managing an enterprise wlan with cisco prime network...

BRKEWN-2069

Managing an Enterprise WLAN with Cisco Prime Network Control System (NCS)

www.ciscolivevirtual.com

http://www.ciscolivevirtual.com/

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public BRKEWN-2069 2

Agenda

Understanding the need for Prime NCS

Cisco Prime Network Control System (NCS)

Cisco Prime NCS 1.1 deep dive

Network Configuration

Design & Planning

Autonomous AP Support

Identity Services Engine

Scalability, Deployment Options and Services

Understanding the need for Prime NCS


Addressing Management and IT Challenges

Network complexity

Manual changes

Where to start?

What to configure?

Which services?

Maintenance plan

Troubleshooting


Influx of Mobile Devices Creates IT Challenge

IT Consumerization: Now a Reality

ORGANIZATION

TIME

Smartphone adoption is

growing at 50%+ annually*

By 2015, tablets will constitute

50% of laptop sales**


The User to Device Ratio Has Changed

IT Resources Stay The Same Fixed User

• Wired access

• One user: One device

Mobile User • Wireless access

• One user: Local devices

Borderless User • Anytime, Anywhere access

• One user: Many devices

Access Evolution Late 90’s Early 90’s Today

Effectively support users

with box management Need for policy & control

Need for operational

efficiency


What is Cisco Prime

A strategy for innovative management

Supports enterprise and service providers

Integrated lifecycle management across Cisco architectures and technologies

Simplified and predictable network management

Increased operations efficiencies


Network

Endpoints

Cisco Prime for Enterprise Product Portfolio

Unified Management Across Architectures, Networks, and Services

Services

NCS LMS

CM • Cisco Prime Network Control System (NCS)

• Cisco Prime LAN Management Solution (LMS)

• Cisco Prime Collaboration Manager (CM)

• Cisco Prime Network Analysis Module (NAM)

• Cisco Prime Infrastructure 1.1 (NCS + LMS4.2)

NAM


What is Network Control System (NCS)?

Single platform for consolidated view of wired and wireless access infrastructure and endpoints

Built on the foundation of Cisco WCS, provides complete lifecycle management of wired and wireless access networks

Provides monitoring of endpoint security policy integration with Cisco Identity Services Engine (ISE)

All existing functionality in WCS is supported in NCS

Simplified and predictable network management

Lowers total cost of ownership


Enhanced User Experience

Information architecture: Seamless navigation and workflows align to tasks

Modern interaction behavior: Maintains context while performing network management tasks

Smart tables & advanced filtering: Quickly view additional information without leaving the workflow

Ever-present alarm views & browser: Always-on visibility to potential end-user problems to speed remediation

Designed to Work With How IT Approaches Problems


Single Integrated User and Access Dashboard

• Flexible platform: Accommodates new and experienced IT administrators

• Simple, intuitive user interface: Eliminates complexity

• User-defined customization: Display the the most relevant information


Unified User and Endpoint Services

Correlated and focused wired / wireless client visibility

Client health metrics

Client posture & profile

Client troubleshooting

Client Reporting

Unknown device ID input

Clear view of the end-user Landscape Who is connecting Using which device Are they authorized


Comprehensive Wireless Lifecycle Management

Cisco Prime NCS1.0 Deep dive


Wired & wireless discovery and inventory

Add / detect infrastructure devices such as switches, WLAN controllers and access points

Comprehensive access infrastructure reporting

View the access infrastructure as a whole or as discrete technologies

Stolen asset notification

Track when devices presumed stolen come back online

Integrated Access Infrastructure Visibility


Controllers & AP’s

Configuration of controllers, AP's and other managed devices are performed using the configure Tab

Devices added to NCS populate templates and dynamically populate NCS with information on associated AP's and fields like RRM clients etc.

Discovery and learning of Devices


Discovery and learning of Devices

Controllers can be discovered individually or using CSV, Zip file formats

Any AP’s associated to the respective controllers are auto detected and loaded into the NCS database.


