To exemplify real-world wireless solution components and products, we will focus on one of the most common wireless product vendors in the networking world – Cisco. Other vendors offer similar products and each has its own particularities.
The Cisco Unified Wireless Network (CUWN) concept includes the following elements:
- Wireless clients: This component includes laptops, workstations, PDAs, IP phones, smartphones, tablets, and manufacturing devices that have embedded wireless technology.
- Access points: This component provides access to the wireless network; APs should be strategically placed in the right locations to get the best performance and minimal interference.
- Network management: This is accomplished through the network wireless control system, which is a central management tool that allows you to design, control, and monitor wireless networks.
- Network unification: The wireless LAN system should be able to support wireless applications by offering unified security policies, QoS, IPS, and radio frequency management. Cisco WLCs offer this unified functionality integration in all of its major switching and routing platforms.
- Network services: Wireless network services are also referred to as mobility services (Cisco’s is called the Mobility Services Engine – MSE) and they include things like guest access, voice services, location services, and threat detection and mitigation.
One of the advantages of using the CUWN solution is that it allows centralized control architecture that offers reduced total cost of ownership (TCO), improved visibility, dynamic RF management, enhanced WLAN security, enterprise mobility, and improved productivity and collaboration.
Standalone versus Light Weight Access Points
Standalone access points are also known as autonomous access points; they are easy to install but they can be difficult to manage in large deployments. Standalone access points are not as desirable as the Light Weight Access Points (LWAPs) from Cisco because they must be individually managed. In addition, different parameters must be manually configured on each device and this includes the SSID, VLAN information, and security features.
The CUWN solution introduced the concept of LWAPs and WLCs. These two types of wireless devices divide the responsibilities and the functionalities that an autonomous AP performs on its own. This technology adds scalability by separating the WLAN data plane from the control plane into a “split MAC” design, as shown in Figure 9.12 below:
Figure 9.12 – WLAN Split MAC Operation
LWAPs only focus on the actual radio frequency transmissions and the necessary real-time control operations, such as beaconing, probing, and buffering. At the same time, WLCs manage all of the non-real-time tasks, including:
- SSID management
- VLAN management
- Access points association management
- Authentication
- Wireless QoS
Modern LWAPs have plug-and-play capabilities and require WLCs for operation. They can be directly connected to the network without the need for additional configuration. The management logic and the way they function are dictated by the WLC configuration. This makes the implementation process much easier than would be the case if autonomous access points were used.
LWAP-to-WLC Communication
When using LWAPs, all RF traffic they receive must first go to the WLC device that manages the specific AP. This really changes the way in which traditional WLAN communications work, even for hosts associated with the same AP.
The RF communication between LWAPs and WLCs is handled (tunneled) using the Light Weight Access Point Protocol (LWAPP). The LWAPP tunnel can operate either in Layer 2 or Layer 3 mode. Layer 2 mode implies that the AP and the WLC share the same VLAN, subnet, and functions with the LWAP receiving 802.11 frames, encapsulating them inside Ethernet toward the WLC device. When the LWAPP tunnel operates in Layer 3 mode, the LWAP receives 802.11 frames and encapsulates them inside UDP toward the WLC device. This implies that the WLC can be anywhere as long as it is reachable by the AP.
The LWAPP Protocol
LWAPP allows the move of intelligence away from the access point and shares it with WLCs. WLCs handle wireless policies, control messaging setup, authentication, and wireless operations. WLCs can also be considered the bridge between wireless networks and wired networks. WLC devices can manage multiple access points, providing configuration information as well as firmware updates on an ad-hoc basis.
LWAPP is an IETF draft standard for wireless LAN control messaging between access points and the WLCs. It can operate at both Layer 2 and Layer 3, but the Layer 3 LWAPP is far more popular.
| Note: The access points and the wireless LAN controllers exchange control messages over a wired backbone network.
|
LWAPP Layer 2 functions include:
- 802.11 beacons and probe responses
- Packet control
- Packet acknowledgement and transmission
- Frame queuing and packet prioritization
- 802.11i MAC layer data encryption and decryption
WLC Layer 2 functions include:
- 802.11 MAC management
- 802.11e resource reservation
- 802.11e authentication and key management
Layer 3 LWAPP tunnels are used between access points and wireless LAN controllers to transmit control messages. It uses UDP port 12223 for control and UDP port 12222 for data messages. Cisco LWAPs can operate in six different modes:
- Local mode
- Remote Edge Access Point (REAP) mode
- Monitor mode
- Rogue Detector (RD) mode
- Sniffer mode
- Bridge mode
Local mode is the default mode of operation in LWAP. Every 180 seconds the access points spend 60 ms on channels it does not operate on. During the 60 ms time period, the access points perform noise and interference measurements and scan for intrusion detection events.
