Huawei PAN BYOD Converged Network Solution

Huawei PAN BYOD Converged Network Solution

Background According to a report from IDC, by the end of 2015, users will use more mobile devices than PCs to surf the Internet. With the popularity of smart terminals, more and more employees use tablet PCs and smartphones to do work, which improves office work efficiency. Mobile officing brings innovations to enterprise services. For example, tablet PCs are used in hospitals for ward round, in banks for VIP services, and in restaurants for dish ordering. On the other hand, employees are increasingly bringing their own smart devices to the office and taking the files and materials out of the office. This may bring risks to enterprise information security. Networks constructed in traditional ways can no longer support such a variety of terminals, especially mobile terminals, which pose the following challenges to an enterprise: Blurring of Network Boundaries During the time of fixed network, computers or laptops are connected to the Internet at fixed locations and can be easily controlled and managed. So there is a clear network boundary. However, with the popularity of Wi-Fi and 3G/4G networks, more and more mobile devices are connected to enterprise networks, blurring the network boundaries. Unauthorized users may also try to access the enterprise network. Diversification of Application Scenarios Many kinds of users need to access the enterprise network, including employees, employees of partner companies, external visitors, and VIP visitors. The application scenarios include wired access, wireless access, internal access, external access, and scenario switching. Different users have access to different network resources of the enterprise and are authenticated in different policies and modes. Moreover, the location and time of the network access must also be considered. Complicated Management There are many types of mobile devices that run different operating devices and applications, which complicates the work of IT administrators of an enterprise. Security Risks to Services The foremost concern of many enterprises in constructing wireless networks is service security. Network users accessing the enterprise network jeopardize the enterprise data and information. Employees using mobile devices of the enterprise to do office work outside the company may lose the devices, causing data leakage. The openness of the mobile network also increases the possibility of malicious attacks against the enterprise, which may lead to network paralysis. 1

Huawei PAN BYOD Converged Network Solution 2.1 Solution Overview Boasting the best experience and construction ideas of wireless networks, Huawei provides a series of bring your own devices (BYOD) solutions for enterprise to help them build high-efficiency, unified, secure mobile networks. There are different scenarios of wireless network building. Some enterprises already have wired networks and need to build wireless networks as well. Some enterprises need to build brand new wired and wireless networks. Some enterprises already have wireless networks and need to solve the security problem. To satisfy the various scenario requirements, solves the problem of network boundary blurring through integrated wired and wireless networks, the problem of diversified application scenarios through unified access authentication and policies, the problem of complicated management through unified management, and the problem of security risks through impeccable network security policies. Architecture of Huawei Enterprise Networking BYOD Solution 1 Endpoint 2 Infrastructure 3 Management AnyOffice On IOS/Android Public places 3G/4G Headquarters SVN Public Wi-Fi Internet USG Smart Phone SOHO AP WAN S9700 Policy Center PAD AnyOffice On Win/Mac SmallBranch Branch AP AP USG AC6605 S7700 esight Laptops S5700 AR G3 S5700 Special Scenes PC Outdoors AR G3 ATM Emergency Cellular network ewbb AP MDM 2

2.2 High-Efficient Network for BYOD The popularity of using smart terminals for working and wide application of VoIP, virtual desktop, video conferencing, and telepresence require enterprise core networks with large-capacity and high-performance forwarding capability. Huawei switches provide Gigabit access, 10-Gigabit aggregation, and 40G core processing capabilities for enterprises to cope with these challenges. Catering to the network trend, Huawei, for the first time, introduces the Software-Defined Networking (SDN) architecture into campus networks and redefines the agile network to support the dynamic, cloudized, and changing next generation network. To handle the swams of traffic, Huwei provides highdensity WLAN products with the intelligent scheduling function. With this function, Huawei WLAN products automatically control the transmit power of each packet based on the signal strength of terminals, limit low-rate access, and provide 5GHz/2.4GHz dual-band access to prevent co-channel interference and improve bandwidth. The intelligent scheduling function allows for smooth and environmentally friendly Wi-Fi access. The unique Beamforming+ technology makes wireless signals more stable to improve receive signal strength. In terms of installation, the WLAN products have userfriendly handles and dovetail foundation and are designed for both wall and pole mounting, reducing the WLAN network construction time by 30% and network maintenance cost by 20%.Meanwhile, PHU, a portable test device built on the smartphone hardware platform, is used to provide dynamic and static network evaluation, and intelligent output of optimizing solutions to simplify network planning. 2.3 Unified Access, Polices, and Management to Improve BYOD Experience 2.3.1 Unified Access provides a unified network for users to access at anytime and anyplace. Users can access the enterprise intranet via Wi-Fi, wired, or 3G/4G networks, or from branch offices. This solution ensures secure and seamless switchover of access locations. In addition, provides a unified wired, wireless, and VPN authentication center for centralized access control in different scenarios. This solution integrates the industryleading VPN and MDM technologies to ensure the smooth access switchover between 3G and Wi-Fi networks as well as between Wi-Fi networks. Users do not need to be authenticated again after switching to another access network. 3

