Aruba Networks Green Island News Blog

New Aruba blog site

2011-07-07T17:24:00.000-07:00

Aruba has launched a new blogger community - check it out at http://www.arubanetworks.com/company/communities/

Why SCADA Networks Are Vulnerable To Attack - Part 4: Controlling What You Use

2010-07-27T16:20:00.000-07:00

Security doesn’t happen by accident – it must be built into or added to a network. Some of the key security building blocks for wired and wireless networks include encryption, authentication, intrusion detection, controlled access to network resources, and wireless airtime and bandwidth control.

Sensor and control networks are typically missing most of these building blocks. Designed to optimize response time, the short packets cannot easily accommodate the larger packet sizes associated with high security encryption.

Some controls networks, LONWORKS® for example, include an authentication mechanism, but in practice it is infrequently implemented because its use complicates key management in multi-vendor networks. Intrusion detection, for wired or wireless control networks, is typically not available, nor is firewalling or endpoint compliance – certainly not at the sensor/actuator level, and sometimes not even at the controller level.

Quick fixes to address these limitations are not easily incorporated because the protocols employed are often embedded inside microprocessors that lack the processing power and memory to support the necessary security algorithms, buffers, and certificates.

Fortunately most control networks today interface with an IP-based network for management, monitoring, and/or control. And it is at this interface that you can click the ruby slippers and apply proven security techniques like policy-enforcement firewalling to prevent the control network from launching Denial-of-Service (DoS) attacks or non-compliant devices from accessing the network.

If the control network is IP-based then the protective measures can be applied to the control devices themselves – if not, then protection can only be applied to data traversing the interface between the sensor/actuator network and the IT systems to which it is connected, i.e., the latter can be protected against the former. Either way, greater security will be obtained than if no protective measures were applied between the control devices and the network with which it is connected.

The range of available security features that may be applied depends on the control network architecture, and includes:

The protective measures afforded by these techniques can be applied prophylactically to reduce some or most of the control system’s vulnerabilities.

With regard to cost, if Wi-Fi based sensors and actuators are used, the protective measures built into the wireless LAN infrastructure can be applied at little or no additional expense. If IP-based sensors and actuators are used, there will be some incremental expense but the devices themselves will not have to replaced because they already have the essential building blocks for higher security in place. If a non-IP based control network is used then the benefits will vary.

The table below summarizes how the security features described above can be employed to enhance the security of commonly used in control networks (features specific to wireless networks are left blank when applied to wired control networks).

Conclusion

SCADA, smart grid, and energy management systems sit at the heart of industry and commerce. This blog series was intended to highlight that defending these systems against attack must become a high priority because you can't use what you can’t control.

The control networks on which these systems depend today have unintended vulnerabilities. These vulnerabilities can be corrected in whole, part, or not at all depending on the architecture and technology of the underlying network.

Consideration should be given to retrofitting security systems into existing IT infrastructure to address security concerns, removing control networks for which there are no corrective measures, and ensuring that any new control-related infrastructure is designed with protective measures built-in from the outset.

For more information on security solutions that you can apply today please visit Aruba's Web site.

Why SCADA Networks Are Vulnerable To Attack - Part 3: Firewall Both Users AND Devices

2010-07-27T16:12:00.000-07:00

Following a rise in the theft of payment card data, the Payment Card Industry (PCI) standards council was created by the top card brands to combat such crime. The resulting PCI Data Security Standard (DSS) defines mandatory security guidelines for use by all merchants and service providers that store, process and transmit cardholder data.

Wireless LAN security is a core component of these requirements. DSS v1.1 permitted the use of WEP encryption. Indeed, many retailers wanted to continue using the WEP devices they had already purchased, not because of the encryption scheme but to avoid the capital outlays required to replace WEP devices with higher security equivalents.

While WEP encryption is easily cracked, and was subsequently banned under DSS v1.2, an ingenious method was used to protect WEP devices so they could continue in service until DSS v1.2 was implemented. This solution protected the network without requiring any changes or clients added to the WEP devices. This solution holds great promise for the protection of SCADA, smart grid, and energy control systems.

Consider the humble bar code scanner. A workhorse of both point-of-sale (POS) and logistics systems, many scanners in use today rely on 802.11b/g Wi-Fi and WEP. Data from the scanners are passed via Wi-Fi to the enterprise network. If you crack WEP you therefore potentially open a back door into that network.

Integrating a stateful, role-based policy enforcement firewall into the wireless network slams shut this back door. By blacklisting unauthorized devices – not based on the port through which they entered the network but rather by the user and/or type of device - unauthorized users can be denied access to the rest of the network.

The firewall can distinguish between multiple classes of users, allowing one common network infrastructure to function as independent networks whose isolation is ensured by policy enforcement. Guest access is separate from POS which is separate from logistics, etc.

The elegance of this approach is that it can be retrofitted to existing networks – wired and wireless using a true overlay model - without any software clients or other changes to the devices being protected. It protects any devices from any manufacturers.

This same segmentation and policy enforcement scheme can be applied to wired and wireless sensors as soon as their data hit the IT infrastructure. Access rights, quality-of-service, bandwidth, VLANs – almost any parameter can be controlled and actively managed by the stateful, role-based policy enforcement firewall. It is to the benefits of this approach, used in conjunction with additional security enhancements, that we’ll turn in the next posting.

Why SCADA Networks Are Vulnerable To Attack - Part 2: The Weakest Link

2010-07-27T16:08:00.000-07:00

In the beginning, there was cabling - lots of cabling. Every sensor, actuator, and display was connected by a separate cable that grew like a hydra from a controller, the brains of a traditional control system. If a solenoid needed to be triggered in response to the activation of a limit switch then the signal traveled from the limit switch, through cabling to the controller, which processed the information and sent a command to the solenoid over yet another cable.

These direct wired systems were subsequently replaced with time or frequency division multiplex systems that allowed one common cable to be shared among multiple devices. Installation was simpler and less expensive, the controller was more complex and, as before, a central point of failure should its program fail to execute properly.

Next up were intelligent, distributed networks in which devices communicated directly with one another on a peer-to-peer basis, without the need for a central controller. Locally intelligent and able to communicate on shared communication medium with any other device on the network, these networks allowed reconfiguration of system functionality via software download over the network. Peer-to-peer communications allowed the direct exchange of information between any or all of the devices without intervention by any central device, eliminating the single point of failure issue.

Regardless of the specific architecture used, in all cases the objective of the control network was to deliver status information as quickly as possible to all devices that needed updates. The protocols we’re highly optimized for short control packets, and nary a bit was “wasted” on ancillary data or status.

The same optimization guidelines applied to the microcontrollers running the devices. To keep costs down and thereby allow the networks to be pervasively deployed down to the lowest cost sensor/actuator, processors were optimized for high throughput and processing short packets.

The popularity of IP connectivity spawned the development of IP-based control networks in which Ethernet or Wi-Fi forms a backbone for linking different sections of a control network. While controllers were the first devices to sit on an IP network, increasing numbers of native IP sensors and actuators are reaching the market.

Many IT departments prohibit the connection of any IP-based, control-related sensor/actuator, controller, gateway to their corporate networks out of concerns about network integrity and security. IT managers are legitimately concerned that the high offered traffic of control networks, some of which run at 100% channel utilization, will overwhelm their Ethernet networks and cause unintentional denial of services. Others are concerned that control networks, the security standards of which are rarely a high priority, could become unprotected back-doors into the corporate network.

What is rarely if ever discussed is how exposed the enterprise is to unauthorized manipulation of the control devices themselves. These systems control the power at the heart of every business and institution, and it is paramount that they be protected against unauthorized manipulation. It is to this point that we’ll return in the next installment of this series.

Why SCADA Networks Are Vulnerable To Attack - Part 1: Unintended Consequences

2010-07-27T15:58:00.000-07:00

This multi-part series discusses the security vulnerabilities of the sensor/actuator controls at the heart of SCADA, smart grid and energy management systems, and proposes a means of containing, if not fully addressing, the limitations of these systems.

* * * * * * *

In the 1980s the proximity access card was introduced to the building security market. Until that time, gaining access to high security facilities – including many government agencies – required one to physically insert a magnetic stripe or Wiegand card into a reader.

Proximity card readers from Schlage, Sielox, Indala, and others overcame the inconvenience of swiping a card by using radio energy to sweep the area in front of the reader. Users needed only to place their wallet, purse, valise, or ID badge near a reader and the radio energy would be picked up by their proximity card.

A tuned circuit internal to the card would resonate when within range of the reader, generating a unique radio signature that would be captured and analyzed by the access control system. If the signature matched that of a valid card already programmed into the system, access would be granted. Simple, elegant, and convenient, proximity card systems quickly grew in popularity.

Problem was, this innovative technology had profound, unintended consequences. It allowed the surreptitious identification of people with access privileges to high security facilities. One could use radio energy to sweep a crowd of people and, by virtue of their proximity card, pick out persons of interest based on their signatures generated by their proximity cards. At a time when the Cold War was steamy hot and espionage was rampant, the proximity card was a new-found tool for adversaries.

The unintended consequences of a new technology are not usually discovered until after it's in use, sometimes widespread use, by which time available remediation options might be limited or very expensive. Such is the case with SCADA, smart grid, and energy management systems, which are now front and center in the effort to better manage energy consumption and lower greenhouse gases. Unintentionally vulnerable to manipulation and unauthorized access, these systems can literally turn out the lights, stopping a utility or enterprise cold in its tracks.

(Photo: www.brightsecuritygroup.com)

Is there a role for Wi-Fi in offloading traffic from cellular networks?

2010-07-15T11:56:00.000-07:00

We are today witnessing a mobile device boom driven by distributed workforces that need secure anywhere-connectivity, and consumers who want always-on Internet access. Smartphone sales grew 29% year-over-year in 2009 to surpass notebook sales (1), and dual-mode (Wi-Fi/cellular) phones and smartphones will more than double from 2008-2013 to 130.9 million units (2).

One consequence of the flood of mobile devices is growing congestion on cellular data networks. Slow and dropped network connections are legion in large metropolitan areas like Beijing, New York, and San Francisco. Cellular data traffic is rising beyond sustainable network capacity, and there are no signs that it abate any time soon.

This problem is compounded by the challenge carriers face in obtaining acceptable ROI from their massive infrastructure investments. Value-added services like video help a carrier’s bottom line, but the more bandwidth-hungry video booms, the greater capacity is squeezed. Sticky new services and applications needed to secure customer loyalty only add to bandwidth woes.

One solution is to offload bandwidth-intensive multimedia traffic to nearby Wi-Fi networks, a process called “cellular offload.” In theory pushing traffic from overcrowded cellular networks onto high capacity, high-speed Wi-Fi networks should alleviate network congestion. The challenge for carriers is ensuring that bandwidth relief doesn’t come at the expense of the customer experience…or at the customer’s expense.

