CWNA Chapter 11: The Foundation of WLAN Architecture
Per our previous CWNA blogpost we discussed all things MIMO and MU-MIMO as well as channel widths and how modulation schemes are arrived at. Doesn’t “per our previous” sound like you are about to get scolded for something you had already discussed. It is the polite way to point out that you already told somebody something in a previous email. The perfect passive aggressive response!
Today we will be exploring the different ways that WLANs are built and how wireless LAN controllers (from now on referred to as WLCs) and APs fit into different architecture types. We will also go over how they can be managed. Let’s dig into WLAN Architecture.
802.11 Radio Form Factors
- Types of External WiFi Radios
- Personal computer memory card international association (PCMCIA)
- Express Card
- Secure Digital (SD) Card
- Compact Flash
- USB, which is the most popular at this time
- USB2.0 can only transfer up to 480Mbps
- USB3.0 can transfer up to 5Gbps and has been known to raise the noise floor 5-20db
- Internal WiFi Radio Types
- Mini PCI: often used in laptops and APs
- Mini PCI Express
- Half Mini PCI Express
- Mobile Devices
- Most use a single chip form factor embedded into the devices motherboard
- Wearables
- Watches, wristbands, exercise sensors and glasses
- Internet of Things (IOT)
- Typically made up of sensors, monitors and machines
- Mostly transmit in the 2.4GHz band
- Some use Bluetooth or Zigbee
- Client Device Capabilities
- It is important to remember that all 802.11 client radios do not have the same capabilities
802.11 Radio Chipsets:
A group of integrated circuits designed to work together is often marketed as a chipset.
Client Utilities
A WiFi client utility is effectively the software interface between the radio NIC and you. The technical term for WLAN client utilities is supplicant. Config settings for a client utility typically include the SSID, transmit power, WPA/WPA2 security settings, WMM quality of service capabilities, and power management settings. There are 3 major types of client utilities:
- Integrated operating system utilities
- Vendor-specific client utilities
- Third-party client utilities
Management, Control and Data Planes
Management Plane
The management plane is defined by administrative network management, administration and monitoring. Here we would have a network-management solution used to monitor network devices. Within 802.11 the functions of the management plane are:
- WLAN Configuration
- WLAN Monitoring and Reporting
- WLAN Firmware Management
Control Plane
The control plane consists of control or signaling information and is often defined as network intelligence or protocols. An example would be CAM tables and STP used by L2 switches for data forwarding. Within 802.11 we have the following examples:
- Adapative RF or RRM: Where coordinated channel and power settings for multiple APs are provided.
- Roaming Mechanisms: This provides support for roaming handoffs between APs.
- Client and Load Balancing: Client load and performance metrics are collected and shared between APs to improve the WLAN experience
- Mesh Protocols: WLAN vendors use either L2 or L3 routing protocols to move user data between mesh APs.
Data Plane
Also known as the user plane, the data plane is where the user traffic is actually forwarded in a network. An example is an individual router where IP packets are forwarded. The two wireless devices that typically participate here are the AP and the WLC.
WLAN Architecture
Typical WLAN Architecture is built on one of three areas.
- Autonomous WLAN Architecture
- Centralized WLAN Architecture
- Distributed WLAN Architecture
Autonomous WLAN Architecture
Autonomous WLAN Architecture is the most common for traditional APs. All of the configuration settings exist on the AP, as does the management plane. Encryption and decryption mechanisms and MAC layer reside here. All traffic being forwarded locally by each individual AP means the data plane resides here as well. Typically we have two physical interfaces, an ethernet port and a RF Radio which are often bridged together by a bridged virtual interface (BVI). The BVI is the management interface of an AP. These APs are deployed at the access layer and are powered most often by POE and operate independently of other APs.
Centralized Network Management Systems
Due to the difficulty managing a large number of autonomous APs, it was required to have a wireless network management system (WNMS). This moved the management plane off the AP. Autonomous APs are now considered legacy. Additionally this provides monitoring of the network infrastructure as well as wired and wireless clients, connected to the network. Since this is a management plane solution, no control plane or data plane exist on an NMS. Typical communication between the NMS on an AP is done using SNMP or CAPWAP.
Centralized WLAN Architecture
Centralized WLAN Architecture uses a central WLC that resides in the core of the network. Autonomous APs are replaced with controller-based or lightweight APs. In this case, all three planes move to the controller.
- Management Plane: APs configured and managed from the WLC
- Control Plane: Adaptive RF, load balancing, roaming handoff and other mechanisms exist on the WLC
- Data Plane: The WLC exists as a data distribution point for user traffic. APs tunnel all user traffic to the controller.
WLAN Controller (WLC):
A WLAN Controller could also be referred to as a wireless switch, and some can be considered a multilayer switch as they route traffic at L3.
