Remote & Branch Networking Fundamentals #AirheadsConf Italy
•Download as PPTX, PDF•
1 like•1,418 views
Remote & Branch Networking Fundamentals #AirheadsConf Italy
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Remote & Branch Networking Fundamentals #AirheadsConf Italy
Similar to Remote & Branch Networking Fundamentals #AirheadsConf Italy (20)
More from Aruba, a Hewlett Packard Enterprise company
More from Aruba, a Hewlett Packard Enterprise company (20)
Recently uploaded
Recently uploaded (20)
Remote & Branch Networking Fundamentals #AirheadsConf Italy
- 1. Remote and Branch Networking Fundamentals June 9-14, 2014
- 2. CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved 2 #AirheadsConf Agenda • Challenges of Deploying Remote networks • Aruba Solution • Aruba Instant • Aruba Instant for Private WAN based Deployments • Aruba Instant-VPN • Management and Zero-Touch Deployment
- 3. Challenges of Deploying Remote Networks
- 4. 4 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Who should care? Branch office / Remote teleworker Retail Healthcare
- 5. 5 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Challenges
- 7. 7 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Solution Home Office On The RoadBranch Datacenter AirWave Aruba Mobility Controller ClearPass Access Management Instant-VPN Mobility Switch Instant Cluster Virtual Intranet Access (VIA) Client Internet / WAN Instant Cluster
- 9. 9 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Internet Airwave and Aruba Central Campus Network Aruba Central Aruba AirWave Data Center • Advanced guest services • Mobile device onboarding • Unified wired/wireless policy Airwave ClearPas s Mobility Switch
- 10. 10 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Activate: Zero-touch Deployment
- 11. Aruba Instant
- 12. 12 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Instant • Redundancy for internal failure • Redundancy for external failure • Organic growth • Mobility-ready • RF optimization • Master AP selection • Over-the-air provisioning • WiFi oriented configuration Simple to deploy Self- optimizing Self- healing Scalable
- 13. 13 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Instant Architecture • Distributed data-plane – Wireless encryption / decryption, firewall • Distributed control-plane – Authentication, DHCP, ARM, WIPS • Centralized (local) management-plane – Configuration, firmware management, GUI, SNMP
- 14. 14 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Automatic RF Management Infrastructure control • Automatic RF optimization for coverage & capacity • Real-time spectrum analysis and interference avoidance • Load / Application awareness • Self-healing Channel 11 Channel 6 Channel 1 Client Control • Moves clients towards less congested frequency band • Distributes clients across available spectrum* • Bandwidth controls
- 15. 15 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Security tailored for Mobility Context Aware On-boarding Role-based access Policy Enforcement • Aruba RFProtect + AirWave RAPIDS • RF Scanning, Rogue AP detection / containment, Valid-station protection • Encryption • Over-the-air AES encryption, IPSec VPN to datacenter (where applicable) • Role-based Access • Per-user, per-device access • Policy Enforcement Firewall • Segregation of business traffic from guest traffic. • Blacklisting for session violation • Centralized Monitoring and Alerting
- 16. 16 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf • No need for separate SSID for QoS. • Session based DSCP tagging & prioritization • Multicast-to-unicast conversion for video • Media-classification for encrypted voice –Apple Facetime • AirGroup* to manage Apple AirPlay, AirPrint, etc Mobility Services: Real-time Applications Clear Pass IAP IAP IAP
- 17. 17 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Mobility Services: Guest Access • Securely Manage Visitor Access – Streamlined workflow; No IT • Sponsored-based, Visitor Self-Registration, Pre-registration, Anonymous Guest Access • 3rd Party Integrations • APIs for integration with existing applications / CRM tools – Assignable roles, expiration times, user names, passwords • Highest Customization – Skin technology, software plugins, APIs – Targeted advertising and content delivery
- 18. Private WAN based Deployments
- 19. 19 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Private-WAN based Deployments
- 20. 20 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Private-WAN based Deployments
- 21. 21 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Auto-GRE for Guest Branch office Datacenter AirWave ClearPass Instant Cluster VRRP Link Master Standby Guest Anchor Master Active Servers MPLS Employee Traffic Guest Traffic
