Bring Your Own Design: Implemen4ng BYOD Without Going Broke or Crazy. Eric Stresen- Reuter Technical Director Ruckus Wireless

Transcription

1 Bring Your Own Design: Implemen4ng BYOD Without Going Broke or Crazy Eric Stresen- Reuter Technical Director Ruckus Wireless

2 Bring Your Own Design SIMPLIFYING BYOD WITH RUCKUS RUCKUS WIRELESS PROPRIETARY AND CONFIDENTIAL

3 What Enterprises REALLY Want Getting users and devices on the network Enforcing user policies and security Managing and controlling devices

4 What Enterprises REALLY Need Simple on-boarding Automated enforcement of user/device policies Visibility of who and what is on the WLAN Extension of wired security to WLAN More capacity to deal with flood of devices Leverage existing infrastructure

5 BYOD Technology Circle IDENTIFY Device Profiling Device Inventory Inventory dashboard ONBOARD Device registration Zero-touch onboarding Provisioning - Wi-Fi/VPN profile, cert management MANAGE Mobile Device Mgmt (MDM) Mobile Application Mgmt (MAM) SECURE Access control based on device type/profile Access control based on user roles Secure connectivity

6 What s Driving Wireless? #1 Student s Daily Lives are Media Rich! o Cell phone use (18 34 year olds): o 91% take photos vs. 76% all adults o 61% play music vs. 33% all adults o 57% record a video vs. 34% all adults --- Pew Internet and American Life Project, Generations and their Gadgets, February 3, o 92% of undergrads use Wi-Fi vs. 57% of all adults o 59% of undergrads own a desktop PC o 88% of undergrads own a laptop o 93% of graduate students own a laptop --- Pew Internet and American Life Project, College Students and technology, July 19, 2011.

7 What s Driving Wireless? #2 Collaboration and Social Media! o Friends on Facebook o Follow us on Twitter o Watch our YouTube video o Blog about college life o Digital media libraries o Video chat Network Use is Massively Increasing via Wi-Fi

8 What s Driving Wireless? #3 Instructional Enhancement! o Accommodates learning styles o Reinforces classroom work o Meets students demand o Wish instructor used more often: o Web-based videos 19% o Video sharing sites 18% o Podcasts and webcasts 17% o Simulations or educational games 15% --- Grajek, S. The Current State of College Students and Technology, EDUCAUSE, 2011.

9 What is Smart Wi-Fi? BeamFlex Smart Wi-Fi Antenna Arrays o Developed leading industrial grade Wi-Fi products and technology called Smart Wi-Fi o Adaptive RF control (BeamFlex) o Predictive channel selection(channelfly) o Resilient and self optimized meshing (SmartMesh) o Automatic user device configuration (Zero IT config) o Dynamic Wi-Fi security (Dynamic pre-shared keys 9 RUCKUS PROPRIETARY AND CONFIDENTIAL

10 What s makes the difference? THEM US Fixed 1:1 relationship between Wi-Fi radios and antennas Dynamic 1:many relationship between Wi-Fi radios and antennas

11 Adaptive Antenna Completely automatic Continually picks best signal path to clients Mitigates interference Up to 10dB Signal gain Dual polarized

12 Dealing With Density Band Steering for High Capacity Environments Dual-band n Before Band Steering 5GHz 3 (18%) 2.4GHz 14 (82%) After Band Steering 5GHz 14 (82%) 2.4GHz 3 (18%) 2.4 Ghz Steers clients to 5GHz by withholding probe and auth responses on 2.4GHz Doesn t steer clients below RSSI threshold set per WLAN Client table in each AP tracks Client probe requests per band Avg. RSSI per band over last minute Dual band support Table checked before responding to client 5.0 Ghz

13 Reliable Performance Non Line of Sight Ruckus Meraki HP Cisco Aruba Apple 1 client, GHz No interference Downlink Mbps Beating Interference Ruckus Meraki HP Cisco Aruba Apple 1 client, 70 5 GHz Line of sight Uplink Mbps 60 Clients, Bi-Directional 60 Clients, Uplink Ruckus HP Aruba Cisco Meraki Apple 0 Failed to Finish Failed to Finish 5 GHz 75% downlink 25% uplink Aggregate Bi-Directional Mbps AP models: Ruckus 7363, Cisco 3500, Aruba 125, HP 460, Meraki 24, Apple Extreme. Ruckus HP Aruba Cisco Meraki Apple 0 5 GHz Aggregate Uplink Mbps

14 RUCKUS WIRELESS PROPRIETARY AND CONFIDENTIAL Now what? SIMPLIFYING BYOD WITH RUCKUS

15 Don t Reinvent the Wheel FIREWALLS CONTENT FILTERS AAA/AD/LDAP SERVERS ACLs / VLANS

16 Defining the SSID Structure o Domain SSID o School owned / managed devices with access to all resources: printers, applications, files shares o Guest Visitor SSID o Users who are not in the OUI with access only to the internet o Staff and Student BYOD SSID o Non-school owned / managed devices needing Internet access and specified school resources, VLAN and content filtering applied o Provisioning SSID o Hotspot with a walled garden attribute, redirecting all users to an activation page