Cellular offload must be simple to initiate, the quality of service on Wi-Fi must be equal to or better than that offered on cellular, and there should not be cost penalties to the user. That’s a tall order. Many a manufacturer of metropolitan mesh Wi-Fi networks that has attempted cellular offload has failed.

Why? Because metro mesh networks were designed for e-mail and Web access, and not high-density, latency-sensitive data, voice, and video applications. Mesh technology is available that can handle these types of applications, Azalea Networks being a noted example, but metro mesh vendors have so fouled the market that customer resistance is high though not insurmountable.

Cost penalties are another concern. Some carriers, ATT among them, are trying to convince subscribers to pay twice for cellular offloading – once for cellular data service and once for a home Wi-Fi access point to handle traffic that the cellular network can’t. Even if the economics did work for a consumer, this stop-gap crumbles the moment users step foot outside their homes. A system-wide solution – not an ad hoc one – is the only way to address the dilemma.

A corollary to Parkinson’s Law says that data expands to fill all available bandwidth. So while some pundits say we’ll obtain bandwidth relief from 4G cellular (most studies say otherwise), those networks will attract applications that are even more bandwidth heavy.

What we need a commuter lane to handle network overspill and ensure that essential and urgent cellular traffic has the bandwidth it needs. Wi-Fi networks can be that path, if constructed correctly and with the right building blocks, and can do so at a price that is affordable to implement on a vast scale.

So let's stop blaming the rising popularity of Web-enabled smartphones and start focusing on using Wi-Fi to solve the problem.

(1) Dataquest Insight: PC Vendors' Move Into the Smartphone Market is Not Challenge Free
(2) Dataquest Insight: Factors Driving the Worldwide Enterprise Wireless LAN Market, 2005-2013

Project "CleanWallet": The Newest Way To Separate Wi-Fi Customers From Their Money

2010-04-29T18:14:00.001-07:00

The best pickpockets create a diversion before they dip and run. They'll bump into you, drop an object nearby, or yell something to catch your attention.

Distracted by the commotion, the extraction proceeds unnoticed. That is until you next reach for your money only to find it's gone missing. Never to be seen again.

This week at Interop Cisco created such a diversion when it announced the availability of a new hardware-based spectrum analyzer. With features remarkably similar to Aruba's recently announced software-based spectrum analyzer - and using words so closely paired to Aruba's that a plagiarist would swoon - Cisco proclaimed that the world at last had a solution for dirty air. The secret: a new line of access points containing - drum roll, please - an embedded ASIC. Did that get your attention?

Now for the dip. In order to get this feature you have to replace your existing access points. If you want clean air everywhere then you have to replace all of the access points in your network. Every single one. Brilliant!

You've got to credit where credit is due. Project "CleanWallet" is really a double-dip - once for new APs and once for the 802.11n APs you only just purchased. Even the Artful Dodger would be impressed.

Silly sods, us. Instead of forcing customers to divvy up cash to replace their access points, our new software-based spectrum analyzer works with all Aruba 802.11n access points, including those already installed. Aruba's spectrum analyzer is feature rich, and includes Fast Fourier Analysis, spectrograms, interference classification, and programmable recording/playback.

We don't require any new hardware to make spectrum analysis work, and for customers using our Wireless Intrusion Prevention Module the feature comes for free. Aruba's 802.11n access points are already significantly less expensive than Cisco's, so the entire Wi-Fi system, including spectrum analysis, is easy on your wallet.

If Project "CleanWallet" isn't your thing, give us a call. We'll prove that you don't have to pay through the nose or sacrifice features to get clean air.

Innovation Shouldn't Have To Be Delivered By Forklift

2010-04-18T14:02:00.000-07:00

Ever notice how the latest and greatest innovation from some vendors invariably requires replacing the equipment you've already installed? Known as a "forklift" upgrade, these swap-outs benefit the vendor at the expense of the customer's time and money.

Let's face it, forklift upgrades are driven by vendor greed. The worst offenders make no apologies for their inability and/or unwillingness to design upgradable products. It's just not in their DNA. Product design recapitulates corporate philosophy, to paraphrase Haeckel.

There are existence proofs that a forklift is not a mandatory prerogative to obtain a new feature - even one incorporating a profoundly complex new technology. Therefore a forklift-based strategy must originate in a forklift-oriented mentality.

Case in point - spectrum analysis.

Wi-Fi networks operate in environments containing electrical and radio frequency devices that can interfere with network communications. 2.4 GHz cordless phones, microwave ovens, wireless telemetry systems, and even adjacent Wi-Fi networks are all potential sources of interference. Interference sources can be either continuous or intermittent, the latter being the most difficult to isolate.

The task of identifying interference typically falls to a spectrum analyzer, the gold standard for isolating RF impediments. Spectrum analyzers help isolate packet transmission issues, over-the-air quality of service problems, and traffic congestion caused by contention with other devices operating in the same channel or band. They are an essential tool to ensure that networks run as they should.

To be effective the analyzer needs to be in the right place at the right time. The ideal solution is a spectrum analyzer that’s built into the wireless LAN infrastructure, and can examine the spectral composition of the RF environment anywhere in the Wi-Fi network, at any time. Today vendors offer handheld spectrum analyzers as well as ones that require the addition of spectrum analysis monitors (effectively doubling the total number of access points on site for full coverage).

Rumors are that at least one vendor will be offering new access points with integrated spectrum analysis. Consistent with their company policy, however, a forklift upgrade will be required to use it.

Aruba has taken a completely different tack with spectrum analysis. Its recently introduced scientific-grade spectrum analyzer includes traditional tools such as Fast Fourier Transform (FFT), spectrograms, and interference source classification. It also includes powerful new features such as interference charts, channel quality measurement, and spectrum recording and playback.

Uniquely, the new spectrum analyzer works with all Aruba 802.11n access points, including those already in service. That is, a customer with an existing Aruba 802.11n deployment can enable spectrum analysis on any of their existing access points without adding any new hardware. None.

And the cost? Zero if you are already using Aruba's Wireless Intrusion Protection (WIPS) Module into which the new analyzer is integrated.

Why does Aruba introduce new features that expand the capabilities of its customers' already deployed networks? Why did it add distributed forwarding without a controller in the data path? E9-1-1 call positioning? Wired switch management?

Because adding features recapitulates our corporate commitment to value, driving growth by enhancing the utility of our customers' investments. It's a mutually beneficial arrangement, and one that stands in sharp contrast to a forklift mentality.

The next time you consider an IT vendor consider how they deliver innovative features. With a hand outstretched in partnership or reaching for your wallet.

Adversity Drives Innovation

2010-04-02T09:56:00.000-07:00

Economic downturns are commonly viewed as a time of retrenching and cut-backs, but they're also times of intellectual ferment and innovation. While budget cuts and scaled back programs create adversity, there remains a job to do and customers to satisfy.

The issue is how to accomplish this with fewer available resources. To do this you have to get creative, and adversity catalyzes the process. It is the gap between available resources and demand that drives innovation, creativity, and opportunity.

In the words of J.C. Maxwell, “adversity motivates.” Maxwell’s "Benefits of Adversity" identifies the positive attributes of adversity:

1. Adversity creates resilience;
2. Adversity develops maturity;
3. Adversity pushes the envelope of accepted performance;
4. Adversity provides greater opportunities;
5. Adversity prompts innovation;
6. Adversity recaps unexpected benefits;
7. Adversity motivates.

The present downturn is no exception. IT managers face budget and headcount cuts, yet the companies for which they work cannot stop running. Leveraging investments in existing infrastructure, minimizing major new capital investments, and recouping savings from company operations are the new marching orders. If satisfying existing needs was good enough then the task at hand would be straightforward – weather the adverse economic climate by cutting as much spending and headcount as possible.

But in business it isn't that simple. The end of any downturn is followed by an uptick that will require increased IT services. Cut too far today and IT won’t be able to respond tomorrow. Business will suffer - again. IT managers must therefore be cognizant of the future and look at changes and cuts with an eye towards their impact on a future recovery.

This begs the question – is it possible to batten down the hatches to survive the current economic storm while laying the foundation for a future recovery? The answer is yes...but the challenge to doing so, surprisingly, is neither technological nor monetary but conceptual.

Doing more with less requires a new way of thinking about problems. In the IT world it means reconsidering the value of overbuilding complex, expensive infrastructure. In this market, in this economy, the first priorities need to be streamlining costs, boosting productivity, and enhancing efficiency.

A simple example will drive home the point. To lower costs, most enterprises are reducing their real estate footprints. Today 88% of employees work somewhere other than the corporate headquarters - many hotel in branch offices, work from home, or work on the road. The traditional way in which these remote users would be served is with a branch router. This paradigm might be acceptable for a large office but it's outrageously expensive for a branch of just a few people.

The challenge is how to network a large and growing remote workforce in an environment focused on cost reduction. It is here that adversity catalyzes innovation. By standing the problem on its head and saying the real issue is how we enable mobility at low cost for a large number of users - not how we connect a branch office - new, non-traditional solutions emerge.

To a router vendor every problem ends with a hardware-based solution - it is the proverbial key under the streetlight. Reconstituting the problem expands the area of illumination, revealing, for instance, that cloud-computing and virtualization are new options not previously considered.

Simply reframing a question can open a completely new set of solutions. Adversity forces the process by highlighting the inadequacy of the “old school” way of thinking and opening the door to innovative new solutions. Ones that focus on today's needs instead of yesterday's answers.

VBN Killed The Branch-In-A-Box

2010-04-01T22:47:00.001-07:00

In 1979 The Buggles released their debut single, 'Video Killed The Radio Star,' a nostalgic look at radio from the perspective of the video age that killed it.

Progress drives on, looking nostalgically in the rear view mirror from time to time, but propelled forward by the engine of our insatiable desire for something better.

Tube-based table radios are nostalgic. So are rotary phones, wooden plows, and iron clad ships. Doesn't mean we want to use them anymore. They were abandoned because something better came along. Something easier to use. Faster.Less expensive.

Technology transitions happen all the time in enterprise IT, but the branch office and fixed teleworker seem to have been neglected along the way. And what an oversight it was. Today more than 85% of employees work outside of the primary corporate campus. Yet they need - but haven't had - the same access to corporate network resources and applications as someone in the home office.

The solution cobbled together by router vendors was to remotely replicate the infrastructure that's on the corporate campus. That is, assemble a stack of appliances for security, VPN, Wi-Fi, routing - and then try to integrate them to work together.

Over time the separate appliances morphed into an integrated branch-in-a-box router. But experience showed that while you can morph a router from a hairball, but you can never take the hairball out of the router. From the user's point of view, the solution was little improved.

The fundamental problem is that the campus network and its branch offspring were designed assuming static users sitting behind protective firewalls. Mobility - mobile users specifically - breaks that model. You have to punch holes in firewalls, configure complex VLAN assignments for segmenting traffic and user types, install VPNs to protect roaming users. The list goes on and on. And grows more expensive, complex, and user unfriendly as it does.