2.3.2 Unified Policies IT administrators can provide different users with different policies based on the fine-grained information obtained about the role of the user, the owner of the device, time, location, device type, and the access mode (5W1H). Who: The administrator classifies network visitors into different types: external visitors, employees, managerial personnel, and sales personnel. Whose device: whether the device belongs to the enterprise or a particular person. A personal device shall carry as little information as possible to just meet the employee's work requirements. Meanwhile, the enterprise cannot put too many limitations on the personal device. However, as for a device distributed by the enterprise to an employee, the enterprise can customize the device to either put limitations or realize service innovation. What Device: Smartphones, tablet PCs, laptops, and desktop computers. Different policies are configured for different devices due to their various functions. When: Enterprises put different limitations on network visitors according to when they access the enterprise network, for example, whether they try to visit the network during work time or after-work time. Where: Whether the network visitor is an internal visitor or an external visitor? How: Enterprise can provide individual-based access modes to different users in different scenarios, including 802.1x and SSL VPN access, wired and wireless access, external and internal access. Due to 5W1H, enterprises can implement different control polices including QoS, bandwidth, time period, rights, and routing control policies. 2.3.3 Unified Management is capable of centrally managing users and network and mobile devices. The highly integrated management platform simplifies network maintenance. In terms of network device management, Huawei esight management platform provides resource-specific hierarchical and domain-based management of intranet access from wired and wireless network devices. The visualized management design allows IT maintenance engineers to gain visibility into the operating status of wired and wireless network devices. For wireless network devices, the solution is capable of visualizing radios, locating devices, and identifying and locating interference sources. The one-stop troubleshooting allows for rapid end-to-end fault location and provides a hardware probe detection solution for applications, such as telepresence. In terms of mobile device management, Huawei AnyOffice mobile working platform provides lifecycle device management, including device discovery, registration, access control, device control, data management, device loss management, and deregistration. This solution also allows for self-service management to improve user experience and management efficiency and reduce maintenance cost. In terms of user management, Huawei Policy Center provides user group-specific polices for unified management of employees and guests accessing the intranet via wired or wireless networks from intranets and extranets. To manage guests, you can configure GRE tunnels on the Policy Center to isolate guest and employee traffic and deploy an ASG to audit guest Internet access behaviors to prevent information leaks. 2.4 End-to-End Tridimensional Protection to Secure BYOD Services ensures tridimensional (cloud, pipe, and device) network security. To prevent data loss, Huawei AnyOffice client allows users to remotely lock the lost device and erase the sensitive data on it. The AnyOffice client also provides the sandbox function to isolate enterprise data and personal data on a BYOD device. To prevent employees from leaking information, the AnyOffice solution is capable of comprehensive management and control, such as outgoing file control, jail breaking detection, antiprintscreen, and device lost management. application blacklist and whitelist to control employees' Internet access behaviors. For transmission security, Huawei solution supports wireless air interface encryption, IPSec, and SSL VPN. For threat prevention, Huawei provides anti-ddos, antivirus, IPS, and IDS solutions. To secure wireless devices, Huawei launches device-level WIPS/WIDS solutions. To enhance enterprise information security, Huawei intelligent threat prevention solution provides more refined security defense policies. For application control, Huawei provides dedicated application control gateways. You can configure 4

Benefits, efficient, unified, and secure, frees customers from the hassles in wireless network planning and construction. It is the most comprehensive BYOD network solution in the industry. inherits the network security strengths of Huawei. It can be widely applied to various scenarios and is easy to scale up. The products of this solution deliver high performance and stability. Therefore, Huawei PAN BYOD Converged Network Solution is the first choice for enterprises to construct mobile working networks. 5

Components Network management : esight Huawei Enterprise Network BYOD Solution Network management product Policy management : Policy Center Maintenance audit : UMA Security management : isoc Chassis Ethernet switch Box Ethernet switch Enterprise router WLAN CE12804/12808/12812 S1700-8 S1700-24 S1700-28 S1700-52 AR2220 AR2240 AR3260 CE12804/12808/12812 S2700-9TP S2700-18TP S2700-26TPS2700-52TP AP7120DN AP6010DN S9703/S9706/S9712 S3700-26C S3700-28TP S3700- S3700-52P-48S/T 52P-24S AR1220L AR1240 AR1220V/ 1220VW AP6310SN AP6610DN-AGN S7703/S7706/S7712 S5700-28P/52P S5700- S5700-6TP S5700-24TP 28C/52C AR207V HSPA AR1220/ 1220V AR151/156/ 157/158E AP7110SN AP6310SN DC security gateway NGFW S5700-48TP S5710-28C/52C S6700-24EI/48EI S6850-52Q 48T/48S Firewall/UTM Online behavior management AR157G HSPA Security product SSL VPN AR201/202/ 207/208E AR207V AC6605-24-PWR ACU For S9700/S7700 IDS/IPS Anti-DDoS Anti-virus firewall Mobile terminal client terminal client USG9500 USG3000/6000 USG 2000/5000 ASG2000 SVN 2000/5000 NIP2000/5000 Anti-DDoS1000/8000 AVE2000 AnyOffice Agent 6

Copyright Huawei Technologies Co., Ltd. 2013. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademark Notice, HUAWEI, and are trademarks or registered trademarks of Huawei Technologies Co., Ltd. Other trademarks, product, service and company names mentioned are the property of their respective owners. General Disclaimer The information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There are a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice.