1. Securing The Network EDGE December 2010
Hello and welcome to this training module.
My name is Bobby Guhasarkar, and over the next 30 minutes or so, I will give you an introduction to Aruba networks.
Securing The Network EDGE December 2010

2. Who Is Aruba? : ARUN Gartner $266M+ in Revenue 850+ Employees
Quick Facts
Industry Recognition
: ARUN
Gartner
2010 WLAN MQ Leader for three consecutive years
$266M+ in Revenue
850+ Employees
11,000+ Customers
Revenue up YOY
GAAP Profitable
No debt, $150M+ cash
Growth
More than 900 new customers just in Q4FY10
Copyright © Gartner, Inc. "Magic Quadrant for Wireless LAN Infrastructure, 2009" by Michael J. King and Timothy Zimmerman, 12 February The Magic Quadrant is copyrighted 2009 by Gartner, Inc. and is reused with permission. The Magic Quadrant is a graphical representation of a marketplace at and for a specific time period. It depicts Gartner’s analysis of how certain vendors measure against criteria for that marketplace, as defined by Gartner. Gartner does not endorse any vendor, product or service depicted in the Magic Quadrant, and does not advise technology users to select only those vendors placed in the “Leaders” quadrant. The Magic Quadrant is intended solely as a research tool, and is not meant to be a specific guide to action. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

3. Enterprises Around the World Depend on Aruba Networks
High Tech
Internet
Finance
Media & Ent.
Education
Government
Healthcare
Retail
Hospitality
Public Transit
Public Venues
Services
Oil and Gas
Manufacturing
Logistics
Telecom

4. Enterprise Network “EDGE” Solutions
What We Do…
Enterprise Network “EDGE” Solutions
Wireless LAN
Infrastructure
& Rightsizing
MultiVendor
WLAN Solution
Management
Next-Gen
Branch/Store/Clinic
Networks
Full Featured
Home
Networks
WiFi IDS/IPS &
PCI Compliance/NAC
/CSS
Road Warrior
Common Platform & Virtualization Architecture
Transport/Ports/VLANS  User Centric Security & Services
Distributed Piecemeal Boxes  Intelligent Centralization Solution
Wired Mostly  Wireless Mostly

5. Enterprise Networking Market Trends

6. Infrastructure for the Workforce
1990–2007
HQ Based Employees Tied to Desk
Convenience WLAN Technology
Files, Data, and Apps Are Stored on Local Servers

7. But, Everything Is Changing
2007 and Beyond
Branch Office
HQ Based Employees Tied to Desk
Convenience WLAN Technology
Remote Office
Workforce is mobile
Laptops + Smartphones Are the Computing and Communications Devices
Home Office
Files, Data, and Apps Are Stored on Local Servers
Mobile
Files, Data, and Apps Are Stored in Private and Public Clouds
High Performance WLAN Technology

8. Mobile Devices are Everywhere
Laptops/Tablets
22% growth in Q2,2010
43.4% of Enterprise workers use WLANs today, growing to 58% by 2014
37% growth in Q2,2010
3.2M iPads in 80 days
8.4M iPhones
60% of Fortune 500
400 Higher Ed institutions
Smartphones
2.7M Smartphones in Q2,10
$484M total WLAN market highest ever
840K access points
47% of 11n units, 64% of revenue
Cisco’s 47% is 11n, Moto’s is 30% is 11n, Aruba’s 80% is 11n
No wonder cisco’s customers are complaining about performance!
Number of APs per controller going up for every vendor except Moto
Compare 11n revenue numbers, Cisco makes $265M total, $30M of autonomous APs
Acer
Apple
BlackBerry
HTC LG
Motorola Nokia Samsung
12.1M BlackBerries in Q2,10

9. How do you define what is the enterprise security boundary?
RF Performance
11g to 11n: 54Mbps to 150Mbps on 20MHz channel --- channel bonding: 300Mbps with 40MHz channel overhead: Goodput on a 40MHz channel between an 11n client and an 11n AP would be 180Mbps. 30 clients per AP, results in 6Mbps --- bandwidth is the most valuable asset in WLANs – one needs to maximize it (ARM), guarantee its availability for all clients (ARM 2.0), and ensure that it is protected (ARM + Spectrum).
18 clients load balanced across 2.4GHz and 5GHz bands (6 + 12) with band balancing, 5GHz clients are load balanced across available 40MHz channels and 2.4GHz clients are load balanced across available 20MHz channels with spectrum load balancing, and individual clients are given a share of the WLAN medium per radio with air-time fairness.
Voice and video requires Application Layer Gateway functionality built-in to the products – without it voice/video quality will suffer.
Secure Mobility
Port VLAN ACL relationship that is tied to the routing table used to work great for the wired 100Mbps/1Gbps links. Full duplex, predictable link speed, and static mapping of configuration at the expense of mobility. But we want to go mobile with Wi-Fi. So what’s the solution? Port has disappeared – instead end user devices need to connect to a Wi-Fi access point supporting other Wi-Fi devices on the same radio. Keeping track of the VLAN to enforce policy everywhere a user shows up is no longer scalable. User Groups are the solution x already integrates with existing AAA infrastructure to authenticate end users and their devices and return user group information. Aruba maps these user groups to individual roles – roles carry end user policies instead of VLANs. VLAN and IP routing is still used for transport but they do not have any say in policy enforcement for mobile users across the enterprise, whether they are in a building in the campus, at home or at one of the branch offices. Their policies are virtualized and appear wherever they are connecting to the Aruba network – since the users are not static and now mobile, their policies are virtualized and enforcement is mobile.
Each of the policy rules incorporate knowledge of mixed mode devices. Mobile device means multi-capable device. Aruba will apply individual QoS rules to different applications running on the same device. No other infrastructure can enable this.
Network Management
AirWave’s differentiation comes from its capability to enable a user based network monitoring and reporting solution. All information that is presented to the administrator is prepared in an effort to create visibility into the WLAN clients and their health. Network security reporting for policy compliance, client tracking capability for location based services or for network troubleshooting, multi-vendor WLAN management, multi-vendor edge switch management, mobile device management, live RF visualization supported by RF planning are all integrated to AirWave – reducing total cost of ownership for capital expense and results in significant operational savings.

10. Wired Network Security Questions
On your wired network...
Do you authenticate all users and devices?
Do you encrypt all traffic?
Do you control access to network resources based on user identity?
Wireless lets you do all of this – by design

11. Port-Centric Networks Prohibit Mobility
Hackers
Visitors
Consultants
Employees
Branch
Partner Site
Hotel
Home
Port-Centric Network Design
Optimized for a fixed, deskbound workplace
Cannot follow mobile users and applications

12. User-Centric Networks Enable Mobility
Role-Based Access Control
AAA FastConnect
SSID-Based Access Control
Access Rights
Staff
Executive
RADIUS
LDAP AD
Virtual AP 1
SSID: Corp
Finance
Corporate
Services
Contractors
Legal
Voice
Virtual AP 2
SSID: GUEST HR
Video
Secure Tunnel
To DMZ
Guest
Captive Portal
Guest
DMZ 12

13. Military-Grade WLAN Security
Data Privacy
TPM on the AP, Centralized Encryption on the Mobility Controller
Network Protection
Attack prevention with ICSA certified stateful firewall
Identify
the user
Validate
the device
Access Control
Stateful authentication and policy enforcement per user
TPM: Trusted Platform Module
Intrusion Prevention
Integrated protection against advanced wireless attacks
No special AP hardware or management appliance required
Classify
the traffic
Control access per user

14. Full Spectrum Visibility
Cost Effective
Integrated to Wi-Fi chipset in all Aruba n APs
Does not require specialized AP or external laptop for monitoring
Always On
No specialized chip in AP
No need to spare scanning time
Record and Playback on Demand
Detailed Charts
14 simultaneous views within the Aruba Mobility Controller
No need for external laptop

15. User-Centric Network Management
Scales to 100,000 Devices
Supports multi-generation, multi-vendor products
Customer Examples
Reduced time to resolution by 75% across a multi-vendor environment.
Simple Enough for Anyone
Designed for use by any member of the IT organization
User based management – fast troubleshooting time – user tracking across multiple technologies based on authentication name
Integrate with leading enterprise management systems such as HP OpenView, IBM Tivoli, BMC Remedy, CA Spectrum, and EMC SMARTS.
Manage more Cisco access points than Cisco can
Map management to 'multi-vendor, lifecycle, operations mgmt, network availability, inventory management‘
Largest WLANs managed by AirWave: Motorola’s, Cisco’s, HP’s, Meru’s
You need to be able to delegate responsibility across the IT organization — letting the service desk troubleshoot routine issues so that network engineering staff can work on the most difficult and important problems. And that’s what AirWave 7 is all about. The service desk gets intuitive charts and tables they can use to triage user problems, while desktop support, network engineering, and security have one place they can go to access diagnostic information and alerts. Executive Management can even access the system to view network health and other management reports.
With visibility into wired and wireless infrastructure as well as client devices, AirWave 7 enables you to perform comprehensive root-cause analysis and get to answers.
Redundancy integrated
Centralized operations management
Configuration of wired and wireless devices
Firmware distribution
Automated compliance
AirWave VisualRF gives you an accurate view of your entire network without ever leaving your desk. It automatically generates a map of your RF environment and the underlying wired topology, showing you what your network looks like — in real time. VisualRF builds this map using RF measurements gathered from your active wireless access points and controllers, without requiring you to buy a costly, separate location appliance.
Key points to make:
Simple setup process that doesn’t require site surveys or additional dedicated sensors, exciters, or location servers
Supports the full network lifecycle, from planning, to installation, to troubleshooting
Has free, stand-alone planning tool delivers identical planning capabilities in an online or offline environment
Combination of methods to provide the most accurate information: dynamic RF sampling and a predictive model based on site and infrastructure characteristics for areas where RF sampling isn’t available
Generally achieves resolution below 10 meters without additional tuning activities
Real-time location tracking for users and devices
Open API provides for a cost-effective way to utilize location data to a variety of location-based business applications
Offline planning applications for pre-deployment planning
Can be run in the cloud
Storage of user and device statistics for up to 2 years
Grouping of different sets of devices into “folders”
Real time per SSID usage statistics and reporting
Automated reporting with , HTML, XML
Customized reporting of network usage and stats
Memory, CPU, port, device reports across the WLAN
Virtualized network management of different functions and hardware with role based administrator access
Centralized management of more than 100K APs
Multiple Aruba master controller domain management
Scheduled firmware upgrades for the WLAN
Archive prior configurations
Automated historical reporting for security compliance
Automated configuration policy auditing of WLAN infrastructure supported with alerts and triggers
Rogue AP switch port identification and wired network rogue AP scans where WLAN is not present
Policy and rule based wireless intrusion detection
More efficient division of tasks between engineering, installation, field services.
User Level Visibility
Purpose built to manage mobile environments
Resolves most problems without dispatching a technician.

16. Aruba’s Purpose Built Secure Mobility Solution
Head Office
Branch Office
Home Office
Mobile Employee
Unified Network Management
Centralized Controllers
One Network
Multiple users
Multiple devices
Multiple policies