Virtual Branch Networking (VBN) 1.0 was introduced in 2009 as a ground-up, mobility focused solution. VBN made it less expensive and simpler to securely connect remote users with the enterprise network at low cost and without changing the user experience.

VBN 2.0 goes one giant step farther by leveraging cloud services to do the job done by branch routers today - application acceleration, content security, remote access. Only it does so using a lower cost, more scalable solution that delivers a consistent user experience regardless of where you work: in the corporate HQ, in a branch office, from home, or on the road.

The cloud provides a massively scalable, economical way of delivering services and applications. It has changed the way we transfer data, download files, and use applications. When applied to branch networks, cloud services are the perfect tonic. They deliver essential business-critical services, without complexity, to widely distributed users at less than half the cost of the branch in-a-box router. This is one change you'll make and never, ever look back.

In my mind and in my branch,
We can't rewind it bought the ranch,
VBN killed the branch-in-a-box.

Read more about VBN 2.0 on-line.

The Lessons of Wi-Fi #14: Wi-Fi Should Save Money, Not Waste It

2010-03-07T08:49:00.000-08:00

The computer science graduate students shuffle into class, taking their assigned seats. The professor opens the lesson by asking if there are any questions about the assigned reading.

A student raises her hand and asks, "We live in such a complex world. How could it possibly have been created in just 7 days." Without a moment's hesitation the professor looks up and responds, "Because there was no installed base – it was a new deployment."

Retrofitting 802.11n Wi-Fi to an existing network requires consideration of a number of factors: switch capacity, cable length, cable capacity, power sources. The last item is especially important during the transition to 802.11n. Many 802.11n access points far exceed the current capability of existing 802.3af Power-over-Ethernet (PoE) sources. Some require an astounding 32 Watts or more, far beyond the capabilities of 802.3af.

Unless you read the fine print in product data sheets you could find yourself exceeding the power delivery capabilities of both power sources and a single Ethernet cable. A Wi-Fi network that was supposed to reduce the cost of IT infrastructure by doing away with unneeded wired ports and switches could instead result in a whopping big bill to replace PoE infrastructure.

The Lessons of Wi-Fi #14: a Wi-Fi network should save money, not waste it. If you have to add supplemental power injectors, especially mid-span power sources, labor and hardware costs will soar. Power-hungry access points and high-current injectors also generate a lot of heat, so you'll incur higher recurring cooling costs. And your carbon footprint will grow.

Aruba's 802.11n access points operate from 802.3af power sources. Always have. In fact, we were the first company to introduce an 802.3af powered 3x3 MIMO access point. The access points also feature a lifetime warranty because the company stands behind what it builds.

As you consider an upgrade to 802.11n, be certain that 802.3af delivers sufficient current to power all of the radios to their full operating mode in every access point. If the data sheet says you need something other than a single 802.3af supply operating over 100m of cable to get full performance, consider yourself warned.

So check out our range of 802.11n access points and leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #12: Your Wi-Fi Network Should Not Be A One Trick Pony

2010-03-06T16:35:00.001-08:00

Time was when you left work at the office. Those days are long gone. Enterprises and institutions with workforces, offices, or colleagues spread across time zones often have time- and location-shifted working conditions.

Users might need to work from home, on the road, or at a remote site. In all cases, a user will be most productive if the network experience - and access to applications and network resources - is the same remotely as it is at his or her desk at work.

Can the wireless LAN infrastructure that's used in a campus environment pull double duty and be used by remote users, too? The stock answer from most vendors is "nary the twain shall meet" - use a campus wireless LAN at work and a remote access solution like a virtual private network (VPN) everywhere else.

Since using a VPN is very different than accessing a campus network, this means that users need to be trained how and when to use the appropriate access method. And that means Help Desk calls. The end user is stuck with two parallel, non-intersecting networks to buy, maintain, and learn. Ouch!

The Lessons of Wi-Fi #12: your Wi-Fi network should not be a one-trick pony. One common network infrastructure should support both the campus wireless LAN and off-site users. And it should provide an identical end user experience regardless of how or where the network is accessed.

Enter Aruba's Virtual Branch Networking (VBN) technology. VBN uses low-cost Remote Access Points (RAPs) to securely connect remote users, and their Wi-Fi and wired Ethernet devices, back to a controller in the data center. The same controller that runs the campus Wi-Fi network.

Any standard Aruba indoor access point can be used as a RAP. That means one SKU can serve as both a campus AP or a Wi-Fi enabled remote access device for a home, branch office, or road warrior.

The $99 list price RAP-2 unit pictured here is small enough to fit in a shirt pocket or valise. It works with any IP-based devices - laptops, iPhone, iTouch, PCs, printers, wired and wireless voice over IP phones, wireless projectors - all of which can simultaneously share a single RAP. As can multiple users.

VBN features one-button installation so that a non-technical person can provision a RAP-2 by him or herself. No IT assistance, no user training required. Once commissioned the user just turns on his or her MacBook, PC, iTouch and they're instantly connected to the network...just as they would be on campus.

Data encryption and an integrated firewall provide comprehensive network security for all RAPs, while centralized management ensures speedy diagnostics and updates right over the network.

You don't have to suffer a double budget hit to get best-in-class campus Wi-Fi and secure remote access. So check out VBN and leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #11: Aesthetics Matter

2010-03-04T21:37:00.000-08:00

If you walk around most any IT trade show, a harsh reality sinks in. While a lot of engineering goes in hardware and software design, spending is often miserly when it comes to packaging design.

Consumer companies hire world-class designers - or design firms like IDEO - to create products with rakish, timeless good looks. The resulting products fit well in virtually any decor.

Step into the enterprise market and things change. Evidently many enterprise vendors believe that function trumps form. Make a product function well and no one will care that it was hit with the ugly stick. Even if the products are intended for open display - on ceilings in Board Rooms, classrooms, branch offices.

The Lessons of Wi-Fi #11: aesthetics matter. Businesses and institutions spend fortunes, large and small, with architects and interior designers to ensure that their facilities are attractive. Every component that goes into a building - from fire sprinkler heads to smoke detectors to wiring devices - must pass muster. How could any IT vendor believe that the very same aesthetics standards don't also apply to IT gear. Especially publicly visible devices like Wi-Fi access points.

Visit an IT trade show and you'll see shoe-box sized APs, bristling with dark, leg-like antennas. And squat APs, disk-shaped like the calling card of a digital elephant. And bulbous APs shaped like a knight's helmet.

In the landscape of the ceiling, camouflage is paramount: a diminutive, sleek design with neutral colors and a shape that matches other ceiling fixtures fits in best. At Aruba we use world-class packaging designers to help our indoor access points blend into their surroundings. Our AP-105 Access Point is the smallest enterprise-class 802.11n AP on the market, and neutrally blends into any public environment. While its stellar performance calls attention to the product, its packaging does not.

You don't have to compromise aesthetics to get best-in-class Wi-Fi. So check out the AP-105, and leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #10: A Bad Tool Will Never Find A Good Network

2010-03-03T20:53:00.000-08:00

You need a new Wi-Fi network for your school. The legacy system is a patchwork of consumer Wi-Fi gear and just can't handle your multi-media, throughput, and security requirements. Moreover the old network is a bear to manage because it doesn't provide any diagnostic information about the cause of increasingly frequent network outages.

One of the vendors you call in gives you a nifty sales pitch about their newfangled access points and even throws in a free network survey. When you ask about network management the sales person says they have a system that automatically discovers, configures, and monitors the whole wireless network, and can scale from single sites to cover the whole school district.

"But what if a problem originates in the wired network or in a mobile device? Or I want to manage the wired switches? How do I handle those scenarios?" you ask. All you draw in return is a blank stare.

The Lessons of Wi-Fi #10: to paraphrase a late13th century French proverb, mauvés hostill ne trovera ja bon network - a bad tool will never find a good network. Network management is really about optimizing operations management, about how to keep a network running 99.9999% of the time. Configuration and monitoring are only small pieces of the work that needs to be done.

Physicians train for hundreds and hundreds of hours to properly handle emergencies. Why? Because patients rarely die waiting for routine check-ups. It's in an emergency - when the stakes are high and time is very short - when they must prove their mettle. The same is true for network management tools.

Wireless networks don't work in isolation. Their operation depends on a wired core, closet switches, cabling, and the mobile devices with which they're associated. A fault could happen anywhere along this chain but "look" like it originated in the Wi-Fi network because that's where the problem first surfaced. A monitoring and diagnostics tool that only looks at the operation of the wireless network will stumble badly in this situation. And the consequence? Classes come to a halt, business stops, patients wait. Pretty bad.

Aruba's AirWave 7 tool is different. It's an operations solution that integrates the management of wireless networks, wired infrastructure, and client devices into a single interface. AirWave 7 provides a single point of visibility and control for the entire network edge, including wired and wireless infrastructure as well as individual client devices. In so doing, AirWave 7 reduces the cost and complexity of network management, while improving service quality for users.

A Mobile Device Management module gives IT managers control over mobile client devices from the same intuitive console they use to manage the network infrastructure. From a single console managers can supervise mobile devices, access points, controllers, and wired edge switches, including vital performance data, port utilization statistics and error data. By integrating monitoring of the wired and wireless infrastructure, the software facilitates faster and more accurate root-cause analysis.

And AirWave 7 is a multi-vendor tool. It works with Cisco and HP switches, among others, and supports wireless LANs made by more than 15 vendors, including Aruba, Cisco, HP, and Motorola. You're only out of luck if you own non-standard products or products from small niche vendors.

If you'd like to get the whole picture on network management you've only to visit the AirWave product site to see what real operations management can do for you. And leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons of Wi-Fi #9: Use Analysts & Audited Financials To Validate Vendor Claims

2010-03-01T16:44:00.000-08:00

A loud-talking ranchman applies to a banker for a loan. The banker asks a neighbor if the rancher is a good credit risk. The neighbor ponders for a moment and then replies “Big hat, no cattle.” False bravado is funny when it’s the stuff of fiction, less so in real life – especially for customers snagged by rhetorical barbs.

And yet it happens again and again. Each year the networking world is introduced to “big hat” products with features and specifications so too-good-to-be-true that we let ourselves be reeled in. Why we don’t see through the shiny veneer and ask for proof of pedigree is a wonder. But it happens all the same.

The Lessons of Wi-Fi #9: use analysts and audited financials to validate vendor claims. Neutral independent industry analysts like Burton Group, Canalys, Gartner, IDC, Infonetics, InfoTech, and Yankee Group can quickly assess vendors' technical claims.

And don't forget to check financials - audited financials - because you want your vendor to be in business should you need assistance or spare parts. If a vendor won't give up the numbers - or the numbers are substandard - then you have grounds for real concern.

A quick example will put the discussion in context. In 2008 a “big hat” four-radio 802.11n access point was announced that claimed to deliver 1.2 gigabits-per-second of aggregate capacity. The data sheet claimed that the four radios worked in tandem, enabling users to dramatically reduce the number of access points and additional security sensors, thereby reaping savings on cabling, connection and installation costs.

