
November 2013

CONFIDENTIAL
© Copyright 2013. Aruba Networks, Inc.
All rights reserved

1

#airheadsconf

Agenda
Everything in this presentation
is from AirWave 7.7, unless
specially noted by:

AirWave overview
Diagnosing client RF problems

Coming
soon in
8.0

Proactive management
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
AirWave 8.0 Multi-Server
CONFIDENTIAL
All rights reserved

2

#airheadsconf

AirWave overview

CONFIDENTIAL
All rights reserved

3

#airheadsconf

Agenda
AirWave overview
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
CONFIDENTIAL
All rights reserved

4

#airheadsconf

AirWave manages it all

Aruba
WLAN

Wired

Legacy
WLAN

Aruba
Networks
Controllers &
APs
Instant

CONFIDENTIAL
All rights reserved

Any MIB-II
compliant
device

Migrate from
Cisco
Motorola
Legacy

5

Outdoor /
Mesh

Monitor
network activity

Aruba

Users &
Devices

Aruba AP175

Classification &
reporting
Integration with
MDM

Aruba
AirMesh

#airheadsconf

Aruba Management Architecture
AirWave
•  Long-term History & Trending
•  WLAN Troubleshooting
•  Visualization & Reporting

Controller (or VC)
•  Centralized Radio Management
•  Role based Policy Enforcement

APs / AMs
•  802.11 radios
•  Integrated IDS/IPS
•  Spectrum Analysis

CONFIDENTIAL
All rights reserved

6

#airheadsconf

Data Flow to AirWave
Airwave
Email, SNMP, Syslog

Controller

CONFIDENTIAL
All rights reserved

NMS

Virtual
Controller

7

#airheadsconf

AirWave Groups & Folders
Groups
Define Configuration Standard
Devices share config in Group
Defines polling intervals and protocol
Share same Firmware level on devices
Groups are non-hierarchical

Folders
Similar to Directory structure on your PC
Common monitoring, alerting
Control role based access
Hierarchical based organization
No limit on level depth
Every device associated with ONLY ONE Group and Folder
CONFIDENTIAL
All rights reserved

8

#airheadsconf

AW 7.7 list

CONFIDENTIAL
All rights reserved

9

#airheadsconf

AirWave 7.7 & 8.0
AirWave 7.7

AirWave 7.7.6

–  10 new visibility features (see next)

–  IAP GUI config

–  Application visibility

–  7.3 switch config profiles

–  No more Flash graphs

–  Zero-touch config for switches

–  Support 11ac, new APs, AOS 6.3
–  Support for IAP 3.3
–  SNMP à AMON for client & AP data
–  VisualRF speedup

AirWave 8.0

Coming
soon in
8.0

–  Separate firmware download & reboot

–  Support for IAP 3.4 & 4.0

–  Integration w/ Image Server

–  Multi-server AirWave

–  Added Cisco 1600 & 2600

–  UI refresh including migration of
VisualRF to HTML5

–  Run commands repeatedly

CONFIDENTIAL
All rights reserved

10

#airheadsconf

New Visibility Features Added in 7.7
1.  Watched Clients – to show status of VIP clients
2.  RF capacity dashboard – to show heavily-used radios/APs
3.  Anomaly detection – to find anomalies in client counts or bandwidth used
4.  Client steering table & report – to show ARM3.0 steering events
5.  Graphs no longer in Flash – to enable AirWave on iPads
6.  AppRF – to show PEF session data over time
7.  Client health metric added to existing RF performance dashboard
8.  Client health indications displayed for clients on VisualRF floorplans
9.  Summarize reports by folder –show heaviest usage by folder/geography
10. Trigger enhancements – eliminate stale events

CONFIDENTIAL
All rights reserved

11

#airheadsconf

AirWave 7.7: New Aruba Support
Support for new APs
•  AP224/AP225 (802.11ac), RAP155/155P

AOS 6.3 Support
•  Configuration of new and updated profiles

Real time monitoring for controllers
•  Client monitoring data (state and stat)

