WHITEPAPER Meru MobileFLEX An Architecture Overview Design Wireless Networks for Control and Flexibility
Table of Contents Executive summary... 1 Introduction... 2 MobileFLEX architecture overview... 3 Context- aware channel layers... 4 FLEX Access... 5 FLEX Control... 6 FLEX Management... 6 FLEX Policy... 7 FLEX Solutions... 8 Grow with Meru... 9 Glossary... 10
Executive summary As more employees decide what mobile devices they will bring to work, CIOs and their IT teams are struggling to: 1. Define and enforce bring- your- own- device (BYOD) usage policies. 2. Add wireless LAN capacity as employees consume rich media on multiple devices at work. 3. Expand coverage to support the use of tablets, smartphones, and other mobile devices in new areas. 4. Scale consumer- grade services, such as Apple AirPrint and AirPlay, which were designed for home use. The ability to deliver enterprise mobility solutions, such as classroom management in schools or unified communications and collaboration in an enterprise, may stall or proceed more slowly than planned as IT struggles to address network resource challenges and roll out a reliable, high- capacity wireless infrastructure with BYOD usage policies. To gain control over this dynamic new world, IT needs a flexible network architecture that can adapt to rapidly changing business requirements. This requires an architecture that not only provides an Ethernet- like network access service, but also an architecture that spans multiple layers within an application to satisfy all the emerging wireless requirements. Meru s MobileFLEX architecture has been designed to give IT the control and choice it needs to thrive in the face of BYOD and the consumerization of IT, and ensure an outstanding user experience amid the growing mobile use of vertical and enterprise applications. This whitepaper describes the core elements of Meru s MobileFLEX architecture and shows how MobileFLEX delivers the maximum business benefit for an 802.11 WLAN solution. The MobileFLEX architecture enables Meru to offer context- aware layers, which are separate, dedicated channels for different applications and usage contexts. Applications can be assigned to specific RF channels to ensure that each application has the guaranteed bandwidth it needs even over a dynamic and shared wireless infrastructure. Meru s comprehensive portfolio of access points and controllers delivers ubiquitous wireless LAN coverage on campus, in remote offices, in- room, outdoors, and in very client dense environments such as stadiums and arenas. Unlike other vendors that have a single RF deployment mode, Meru gives IT managers multiple choices so they can optimize performance, mobility, and user experience based on the applications and usage contexts that are right for their organization. For example, an IT administrator can easily use Meru s multiple- channel mode to support a small or distributed network and Meru's single- channel mode to support voice- and mobility- optimized applications at corporate headquarters. Or the IT manager may use Meru s channel layering to extend wireless capacity, especially if there are a lot of mobile devices that use the crowded 2.4 GHz band. Moreover, Meru s single- channel mode is critical to realize the full benefit of an 802.11ac deployment because of the reduced number of available RF channels. Similarly, at the control layer, Meru gives IT a choice: the simplicity of an on- premise controller appliance, the on- demand scalability of controller software running on VMware, or a distributed deployment that is optimized for the WAN and remote locations. Meru truly shines at the policy layer, with a secure BYOD and guest connection service integrated into the MobileFLEX architecture. Meru has the industry s most widely deployed BYOD and guest management solution, with more than 3,000 installations. Meru makes it easy to define and enforce BYOD and guest access policies on any wired or wireless infrastructure. IT can enforce detailed policies, such as allowing users with tablets to access limited domains within the intranet or restrict smartphones to Internet and email access. Meru s Service Connect software also allows organizations to scale consumer- grade services, such as AirPrint and AirPlay, for wireless printing and media streaming. At the application layer, the MobileFLEX architecture provides the requisite services to support industry- specific and broad- based enterprise mobility solutions. For example, Meru has put together a fully validated classroom management solution in partnership with LanSchool as well as a unified communications solution in partnership with Microsoft Lync, each with its respective deployment and configuration guides, to help IT reduce cost and complexity.