Still, the press ate it up. A flurry of articles expounded the virtues of delivering multiple HD streams to an entire building, with perfect coverage, at almost no cost. The world would soon be saturated with multi-adio APs, the unwashed masses blanketed with 802.11n. Wow, where do I sign up?

Fast forward to late 2009. The “big hat” super duper access point was no more. It simply vanished from the vendor’s Web site, its demise a secret. Was it ever built? No. But the company received undeserved publicity and that reeled in some unsuspecting customers.

To paraphrase Orson Wells, companies should herd no cattle before their time. Industry analysts can help you separate claims from reality. If an analyst says that a vendor can't excute well, refuses to divulge shipment numbers, and/or lacks technical vision - well, your due diligence is over.

The next time you see or hear about a product that appears to be too good to be true, separate the hats from the herds - kick the tires, test the features, validate the design. Those impressive features might be chimeras or, as with Aruba's AP-105 802.11 Access Point, the genuine article.

The Lessons of Wi-Fi #8: You Can Fund Your Wi-Fi Deployment By Rightsizing Your Wired LAN.

2010-03-01T08:19:00.000-08:00

By any measure the California State University (CSU) system is enormous, encompassing 23 different campuses, nearly 450,000 students, and 48,000 faculty and staff.

Recently the university system was faced with a massive and potentially hugely expensive wired network refresh to upgrade infrastructure that was approaching the end of its service life. At the same time, the CSU system was experiencing a surge in the demand for network access across all of its campuses. In the absence of a budget for a Wi-Fi solution, which would have allowed one wired port to be simultaneously shared among many users, the IT staff was concerned that the need for Ethernet ports and switches would double.

What would you do in this circumstance? Expand the wired network? Seek additional funds for a wireless initiative? Restrict access to the network?

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #8: you can fund your Wi-Fi deployment by rightsizing your wired LAN.

Cisco suggests that the right solution was to expand the wired network with perhaps a smattering of wireless in lecture halls. Why? In a paper titled True-Sizing the Network, Cisco claims that Ethernet is future proof, more secure, and more reliable than wireless networks. In fact it marginalizes Wi-Fi, relegating it to situations in which Ethernet cannot otherwise be used.

The twisted “true-sizing” message short changes end users because it fails to take into consideration changes in user preferences, markets trends, and technology that have occurred in recent years:

iSuppli reports that shipments of laptops surpassed desktops (38.6M vs. 38.5M) in 3 Q 08;
Yankee Group estimates that enterprises with no Wi-Fi access will drop from 43% in 2006 to just 3% in 2012;
Burton Group states that 802.11n marks the beginning of the end for wired Ethernet as the dominant LAN access technology in the enterprise;
Best-in-class Wi-Fi networks sport WPA2 encryption, wireless intrusion detection, policy enforcement firewalls, and FIPS 140-2/Common Criteria/DoD validation - making them equal or more secure than most wired networks.

The best solutions for end users originatefrom understanding how and where they want to use the network, and then designing networks that meet those needs.

Aruba's network rightsizing program defines just such a process - measure wired port utilization, consolidate ports in use into fewer switches, and deploy 802.11n wireless to address mobility needs. Use Wi-Fi everywhere you can, wired networks only where you must. If savings are to be had, the rightsizing analysis process will tease them out. If not, then that will also be made clear. Either way, the network rightsizing analysis will offer insights into network and port utilization that might not be intuitively obvious.

Returning to CSU, what the IT staff decided to do was to obtain more data by measuring wired port usage. What they found surprised them: wired ports across all 23 campuses were consistently underutilized. More than half of the wired ports had passed no packets during the previous six months.

Armed with these data, the team decided to embark on a new approach. Instead of upgrading the entire wired network, something they had historically done every 4-5 years, they looked at the opportunity before them with fresh eyes.

Wi-Fi was determined to be a reliable, low-cost option for delivering pervasive campus connectivity. Several campuses had already deployed some Aruba wireless LAN equipment, mostly for coverage in selected high-usage areas, and San Diego State University had built a relatively large WLAN on their campus. The Aruba WLAN had proven to be highly secure, scalable and reliable. It also allowed for a scaled-back refresh of the wired network, saving money by limiting upgrades only to the wired ports that were actually used.

CSU's IT staff created a database that included every telecommunication room, the number of ports in each room, and the number of those ports that were actively used. A formula was developed to define the refresh requirements of each of the 23 campuses based on this measurement.

By applying this formula across all 23 campuses, CSU was able to save approximately $30 million by reducing the scale of the wired network refresh and enhancing network access with Aruba’s Wi-Fi solutions.

The CSU system still uses wired networks but they've been rightsized to address actual and projected utilization. Wireless network utilization has risen sharply, because users are taking advantage of the mobility afforded by the expanded 802.11n network. And CSU saved a whopping big chunk of change that can be applied to other programs and opportunities.

Network rightsizing is a proven method of assessing and adjusting your network infrastructure. The California State University rightsizing program is a testament to the validity and value of the rightsizing model.

While the rightsizing mantra is to use wireless wherever you can, wired only where you must, the model makes no presumptions about the right mix of wired and wireless access. Proponents of “true-sizing” maintain no such neutrality. Their bias towards Ethernet marginalizes Wi-Fi, and in so doing deprives end users of the potential cost savings and mobility/efficiency gains that organizations like CSU have obtained.

The Lessons of Wi-Fi #7: You Don't Need Unobtainium To Build Great Wi-Fi Products

2010-03-01T07:42:00.000-08:00

Introduced in July 1979, the Zilog Z80 was an 8-bit microprocessor that operated on 1, 4, 8, or 16-bit data, had a 16-bit address bus, generated its own RAM refresh signals, and would run programs originally designed for Intel’s 8080 CPU. The flexibility of the design made it suitable for a very wide range of consumer, industrial, and military applications spanning from the Tandy TRS-80 computer to programmable logic controllers to naval weapon systems. Prices fell as volumes rose, and the Z80 was one of the most popular 8-bit CPUs for many years following its original introduction.

One of the wonders of semiconductor technology is that a standard part like the Z80 can find its way into so many different applications. The very same CPUs, memories, amplifiers, voltage regulators, and/or transceivers found in consumer products in your home might be found in automobiles, office equipment, factory production lines, airplanes, or ships. What differs is how the part is applied, packaged, and tested. In other words, you don't always need custom parts made of unobtainium to perform specialized tasks in demanding environments.

What happened to the Z80 in the 1970s is happening today with 802.11n chip sets. Chip set vendors are designing a common set of 802.11n parts for use in enterprise, SMB, gateway, and home access point and router products. Doing so drives up the volume of sales, resulting in production economies that boost profit margins for chip vendors even as prices fall for end users.

One of the largest Wi-Fi chip vendors – Atheros – sells its AR9002AP-4XHG chip set for all of the above referenced applications. The chip set features extensive component integration, a small form factor, and low overall cost. The fact that the AR9002AP-4XHG finds its way into such a diverse range of applications speaks volumes about the potential flexibility and robustness of the design. I say potential because whether the objective is realized or not depends on the implementation of the final Wi-Fi device.

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #7: you don't need unobtainium to build great Wi-Fi products.

Just as naval weapon system vendors leveraged a common Z80 design to create very unique and rugged products, so, too, has Aruba leveraged an 802.11n chip set targeted at a broad market in the design of its unique AP-105 802.11n Access Point. The AP-105 was tailored to demanding enterprise applications, and special care was taken in the design of the packaging, antennas, power supply, and security features to make the product both robust and exceptionally fast. A great AP, with a great standard 802.11n chip set, selling for a great price.

The result is an enterprise-class 802.11n access point that has higher throughput and more features than Cisco access points, yet sells for roughly 40% less money. So much less that Cisco felt compelled to pull apart the AP-105 to find out what makes it tick (they did the same when Aruba's high-end kick-ass AP-125 802.11n Access Point was released).

Their conclusion? The AP-105 is unobtainium-free and therefore no better than a consumer product. You know, like that cell phone you rely on for emergency calls 24x7, or that iPod that has delivered faithful service every day at the gym. Comparing the reliability of the AP-105 to that of a consumer product is not an insult. At the end of the day, Cisco still has to explain why the AP-105 is faster, more feature rich, less expensive, and easier to install than its own run-of-the-mill, over-priced, unobtainium-based access points.

So with the wind of good design at our backs, and unobtainium nowhere to be seen, the AP-105 is flying off the shelves, charting a path the Z80 followed.

The Lessons of Wi-Fi #6: Sleight-Of-Hand Is No Substitute For Good Product Design

2010-03-01T07:28:00.000-08:00

Would you ever strap a PC to your ceiling and run it there? Probably not. What about inside the plenum space above the ceiling? Nope.

Accessibility aside, the ceiling and plenum are hostile environments for electronics that aren't specifically designed for the vibration, temperature extremes, and blown dust typical of these locations.

If you look inside devices designed for this environment - smoke detectors, passive infrared sensors, quality Wi-Fi access points - what you WON'T find are vibration-sensitive connectors (like SIMM sockets), moving parts (like fans), and modular circuit boards that could wiggle loose. These devices are typically designed to have high mean time between failure (MTBF) ratings, something impossible to achieve with commercial SIMMs or fan-based power supplies. It seems so intuitive...and yet.

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #6: sleight-of-hand is no substitute for good product design. Wi-Fi access points need to be designed from the ground-up to withstand the rigors of ceiling and outdoor mounting environments.

Consider Wi-Fi arrays, which are effectively PC motherboards with a fleet of sockets, add-on modules, plug-in connectors, and memory SIMMs. They even conjured up a fan-based PC-like power supply - no standard 802.3af Power-over-Ethernet here. And when it fails you've lost 4+ radios at one time. The only workaround is to double-up the number of arrays, a real budget sink. Arrays just aren't designed with long service life, energy efficiency, or network resiliency in mind. That's the reason why no leading vendors in the Wi-Fi market sell arrays.

Aruba Wi-Fi access points have no fans, no SIMM sockets. Our 802.11n access points are designed for the rigors of ceiling and plenum mounting, and run from standard 802.3af PoE. MTBF ratings are excess of 250,000 hours - more than 28 years. And should an access point go down, Aruba's Adaptive Radio Management adjusts the power of near-by access points to self-heal the coverage gap. Automatically.

They'll provide years of reliable service and are backed by a lifetime warranty. And they cost less than an array-based system. A lot less.

So the next time you consider upgrading your wireless LAN, think about the environment in which the equipment will be used. Reliable products don't happen by magic - they happen by design.

The Lessons Of Wi-Fi #5: Eggs Break So Don't Put Them All In One Access Point

2010-02-16T20:31:00.000-08:00

Let's consider an alternate ending to Lesson #4. You need wireless access across an entire floor of your building, and a Wi-Fi vendor with shiny white tasseled loafers planted on your desk says he has just the solution: a single16-radio access point that will provide coverage across the whole floor and will save you a bundle in installation costs. How can you go wrong? Think of the cost savings: only one access point to buy, only one access point to wire.

