Remote Branch Networking Fundamentals
•
0 j'aime•2,111 vues
A clear description of the technical opportunities offered by ARUBA ClearPass, AirWave, Activate and Instant. Another "pearl" from Airheads blog:
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
Similaire à Remote Branch Networking Fundamentals
Similaire à Remote Branch Networking Fundamentals (20)
Plus de Marcello Marchesini
Plus de Marcello Marchesini (9)
Dernier
Dernier (20)
Remote Branch Networking Fundamentals
- 1. Remote and Branch Networking Fundamentals June 9-14, 2014
- 2. CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved 2 #AirheadsConf Agenda • Challenges of Deploying Remote networks • Aruba Solution • Aruba Instant • Aruba Instant for Private WAN based Deployments • Aruba Instant-VPN • Management and Zero-Touch Deployment
- 3. Challenges of Deploying Remote Networks
- 4. 4 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Who should care? Branch office / Remote teleworker Retail Healthcare
- 5. 5 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Challenges
- 7. 7 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Solution Home Office On The RoadBranch Datacenter AirWave Aruba Mobility Controller ClearPass Access Management Instant-VPN Mobility Switch Instant Cluster Virtual Intranet Access (VIA) Client Internet / WAN Instant Cluster
- 9. 9 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Internet Airwave and Aruba Central Campus Network Aruba Central Aruba AirWave Data Center • Advanced guest services • Mobile device onboarding • Unified wired/wireless policy Airwave ClearPass Mobility Switch
- 10. 10 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Activate: Zero-touch Deployment
- 11. Aruba Instant
- 12. 12 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Instant • Redundancy for internal failure • Redundancy for external failure • Organic growth • Mobility-ready • RF optimization • Master AP selection • Over-the-air provisioning • WiFi oriented configuration Simple to deploy Self- optimizing Self- healing Scalable
- 13. 13 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Aruba Instant Architecture • Distributed data-plane – Wireless encryption / decryption, firewall • Distributed control-plane – Authentication, DHCP, ARM, WIPS • Centralized (local) management-plane – Configuration, firmware management, GUI, SNMP
- 14. 14 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Automatic RF Management Infrastructure control • Automatic RF optimization for coverage & capacity • Real-time spectrum analysis and interference avoidance • Load / Application awareness • Self-healing Channel 11 Channel 6 Channel 1 Client Control • Moves clients towards less congested frequency band • Distributes clients across available spectrum* • Bandwidth controls
- 15. 15 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Security tailored for Mobility Context Aware On-boarding Role-based access Policy Enforcement • Aruba RFProtect + AirWave RAPIDS • RF Scanning, Rogue AP detection / containment, Valid-station protection • Encryption • Over-the-air AES encryption, IPSec VPN to datacenter (where applicable) • Role-based Access • Per-user, per-device access • Policy Enforcement Firewall • Segregation of business traffic from guest traffic. • Blacklisting for session violation • Centralized Monitoring and Alerting
- 16. 16 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf • No need for separate SSID for QoS. • Session based DSCP tagging & prioritization • Multicast-to-unicast conversion for video • Media-classification for encrypted voice –Apple Facetime • AirGroup* to manage Apple AirPlay, AirPrint, etc Mobility Services: Real-time Applications Clear Pass IAP IAP IAP
- 17. 17 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Mobility Services: Guest Access • Securely Manage Visitor Access – Streamlined workflow; No IT • Sponsored-based, Visitor Self-Registration, Pre-registration, Anonymous Guest Access • 3rd Party Integrations • APIs for integration with existing applications / CRM tools – Assignable roles, expiration times, user names, passwords • Highest Customization – Skin technology, software plugins, APIs – Targeted advertising and content delivery
- 18. Private WAN based Deployments
- 19. 19 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Private-WAN based Deployments
- 20. 20 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Private-WAN based Deployments
- 21. 21 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Auto-GRE for Guest Branch office Datacenter AirWave ClearPass Instant Cluster VRRP Link Master Standby Guest Anchor Master Active Servers MPLS Employee Traffic Guest Traffic
- 23. 23 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Datacenter AirWave/Aruba Central Aruba Mobility Controller ClearPass solution Internet / WAN VRRP Link Master Standby DMZ Master Active Home Office Instant Home office Solution Home Office Instant
- 24. 24 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Branch Office Solution Branch office Datacenter AirWave/Aruba Central Aruba Mobility Controller ClearPass solution Instant Cluster Internet / WAN VRRP Link Master Standby DMZ Master Active Branch office Instant Cluster
- 25. 25 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DHCP - How does Distributed L3 work ? Network 10.0.0.0/8 VLANs 10 to 99 Data Center Remote Branch Internet / WAN Active VPN Tunnel Client A Browsing to Intranet Browsing to Youtube Route on IAP – For 10.0.0.0/8 network, next hop is VPN terminating controller’s IP address Master IAP Memeber IAP Client B Browsing to Intranet Browsing to Youtube VLAN 250 IAP-VC is the DHCP Server DHCP Request VC SRC NATs traffic using IAPs local IPVC routes the traffic to the tunnel Intranet
- 26. 26 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DHCP - How does Centralized L2 work ? Network 10.0.0.0/8 VLANs 10 to 99 Data Center Remote Branch Internet / WAN Active VPN Tunnel Client A Browsing to Intranet Browsing to Youtube Route on IAP – For 10.0.0.0/8 network, next hop is VPN terminating controller’s IP address Master IAP Member IAP Client B Browsing to Intranet Browsing to Youtube VLAN 50 DHCP Request VC SRC NATs traffic using IAPs local IPVC bridges traffic in the tunnel VLAN 50 DHCP Server and Default Gateway Intranet
- 27. 27 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DHCP - How does Local Subnet work ? Intranet Network 10.0.0.0/8 VLANs 10 to 99 Data Center Remote Branch Internet / WAN Active VPN Tunnel Client A Browsing to Intranet Browsing to Youtube Route on IAP – For 10.0.0.0/8 network, next hop is VPN terminating controller’s IP address Master IAP Slave IAP Client B Browsing to Intranet Browsing to Youtube VLAN 200 IAP-VC is the DHCP Server DHCP Request VC SRC NATs traffic using IAPs local IPVC SRC NATs traffic using inner IP
- 28. 28 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Recommendations IAP-VPN Modes Usage Recommendations Distributed L3 Recommended for all deployments. Local Recommended for Guest networks with centralized captive portal servers. Centralized L2 Recommended only if Multicast to branch is a requirement. If Multicast to branch networks is not required, use L3 modes.
- 29. 29 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Branch ID Algorithm
- 30. Aruba Instant-VPN Design Options
- 31. 31 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Single AP deployments
- 32. 32 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Single AP deployments
- 33. 33 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Multi-AP deployments
- 34. 34 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Multi-AP deployments
- 35. 35 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved Thank You #AirheadsConf
- 36. 36 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Distributed-L2
- 37. 37 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Central-L2
- 38. 38 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Central-L3
- 39. 39 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Dist-L3
- 40. 40 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf Local Mode
- 41. 41 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved #AirheadsConf DOWNLOAD: Airheads Mobile JOIN: community.arubanetworks.com FOLLOW: @arubanetworks DISCUSS: #AirheadsConf ATMOSPHERE 2014 AIRHEADS@
- 42. 42 CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved Thank You #AirheadsConf