- 23. 23 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Datacenter AirWave/Aruba Central Aruba Mobility Controller ClearPass solution Internet / WAN VRRP Link Master Standby DMZ Master Active Home Office Instant Home office Solution Home Office Instant
- 24. 24 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Branch Office Solution Branch office Datacenter AirWave/Aruba Central Aruba Mobility Controller ClearPass solution Instant Cluster Internet / WAN VRRP Link Master Standby DMZ Master Active Branch office Instant Cluster
- 25. 25 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DHCP - How does Distributed L3 work ? Network 10.0.0.0/8 VLANs 10 to 99 Data Center Remote Branch Internet / WAN Active VPN Tunnel Client A Browsing to Intranet Browsing to Youtube Route on IAP – For 10.0.0.0/8 network, next hop is VPN terminating controller’s IP address Master IAP Memeber IAP Client B Browsing to Intranet Browsing to Youtube VLAN 250 IAP-VC is the DHCP Server DHCP Request VC SRC NATs traffic using IAPs local IPVC routes the traffic to the tunnel Intranet
- 26. 26 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DHCP - How does Centralized L2 work ? Network 10.0.0.0/8 VLANs 10 to 99 Data Center Remote Branch Internet / WAN Active VPN Tunnel Client A Browsing to Intranet Browsing to Youtube Route on IAP – For 10.0.0.0/8 network, next hop is VPN terminating controller’s IP address Master IAP Member IAP Client B Browsing to Intranet Browsing to Youtube VLAN 50 DHCP Request VC SRC NATs traffic using IAPs local IPVC bridges traffic in the tunnel VLAN 50 DHCP Server and Default Gateway Intranet
- 27. 27 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DHCP - How does Local Subnet work ? Intranet Network 10.0.0.0/8 VLANs 10 to 99 Data Center Remote Branch Internet / WAN Active VPN Tunnel Client A Browsing to Intranet Browsing to Youtube Route on IAP – For 10.0.0.0/8 network, next hop is VPN terminating controller’s IP address Master IAP Slave IAP Client B Browsing to Intranet Browsing to Youtube VLAN 200 IAP-VC is the DHCP Server DHCP Request VC SRC NATs traffic using IAPs local IPVC SRC NATs traffic using inner IP
- 28. 28 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Recommendations IAP-VPN Modes Usage Recommendations Distributed L3 Recommended for all deployments. Local Recommended for Guest networks with centralized captive portal servers. Centralized L2 Recommended only if Multicast to branch is a requirement. If Multicast to branch networks is not required, use L3 modes.
- 29. Aruba Instant-VPN Design Options
- 30. 31 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Single AP deployments
- 31. 32 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Single AP deployments
- 32. 33 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Multi-AP deployments
- 33. 34 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Multi-AP deployments
- 34. 35 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved Thank You #AirheadsConf
- 35. 41 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf
- 36. 42 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved Thank You #AirheadsConf
Editor's Notes
- llanges
- 30:24 – 32:44
- Changed middle bullet
- llanges
- The only true BYOD ready, unified wired and wireless access solution for Distributed Enterprises. The key advantages being, SIMPLICITY, RELIABILITY and SECURITY. AirWave provides the end-to-end clarity and control to manage mobile users on multi-vendor, multi-site networks. Also provides remote debugging capabilities. The first and only BYOD provisioning and onboarding framework for any network. Delivers unparalleled simplicity when managing and securing network access across wireless, wired and VPNs. Servers as VPN termination point for each of the branch IAP virtual controllers. Aruba Activate for zero touch deployment. Also, security and content filtering services integrated in Instant by partnership with OpenDNS Same role-based context aware architecture can now be extended to wired users. Easier to install than your home Wi-Fi network, Aruba RAPs provide a secure, always-on wired and wireless connection back to the corporate network. Provides investment protection and deployment flexibility for future growth into large branches by ability to convert IAPs to CAPs. Also provides site to site VPN capability. Provides enterprise grade branch solution with site survivability, high availability, and zero touch deployment option. Offers intelligent infrastructure and user management with no dependency on WAN link for control traffic. Aruba VIA client software provides secure network connectivity for smartphones, tablets and laptops. Supports Windows, OS X, iOS and Android platforms. Seen on this slide is the Aruba DE solution architecture. So let us go over the components that comprise the Aruba DE solution and how to position these solutions: So for road warriors who need to