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #5: eggs break - don't put them all in one access point.

What appears alluring at first glance is really false economy. One single failure and there's nothing between you and a totally dead network - you'll have lost the entire floor. A 16-radio access point on a single cable sounds cool but it only gives you coverage – not capacity (you'll need a lot more radios, cables, and switch ports for that. And it offers no redundancy against failures like a dead CPU or memory.

How about just throwing in a second 16-radio access point for redundancy? Even if you could align it to deliver the same coverage pattern, your hardware costs would be blown sky high. And if you're using 802.11n, you’ll further drain the bank by needing additional expensive power supplies and even more cables and ports.

With a multi-access point, multi-channel design, any coverage gap created by the loss of a single access point is mitigated by nearby access points. Load balancing handles high density scenarios while airtime fairness handles different mixes of 80211a/b/g/n clients. And using separate access points allows you to cover rooms and labs and lathe walls and metal-foil wall paper that can't be penetrated from outside - even by a single, centrally-located 16-radio array.

The question to ask yourself is what is the cost of a failure? How much will you lose if the entire office wireless network goes down for a day? Or students can’t access the Internet? Or a trade show network stops running? For most users, the cost of putting all of your eggs in one access point is too high.

You've now discovered why no major wireless LAN vendors pack so many radios into a single access point. It's false economy because it puts your business at risk should a failure occur.

And as far as cost differences, they've all but evaporated with Aruba's newest 802.11n access points. You don't need to take my word for it - Gartner's 2009 Wireless LAN Infrastructure Magic Quadrant spells it out in black and white.

If you'd like to get the whole picture on Wi-Fi architecture you've only to download our free white paper, WLAN RF Architecture Primer. And leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons Of Wi-Fi #4: All Wi-Fi Vendors Live By The Same Rules of Physics

2010-02-11T15:51:00.000-08:00

You've invited Wi-Fi vendors to your facility to discuss a new Wi-Fi project. You need wireless access across an entire floor of your building which includes open plan seating, conference rooms, and executive offices. This will be the primary form of network access and it needs to work. All the time.

It's late afternoon. A Wi-Fi vendor sits across from you in his white suit and black shirt, the very model of semi-neo-avant garde stylin. His shiny white tasseled loafers are firmly planted on the corner of your desk. He looks you straight in the eyes and says that his access point transmits radio signals farther than anyone else's. "It uses special technology. Yes, it's expensive, but by packing sixteen super duper radios in one unit you'll save a bundle because you only need one access point to cover the entire floor." Wow! How can you go wrong?

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #4: we all live by the same laws of physics, and no Wi-Fi vendor has yet bent them to their will.

The maximum output of a radio at any given frequency is dictated by local regulatory agencies. In most countries 100 milliWatts is the upper limit of what an indoor access point is permitted to output. Regardless of vendor and irrespective of Wi-Fi chip vendor - Atheros, Broadcom, Intel, etc. There is a level playing field when it comes to building radios.

What vendors can do is twiddle with antennas, using directional antennas to focus the allowed radio energy into more well defined beams. And, indeed, doing so can project radio signals longer distances.

The issue is that Wi-Fi networks are bidirectional - there's something on the receiving end of those directional antennas. Low power clients like iPhones and netbooks aren't equipped with directional antennas, much less ones that are easily focused on access points. They may be able to hear distant access points but the access points may be unable to hear them - even if directional antennas are used - because they don' use high power radios.

Additionally,as we learned in Lesson #3, bit rate is inversely proportional to range. In a shared medium like 802.11 where only one device transmits at any one time, lower data rates mean less available air-time for data on that entire 802.11 channel. So even if an access point and its clients can communicate, the throughput from the clients to the access point will be relatively low. Not good for voice. Not good for video. Not good for you.

You don't get something for nothing, but you can find yourself with nothing from something. The Wi-Fi standards anticipated the use of multiple access points, and that's how clients are designed to work. Pushing the limits of how far a Wi-Fi signal can be made to propagate has heuristic value, but when it comes to real-world deployments it can jeopardize the functionality and reliability of your network.

It's best just to tell the vendor to take his shoes off your desk and sell his wares elsewhere - you're having none of it.

If you'd like to get the whole picture on Wi-Fi architecture you've only to download our free white paper, WLAN RF Architecture Primer. And leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons Of Wi-Fi #3: Wireless Coverage ≠ Wireless Capacity

2010-02-10T21:50:00.000-08:00

You're excited - the two bids you were expecting for your new Wi-Fi network have just arrived. You rip open the envelopes and then stare in disbelief.

The first bid - the low bid - includes fewer than 100 access points and a note stating that the access points are specially designed to operate at full power at all times so fewer are required. The second bid includes 135 access points and a note about meeting bandwidth capacity requirements and providing resiliency in the event of failure. Both vendors had the same set of plans to review, both did a walk-through of the facility. How could their bids be so different?

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #3: wireless coverage ≠ wireless capacity. Designing for coverage means providing a discernible Wi-Fi signal everywhere without regard for network speed. The access points on these networks are typically run at full output power so the signal coverage is max'd out. They're also spaced with minimal or no overlapping coverage. As a result fewer access points are required.

The downsides of designing for coverage? Many. Consider these two:

Bit rate: There is an inverse relationship between bit rate and range. The farther away a Wi-Fi device moves from an access point, the lower the bit rate. Wi-Fi devices operating at the fringe of the coverage area will be very slow indeed. Too slow for voice, streaming video, electronic white boarding, and many other applications;

Failure happens - but this design can't deal with it. If an access point fails, nearby access points can't increase their output power to fill in the coverage gaps.

Designing for coverage is okay if consistent network performance and resiliency are unimportant. Otherwise it should be avoided.

In networks that are designed for capacity, the required bandwidth is available throughout the coverage area. Application performance will therefore be universally uniform.

Planning for capacity requires more access points because the distance to laptops, iPhones and other clients needs to be more limited (remember rate vs. range) for robust, high-speed operation. They're also needed to ensure adequate load balancing, a feature especially important in areas with densely packed clients such as classrooms, lecture halls, and trading floors. The benefits far, far outweigh the cost - you end up with a resilient network on which you can consistently depend for years of service.

Some vendors play on customers' lack of familiarity with the difference between coverage and capacity. When it comes to reviewing bids and proposals, take note of differences in the number of access points and claims about "unique" features affecting coverage. If you fall for the coverage

If you'd like to get the whole picture on Wi-Fi architecture you've only to download our free white paper, WLAN RF Architecture Primer. And leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons Of Wi-Fi #2:Not All Wi-Fi Networks Are Standards Based

2010-02-09T14:34:00.000-08:00

One the reasons for creating technical standards is to ensure interoperability between devices that need to work together. In the Wi-Fi world, the 802.11 standards serve this purpose, and encompass a very extensive set of guidelines that manufacturers of infrastructure and devices must follow to create a cohesive wireless system. Why then do we encounter situations in which Wi-Fi infrastructure is incompatible with Wi-Fi devices?

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #2: not all Wi-Fi networks are standards based. Some use proprietary technology that is not compatible with the way other Wi-Fi device manufacturers have designed their products.

Take, for example, Glenelg Country School and Frances Xavier Warde School, both of which experienced dropped connections with wireless classroom multimedia projectors. At Raytown C-2 School District radio interference affected laptops on rolling computer carts, while at Prairie Cardiovascular Consultants interference was so bad that it affected both office and clinical operations. Others have reported issues with different models of PCs or Apple Macintosh computers and iPhones.

What's interesting about these cases is that the problems were traced to one common source: the wireless LAN infrastructure. Once the infrastructure was upgraded - in these cases to Aruba wireless LANs - the problems went away.

All of these sites had used a non-standard, proprietary single-channel wireless LAN architecture. There are only two companies in the industry that make such systems, and both are small niche players with shrinking market share. So why would anyone buy such non-standard products in the first place?

Simple - product differentiation can be very alluring. It offers the opportunity for the adventurous to tout themselves as early adopters of what they hope will be "the next big thing." Wanting to be the first to use a new Apple iPad, Alienware laptop, or Google Nexus One makes perfect sense. These products embody innovative designs that redefine their markets. But they're also designed to work with existing networking infrastructure like 802.11 Wi-Fi - that they didn't redefine.

Where you run into serious trouble is deploying non-standards based infrastructure. That's akin to being the first to try a 156 Volt, 76 Hz electrical system in your house. Some devices might work, but you run the very considerable risk that others will crash and burn.

And that's what happened to the single channel wireless LAN customers. The reason single channel architecture hasn't caught on isn't because it's a secret waiting to be discovered. It's because there's a secret to what makes it run, and therefore interoperability is not assured.

When it comes to living on the bleeding edge of technology, consider the importance of interoperability. If a new technology has to be seamlessly integrated with other existing devices - as is the case with Wi-Fi networks and devices - then using a non-standards based product is just asking for trouble.

If you'd like to get the whole picture on Wi-Fi architecture you've only to download our free white paper, WLAN RF Architecture Primer. And leave it to someone else to relearn the lessons of Wi-Fi.

The Lessons Of Wi-Fi #1: Not All Wi-Fi Networks Are Created Equal

2010-02-08T22:09:00.000-08:00

You've invested thousands - tens of thousands - in new educational software, a fleet of new Wi-Fi enabled laptops, and even computer carts to chauffeur computers between classrooms. But when the students fire up the machines and try to access the shiny new instructional video you're trying to stream wirelessly, they get nothing. Nothing but static. Or jitter. Or dropouts. What went wrong?

Those who forget the lessons of Wi-Fi are doomed to repeat them. Lesson #1: not all Wi-Fi networks are created equal. They all have access points, and they may even be Wi-Fi Alliance certified. But the similarity ends there.

Streaming real-time video is a demanding Wi-Fi application that requires additional processing above and beyond the Wi-Fi standard. The main technology enablers for video over Wi-Fi are adequate bandwidth, quality of service (QoS), and multicast support.

While 802.11n - the newest high-speed Wi-Fi technology - provides a significant bandwidth boost, RF management algorithms are important to ensure continuous, high-rate coverage. These algorithms must include control of the access points and the laptops (clients) - a feature provided by Aruba's Adaptive Radio Management technology - to automatically calculate the optimum channel and transmit power assignments, move clients to the most appropriate access point, and optimize the network’s use of available radio spectrum. This function is especially important for mobile clients - like iPhones - and in the presence of densely deployed clients such as you would find in classrooms and lecture halls.

QoS for video uses the same mechanisms as for voice, however, the bandwidth requirements of video applications vary widely. It is therefore important that any content that requires special handling be correctly flagged. Aruba's integrated stateful firewall does just that.