Aruba Instant
•  Support for IAP 3.3
•  Threshold to mark VC down (similar to SNMP threshold)
•  Show the AP acting as VC in lists
•  Firmware upgrade improvements: Image Server Integration, group enforce flag

CONFIDENTIAL
All rights reserved

12

#airheadsconf

AirWave 7.7: Other Enhancements
Trigger Enhancements
•  Auto acknowledgement of up/down alerts
•  NMS integration now supports SNMPv3 informs
•  Radio up trigger

Reporting Enhancements
•  Folder level summarization in Device Summary reports
•  Wired bandwidth in Network Usage Report
•  Quarterly reports (reports every n months)
•  Email CSV reports
•  API to get report data in XML format (XHTML)

Usability and workflow enhancements
•  30x improvement in time taken for nightly audit (login to controller once for all the APs)
•  Import config from controller/switch when added into group (like Instant)
•  Show device name everywhere (no more mac addresses in AP names)
•  Split up image download and reboot
•  First discovering AP/time in the rogue list
• 
CONFIDENTIAL
All rights reserved

13

#airheadsconf

AirWave 7.7: VisualRF
Features
•  Identify planned APs on a floor plan
•  Show notes field (read only)
•  New AP Support (AP224, RAP155)

Performance and Scalability Improvements
•  Loading VisualRF page is faster
•  Optimized for better handling of channel utilization and interface metrics
•  Better logging and diagnostics
•  Better defaults for http timeouts
•  Handle OOM issues better
•  Location Accuracy Tool for better troubleshooting

CONFIDENTIAL
All rights reserved

14

#airheadsconf

Diag client prob

CONFIDENTIAL
All rights reserved

15

#airheadsconf

Agenda
AirWave overview
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
CONFIDENTIAL
All rights reserved

16

#airheadsconf

Helpdesk

CONFIDENTIAL
All rights reserved

17

#airheadsconf

User “gmurphy” calls helpdesk…

CONFIDENTIAL
All rights reserved

18

#airheadsconf

Client Diagnostic View

CONFIDENTIAL
All rights reserved

19

#airheadsconf

Overlay: Client Location

CONFIDENTIAL
All rights reserved

20

#airheadsconf

Overlay: Heatmap

CONFIDENTIAL
All rights reserved

21

#airheadsconf

Overlay: Data Rate

CONFIDENTIAL
All rights reserved

22

#airheadsconf

Overlay: Client Health

CONFIDENTIAL
All rights reserved

23

#airheadsconf

Client match

CONFIDENTIAL
All rights reserved

24

#airheadsconf

Client Match Events

CONFIDENTIAL
All rights reserved

25

#airheadsconf

Client Match Events - Detail

CONFIDENTIAL
All rights reserved

26

#airheadsconf

Client & Radio
detail

CONFIDENTIAL
All rights reserved

27

#airheadsconf

Client Detail

CONFIDENTIAL
All rights reserved

28

#airheadsconf

Client Detail
Detailed information
for the selected client:
•  Device info
•  Current association
•  Graphs
•  Current location (VRF)
•  Alerts for that client
•  Client match events
•  Radios that hear client
•  Association history
•  Device events

CONFIDENTIAL
All rights reserved

29

#airheadsconf

Radio Diagnostics

CONFIDENTIAL
All rights reserved

30

#airheadsconf

Graphs
Flash à HTML5

CONFIDENTIAL
All rights reserved

31

#airheadsconf

All Graphs in 7.7 Now HTML5
Graphs in AirWave 7.6 and earlier were Flash-based
All graphs in AirWave 7.7 are converted from Flash to HTML5

CONFIDENTIAL
All rights reserved

32

#airheadsconf

All Graphs in 7.7 Now HTML5
By clicking on a graph, can then zoom in/out, pan,
and hover (to get values for each point)