Autonomous

Adding Autonomous AP's same format as adding Controllers


Wired

Adding Switches is also the same format as adding a Controller

Devices supported and possible functions can vary depending on IOS version.

Most Cisco Catalyst 2960, 2975, 3560, 3750 running [IOS12.2(50) SE], 4500 on [IOS12.2(50) SG] and 6500 series running [IOS12.2(33) SXI] or higher

Note! For Context aware services read/write community access is required.

Network Configuration


Configuration—Auditing Easy way to identify configuration gaps

between WCS or NCS and WLC

Manual on-demand audit capability

Automatic audits based on “configuration sync” background task

Allows easy reconciliation in the event of a configuration mismatch

Helps ensure WLCs comply with configuration policies


Quick Audit Summary and Reconciliation

Audit Summary

Restore or Maintain Config


Audit Settings Audit Settings

Audit Mode

Basic Audit: Perform an audit on current WLC configuration and compare it with the configuration in NCS

Template-Based Audit: Perform an audit on current WLC configuration with respect to applied templates, config groups’ background templates and then the configuration in NCS

Audit On

All Parameters: Audit on entire WLC configuration

Selected Parameters: Audit on selected parameters from the templates


Configuration—Auto-Provisioning What is Auto-Provisioning?

Ability to automatically detect and configure new WLCs (locally or at remote sites)

Allows detection based on multiple criterion: Hostname, MAC Address or Serial number (.cfg file on TFTP server)

Adds WLC to NCS for further configuration after provisioning

When Would You Use It?

Large distributed deployments

Limited IT resources

Streamline operations and eliminate configuration mismatches


Controller Auto-Provisioning

Monitor Only: Controllers matched by this filter

will not be configurable by NCS in the auto

provision process

Filter Mode: Choose from hostname, MAC Address

or Serial number to match the WLC

Config Group Name: Add the auto-provisioned

WLC(s) to their own config group for

easier management since these might share

common policies Input Device: Select from single or multiple devices

to provision. Selecting CSV option provides a link to

download a sample file to understand the syntax.

Device Configuration: Other device parameters

that can be configured at this stage.

After hitting “Submit”, the filter is saved with one entry

for the “member” you just added. At this point, you may

add other members (WLCs) to this filter as well. This

filter also creates a WLC config file in NCS’s TFTP

directory. Ensure your DHCP server’s option 150

points to NCS Server


Scheduled Image Download to Controller

• Provides option to schedule software

download (FTP/TFTP) to controllers.

• Task can be saved for future scheduling.

• Reboot can be scheduled at a future

date/time.

• Email notification can be sent after

completion of download.


Scheduling AP Pre-Image Download

• Provides option to schedule image

download to AP.

• Reboot can be scheduled at a future

date/time.

• Email notification can be sent after

completion of download.


Design & Planning

Map Layout

Buildings, Floors

Map Editor

Real-time Heatmaps

User Density not evenly distributed

Public Venue differs to higher education


• Eliminate improper RF designs and coverage problems

• Built-in tools perform site-surveys, RF reassessments and RF readiness evaluation

Planning

Integrated Planning Tool

– Import floor plans from 3rd-party tools

– Configure access point placement, coverage, and other variables

– Generate equipment proposal

Hierarchical Maps

– Design multiple buildings, floors, regions

Location and Voice Readiness Tools

– View performance and coverage estimates

Easily Visualize the Ideal RF Environment

Planning Tool

Instant Access

to Tools Hierarchical Maps

RF Prediction Tools Assist in Designing Optimal WLANs


Planning—Overview

Launching the Planning and Editing Tools

Create a new Campus/Building

Create a floor plan

Pick “Planning Mode…” from the drop-down menu


Planning Mode – High Level Options

Planning Mode—High-Level Options

Add AP: Allows adding new Access Points to the Map

Delete AP: Remove existing Access Points from the Map

Map Editor: Edit the floor plan to draw objects such as light/thick walls, light/heavy doors, cubicles, glass, coverage areas, perimeters, markers, etc.

Synchronize with Deployment: Pull in currently deployed and placed Access Points on the floor to tweak existing deployment

Generate Proposal: Generates a document that maybe provided to a 3rd party deployment company; additionally, also provides various heatmaps


Planning Tool—Map Editor

Accounts for objects and obstacles on a floor plan

Scaling for a precise RF propagation model display

Attenuation characteristics for objects also obstacles help predictive engine

Helps specify areas and regions such as:

Coverage Area and Markers

- used for location notifications

Perimeter

- defines the outer boundary

Location Inclusion, Exclusion Regions and Rails

- used for location events and notifications

Objects and obstacles that may be specified:

Walls (Light and Heavy) 2dB and 13dB

Cubicle (Walls) 1dB

Doors (Light and Heavy) 4dB and 15dB

Glass (doors, windows, walls) 1.5dB

!


Planning Select Map Properties

Wireless Planning layout

Add obstacles like high attenuating walls lifts etc.

AP types, antenna etc.

Examples

AIR-ANT2410Y

AIR-ANT2422DG

Scaling, Orientation, Azimuth and position are all important parameters


Planning Tool—Options

Specify AP Prefix and AP Placement

method (automatic vs. manual)

Selecting AP type determines the

antenna choices available for both the

2.4GHz and 5GHz band Select the protocol (band) and

minimum desired throughput per band

that’s required for this plan

Data and Voice provide “safety

margins” for design help. Safety

margins help design for certain RSSI

thresholds (detailed in online help).

Enable planning mode for advance

options for data, voice, location and

others

Location typically requires a denser

deployment than data and the location

checkbox helps plan for the advertised

location accuracy

Location with monitor-mode factors in

AP(s) that could be deployed to

augment location accuracy

Both the “Demand” and “Override…”

options allow for planning for any

special cases where there’s a high-

density of client presence such

conference rooms or lecture halls


Planning Tool—Customize Plan

Clicking an AP in the

plan allows

customization

(added, deleted or

simply modify

properties) before

a proposal may

be generated

Default suggestions after running

the planning tool present AP

deployment choices and ability to

switch between data and signal

strength heatmap


Planning Tool—Proposal

Proposal Contents:

Floor Plan Details

Disclaimer/Scope/Assumptions

Proposed AP Placement

Coverage and Data Rate Heatmap

Coverage Analysis


Importing Planning designs

WCS 7.0x or NCS 1.0 onwards supports 3rd party planning tools and Site Survey imports for single or multi-floor structures

RF design completed using external application adding RF losses and known criteria

AP positioning calculated on RF propagation and known signal characteristics of antenna and AP models

Actual AP positioning from Site Survey data can also be directly imported into NCS.

Floor plans, AP coordinates and configuration, RF calibration and planning information can be exported to a tar file and imported into NCS, an entire Campus or individual components can selected when performing these tasks.


Maps Layout

Hierarchical Layout

for easy navigation

Default View of Campus, Buildings,

and Floors can be easily changed with

the “Quick Filters”

Building view provides a quick glance

in to floors’ status and alarm summary

for easier troubleshooting

Adding Campus or Buildings are made easy

with the drop-down menu actions through an

easy wizard that walks you through

provisioning floor plans and APs


Commonly used map

actions are ever-present

in icon format

Display and locate

interference

sources and zone

of interference

Maps Layout—Floor View

Quickly Add/Remove Layers

that may be placed on the floor

plan and heat maps

Mouse-over on objects on the

map provides quick object

summaries


NCS Map Export/Import

• Provides ability to export maps from one

NCS to target NCS.

• Can select all maps or subset.

• Export/import of map includes both map and

AP’s placed on MAP.

• Exported via tar gzipped XML file.

• Import process ungzips/untars XML file

automatically.


NCS Real-Time Heatmaps NCS Provides:

AP-to-AP RSSI measurements reflected in heatmaps

Option for selecting between dynamic (real-time) or predictive heatmaps


Real-Time Heat Maps + Rx Neighbors

Provides list of neighboring AP’s and RSSI value that they “hear” the

selected AP

Autonomous AP Support


Monitoring Autonomous APs


Autonomous AP Reports

Provides visibility into operation of aIOS AP’s


Autonomous Clients


Standalone Access Point Monitoring and Migration

Fault monitoring, Configuration, Reporting of standalone (autonomous) access points

Monitor all Cisco IOS®-based Cisco Aironet standalone models

Monitor Integrated Services Router access points 800, 1900, 2900, and 3900 series

Easily upgrade and migrate Cisco Aironet standalone access points (individually or as groups)

Migrate Standalone Access Points

aIOS

aIOS

aIOS

CAPWAP

WLAN Controller

Identity Services Engine Integration


NCS and ISE Integration

NCS leverages ISE API for posture assessment and report generation

Ability to drill-down to an individual client-level security details

Ability to troubleshoot client connectivity issues


NCS + ISE: Client Posture and Profiling

ISE determines client to

be Microsoft

Workstation based on

device fingerprinting

Client authenticated

using 802.1x via ISE


Client Troubleshooting: Wireless Client


Client Troubleshooting: Wired Client


ISE Troubleshooting Tools


ISE Integrated Troubleshooting Audit Network Device Configuration

Is my switch properly configured to

support AAA and other ISE services

including Posture, Profiling, and

Logging?

Are my switchports properly

configured to support 802.1X, MAB,

and Web Authentication per Cisco

best practices?


ISE Alarms Predefined and custom alarm settings

Schedule-based – Non-stop (any time) or per custom day/time range

Visual notification from every page in ISE UI with quick drill-down

Send notifications externally via Syslog or email.

Scalability, Deployment Options and Services


Scaling Complete lifecycle management of hundreds of wireless LAN controllers from

a centralized location

Rich monitoring and troubleshooting for Cisco Catalyst Switches

Visibility into key performance metrics – interface ports, endpoints and users and switch inventory

Device WCS Devices

Supported

NCS Devices Supported

Cisco Lightweight Access Points 3,000 15,000

Cisco Wireless LAN Controllers 750 1200*

Cisco Autonomous Access Points 1,250 5,000*

Cisco Switches 0 5,000

* No licensing count


Physical Appliance Virtual Appliance

Hardware and software (OS and NCS pre-installed)

from Cisco

VMware image (OS + NCS)

Supported on:

•VMware ESX/ESXi version 3.5

•VMware ESX/ESXi version 4.1

15,000 lightweight AP’s

5,000 aIOS AP’s

5,000 switches

Large: 15K/5K/5K

Medium: 7.5K/2.5K/2.5K

Small: 3.5K/1K/1K

Cisco hardware appliance

•Not supported on WLSE hardware

High-end: 8x2.93GHz CPU/1GB DRAM/300GB HD

Standard: 6x2.93 GHz/14 GB/200 GB

Low-end: 4x2.93 GHz/8 GB/150 GB

Appliance-Based Solution


Diagnostic Tools

Client Analysis

Wired & Wireless

Virtual Domains

Location Tools


Client Troubleshooting Tool

An easy way to identify client-related issues from within NCS, without the need for extensive WLC debugs

Look at the client’s current state (and at what stage of the connection they might be having issues at)

Allows for real-time troubleshooting and log retrieval from the WLC

Allows for looking up historical, and relevant client and AP events

Allows integration with ACS View Server for authentication log retrieval


Client Troubleshooting Tool (contd..)

But, first things first—common problems:

Watch out for misconfigured clients (common areas are WLAN profile settings, authentication and encryption settings, and any advanced extensions that might not be required

Ensure WLC settings match the provisioned client profiles (security, SSID broadcast, WLAN override, etc.)