Since video can account for a large percentage of network bandwidth, determining when to broadcast to multiple clients - multicast streaming - is essential. Here again, Aruba incorporates technology to monitor multicast group members, and only delivers multicast streams to access points whose clients require it.

If you'd like to get the whole picture on video over Wi-Fi you've only to download our free white paper, I Can See Clearly Now. And leave it to someone else to relearn the lessons of Wi-Fi.

Distance Learning Has Never Been Closer

2010-02-08T08:11:00.000-08:00

One of the challenges of distance learning is how to replicate the "campus experience" for remote students. Doing so encourages collaboration with other students, and improves study opportunities, by leveraging the same electronic learning applications, library reference materials, and server resources as campus students enjoy.

It also builds school loyalty because if these services remain in place post graduation, it improves the chances of continued participation once students become alumni.

Providing secure access to your school's electronic learning resources is a challenge. Open access or password-controlled access won't protect against network attacks, password-sharing, or excessive bandwidth consumption by mischievous students.

A secure virtual private network (VPN) requires your IT staff to load and manage client software on every device a student might wish to use. This is an on-going burden because incompatibilities may be introduced as students upgrade operating systems or other applications on their computers.

Virtual Branching Networking (VBN) solves distance learning connectivity and security issues. Using a small, very inexpensive device called a Remote Access Point (RAP), VBN enables remote students to connect securely to your data network. RAPs enable students to use any IP-based devices with an Ethernet port or W-Fi - MacBooks, iPhones, iTouches, iPads, PCs, VoIP phones, printers - without loading any software clients.

A built-in firewall strictly enforces access policies set by your IT staff, and can even control how much bandwidth a student uses. All access policies are centrally managed and then pushed over the network to the RAPs. The same is true of software updates: they're pushed automatically to every RAP in the field.

New RAPs are shipped unconfigured. To connect one to your network the student pushes a button on the front of the unit and then enters the IP address of your data center.

A RAP controller in your data center then exchanges security certificates with the student's RAP and voila, the student is on-line. No IT staff involvement is required for this process to occur, meaning that it's possible to economically support a very large distance learning program without adding IT staff.

Since RAPs are shipped unconfigured, they can be sold or rented to students through your bookstore or by a third party with zero-touch involvement by your IT staff. If a student leaves your distance learning program, or fails to pay tuition, a simple change in the access policy will completely disable the RAP.

Alternately, when a student graduates the RAP settings can be changed to disable distance learning and enable Internet access using your alumni site as the home page.

VBN has been field-proven in enterprise teleworker deployments around the world, and is the ideal solution for distance learning applications of any size. To find out more please visit our Web site.

A Tale of Two Cities: Educause Denver and Interop New York

2009-11-24T13:48:00.000-08:00

It was the best of Wi-Fi, it was the worst of Wi-Fi, it was the age of access, it was the age of stagnation, it was the epoch of mobility, it was the epoch isolation, it was the season of enlightenment, it was the season of bewilderment, it was the spring of tranquility, it was the winter of frustration, we had everything that was promised, we had nothing but words, we were all going direct to the Internet, we were all going nowhere (and slowly at that) — in short, the Aruba 802.11n wireless LAN at Educause Denver delivered the goods, the Xirrus arrays at Interop New York....well, read on.

The Educause 802.11n Wi-Fi network ran flawlessly and was smokin’ hot: 800 simultaneous users, 50% 802.11n clients, 50Mpbs delivered in client speed tests.

If you want to know what happened in New York see Jim Frey’s Network World posting, "Internet = InterNOT @ Interop."

If it looks like a skeet, and it flies like a skeet, and its connectivity is comparable to a skeet, then treat it like a skeet.

The Shoe Drops: Brocade Dumps Single-Channel Architecture

2009-10-14T16:25:00.001-07:00

Brocade yesterday announced that it will be reselling a new line of wireless LANs. Foundry (now part of Brocade) has been reselling wireless LANs for some time, so aside from a new OEM supplier where is the news?

Well, it turns out that Brocade didn't just select another vendor. It selected a completely different wireless LAN technology.

For roughly three years Foundry has been reselling Meru's proprietary single-channel / virtual-cell architecture. Meru has long made what we consider to be outrageous claims about its proprietary technology - airtime fairness, high throughput, fewer required access points, and so on. The Foundry team has had years of experience understanding the real strengths and weaknesses of Meru's single-channel networks, their 802.11n technology, their network management. They have deployed wireless LANs with virtual-cell technology across a range of customer types - education, healthcare, business. They, better than any single customer, knew the strengths and weaknesses of the vendor and the technology.

The upshot of yesterday’s news? Single-channel wireless LAN technology was rejected by the customer that knew it best.

Changing an OEM supplier is a decision that is never made lightly because it profoundly impacts the customer base and the company's reputation. Customers who invested in the single-channel / virtual-cell architecture are surely asking why Brocade abandoned a network that was supposed to be so innovative. What are the limitations and deficiencies that caused Brocade to change the underlying architecture as well as the vendor? The Brocade announcement is a watershed because it is a repudiation of the proprietary single-channel architecture. It also serves as a cautionary tale that vendor claims that sound too good to be true generally are.

The technology shift from single-channel to a new architecture will likely be very disruptive to Brocade’s customers. Brocade has already removed the Meru-based products from its Web site, and support-related issues will no doubt be unpleasant. But all is not lost.

Aruba wants Brocade’s wireless LAN customers as our customers, and we have a generous trade-in program to ease the pain of the transition to our award-winning adaptive 802.11n networks. Switching to Aruba will be a real step-up for those customers because we have field-proven adaptive wireless management, wireless infrastructure control, remote networking, wireless intrusion detection, policy-based firewalling, and client-to-core security that were never before available from Meru. Our AirWave Wireless Management Suite will manage their legacy Brocade/Meru network from the same console from which they will manage their brand spanking new Aruba wireless LAN.

The transition will be smooth and Brocade’s customers will be stepping up to a more secure, more stable platform from Aruba. And instead of a story line they'll be getting the real deal.

Wired Bondage

2009-10-04T12:28:00.000-07:00

The corded desk phone is becoming a rarity in most households, having long since been replaced by the more convenient wireless phone. Wireless phones offer untethered mobility, allowing us to make and receive calls wherever it's most convenient to do so. And we're not sacrificing features in the pursuit of mobility. Wireless phones today offer far more calling, conferencing, called ID, and answering options than corded phones ever did.

And then there's the office phone. Like a throwback in time, when we enter the typical place of work we enter a world of wired bondage. Why is the corded desk phone still so prominent in offices?

Single mode and dual-mode Wi-Fi enabled phones are available, but the small handheld devices don't offer the same user experience as a desk phone. There's something just right about a desk phone's handset that makes it ideal for hands-free talking when a speakerphone just won't do.

Problem is that the desk phone just hasn't made the same strides as the wireless handset. Sure, we've added IP connectivity, fancy displays for Caller ID, phone books that simplify dialing, and even wireless headsets to bring us a small measure of mobility. But the modern desk phone still requires a wired Ethernet port, and typically a Power over Ethernet power source, too.

This megalith with a direct lineage extending back to the telegraph is the last hurdle to the introduction of a wireless network edge. Replace the wired desk phone with an enterprise-class Wi-Fi desk phone and you can eliminate a big chuck of the wiring and edge switching infrastructure, lowering costs and saving electricity to boot. You also gain the freedom to locate the phone where you want it, and to make adds, moves, and changes at minimal expense.

134 years after the creation of the phone gave us the freedom to speak with the world, it today shackles us in wired bondage. It tethers us to Ethernet ports, to expensive infrastructure, to yesterday's way of working. Let's look forward to the day when Wi-Fi desk phones set us free at last.

Who Moved My Packets, Or How I Learned To Stop Worrying And Cut The Cord

2009-08-02T14:58:00.000-07:00

With the ratification of 802.11n just around the corner, it’s a good time to reexamine the fundamentals of Wi-Fi design and determine how this blazingly fast new technology will affect you. Who Moved My Packets is about the design considerations associated with 802.11n data, voice, and video applications.

Let’s start with a discussion about designing for coverage or capacity. For some wireless applications simple connectivity is the biggest issue with which users have to contend. Designing a network for coverage ensures that a Wi-Fi signal can be received at any location in which a Wi-Fi device is likely to be used. Connectivity is the primary objective - bit rate, packet throughout, multi-media support, quality of service, and even redundancy of coverage are secondary considerations.

Consider an indoor application in which Wi-Fi is used to communicate with a pool of bar code scanners for inventory management. The users are few in number, the amount of data transmitted is relatively small. Since the bit rate of an in-building Wi-Fi connection typically falls with distance and in the presence of interference sources, what started as a high speed connection near an access point could drop to 1Mpbs or less just a short distance away. However, even at that low throughput, a network designed for coverage should be sufficient for the application.

Any Wi-Fi network can be designed for coverage, and as a rule, designing for coverage requires far fewer access points. Just crank up the access point power to full, space the access points so that their coverage patterns overlap slightly, and the design part is done. Interference compensation, fair airtime availability, security, and network management are another matter entirely, but they’re outside the scope of this discussion.

A handful of Wi-Fi vendors have made an art of promoting their products as requiring fewer access points. Some Wi-Fi array (multiple access points in one box) and single channel vendors go so far as to tout their “unique” ability to deliver what no other Wi-Fi vendors can accomplish.

It’s all smoke and mirrors. Wi-Fi vendors all use Wi-Fi chip sets from a small pool of IC suppliers, and by regulation the power output of the radios is tightly controller by the government. The distance over which they can transmit, using comparable antennas, is the same. If you pull back the curtain, the secret of their claims is simply that they’re designing for coverage. Nothing more.

In fact, it’s really something less. Why? Because many users need a system that is designed for capacity. In a network designed for capacity, coverage is a given but bit rate, packet throughout, multi-media support, quality of service, and often fault-tolerance are primary considerations.

A capacity-based network requires that the vendor pay keen attention to internal architecture, algorithmic processing, and packet handling necessary to service deployments with a high capacity requirement: (1) large number of users; (2) users that are densely congregated; or (3) applications using voice or streaming video or business-critical telemetry data. Coverage alone is not sufficient for these scenarios – they require guaranteed bit rate, high packet throughout, and quality of service.

These scenarios are already the norm in education, healthcare, and government applications, and are fast becoming typical in enterprise, retail, and industrial deployments. With the migration of data, voice, and video applications to 802.11n from wired LANs, the need for capacity-based Wi-Fi will skyrocket. Users will expect wire-like performance with virtually unconstrained capacity on their shiny new 802.11n networks.

So the next time you’re given a pitch for a wireless LAN with one half, one quarter, one eighth the number of access points of an Aruba network, ask the vendor if they’re designing for coverage or capacity. And ask for test data to back it up. Doing so will avoid following Maj. T.J. 'King' Kong on a ride that is a mistake from the outset.