CONFIDENTIAL
All rights reserved

33

#airheadsconf

Run CLI cmds

CONFIDENTIAL
All rights reserved

34

#airheadsconf

Run CLI command(s) at intervals

CONFIDENTIAL
All rights reserved

35

#airheadsconf

Proactive

CONFIDENTIAL
All rights reserved

36

#airheadsconf

Agenda
AirWave overview
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
CONFIDENTIAL
All rights reserved

37

#airheadsconf

PEF visibility

CONFIDENTIAL
All rights reserved

38

#airheadsconf

Application Visibility
Collections of 9-tuples:
•  Source-IP
•  Source-port
•  Destination-IP
•  Destination-port
•  Protocol
•  Device type (Win7, iPad, iPhone…)
•  Role (employee, guest…)
•  ESSID (production, guest…)
•  Location (folder)

CONFIDENTIAL
All rights reserved

39

#airheadsconf

Application Visibility: Overview

CONFIDENTIAL
All rights reserved

40

#airheadsconf

Application Visibility: by Destination

CONFIDENTIAL
All rights reserved

41

#airheadsconf

Application Visibility: by ESSID

CONFIDENTIAL
All rights reserved

42

#airheadsconf

RF performance

CONFIDENTIAL
All rights reserved

43

#airheadsconf

RF Performance

CONFIDENTIAL
All rights reserved

44

#airheadsconf

RF Performance

CONFIDENTIAL
All rights reserved

45

#airheadsconf

RF capacity

CONFIDENTIAL
All rights reserved

46

#airheadsconf

RF Capacity

2 radios were
“heavily utilized”
80-100% of the
time.
(“Heavily utilized” is
80%+ utilization).
(Only “on time” is
considered. That is,
blocks of time the
radio is doing
something, not the
middle-of-the-night).

CONFIDENTIAL
All rights reserved

47

#airheadsconf

RF Capacity

CONFIDENTIAL
All rights reserved

48

#airheadsconf

RF Capacity

CONFIDENTIAL
All rights reserved

49

#airheadsconf

Client overview &
VIP dashboard

CONFIDENTIAL
All rights reserved

50

#airheadsconf

Watched Clients

CONFIDENTIAL
All rights reserved

51

#airheadsconf

Network
deviations

CONFIDENTIAL
All rights reserved

52

#airheadsconf

Network Deviations

CONFIDENTIAL
All rights reserved

53

#airheadsconf

Network Deviations
Anomalies illustrated for
clients and bandwidth.
Shown here, the current
reading (blue, green),
plotted against 40-week
average +/– one
standard deviation.
Average for any given
period of time, (for
example, noon-12:10 on
a Friday), is calculated
for that same time-period
(noon-12:10) for the
previous 40 Fridays.
(Average is NOT simply
the previous few days).

CONFIDENTIAL
All rights reserved

54

#airheadsconf

VRF

CONFIDENTIAL
All rights reserved

55

#airheadsconf

Agenda
AirWave overview
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
CONFIDENTIAL
All rights reserved

56

#airheadsconf

VisRF

CONFIDENTIAL
All rights reserved

57

#airheadsconf

VisualRF

Review Coverage
Heatmaps

CONFIDENTIAL
All rights reserved

58

#airheadsconf

VisualRF

Visualize Rogue
AP Location
Locate Interference
sources

CONFIDENTIAL
All rights reserved

59

#airheadsconf

VisualRF

CONFIDENTIAL
All rights reserved

60

#airheadsconf

VisualRF 8.0: FlashàHTML5 for iPad
In AirWave 8.0, VisRF moves to HTML5.

CONFIDENTIAL
All rights reserved

61

Coming
soon in
8.0

#airheadsconf

VisualRF 8.0: HTML5

Coming
soon in
8.0

CONFIDENTIAL
All rights reserved

62

#airheadsconf

VisualRF 8.0: HTML5

Coming
soon in
8.0

CONFIDENTIAL
All rights reserved

63

#airheadsconf

Reports

CONFIDENTIAL
All rights reserved

64

#airheadsconf

Agenda
AirWave overview
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
CONFIDENTIAL
All rights reserved