Features of a WLC:
- AP Management: the majority of AP functions like power, channels, and supported data rates are configured on the WLC. A commonly used protocol for managing and monitoring APs is CAPWAP (Control and Provisioning of Wireless Access Points).
- WLAN Management: controllers are capable of supporting multiple WLANs, often called WLAN profiles or SSID profiles. Profiles can include SSID, WLAN security settings, VLAN assignment and QOS parameters.
- User Management: controllers usually provide the ability to control the who, when and where using RBAC (role-based access control) mechanisms.
- Device Monitoring: provides visual AP monitoring and client device statistics.
- VLANs: supports the creation of VLANs and 802.1Q vlan tagging.
- L2 Security Support: fully supports L2 WEP, WPA and WPA2 encryption. Can use internal servers or RADIUS and LDAP servers.
- L3 and L7 VPN Concentrators: some offer VPN server capabilities within the controller. Can be a VPN concentrator or endpoint for IPSec or SSL VPN Tunnels.
- Captive Portal: used with guest WLANs
- Internal Wireless Intrusion Detection Systems: some have WIPS capabilities for security monitoring and rogue AP mitigation.
- Firewall Capabilities: stateful packet inspection is available in some controllers
- Automatic Failover and Load Balancing: provides support for VRRP (Virtual Router Redundancy Protocol) for redundancy purposes.
- Adaptive RF Spectrum Management: adaptive RF allows a controller to change the configuration of the controller-based APs based on accumulated RF information gathered from the APs radios.
- Bandwidth Management: bandwidth pipes can be restricted up and downstream
- L3 Roaming Support: able to allow seamless roaming across L3 boundaries.
- POE: not common, but most controllers can provide APs with POE.
- Management Interfaces: most controllers offer support for multiple types of management like CLI, GUI and SSH.
Split MAC
In this type of WLAN Architecture, some of the MAC services are handled by the WLC and some by the AP. In this case many of the 802.11 management and control frame exchanges occur only between the client station and the controller based AP and are not tunneled back to the controller.
Controller Data-Forwarding Models
In centralized data forwarding, the AP and controller from an IP encapsulation tunnel, and all user traffic is passed to the controller for forwarding, as well from the controller. In distributed data forwarding, the AP is solely responsible for all data forwarding.
Two Types:
- Centralized Data Forwarding: all data is forwarded from the AP to the WLC for processing. Sometimes used when the WLC manages encryption and decryption.
- Distributed Data Forwarding: AP performs data forwarding locally, this may be used in situations where it is advantageous to perform forwarding at the edge and to avoid a central location in the network for all data, which may require significant processor and memory capacity at the controller.
Remote Office WLAN Controller
Remote WLCs require less processing power for remote office and branch locations. Typically they communicate with a central WLC across a WAN link in which it downloads configs via a secure VPN tunnel.
Distributed WLAN Architecture
A distributed WLAN architecture combines multiple APs with a suite of cooperative protocols, without the need for a WLC. Modeled after traditional routing and switching design models, in that the network nodes provide independent distributed intelligence, but work together as a system to cooperatively provide control mechanisms. Ubiquitis Unifi product line is a great example of this, where they have a management software for configuration, but it is not required for functionality beyond the initial config.
Hybrid WLAN Architecture
Most WLAN vendors offer to either centralize or locally forward the data plane, depending on the location of the APs and the traffic routes available. With the controller model, the management plane normally exists on the WLC, but it might also be pushed to an NMS that manages the controller based APs as well as the controllers.
Specialty WLAN Infrastructure
Enterprise WLAN Routers: often used as a distributed solution using enterprise grade WLAN routers at each branch office. These connect back to corporate headquarters with VPN tunnels. Often this allows for connections to the same SSID that would be found at the main office.
WLAN Mesh APs: for more detail on mesh APs see Chapter 7 review for an in depth discussion.
WLAN Bridges: The purpose of a WLAN bridge is to provide wireless connectivity between two or more networks. We covered this in chapter 5 to an extent, but we will hit on some new terms here as well. IPSec VPNs are often used for bridge security. 802.1X/EAP can also be used with the root assuming the authenticator role, and the non-root assuming the supplicant role. WLAN bridges support two major configuration settings: root and non-root. The root bridge establishes the channel and beacons for the non-root bridge to join. The non-root bridge will then associate with the root bridge in a station-like fashion to establish the link. A bridge link that only connects two wired networks is know as a point-to-point (P2P) bridge. A point-to-multipoint bridge link connects multiple wired networks. In this situation the root bridge is the central bridge, and multiple non-root bridges connect back to it. The root bridge uses a high gain omni, while the non-roots use unidirectional antennas pointing back to the root. There can only be one root.