The Decline And Fall Of Ethernet (At The Edge)

2009-07-30T23:49:00.000-07:00

The first quarter of 2009 witnessed the first ever decline in wired switch port sales, accompanied by sales of laptops exceeding those of desktop PCs. These events herald the advent of the always-connected mobile workforce. A workforce that expects network access to be available everywhere works transpires. An untethered workforce.

According to the PEW Internet & American Life Project, it is not unusual for Americans to use the Internet “constantly” at work. To do so effectively, Americans either need to be equipped with Ethernet extension cords or cut the cord entirely. Why? Because where once we worked at desks all day long, today roughly half of us spend at least 20 percent of our work time away from our primary workplace. That from Yankee Group's Anywhere Enterprise—Large: 2009 U.S. Transforming Infrastructure and Transforming Applications Survey.

We are transitioning into an increasingly mobile workforce. And to stay connected we are turning our backs on traditional wired Ethernet networks and looking to Wi-Fi. According to another Yankee Group report, Make Wireless the Burger of Enterprise LAN Access, Not the Fries, in 2006 about 43 percent of enterprises did not even offer Wi-Fi access. In 2009 that number dropped to just 11 percent. More telling, 45 percent of enterprises expect that by 2012 more than 50% of their work forces will be connected to an office Wi-Fi network.

The transition from wired to Wi-Fi did not come quickly or easily. Many generations of wireless pretenders have attempted to steal the edge access throne from Ethernet – starting with proprietary frequency hoppers and moving through three versions of 802.11 standards-based wireless.

In ascendance now is the real king – 802.11n. The first standards-based wireless to offer performance, security, and value that rivals or bests Ethernet. In difficult economic times, it’s value that sells, and for network access 802.11n wins hands down over wired networks except for a very limited number of power users.

The good news is that selecting an access method is not a binary choice. Users can mix Ethernet and 802.11n access, using the former only where necessary and the latter everywhere else. Indeed, Wave 1 of the Yankee Group survey revealed that forty percent of enterprises have no plans to deploy gigabit Ethernet to the desktop, preferring instead to move to 802.11n Wi-Fi. Following such a “rightsizing” process promises to deliver the greatest value and the lowest access cost per user, while offering a level of mobility a wired network can simply never match.

Just as the Roman Empire succumbed to invasions due to the loss of its greatness, so too is Ethernet edge access fading in the face of a more virtuous technology. So if you’re considering an office network refresh, or have a green field deployment, follow the tide. As Gibbons wrote, “the wind and the waves are always on the side of the ablest navigators.”

The End Of The Beginning: The Final Ratification Of The 802.11n Standard

2009-07-24T18:45:00.000-07:00

The long-awaited ratification of the high-speed 802.11n standard is slated to happen in mid-September. And the ramifications are both large and small.

Large in the sense that many enterprises have held back from deploying 802.11n until the standard is formally ratified. The reason? Fear of incompatibility between products compliant with the Draft 2.0 pre-standard and those built to meet the final standard.

Small because Draft 2.0 802.11n was already the de facto standard. In order to ameliorate concerns about potential incompatibilities, the Wi-Fi Alliance last year stated that interoperability was a given between products adhering to the draft and final versions of the standard. The September 2009 ratification will simply render that pronouncement prescient, with the draft morphing into the de jure standard with no significant changes to mandatory specifications.

When implemented "correctly," 802.11n is the first wireless technology that not only gives Ethernet a run for its money, it wins the skirmish, battle, and war. I say correctly because there are wide variations among vendors in how 802.11n channels and bands are managed, the impact of legacy 802.11a/b/g clients, the performance of densely deployed clients, and how secure 802.11n networks can be made against attack.

Wire-like reliability, harmonious client interoperability, exceptional throughput, and military-grade security are all possible – but none is assured. Not without additional engineering built on top of the 802.11n standard.

So to paraphrase Churchill, with the ratification of the 802.11n standard we’ve at last reached the end of the beginning. With the standard in place the impetus will now be on end users to validate vendors’ claims about reliability, interoperability, performance, and security. Conduct bake-offs, put equipment through its paces, ensure the veracity of claimed features and benefits. The results will open your eyes to the realization that the ratification of a standard is just the beginning of the real work.

If you’re interested in learning more about how Aruba is making 802.1n realize its full potential, please see the white paper ARM Yourself to Increase Enterprise WLAN Data Capacity (http://bit.ly/wFj9n) and the technical brief 802.11n Client Throughput Performance (http://bit.ly/bMvT).

Companies That Can't Innovate Replicate...Or Just Whine

2009-05-24T08:13:00.000-07:00

A funny thing happened while Aruba was on the way to market with its innovative Virtual Branch Network (VBN) solution and "network rightsizing" initiative - Cisco got hot and bothered.

Just after the VBN solution received the 2009 Best of Interop Las Vegas Award in the Wireless & Mobility category (http://bit.ly/aUocV), Joel Conover, senior manager, network systems at Cisco called the new 600 Series Branch Office Controller "a travesty" (http://bit.ly/KOmNv). He then claimed that Cisco offered the same capabilities with a new product...but only when used behind an expensive Cisco 800 Series ISR Router. Why does Cisco need an expensive WAN router when Aruba VBN does not, even for the entry level $99 list RAP-2?

Aruba's rightsizing initiative promotes the use of Wi-Fi everywhere it can be used, wired networks only where they must be used. Rightsizing is a three step process whereby users assess current wired LAN utilization using a tool like StatSeeker (on average 30-40% of wired ports aren't used at all), consolidate switches and scale service plans/cooling/power consumption to match, and then invest the savings in upgrading the Wi-Fi network to 802.11n. Simple and logical, right? If you can save money you should. If your network is already rightsizied then the most you've invested is some time verifying that's the case.

Customer reaction to rightsizing has been nothing short of amazing. The California State University System identified $30M of savings by shifting from wired networks to Wi-Fi (http://bit.ly/uvjbu).

Cisco, however, had a different reaction.When John Cox published an article in Network World titled "Is it time to cut the Ethernet access cable?" (http://bit.ly/3cG4t) in which he noted that pervasive WLANs leave costly wired ports idle, Cisco flipped. Chris Kozup, ironically titled senior manager for mobility solutions at Cisco, maintained that an Ethernet cable is exactly what everyone needs. Aruba's right-sizing is a "shortsighted message from a wireless-only provider. It's penny-wise and pound-foolish." Using Wi-Fi as the primary form of network access is inflexible and the benefits exaggerated, he said.

And yet....Cisco itself released a report stating that its own employees average 90 minutes per day of additional productive time using Wi-Fi (http://bit.ly/UNHQd). So why is Cisco so aggressively pushing wired LANs on customers?

The answer to both questions can be found in Cisco's business model, which depends on profits generated from selling overpriced wired routers and wired ports. The big R&D bucks go to the wired side of the house, which is perhaps one reason why Cisco's lackluster wireless LANs are missing innovative features like application awareness and adaptive response to changes in local RF conditions.

Cisco's focus on wired LANs and lack of wireless innovation has resulted in two consistent forms of behavior: attempts to replicate features found in Aruba's innovative products (Cisco's new band steering feature and the changes in their newest network management console appear to be almost exact replicas of Aruba features); and whining, as exemplified in the articles above.

If you want real innovation, look to companies that identify problems and deliver creative solutions. Replicators and whiners need not apply.

802.11n Performance: Radios vs. Streams

2009-04-21T19:51:00.000-07:00

Many organizations pride themselves on being at the cutting edge of technological innovation, the first to deploy a vendors newest innovation. Indeed, >50% of organizations surveyed will evaluate other wireless vendors’ products within the next 12-18 months. Being the first to catch the hottest new innovation carries with it the risk of being burned, and a little due diligence can go a long way in making sure that a buying decision is prudent.

Take for example the matter of 802.11n performance. 802.11n performance is based in part on both the number of radio chains and the number of spatial streams. The two are often confused...at the buyers peril. The number of radio chains corresponds with the number of transmitters or receivers, and is typically denoted as “m x n” where m is the number of transmitters, and n the number of receivers. m x n need not necessarily be symmetrical, and some 802.11n access point can dynamically adjust the numbers, e.g., a 3x3 radio can operate in 3x3, 2x3 or 1x3 mode depending on configuration, mode and power profile.

While multiple transmitter and receiver chains can be used to improve the signal quality, the big increases in data rates associated with multiple input-multiple output (MIMO) access points are more dependent on the number of spatial streams. Using 1 stream, the maximum 802.11n data rate per radio, assuming 40MHz bandwidth, is 150Mbps. Using 2 streams that number doubles to 300Mbps, and so on. The number of spatial streams is typically denoted by S in “n x m : S.” There are as yet no 3 stream access points on the market, though several access points have 3 receiver and/or transmitter chains.

By way of example, Aruba's AP-124 and AP-125 Access Points are 3x3:2 devices. In contrast, Cisco's 1140 and 1250 series access points have a dual transmitter, triple receiver design and are 2x3:2 devices. If you're looking for the best performance, Aruba's 3x3:2 access points are your best bet.

Saving Energy and Money By Extending the Battery Life of Mobile Devices

2009-04-18T17:27:00.000-07:00

The battery life of Wi-Fi capable mobile devices can be extended by enabling the Wi-Fi radio to enter a low-power “sleep” mode during period when the device neither needs to transmit or receive data. The longer the sleep time, the lower the battery drain. The difficulty is ensuring that sleep mode does not interfere with network performance, i.e., the device can wake-up in a timely manner.

Mobile device drivers and radio firmware employ a variety of pre-set times and trigger events to optimize entry into, and termination of, sleep time. The techniques employed typically vary by device and applications. For example, scanners typically have longer pre-set sleep times than laptops because the latter is assumed to have greater access to a recharger. The IEEE 802.11 standard includes a mandatory power save polling (PSP) feature whereby the Wi-Fi access point with which the device is associated must buffer data for that device while it is sleeping. Once the device awakens, the buffered data are delivered.

Following the transaction the device can return to the sleep mode if no additional data are to be sent or received. The PSP mechanism includes additional provisions that enable the access point to override sleep times and force the device to wake up at shorter intervals (called DTIM interval) even if there is no traffic to send or receive.

Battery life can be compromised as a result of two primary issues. Network performance problems, such as the failure to respond to ARP requests within the allocated time, or insufficient buffer storage within an access point, can reduce the DTIM interval and cause a mobile device to wake-up more often than necessary.

Additionally, broadcast and multicast Wi-Fi traffic chatter can prevent a mobile device from entering sleep mode, keeping it awake to check lest any of the chatter include packets intended for the device. In both scenarios battery life is compromised because the sleep mode cannot be utilized as intended.

To address these issues some vendors have implemented proprietary power-saving solutions that require software clients (Cisco CCX) or firmware hooks (Symbol). There are two fundamental issues with these approaches: they limit the range of available devices by locking customers into using only devices embedded with the proprietary technology; they require that the customer implement strict revision control over the client software and firmware to avoid incompatibilities or performance differences that exist between revisions.

