Power over Ethernet for Wireless LANs: Reducing Costs and Increasing Security

Transcription

1 Power over Ethernet for Wireless LANs: Reducing Costs and Increasing Security A White Paper Vernier Networks, Inc. 465 National Avenue Mountain View, California

2 Is There a Cure for the Access Point Headache? Many organizations that hope to benefit from the well publicized cost savings of wireless LANs (WLANs) find themselves unpleasantly surprised by the less well publicized costs and hassles of delivering electrical power to wireless access points. Scenarios like the following threaten to jeopardize the financial and operational benefits of WLANs altogether: An access point is malfunctioning, depriving tens of users of network access. To restore service, a network administrator has to drive to the building where the access point is installed, locate the access point in the ceiling, set up a ladder, and climb up to turn the access point off and on. Now that the organization has deployed wireless networks throughout its campus, these search-and-reset missions are becoming all too frequent and expensive. Time and expense of access point maintenance are an unexpected drain on IT resources. A department manager discovers he has badly miscalculated his IT budget. Running electrical cabling to access points in the ceiling will cost at least $400 per access point nearly the cost of the access point itself. The manager failed to budget for materials such as electrical conduits and the fees charged by professional electricians. The expense of running power cables to new access points slows the ROI of WLANs and makes some installations cost-prohibitive. Users on a subnet are frustrated by the poor coverage of their WLAN. To save money, access points have been installed only where power outlets already exist, rather than in the locations suggested by a WLAN site planning report. Power requirements make it difficult to position access points optimally or reconfigure office space when business needs change. Even in areas such as manufacturing floors, auditoriums, and department offices that close at fixed hours, an organization always leaves its wireless network turned on and vulnerable to hackers in nearby offices and parking lots. Customers are unable to take advantage of a powerful security measure turning off unused access points because power switches are inaccessible on access points installed in ceilings and other hard-to-reach locations. Power over Ethernet for Wireless LANs

3 Over the strenuous objections of the user community, an IT department decides to limit its WLAN deployment to guest access and non-essential services, because it doesn t want to leave its mission-critical applications vulnerable to power outages. Unlike servers, which are protected by uninterruptible power supplies (UPSs) in wiring closets and data centers, access points are dependent on local power outlets that are not protected against outages. Until WLANs can survive power outages, many IT departments will not trust them for mission-critical applications, including Voice over IP (VoIP). WLANs were supposed to lower infrastructure costs and reduce IT workload. But electrical cabling has proved to be the weakness in the WLAN model. Power cabling for WLANs creates an ongoing headache for organizations increasing costs, slowing ROI, and tying up valuable IT resources. Power over Ethernet for Wireless LANs 3

4 What Help Do New Standards Provide? To address these problems, WLAN administrators can take advantage of an Ethernet technology recently developed for wired networks. Power-over-Ethernet (PoE) technology, based on the IEEE 802.3af draft standard, delivers power to network devices over two unused pairs of wires in Ethernet cables. A PoE power-sourcing device sends both network data and power down an Ethernet cable to a PoE-ready device, whose Ethernet port is designed to accept both data and power. Because the PoE-ready device is receiving power through its network cable, it doesn t need additional power cabling or even a local power source. As a result, the device can be installed wherever the Ethernet cable can reach: in a ceiling, on a pole, in a corridor, etc. Cisco and other access point vendors have begun shipping PoE-ready wireless access points. Most vendors products use a positive polarity power scheme; Cisco s use a negative polarity power scheme. Both positive-polarity access points and Cisco access points can be powered by UPS-backed power-sourcing devices installed in wiring closets and data centers, making the access points easier to control and more reliable. Delivering power over Ethernet cables provides these benefits for WLANs: Cost savings. Network administrators run just the Ethernet cable to the access point. No other cabling is required. Improved management. Access points can be centrally managed through controls available only to administrators. There s no need for network managers to traverse a campus in order to power cycle an unresponsive access point. Power protection and increased availability for the network. Power for the access points can now be protected by central UPS units, ensuring that wireless applications continue to operate during power outages. Increased security. IT managers now have centralized control for powering individual access points on and off. PoE technology can make WLANs more affordable, manageable, reliable and secure. But PoE technology risks becoming one more issue and one more equipment list for network administrators to manage. Which PoE power sources should administrators select? How should PoE technology best be deployed? Is it secondary infrastructure that should be planned and deployed independently of the deployment of access points, secure gateways, and authentication servers? Or can it somehow be integrated with a comprehensive WLAN management system, simplifying the deployment and ongoing management of the WLAN? Even if an administrator decides to use PoE, the headaches of WLAN management security, networking services for mobile users, access policies, and now PoE deployment just seem to get longer and longer. Power over Ethernet for Wireless LANs