connect in to their corporate network, Aruba offers a soft VPN client “VIA” to tunnel traffic in. This works great for individuals using their laptops, tablets or smartphones to access internal corporate content and is supported on Windows, OSx, iOS as well as Android platforms. But what for the home office user, maybe someone who wants to setup a lab at home and communicate with devices on the corporate network. For that RAP’s are an ideal choice. Next is the branch office itself. There are three deployment options that the customers have here. Aruba instant clusters deployed at branches managed centrally by AirWave (and in the future potentially Athena) Aruba Instant clusters deployed at branches, with the VC at each of the branch office forming an IPSec VPN tunnel with the controller at the HQ all centrally managed by AirWave Branch controllers (600 series) deployed at each of the branch offices terminating APs for those branches and Aruba Mobility controller at HQ all centrally managed by AirWave The choice maybe obvious in some scenarios and not so obvious in other. For eg: If the customer has many small to medium branch locations with no requirement to VPN to HQ, then Instant managed by Airwave/Athena would make most sense. However, for customers that do need VPN, Instant terminating VPN on MC at HQ will be preferred. Note that as compared to conventional RAP deployment, Instant terminating to the MC creates just one tunnel from VC to MC and not on per IAP basis. And then there will be some customers who want end to end encryption and do not want to extend and manage VLANs at the edge for their branches, who would prefer the branch controller deployment model.
- llanges
- llanges
- Component features: Servers as VPN termination point for each of the branch IAP virtual controllers. VRRP used to provide automatic failover and high availability. Provides enterprise grade branch solution with site survivability, high availability, and zero touch deployment option. Offers intelligent infrastructure and user management with no dependency on WAN link for control traffic. AirWave provides the end-to-end clarity and control to manage mobile users on multi-vendor, multi-site networks. Also provides remote debugging capabilities. The first and only BYOD provisioning and onboarding framework for any network. Delivers unparalleled simplicity when managing and securing network access across wireless, wired and VPNs. The only true BYOD ready, unified wired and wireless access solution for Distributed Enterprises. The key advantages being, SIMPLICITY, RELIABILITY and SECURITY. Aruba Activate for zero touch deployment. Also, security and content filtering services integrated in Instant by partnership with OpenDNS.
- llanges
- Component features: Servers as VPN termination point for each of the branch IAP virtual controllers. VRRP used to provide automatic failover and high availability. Provides enterprise grade branch solution with site survivability, high availability, and zero touch deployment option. Offers intelligent infrastructure and user management with no dependency on WAN link for control traffic. AirWave provides the end-to-end clarity and control to manage mobile users on multi-vendor, multi-site networks. Also provides remote debugging capabilities. The first and only BYOD provisioning and onboarding framework for any network. Delivers unparalleled simplicity when managing and securing network access across wireless, wired and VPNs. The only true BYOD ready, unified wired and wireless access solution for Distributed Enterprises. The key advantages being, SIMPLICITY, RELIABILITY and SECURITY. Aruba Activate for zero touch deployment. Also, security and content filtering services integrated in Instant by partnership with OpenDNS.
- Component features: Servers as VPN termination point for each of the branch IAP virtual controllers. VRRP used to provide automatic failover and high availability. Provides enterprise grade branch solution with site survivability, high availability, and zero touch deployment option. Offers intelligent infrastructure and user management with no dependency on WAN link for control traffic. AirWave provides the end-to-end clarity and control to manage mobile users on multi-vendor, multi-site networks. Also provides remote debugging capabilities. The first and only BYOD provisioning and onboarding framework for any network. Delivers unparalleled simplicity when managing and securing network access across wireless, wired and VPNs. The only true BYOD ready, unified wired and wireless access solution for Distributed Enterprises. The key advantages being, SIMPLICITY, RELIABILITY and SECURITY. Aruba Activate for zero touch deployment. Also, security and content filtering services integrated in Instant by partnership with OpenDNS.
- llanges