Introduction Business associates, vendors, and customers are more mobile than ever. Employees are often away from their desks, making communications with others and access to corporate services and information increasingly difficult. Such mobility dictates the need for wireless LANs that deliver increasingly higher data rates and performance. The latest IEEE wireless LAN standard, 802.11ac, promises to support speeds greater than a gigabit per second per radio. Such innovations, however, only satisfy a fraction of the requirements posed by today s expanding wireless business ecosystems. No longer is it sufficient to provide a fast, secure network transport. Today s requirements for a WLAN solution are impacted by multiple trends. People love their Wi- Fi enabled smartphones and tablets, and they are carrying them into the workplace in record numbers. Forrester Research projected that by 2016, more than 350 million people will use their smartphones for work. 1 The explosive growth of use of smartphones and tablets shows no stopping over the next five to six years (see Figure 1). Figure 1: The growth of consumer adoption of smartphones and tablets, according to Forrester Research. The bring- your- own- device (BYOD) phenomenon has caused a huge influx of mobile devices on wireless LANs, as employees and visitors expect to use their personal smartphones, tablets, and laptops at work. Besides creating a network onboarding nightmare for IT teams, the sheer number of devices on corporate and university campuses has skyrocketed. A successful WLAN must now support higher client density than ever. In addition, people commonly bring multiple Wi- Fi enabled devices into work or school. The huge popularity of tablets is driving demand for network bandwidth, especially with services like Apple Bonjour for wireless printing with AirPrint and streaming with AirPlay. Additionally, the growing diversity of mobile devices Apple, Android, BlackBerry, and Windows poses significant management challenges when attempting to apply policies based on client type. 1 Forrester Research, Mobile is the New Face of Engagement, February 2012
Other commercial factors are establishing higher table stakes for WLAN solutions. Sophisticated smartphones are more like general computers than phones. The widespread use of mobile apps adds to the throughput demands placed on the WLAN. Real- time applications, such as voice over IP (VoIP) and streaming video, need both high quality- of- service and increased bandwidth. 2 In addition, geographic diversity often imposes additional security service requirements (e.g., VPN) on a WLAN. To meet the mobility demands of business today, an enterprise Wi- Fi network must go beyond basic network access control to include bandwidth and capacity management as well as device policy enforcement that can control access by user, device, location, time of day or day of the week, and application. Additionally, because the WLAN is the edge of the network, the wireless infrastructure also must be a platform to support line- of- business applications. This whitepaper details Meru s vision for expanding our RF technology innovation 3 to provide a full complement of features and services with a new comprehensive WLAN architecture called MobileFLEX. With MobileFLEX, the Meru network becomes a single point of service and control to support mobile enterprises sophisticated applications, policy, control, security, and transport requirements today and tomorrow. MobileFLEX architecture overview Meru Networks MobileFLEX architecture is designed to maximize mobility and flexibility in both configuration and use, enabling networks and their administrators to adapt to rapidly changing environments. Because each customer has unique requirements to be met by a preferred provider, including premise or remote components, physical or virtual controllers, and cost- effective or high- performance access points, a successful Wi- Fi vendor must have depth and breadth in its product line to address Wi- Fi needs from the smallest office to the biggest campus. Meru is widely known for its innovative wireless virtualization, including Air Traffic Control and Airtime Fairness, which deliver a reliable and pervasive enterprise Wi- Fi solution. This engineering investment is the bedrock on which an expansive set of features is layered. Figure 2: The MobileFLEX architecture gives IT the levels of flexibility and control they need at each layer, while allowing users to use mobile devices of their choice. 2 Two- thirds of the world s mobile data traffic will be video by 2016, increasing some 25- fold from 2011 levels. Source: Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update, 2011 2016. 3 Meru's RF technology innovations include Air Traffic Control, Airtime Fairness, and wireless virtualization architecture.
The MobileFLEX architecture includes: FLEX Access, which encompasses Meru s innovative RF virtualization and delivers ubiquitous coverage on campus, in remote locations, in- room, outdoors, and in very dense client environments. FLEX Control, which includes flexible controller options, including hardware, VMware, and hosted as well as associated management and troubleshooting applications. FLEX Management, which provides stratified network and security management across wired and wireless networks. FLEX Policy, which provides client onboarding and supports the definition and enforcement of access policies to network resources and reporting. FLEX Policy is built on Meru s Identity Manager (IDM). FLEX Solutions, which delivers a framework for support of mobile applications (such as Microsoft Lync) and vertical market applications (such as LanSchool). Each of these elements is designed to provide independent control and flexible functionality at a defined service level. The result of this approach is a product structure with the flexibility (in both features and price) to fit virtually any wireless LAN configuration requirement, while providing IT with the control necessary to maintain security and network reliability. Meru delivers control + flexibility. Context- aware channel layers The MobileFLEX architecture allows Meru to create context- aware channel layers, uniquely enabling organizations to run mission- critical applications over a shared, wireless medium. Context- aware layers can significantly improve the performance and lower the latency of mission- critical applications by creating physically isolated wireless highways for different users and applications. Context- aware layers are like having dedicated carpool lanes for your most important applications and users. They represent an approach that is fundamentally different from quality- of- service or tagging approaches in that the RF channel is physically reserved for use by the defined context. Different layers can be set up for mission- critical, enterprise- grade, and guest or BYOD applications. In a healthcare setting, for example, life- critical applications such as patient monitoring and infusion pumps can be dedicated to a life- critical layer. A second layer can be dedicated to enterprise- grade applications such as voice, location tracking, and electronic medical records, while a third layer is dedicated to consumer- grade applications such as guest access. Context- aware layers can be applied dynamically as well. For instance, if a K 12 school is doing online assessments, IT can reserve an RF channel layer for the exclusive use of the students taking the test. Students in adjacent rooms may be able to see the RF signal but they will not be able to use the reserved Wi- Fi while testing is in progress. After the testing, the reserved channel can be released for use by others.
FLEX Access. Figure 3: Based on the foundation of MobileFLEX, context- aware channel layers allow the use of dedicated, segregated channels for different application classes and users. Enhancing the RF physical and MAC layers of the network has been Meru s established innovation in the Wi- Fi market. Meru was first to market with capabilities such as wireless virtualization and channel layering. As a result, Meru users have enjoyed seamless roaming with mobile devices, superior VoIP quality, and a consistent connectivity experience. With MobileFLEX, the unique Meru capabilities built into Layers 1 and 2 are not only retained but also extended. Figure 4: FLEX Access gives IT managers multiple RF configuration options so they can optimize performance based on the specific use case. With MobileFLEX, Meru gives IT managers multiple RF mode options so they can optimize the performance and user experience based on the specific use case: native mode for small or distributed scenarios, wireless virtualization plus virtual cell for ease of deployment to support voice or high mobility, and channel layering for increased wireless capacity (especially in the 2.4 GHz band). Multiple configuration options give customers the control and flexibility to design their wireless networks in the way that best fits their business and technical requirements. Again, control + flexibility.