WLAN Array: A key point of a WLAN array is that each AP has a sector antenna providing directional coverage. Basically it is an indoor sector antenna with 360 degrees of coverage.
Real-Time Location Systems: Real time location systems can track the locatoin of any 802.11 radio device as well as active RFID tags with much greater accuracy than WLCs. RTLS systems use the existing WLAN infrastructure, preexisting WLAN clients, WiFi RFID tags, and an RTLS server. Extra sensors can also be added to supplement and provide additional accuracy. RTLS servers use signal strength and/or time-of-arrival algorithms to determine location coordinates.
VOWIFI: As we have discussed many times QOS is of utmost importance here. Since we have discussed VOWIFI at length previously we will just hit on the needed components here:
- VoWiFi Telephone: VoWifi phones use 802.11 radios instead of cellular. The form factor is typically that of a telephone but can be in a tag format with phone capabilities. Most use the Session Initiation Protocol (SIP) as the signaling protocol for voice communications over an IP network.
- 802.11 Infrastructure: We need either stand alone APs and/or WLCs.
- PBX: Private Branch Exchange is a telephone exchange that serves a particular business or office. It makes connections among the internal phones of a private company and also connects them to the public switched telephone network (PSTN) via trunk lines.
- WMM Support: WMM must be supported for QOS. We have harped on this a ton and should be second nature at this point.
Cloud Networking:
- Cloud networking is offering software as a service for applications and network management, monitoring, functionality and control, that is scalable. The most common is cloud-enabled networking (CEN), where the management plane resides in the cloud, but data plane mechanisms, such as switching and routing, remain on the local network and usually in hardware.
- Single Server: a single physical server or virtual machine hosts applications for remote access. Has the ability to add HA (high availability) for redundancy.
- Multiple Servers: when there are more customers than a single server instances.
- Elastic Cloud: elastic cloud is a term to describe a cloud offering that provides variable service levels based on changing needs. The system scales by adding servers to clusters and removing them as needed.
Protocols for Management
SNMP: Simple Network Management Protocol is an application layer (L7) used to communicate directly with network devices. Allows for pulling and pushing information to a central SNMP server based on certain, often user configurable thresholds on network devices.
- Components of an SNMP management system
- Several nodes, each with an SNMP entity (agent) containing command responder and notification originator applications, which have access to management instrumentation.
- At least one SNMP entity containing command generator and/or notification receiver applications (traditionally called a manager).
- A management protocol used to convey management information between the SNMP entities.
Structure of Management Information: Management information is structured as a collection of managed objects contained in a database called a management information base (MIB). The MIB consists of the following definitions: modules, objects and traps.
SNMPv1:
- Used a community string which had to be know by a remote agent.
- Was subject to packet sniffing which allows the intruder to discover the clear text community string making it insecure
- It is very inefficient
SNMPv2:
- Added new functions like GETBULK, which solved the iterative method of extracting larger amounts of data from MIBs.
- SNMPv2c does not implement encryption
- SNMPv2 improved security by the specification of a new party-based security system, but was not widely adopted.
SNMPv3:
- Added a lot of security benefits
- Authentication is performed using SHA or MD5
- Privacy-SNMPv3 uses DES 56-bit encryption based on the CBC-DES (DES-56) standard
- Access control-users and groups are used, each with different levels of privileges. Usernames and passwords replace community strings.
CLI Based Management:
- Most commonly used to configure devices
- Can be accessed using serial and console ports
- Telnet
- SSH & SSH2
- HTTPS
Application Programming Interface: To enable applications to interact with one another, an application programming interface (API) is needed. It is a set of subroutine definitions, protocols and tools for building application software.
- Transport and Data Formats:
- Most common transport protocols are HTTP and HTTPS because they are widely supported.
- A RESTful API is an application program interface (API) that uses HTTP requests to GET, PUT, POST, and DELETE data.
- Can be in various formats with Javascript Object Notation (JSON) being the most popular. JSON is very human readable.
- WLAN APIs:
- Configuration APIs
- Monitoring APIs
- Notification APIs: Often called web hook APIs and can be triggered by an event. Webhook APIs reduce system load and minimizes traffic flow between applications.
Common Applications
A common application is the NMS (Network Management System) which gathers monitoring data from different WLAN devices and presents the data using dashboards, graphs and other visualization techniques. Another popular application is location analytics to tell you where devices are across a floor during the day, how long they stay there, and even real time location tracking.
Chapter Review
Today we took a look at WLAN Architectures, the different planes in which a device can function, intricacies of WLCs, and some specific types of WLAN Infrastructure. Our next chapter has us diving into Power Over Ethernet (POE) and what is required to make it work.