REAP mode allows the LWAP to reside across a LAN link and still be able to communicate with the WLC and provide the functionality of a regular LWAP. REAP mode is not supported on all LWAP models.
Monitor mode is a special feature that allows LWAPP-enabled access points to exclude themselves from dealing with data traffic between clients and the infrastructure. Instead, these APs act as dedicated sensors for location-based services, rogue access point detection, and intrusion detection systems. Access points in monitor mode cannot serve clients and they continuously cycle through all available channels, listening on each channel for approximately 60 ms.
In RD mode the LWAP monitors for rogue access points. The RD access point’s goal is to see all the VLANs in the network because rogue access points can be connected to any of these VLANs. The switch sends all the rogue access point client MAC address lists to the RD access point, which forwards these to the WLC to compare them with the MAC addresses of legitimate clients. If MAC addresses are matched, the controller knows that the rogue access point that deals with those clients is on the wired network.
Sniffer mode allows the LWAP to capture and forward all the packets on a particular channel to a remote machine that is running packet capturing and analysis software. These packets include timestamps, packet size, and signal strength information.
Bridge mode typically operates on outdoor access points that function in a mesh topology. This is a cost-effective high-bandwidth wireless bridging connectivity mechanism and it includes Point-to-Point or Point-to-Multipoint bridging.
Wireless LAN Controllers
Wireless LAN Controllers have three major components:
- Wireless LANs
- Interfaces
- Ports
The wireless LAN is basically the SSID network name. Every wireless LAN is assigned to an interface in the WLC and each wireless LAN is configured with policies for RF, QoS, and other wireless LAN attributes.
The WLC interfaces are logical connections that map to a VLAN on a wired network. Every interface is configured with a unique IP address, a default gateway, physical ports, VLAN tagging, and a DHCP server. WLCs support five interface types:
- The management interface used for in-band management, connectivity to an AAA server, or Layer 2 discovery and association
- An optional service port interface for out-of-band management that is statically configured
- The AP manager interface used for Layer 3 discovery and association (the static WLC IP address will be configured on this interface)
- Dynamic interfaces (these are basically the VLANs designated for wireless LAN client data)
- Virtual interfaces used for Layer 3 security authentication, DHCP relay support, and management of mobility features
The port is a physical connection to a neighboring switch or router, and by default, each port is a .1Q trunk port. WLCs might have multiple ports that go into a single port-channel interface (link aggregation can be applied to these ports). Some WLCs also have a service port that is used for out-of-band management.
| Note: Different WLC platforms can support a different number of access points, up to several hundred.
|
Roaming and Mobility
One of the main features of a WLAN solution is giving end-users the ability to access network resources from different areas, including zones where it is difficult to install cables. Another reason for using WLANs would be organizational policies that only allow guest access wirelessly. Sometimes a wireless LAN solution is built as a transition network until the complete wired network is implemented.
Considering the scenarios mentioned above, the end-users will most likely move from one location to another. The solution to this issue is the roaming and mobility features that give end-users the ability to access the network from different locations.
Roaming happens when wireless clients change their association from one LWAP to another without losing connectivity. Designers and engineers should carefully scale the wireless network to allow for the client roaming process. Wireless roaming can be divided into two categories, as shown in Figure 9.13 below:
- Intra-controller roaming
- Inter-controller roaming (Layer 2 or Layer 3)
Figure 9.13 – WLAN Roaming
Intra-controller roaming happens when a client moves his association from one access point to another access point controlled by the same WLC. At that moment, the WLC will update the client database with the new association and it will not change the client’s IP address.
Inter-controller roaming can operate in either Layer 2 or Layer 3. Layer 2 inter-controller roaming implies that users move from AP to AP and from WLC to WLC, but at the same time they remain in the same subnet. Layer 3 inter-controller roaming is more difficult to implement and it implies that users move from AP to AP, from WLC to WLC, and also from subnet to subnet. In this scenario the WLCs must be configured with mobility groups to closely communicate and exchange information about the roaming users’ status.
A very important advantage of Layer 3 inter-controller roaming is that users can maintain their original IP addresses. The two wireless LAN controllers are connected through an IP connection. In this situation, the traffic is bridged into a different IP subnet. When the client associates to the new access point, the new WLC will exchange mobility information with the old WLC. The original client database is not moved to the new WLC. Instead, the old WLC will mark the client in its database entry (anchor entry) and this entry is copied to the new WLC database that will mark this entry as a foreign entry. The wireless client keeps his original IP address and it is re-authenticated as soon as a new security session is established.
Wireless LAN controllers are assigned to mobility groups in order to dynamically exchange mobility messages and tunnel data over the IP connection. Mobility groups use the following ports to exchange data:
- LWAPP control: UDP 12223
- LWAPP data: UDP 12222
- WLC exchange un-encrypt messages: UDP 16666
- WLC exchange encrypt messages: UDP 16667