17 Automating Role-Based Access DOMAIN Administrator automatically placed on VLAN W, no rate limits GUEST Allowed on via a Guest Pass, accepting terms and conditions automatically placed on VLAN Z, rate limited at 1 Mbps STAFF Staff automatically placed on VLAN X, rate limited at 5 Mbps STUDENT Student automatically placed on VLAN Y, rate limited at 1 Mbps STRANGER User does NOT have account and is denied

18 What it Looks Like User Database Student Resources WHAT HAPPENS WHEN? Staff Resources Guest Resources Internet 1. Users connect to a provisioning SSID and are re-directed to an onboarding portal. 2. Users enter domain credentials which are verified against a user database. 3. The user s role assignment and permissions are automatically determined based on authentcaion. Onboarding SSID Student Student SSID Staff SSID Staff New BYOD Devices Guest SSID (hotspot) Guest Provisioned BYOD Guest 4. Using Zero-IT, the device is auto-provisioned with a dynamic pre-shared key and dynamically assigned to the requisite WLAN. 5. Devices re-connect on a secure WLAN, receiving network permissions according to their role.

19 Ruckus BYOD Solution IDENTIFY Application Recognition Client Fingerprinting ONBOARD On-boarding portal Guest Access Device Registration Mobile Friendly portal Customizable Portal Pages MANAGE D-PSK limits per user Extended Language Support Bonjour Gateway MDM SECURE Secure LDAP Application Policy Control Enhanced Roles

20 Key Technologies SIMPLIFYING BYOD WITH RUCKUS RUCKUS WIRELESS PROPRIETARY AND CONFIDENTIAL

21 Zero IT Automates Onboarding Requirement: automatic, secure authentication and roaming Enabled by SSID and authorization protocol configuration Easy-to-use Ruckus approach to push configuration Invitation Branded Landing Page One-Click Configuration Uses mobile OS autodetect and -authenticate features, not a separate connection manager app Automatic Authentication Enabled

22 On-Boarding Portal A modern day, mobile friendly, easy-to-use Wi-Fi connection option! Single SSID for Guest Access & BYOD Registration BYOD SSID (open) Traditional Guest Access Proceed to unencrypted internet on BYOD SSID Easy BYOD Registration Move Client to Secure SSID Install Client Profile DPSK/802.1x Role based SSID Limit DPSK generation per user

23 D-PSK Automates Security/Config ZD applies role, generates D-PSK pushes dissolvable PROV file to device LDAP sends user security group information to ZD WLAN profile configured device, and on the WLAN based on allowed by role.

24 Client Fingerprinting Hostname: Dave s iphone MAC: 50:ea:d6:7c:30:e4 o Visibility Who s device is this? o Self-registration o Automatically registers and maintains client info on WLAN and Wired interfaces o Operating System o Operating System Hostname o Control by device type o Permit/allow o Assign to VLAN o Rate limit (Down/Up) o Management o WLAN controller or standalone o WLAN dashboard o Client monitor o Client details

25 Device Specific Policy Enforcement o Segregates trusted and untrusted devices on single SSID o Simplified access rules per device o n Windows n Windows Mobile o n Mac OS n ios o n Linux n Android o n VoIP n Gaming o n Printers o Control network access per device o Permit/Deny o Assign to VLAN o Rate Limit (Down/Up) VLAN 20 VLAN 10 Device Policy Access Control Device Type Access VLAN Rate Limit DL UL Gaming Deny - - Windows, Mac OS, Linux Permit 20 - ios, Windows Mobile, Android Permit 10 4 Mb 1 Mb

26 Device-Specific Policy Enforcement WHAT HAPPENS WHEN? 1 1. Configure device access policies (staff policy shown) VLAN 10 Resources VLAN 20 Resources VLAN 40 Resources INTERNET 2. Configure WLANs with device-specific policies (staff WLAN shown) 3. Staff laptops (sanctioned Windows devices) connect and receive full network permissions 4. Staff ios / Android devices connect, gain access to staff resources with some limits 2 5. All guest users receive the same Internet-only policies Staff SSID 3 4 Guest SSID 5 Student SSID Student laptops and tablets (sanctioned) connect and receive equal access to resources with rate limits 7. Students attempt to connect with non-sanctioned device types and are denied access Laptop ipad VLAN 10 VLAN 20 No Rate Limit 5 Mbps Android VLAN 20 5 Mbps STAFF DEVICES All Laptops/iOS VLAN 99 1 Mbps VLAN 40 3 Mbps GUESTS Others Blocked STUDENT DEVICES

27 BYOD How-To Guide & Videos Step by Step guide to configuring Ruckus BYOD

28 Questions. RUCKUS WIRELESS PROPRIETARY AND CONFIDENTIAL