Ensure data rate settings on the WLC (Mandatory, Supported and Disabled rates)

Look for client exclusion settings (easy way to find excluded clients is via the ‘quick filter’ in “Monitor—Clients” page


Client Troubleshooting—Launch Points

Multiple Launch points

to initiate client

troubleshooting tool

allows for diverse

workflow integration


Client Troubleshooting—Examples

Identify whether the problem

occurs at 802.11 or higher layers

Suggestions on where to look and how to

potentially resolve the error condition(s)


Client Troubleshooting—Examples

Provides visibility into logs, event

history, and related CleanAir

information


NCS: Wired Client Troubleshooting

Client connectivity

status/issues


Unknown Users

Assign username to client on network not

authenticated via ISE.


Virtual Domains What They Are (or do) What They’re Not (or don’t do)

Quick way to partition NCS objects Not necessarily a complete replacement for RBAC (for

example, via TACACS+)

Allows users to be mapped to separate virtual domains at

the time of creation

If none specified, users are added to the “root” virtual

domain by default

Separate Reports, Controllers, Access Points, Search,

Templates, Config Groups, Alarms and other objects

Don’t separate Google Earth Maps, Auto-Provisioning,

MSEs, and Ethernet Switches

Objects may be assigned to multiple domains at the same

time

Avoid changing configurations from multiple domains

management simple

“root” domain is a superset of all sub-domains Not all objects are available at the “root” level – objects

such as Search and Reports are domain specific

Only the “root” domain may configure location, and any

other email notifications

For more caveats, visit:

http://www.cisco.com/en/US/docs/wireless/wcs/5.2/config

uration/guide/5_2virtual.html


Location Accuracy Tool—Example

Determine Accuracy Probability,

Correct Deployment

Test with Clients, Tags,

Exciters

Schedule Accuracy Tests

© 2009 Cisco Systems, Inc. All rights reserved. Cisco Public BRKAGG-2011 68

Reporting


Section Agenda: Reporting

Report LaunchPad

Report Customizations

Multi-Level Filtering

Customizing Report Output

Multi-Level Sorting in Report Output

Report Scheduling


Report LaunchPad

Callouts – Report

Descriptions

Report LaunchPad – Easy

Drill-Down


Report Customization

Multi-Level

Filters

Customized Reports


Graphical Report Content

Graphical Reporting

Graphical Summaries


NCS + ISE: Report Cross-Launch

New set of reports

launched from NCS

cross-launches reports

in ISE.


NCS + ISE: Report Cross-Launch


Spectrum Analysis

Integration into NCS Prime

Configuration

Spectrum Expert


Spectrum Analysis NCS Direct Launch

CleanAir status and icon

representing Spectrum

Expert support

Clicking on Icon launches SE

application installed on local PC


Spectrum Expert


Key Takeaways

Wired/wireless access – infrastructure and

endpoints – need to be managed together

WCS and NCS provide full lifecycle

management

NCS builds on the features/functionality of WCS

and adds wired management

Easy migration from WCS to NCS – both

platform and learning curve


Helpful Links

Cisco Prime Network Control System (NCS) Datasheet

http://www.cisco.com/en/US/prod/collateral/wireless/ps5755/ps11682/ps11686/ps11688/data_sheet_c78-650051.html

NCS Learning Modules

http://www.cisco.com/en/US/products/ps11686/tsd_products_support_online_learning_modules_list.html

TACACS+ Configuration Example

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a0080851f7c.shtml










Complete Your Online Session Evaluation

Complete your session evaluation:

Directly from your mobile device by visiting www.ciscoliveaustralia.com/mobile and login by entering your username and password

Visit one of the Cisco Live internet stations located throughout the venue

Open a browser on your own computer to access the Cisco Live onsite portal

Don’t forget to activate your Cisco Live

Virtual account for access to all session

materials, communities, and on-demand and

live activities throughout the year. Activate your

account at any internet station or visit

www.ciscolivevirtual.com.

http://www.ciscoliveaustralia.com/mobile

http://www.ciscolivevirtual.com/

managing an enterprise wlan with cisco prime network...

Documents