5 Is There a Manageable Solution Available Today? The Vernier Networks 6500p series is a WLAN security and management solution that builds on Vernier Networks award-winning WLAN technology and provides advanced PoE support for wireless access points. The Vernier Networks 6500p series: Supports the widest range of PoE-ready access points from any manufacturer, including 802.3af-compliant devices and Cisco devices. Supports Cisco 1200 series access points operating in b mode, a mode, or combined a/b mode. Supports up to 12 ports of powered 10/100 Mbps Ethernet per 6500p unit. Protects access point electronics by automatically sensing if the access point is capable of receiving power. Delivers power only if the access point can accept it. Provides network administrators with a simple, intuitive Web-based interface for powering individual or multiple access points on and off. Administrators can provide the ultimate security against hackers by powering off access points in unused areas of the network. Provides all the security, management, and mobility features usually included in the Vernier Networks System, including user-, group-, time-, and location-specific access controls; support for seamless roaming across subnets; support for VPN encryption; and full session logging. The Vernier Networks 6500p solution is available in a scalable, two-tier architecture for enterprise-scale deployments and in a single integrated system for small networks. Enterprise-scale Networks. Customers can use a central Vernier Networks 6500 Control Server to integrate their WLAN with their existing authentication systems and to coordinate network activities for roaming users. Local Vernier Networks 6500p Access Managers secure, manage, and power PoE-ready access points. Small Networks. Customers can use a single Vernier Networks 6500p Integrated System, which combines the functionality of a Control Server and an Access Manager in a single unit, to secure, manage, and power PoE-ready access points for a small network. Power over Ethernet for Wireless LANs 5

6 Powering Access Points with PoE Technology Power-over-Ethernet technology delivers power over two unused wire pairs (4-7 and 5-8) in an Ethernet cable, enabling PoE devices such as access points to draw power from Ethernet cables. Each Vernier Networks 6500p series Access Manager or 6500p series Integrated System functions as a power source for access points, and supports up to 12 ports of 10/100 Mbs PoE Ethernet. The 802.3af standard uses a positive polarity power scheme. Cisco access points use a negative polarity power scheme. Vernier Networks 6500p products support both 802.3af and Cisco devices. Power over Ethernet for Wireless LANs

7 Meeting All Three WLAN Requirements: Security, Manageability, and Power The Vernier Networks System is a comprehensive solution for securing, managing, and powering wireless networks. A proven solution based on industry standards, the Vernier Networks System has already been deployed in enterprises, universities, and health care facilities. Security. The Vernier Networks System provides advanced security controls that make wireless communications safe for mission-critical applications. The system s browser-based login interface for wireless users integrates with whatever mix of authentication systems are already deployed at a site, including RADIUS, LDAP, Kerberos, 802.1x, and Windows domain, enabling organizations to extend their existing authentication controls to the world of wireless networking. A Layer 3 packet-inspection engine enforces user-, group-, location-, and time-specific access rights on every packet traveling through the Vernier Networks System. Using these rights, administrators can enforce fine-grained, role-based access controls, such as restricting which users can access the Finance Department WLAN during business hours. Airwave security features include a range of VPN and encryption technologies, such as PPTP, IPsec, AES, and 3DES, for encrypting network traffic without overburdening an organization s central VPN terminators. Anti-MAC-address spoofing and other security features prevent hackers from spoofing authenticated devices in order to access the network or to tamper with network traffic. Manageability. Vernier Networks manageability features include support for seamless roaming across subnets enabling users to move among any coverage zones where they are authenticated and browser-based administration controls that give administrators a convenient, easy-to-use interface for managing all aspects of WLAN access, security, and power. Full session-logging enables administrators to analyze and trouble-shoot network traffic and to collect information for audits and forensics. Designed to complement an organization s existing IT infrastructure, the Vernier Networks System works with all IP-standard network cards and access points. The Vernier Networks System is available either as an integrated system or as a two-tier architecture, accommodating wireless networks of all sizes. Power. The Vernier Networks 6500p series adds PoE capabilities to the award-winning Vernier Networks System, enabling administrators to deploy WLANs with PoE-ready access points. Vernier Networks PoE technology eliminates the need for separate power cabling for access points, dramatically lowers WLAN deployment costs, enables WLANs to be protected by central UPS systems, and gives administrators centralized control over access point power. Adhering to Vernier Networks philosophy of supporting heterogeneous networks, the 6500p series supports both positivepolarity 802.3af devices and negative-polarity Cisco devices. Power over Ethernet for Wireless LANs 7

8 Conclusion: Financial Benefits and Increased Security The Vernier Networks 6500p series provides a comprehensive solution for securing, managing, and powering WLAN access points. By providing a single-box solution for the problem of reliable access point power, the Vernier Networks 6500p series dramatically lowers the costs of owning and managing WLANs and accelerates WLAN ROI. The 6500p series also provides the ultimate WLAN security by enabling administrators to remotely power vulnerable access points on and off. The Vernier Networks 6500p series delivers: Lower costs. WLAN deployments become more affordable, because Vernier Networks PoE technology eliminates the need for additional power cabling and electrician fees. Increased flexibility. Access points can be easily redeployed or reconfigured, because they are not tethered to existing office power outlets. And the Vernier Networks System enables organizations to work with both 802.3af-compliant access points and Cisco access points. Reduced workload and operational expenses. Instead of having to travel around a campus looking for access points to reset, administrators can simply power cycle an access point from a central location. By reducing installation costs and operational expenses, the Vernier Networks PoE solution enables organizations to accelerate the ROI on their WLANs. Protection from Outages. Adding the Vernier Networks 6500p series and UPS units protects a WLAN from power outages for wireless communications and missioncritical wireless applications. Access points can run off UPS-backed 6500p units in wiring closets and data centers, while laptops and PDAs can run off their batteries. Greater control and efficiency. Administrators can automatically shut off WLANs in unused offices, ensuring that the WLANs don t fall prey to hackers. Compelling cost savings and increased security make PoE an essential part of any WLAN deployment. Using the Vernier Networks 6500p series, organizations can realize the costand labor-saving benefits promised by WLANs. Through the PoE, security, and management features of the Vernier Networks System, WLANs are now ready to support mission-critical applications. Power over Ethernet for Wireless LANs May 2003 Vernier Networks, Inc. All rights reserved.