65

#airheadsconf

Custom & Pre-Defined Reports
20 pre-defined reports to choose from…

…or make a custom report from any combination of the 170+ “sections” available above
CONFIDENTIAL
All rights reserved

66

#airheadsconf

Custom Reports
Filter custom reports by:
•  Folder
•  Group
•  [Infrastructure] Device type
•  ESSID
•  End-user role
•  Client: OS, chipset, manufacturer

Also:
•  Pick report range (start, end)
•  Schedule recurring report execution
•  Email report
•  HTML, CSV, PDF

CONFIDENTIAL
All rights reserved

67

#airheadsconf

Custom & Pre-Defined Reports
Now to highlight 4 reports…

CONFIDENTIAL
All rights reserved

68

#airheadsconf

RF health report

CONFIDENTIAL
All rights reserved

69

#airheadsconf

RF Health Report

CONFIDENTIAL
All rights reserved

70

#airheadsconf

RF Health Report

CONFIDENTIAL
All rights reserved

71

#airheadsconf

RF Health Report

CONFIDENTIAL
All rights reserved

72

#airheadsconf

RF Health Report

CONFIDENTIAL
All rights reserved

73

#airheadsconf

Client session

CONFIDENTIAL
All rights reserved

74

#airheadsconf

Client Session Report

CONFIDENTIAL
All rights reserved

75

#airheadsconf


CONFIDENTIAL
All rights reserved

76

#airheadsconf


CONFIDENTIAL
All rights reserved

77

#airheadsconf


CONFIDENTIAL
All rights reserved

78

#airheadsconf


CONFIDENTIAL
All rights reserved

79

#airheadsconf


CONFIDENTIAL
All rights reserved

80

#airheadsconf

Client match
report

CONFIDENTIAL
All rights reserved

81

#airheadsconf

Client Steering Report
Client match actions by:
•  Folder
•  AP
•  Client

Details of each match

CONFIDENTIAL
All rights reserved

82

#airheadsconf

•  Steers by device type
•  By steering reason
•  By band (11ac, n-5G, n-2.4)

CONFIDENTIAL
All rights reserved

83

#airheadsconf

PCI compliance
report

CONFIDENTIAL
All rights reserved

84

#airheadsconf

PCI Compliance Report
Shows results of an audit
of the WLAN against
specific PCI
requirements.
For each PCI
requirement, shows
failing cases, (if any).

CONFIDENTIAL
All rights reserved

85

#airheadsconf

New report:
most by folder

CONFIDENTIAL
All rights reserved

86

#airheadsconf

Most by Folder (Region) Report
Summarize max
concurrent clients and
utilization by folder.
When each folder
represents a geographic
location, useful to find
“busiest” locations.

CONFIDENTIAL
All rights reserved

87

#airheadsconf

Triggers & Alerts

CONFIDENTIAL
All rights reserved

88

#airheadsconf

Agenda
AirWave overview
Visual RF
Reports
Triggers & Alerts
Rogue detection
Configuration
CONFIDENTIAL
All rights reserved

89

#airheadsconf

Triggers
Configurable attributes common to all triggers:
•  Severity (normal, warning, minor, major, critical)
•  Limit by folder
•  (If folder specified…) do/do-not include sub-folders
•  Limit by group
•  Notes
•  Alert via Email (if so: specify sender Email and 1+ recipients)
•  Alert to NMS (if so: select 1 or more destinations)
•  Optionally suppress future alerts until first is acknowledged

Also, limiting conditions unique to each trigger type
A few select triggers and their unique conditions are highlighted…

CONFIDENTIAL
All rights reserved

92

#airheadsconf

Triggers
Device Down
•  Limit number of outstanding down events
•  Must be down X minutes
•  Suppress thin-AP-down when controller down
•  Suppress device-down when upsteam device is down
•  By device type (AP, controller, RAP, switch…)
•  Minutes down threshold
Device Up
•  Auto acknowledge corresponding down event
•  Match by device type (AP, controller, RAP, switch…)