FLEX Control Enterprise wireless LANs typically use a network controller as a provisioning and configuration management control point. This hardware supports the major control functions for a wireless network, including configuration and version management of AP firmware, secure client authentication and authorization, troubleshooting tools, zero- latency roaming, application resource management, application gateway functions, and fault tolerance. The network controller also can be a control point for performing integrated wired- wireless management and network health management. All of these functional elements are bundled into the Meru System Director controller software. With FLEX Control, Meru offers a broad range of hardware controllers as well as virtualized controller options that run under VMware or distributed cloud service models. Again, control + flexibility. Figure 5: FLEX Control gives IT managers a choice of deployment options to best fit their needs. Meru s product family includes application components that complement and extend the core control functions. Network management services are provided by Meru E(z)RF Network Manager, Spectrum Manager, and Service Assurance Manager applications. Based on our flexible design foundation, System Director and complementary control applications can be enhanced to keep in step with the ever- changing management requirements of enterprise networks. Beyond standard user authentication services, FLEX Control includes an Apple Bonjour gateway to support AirPrint and AirPlay. As a Layer 2 protocol, Bonjour was not designed to work in enterprise networks with multiple IP subnets. In addition to the core Bonjour functionality, Meru provides expanded access, configuration, and monitoring capabilities. Meru fully supports both IPv6 and IPv4, meeting the growing requirements for IPv6 client connectivity specified in national and international mandates for migration to next- generation IP addressing. FLEX Management The ability to monitor and manage the wireless highway is critical, and Meru offers management across multiple levels. Basic configuration management, which is provided through System Director, is executed on a central controller. Larger networks with multiple controllers can be centrally managed using Meru s E(z)RF network management software. The base design of these tools provides the maximum network provisioning and control possible. Support for management of a wired- wireless domain is supported through our partnership with SolarWinds. 4 4 http://www.solarwinds.com
FLEX Policy With wired networks, managing network access was straightforward but insecure. If there was an RJ- 45 jack available, a user could connect to the network. Network security was managed by physical access to the facility and physical access to the RJ- 45. With the advent of wireless LANs, the access security requirements changed: Users needed to understand something about the network topology (the SSID of an assigned network) and have an access key (preshared or 802.1x authenticated by user name and password). For the IT department, this method was somewhat manageable, because administrators could limit the number of wireless users and exert absolute control over who could access WLAN with a minimum of overhead. BYOD has radically changed the network access landscape. No longer is the concern only about serving mobile employees; the challenge has expanded to how to onboard and manage employees, visitors, customers, and vendors who are in constant flux within a business facility. The number of mobile users continues to rise, along with the number of wireless devices per user. The question now is how an IT department can adequately serve this crush of mobile devices and maintain network security without overwhelming IT resources. A key element in addressing this growing challenge is to have a strong and flexible policy engine that can support a network onboarding service and apply diverse policy schemes to various users and devices. Meru recognized this problem early and was first to market integrated guest onboarding with Identity Manager (IDM) through its Identity Networks acquisition. IDM is an integrated application solution widely deployed in several thousand customer installations. IDM is the foundation of FLEX Policy, the policy service element of MobileFLEX. Figure 6: FLEX Policy simplifies BYOD and guest onboarding and enforces access polices consistently. With FLEX Policy, a network user can be associated with a policy (or set of policies) designed to manage network resource access, an active logged- in time window, and application capability. FLEX Policy partitions the user community into two classes:
1. Guest users Individuals who need access to some network and/or Internet services while on company premises. 2. Corporate users Individuals who are employed by the company and have innate rights to access network and corporate resources to fulfill their job responsibilities. Table 1: FLEX Policy Functional Examples FLEX Policy feature Guest Connect Smart Connect Self- registration ü ü Sponsor- initiated assignment ü 802.1x/RADIUS authentication ü Network access time allotment ü Wi- Fi profile autocreation ü VLAN restricted access ü ü Corporate network access ü With FLEX Policy, once users are onboarded, specific application services are available via the Service Connect module. One example is eduroam, 5 a Meru- supported service from an international education collaborative that provides user authentication services across multiple, disparate sites. Being able to report on network activity of guests while logged into the corporate network is important for compliance and troubleshooting. FLEX Policy provides a full suite of reporting options for monitoring client activities. In