CONFIDENTIAL
All rights reserved

95

#airheadsconf

Triggers
AP Usage
•  Direction: up, down, combined
•  Threshold & duration to measure
Channel Utilization
•  Interference %
•  By radio type (11ac, 11a, 11b, 11g, 11n, …)
•  Time busy, receiving, transmitting
Radio Noise Floor
•  Noise floor

CONFIDENTIAL
All rights reserved

96

#airheadsconf

Triggers
Device Event
•  Event contains sub-string
•  Event type (syslog, SNMP trap)
•  SNMP trap category (HW, IDS, client security, AP security, rogue…)
•  Syslog category and/or severity
Radio Down / Radio Up
802.11 Frame Counters / 802.11 QoS Counters
•  110+ different counters by threshold
New client discovered
New device discovered

CONFIDENTIAL
All rights reserved

97

#airheadsconf

Triggers
Interface Usage
•  Interface label, mode, name
•  Interface speed in / out (Mbps)
•  Interface type
Config Mis-match
Device Resources
•  CPU or memory threshold
Rogue Device Classified
•  By classification (valid, neighbor, rogue, …)
•  Confidence level
•  Threat level

CONFIDENTIAL
All rights reserved

98

#airheadsconf

Rogue: Rules
Detected on WLAN, LAN
Detecting AP Count (at least, at most)
Encryption Type
Network Type (Infrastructure, AdHoc)
Signal Strength
SSID (matches, does not match, regex)
Detected Client Count
IP Addresss
Manufacturer

CONFIDENTIAL
All rights reserved

106

#airheadsconf

Rogue: List Columns
Classification (rogue, neighbor, valid)
Threat Level
Classifying Rule
Controller Classification
Heard on Wire?
Number of Detecting APs
SSID
Signal Strength
Encryption Type
Wireless Channel
Radio Vendor
First, Most-recent Discovering AP
First, Most-recent Discovery Date/Time
CONFIDENTIAL
All rights reserved

108

#airheadsconf

Zero-Touch Provisioning
Site A - Configuration A
Site B – Configuration B
Site C – Configuration C

Instant AP connects to AirWave
server via HTTPS and
associates to the Site A group

Instant AP connects to Aruba
Activate via HTTPS and
downloads provisioning
details

Aruba Activate™
1

Secure Data Center

2

10 a.m.

Site C
Site B
Site A

10:02 a.m.

3
AirWave™

10:07 a.m.

CONFIDENTIAL
All rights reserved

AirWave pushes the latest
software image and Site A
configuration

118

Aruba Instant™
#airheadsconf

Device Configuration Management

Discover Devices

Analyze Device

Audit
Configuration

AirWave can Discover, Audit and
Fix configuration mismatches or
settings to the managed devices

CONFIDENTIAL
All rights reserved

120

#airheadsconf

Current single-server architecture

UI

report gen

swarm handler
database
SNMP trap recvr
AMON recvr
SNMP pollers

AW-RRD

config gen/audit

work
queue
ALC workers

Visual RF

message bus

CONFIDENTIAL
All rights reserved

125

#airheadsconf

Multi-server architecture
Coming
soon in
8.0

database
database master
database backup

OpenTSDB

OpenTSDB

OpenTSDB
worker machine #1

UI

worker machine #2

worker machine #3
config gen/audit

report gen
Visual RF

Visual RF

Visual RF

ALC workers

ALC workers

ALC workers

AMON recvr
swarm handler

SNMP pollers

SNMP trap recvr

work queue via [distributed] RabbitMQ message bus

CONFIDENTIAL
All rights reserved

126

#airheadsconf

Airheads Macau 2013 - WLAN Management & Troubleshooting with AirWave

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (20)

Semelhante a Airheads Macau 2013 - WLAN Management & Troubleshooting with AirWave

Semelhante a Airheads Macau 2013 - WLAN Management & Troubleshooting with AirWave (20)

Mais de Aruba, a Hewlett Packard Enterprise company

Mais de Aruba, a Hewlett Packard Enterprise company (20)

Último

Último (20)

Airheads Macau 2013 - WLAN Management & Troubleshooting with AirWave