addition, reports can be customized based on administrator- selected filters. The policy services provided by FLEX Policy can be expanded to provide a rich set of services based on user profile (presence, location, and time of day or day of the week), device type, posture status of the mobile client, and application function class. Managing customer credit and debit Wi- Fi service charges is simplified with FLEX Policy s embedded support of a broad family of Property Management Services (PMS). FLEX Solutions Meru s MobileFLEX allows organizations to meet stringent security requirements while providing a flexible WLAN environment that fits today s mobile enterprise. The most revolutionary aspect of this new architecture is the MobileFLEX approach to supporting and integrating vertical market mobile applications into the wireless fabric. The real value of a WLAN is the business value of the applications that employees use to accomplish their jobs. The enrichment of this aspect of the WLAN solution is a major goal of MobileFLEX. Figure 7: The FLEX Solutions layer enables the integration of general and vertical market mobile applications into the wireless fabric. Meru has announced collaboration with LanSchool 6 to support its education package using Meru s 802.11n WLAN as the secure wireless transport for use in device- dense classrooms. The Meru WLAN solution is designed to meet the high 5 http://www.eduroam.org/ 6 Stoneware, Inc., Carmel IN 46082, 1-888- 473-9485 or 1-317- 669-8730
device density requirements common in lecture halls and classrooms and also guarantee ample bandwidth for all students running real- time applications. Another example of an application supported by FLEX Solutions is the unified communications capabilities provided by Microsoft s Lync. Meru s FLEX Access has been specifically designed to meet the bandwidth and throughput demands for support of real- time applications like voice (VoIP) and video conferencing. Network- agile capabilities provided by Hotspot 2.0 are also part of the FLEX Solutions application collective. Meru is engaging key application developers in target markets to develop additional solutions that collectively maximize the value of both companies' products. As FLEX Solutions integration is completed for each new application, Meru will announce support of the new mobile applications serving the education, hospitality, and healthcare industries. Grow with Meru Meru makes it easy to grow as your wireless needs evolve. Whether you are providing Wi- Fi in common areas, supporting a highly dense client deployment, or delivering IP voice and video, Meru offers a comprehensive portfolio of products that can meet your needs today and tomorrow. You might start, for example, with Wi- Fi in a small office, which you can deploy with cost- effective APs and a controller that can manage up to 50 APs. As your needs expand, you can add capacity with a simple upgrade to the controller to support up to 200 APs. As mobility continues to grow, you can upgrade the controller again and add APs to meet your enterprise requirements. Workers in branch offices or home offices can easily be supported with right- sized solutions. And with a controller than can support up to 5,000 APs, Meru is the ideal solution for delivering the network coverage, capacity, and performance needed on even the largest campuses. Meru s MobileFLEX architecture is a landmark event not only for Meru but also for the wireless industry as a whole. With this innovative design approach, Meru delivers a platform that can increase the aggregate business value of mobility by providing a wireless LAN solution that maximizes flexibility and enables use of the most critical mobile business applications.
Glossary Term Airtime Fairness Air Traffic Control BYOD Consumerization of IT IDM LanSchool Lync MAC PMS RADIUS System Director VLAN VoIP VPN WAN WLAN Definition Meru's Wireless LAN scheme to allocate sufficient and balanced access in order to transmit/receive for all associated clients regardless of RF band or attached data rate. Meru's controller management of client associations with network access points. The bring- your- own- device trend, using personally owned laptops, tablets, and smartphones to access business information and applications. The growing tendency of new information technologies to emerge first in the consumer market and then spread into organizations, often requiring the support of consumer- or user- owned devices on a corporate network. Meru's Identity Manager, which supports guest network access management and client onboarding. Education- specific application from Stoneware, Inc. Microsoft's unified communication solution. Media Access Control layer. Property Management Services. Credit card billing systems used by hospitality for managing charges applied to guest charges. Remote Authentication Dial- In User Service. Used in the client authentication process. Meru s network OS running on Meru controllers. Virtual LAN. Partitioning LAN services by function. Managed by switches and routers. Voice over IP. Virtual private network. Wide area network. Wireless LAN. For more information about Meru and MobileFLEX, visit www.merunetworks.com. Meru Networks Copyright 2013 Meru Networks, Inc. All rights reserved worldwide. Meru Networks, Air Traffic Control, Airtime Fairness, and E(z)RF are registered trademarks of Meru Networks, Inc. All other trademarks, trade names, or service marks mentioned in this document are the property of their respective owners. Meru Networks assumes no responsibility for any inaccuracies in this document. Meru Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 07.13 WP1004.1.US Corporate Headquarters 894 Ross Drive Sunnyvale, CA 94089 T: 1 408.215.5300 F: 1+1 408 215 5301 E: meruinfo@merunetworks.com 10