Aruba has taken a standards-based approach to extending battery life by using infrastructure controls to manage off-the-shelf mobile devices without recourse to proprietary software or firmware. Three standards-based infrastructure controls are leveraged to equal or exceed the battery life achievable with proprietary solutions:

• Proxy-ARP: Mobility Controllers answer all ARP requests for devices with their radios in sleep mode, permitting longer DTIM intervals than could be supported if access points alone managed these requests;

• Long DTIMs: Long DTIM intervals are enabled by a battery boost feature, set by SSID, that permits the conversion of multicast / broadcast frames to unicast frames without having to buffer every DTIM period. Client devices can define their own DTIM periods thereby extending battery life without negatively affecting network performance;

• Multicast suppression: Mobility Controllers employ real-time packet inspection to identify and block network chatter (multicast traffic) that would negatively affect mobile devices. As a result, mobile devices able to remain in sleep mode longer and conserve additional power.

This three-pronged approach to power saving allows for longer sleep times on mobile devices such as scanners and voice handsets. Longer operating service from a single charge can have significant logistics and cost benefits, requiring fewer mobile devices, battery packs, and /or charging stations. Additionally, battery service life will be extended since service time is inversely related to the number of charge cycles.

Aruba’s standards-based approach also frees customers to use any Wi-Fi certified mobile device on the market, with the assurance that its battery life will be maximized regardless of make, model, form-factor or application. Eliminating sole-sourced products in favor of a procurement process based on price and/or performance can yield significant cost savings.

You Get What You Pay For: Meru Pays Novarum For Performance Not Seen By Customers

2009-04-09T09:33:00.000-07:00

Novarum recently published a test report claiming that Meru Networks’ 802.11n wireless LAN delivers higher throughput, better power efficiency, and superior airtime fairness than either Aruba or Cisco. The report is available from Novarum's Web site.

At a high level – setting aside all technical details – the report’s findings are at odds with the experience of many prospects and installed-base customers. Meru deployments have been removed from, or Meru lost head-to-head technical evaluations (“bake-offs”) at, the following schools among many others:

• University of Tennessee – replacement and bakeoff
• C-2 Raytown School District - replacement
• Norwood School - replacement
• Francis Xavier Warde School - replacement
• Drexel - bakeoff

The EDUCAUSE Board (http://ised-l.blogspot.com/2009_01_01_archive.html) has been rife with postings about issues with Meru’s 802.11n network. See for example the posting from Jomar McDonald, Director of Technology, The Frances Xavier Warde School.

Recent press articles have explored the reasons why customers are replacing Meru networks with Aruba adaptive 802.11n networks. One such case is Mike Morisy’s Search Networking article, “From Cisco to Meru to Aruba, school finally finds right WLAN” (http://searchnetworking.techtarget.com/news/article/0,289142,sid7_gci1352631,00.html#).

No one can dispute that performance differences exist between different wireless LANs, however, the dichotomy between the findings of the Novarum report and what customer’s experience in the real world is startling. A little digging into the research methodology employed in the Novarum report highlights casts a bright light on the reasons for this schism. Novarum is a paid consulting firm – a writer for hire, as it were – and given the fact that their findings are completely at odds with what we (along with other vendors) see in actual deployments in the industry, one has to believe that the results they publish are heavily influenced by the source of the funding. For example, a 2007 Novarum report – also commissioned by Meru – saw Aruba’s AP-70 Access Points tested with their antennas closed and in the wrong planar orientation relative to the clients. Novarum claimed that the network was set-up in accordance with Aruba’s guidelines, however, that proved not to be the case with the antenna position and a host of other critical parameters.

Fast forward to the newest Novarum report. The methodology issues are different from the 2007 report but just as significant with respect to their denigration of performance:

• The tests used just one single access point from each vendor - hardly an environment conducive to measuring wireless LAN capacity – and Meru access points were operated at full power but the other access points were not;

• Commercially available software releases were used for the Aruba and Cisco devices (Aruba 3.3.2.10 and Cisco 5.2.178) but Meru used a special test code that is not available to its customers. This inobtainium code was no doubt crafted to perform special tasks, just for the test, that would otherwise be unnatural acts in a commercial deployment;

• Encryption was disabled, despite a mandate by most customers to cipher communications. Encryption has been demonstrated to degrade the performance of Meru wireless LANs;

• Only two client types were used, one being a plug-in adapter, this despite the plethora of clients in real world deployments. The performance of Meru wireless LANs has been previously demonstrated to degrade in the presence of commonly used clients that were excluded from this test;

• Screen shots show major misconfigurations of Aruba’s controller. Aruba utilizes a technology called Adaptive Radio Management (ARM) to optimize wireless LAN performance, and in the test the ARM traffic management profile for fairness was created but not assigned to the Aruba access point under test. The voice traffic DSCP (ToS) tag was also incorrectly set to a value of 56. Other errors abound;

• Meru’s own installation guide states that 3X3 MIMO operation cannot be supported over 802.3af power over Ethernet, and that both radios have to back down to 2X2 MIMO. Therefore it is possible that a single radio was used during power measurements of the Meru access point, and the same was done for the Cisco 1250 access point – providing nothing more than that one radio consumes less power than two.

Occam’s razor - entia non sunt multiplicanda praeter necessitatem – states that the explanation of any phenomenon should be parsimonious with respect to assumptions about observable predictions. The Novarum report is nearly forty pages long, but the most fundamental underlying assumption – that the competing equipment was set-up properly, fairly, and in accordance with the manufacturers’ guidelines – was violated. The results – all of the results – were thereby nullified, the paper wasted.

One assumes one gets what one pays for: Meru got a test report in exchange for paying Novarum. Readers, however, got nothing of value. Caveat emptor.

At Aruba we appreciate and encourage head-to-head testing by our customers before they choose a WLAN. It is only in these real-world scenarios, running the applications and equipment that are intended to be used, that one can best evaluate the performance of a network. We also appreciate the value of thorough testing done by industry experts. However, when you can’t replicate a test in the real world - as is the case with the Novarum report – then the testing procedure is flawed and/or skewed.

Green IT: Wireless Saves Money, Helps The Planet

2009-03-05T11:14:00.000-08:00

Earlier postings on this blog highlighted the environmental downsides of wired LANs, and the benefits of using a Wi-Fi network as the primary means of accessing an enterprise network. For many readers, however, money is where the rubber meets the road. Is it possible to champion Green IT by shifting to Wi-Fi AND save money?

As a staunch advocate of both Green IT and wireless, Aruba felt it should validate what it preaches by rightsizing its own enterprise network - eliminating as much of the wired LAN as possible, replacing it with a wireless network, and then assessing the savings, if any. Under the leadership of our Senior IT Director, Murali Mahalingam, we did just that - we rightsized Aruba’s IT infrastructure. In the process we not only dramatically lowered expenses but also increased employee productivity and reduced the company’s resource footprint.

The first step was to review the performance of both our wired and wireless LANs to determine which best satisfied the majority of our application requirements while offering the lowest cost method of network access. The wireless LAN (WLAN) was determined superior on both counts. As a result we deployed high-speed 802.11n WLANs for >90% of our 500+ employees, and used a traditional wired LAN only for those employees who needed Gigabit Ethernet speeds in excess of the capability of the WLAN.

A single WLAN was configured for data and voice applications for use by all Aruba employees located at our corporate headquarters, remote, branch offices, and home offices. We averaged roughly 15 users per wireless access point. We also provided this solution to the road warriors in our sales force, all of whom connect to the network while traveling.

We also enable true mobility for users by providing wireless connections for voice clients (such as Wi-Fi connected desk phones from snom) and dual-mode Wi-Fi/cellular handsets for all employees at our corporate headquarters, remote, branch offices.

Finally, we replaced virtual private network (VPN) clients and secure tokens with Aruba’s Remote Access Point (RAP) technology for all road warriors and employees who work remotely from home offices. RAP is a low-cost solution that combines a wireless access point with VPN security and policy enforcement firewall. The beauty of RAP is that it does not require any software to be installed on the laptop, PDA, smart phone or other devices with which it is used. RAP is also plug-and play: following initial provisioning by the IT department, no further management or configuration of the RAP is needed. Instead, the employee simply plugs the RAP into a local network (or plugs in a 3G cellular modem) and RAP automatically establishes a secure tunnel with our primary or back-up data center, establishes the corporate SSID, and initiates a secure session for both data and voice (including corporate phone extension calling).

These steps enabled us to simplify our wiring closets by converting a large portion of wired ports to wireless. As a result we needed many fewer data switches. This reduced data room power consumption, increased operating time from our back-up battery uninterruptible power supply (UPS), and reduced cooling loading on our air conditioning system. The net result has been a lower utility bill and a reduction in the tons of CO2 emissions per year associated with equipment cooling.

We were also able to lower cabling and IT support costs associated with office adds, moves, and changes. These might seem incidental, but for many enterprises the costs and wasted cabling quickly add up. For example, we recently merged a nearby engineering center for our AirWave division into our corporate headquarters facility. By leveraging our wireless network instead of installing 2-4 new cable drops per relocated employee, we used 10km less Category 5 copper cable.

From a sustainability perspective, cable insulation, cable management/trunking systems, and wiring device accessories like plugs and boots, are make of PVC, polyethylene, polypropylene, synthetic rubber, MIC, nylon, and phenol formaldehyde. Each of the constituent chemicals has an impact on the environment when the part is made, when it’s used, should it catch fire, and when it is discarded. For example PVC is a commonly used insulation material, and contains lead and other toxic chemicals. Not only does it require special handling at the disposal site – something it rarely receives – but it produces highly toxic chemicals when burned. Polyethylene, polypropylene, synthetic rubber, and nylon are only slightly less toxic. See The Green Building Handbook for more details about the environmental impact of wiring according to energy consumption, resource consumption, global warming, acid rain, ozone depletion, toxicity, photochemical smog, occupational health, recycling impact, and hormone disruption

In terms of expense reduction (read monetary savings), we were able to reduce corporate telecom expenses by using voice-over-Wi-Fi at our headquarters, remote offices and home office locations. When a user goes home and turns on his/her laptop, they are automatically logged into the corporate LAN via RAP. Their Wi-Fi enabled mobile phone will auto-register and support corporate VOIP calls instantly with no additional set up. A user with a Wi-Fi enabled mobile phone can dial a 4-digit extension number to call colleagues in a branch office anywhere in the world at no cost. Additionally, the user can make external calls leveraging the corporate IP PBX. Both of these benefits decrease billable cell phone usage, lowering our telecommunication expenses.

Off-site meetings at shows and partner events are also less expensive since a single RAP provides all attendees with access to the corporate network. Some RAP models include 3G cellular connections, allowing low-cost cellular to be used in lieu of expensive convention/hotel Ethernet for WAN connectivity. No client software or IT overhead is required to handle such meetings.

Additional savings were achieved with respect to our work with business partners. For example, Aruba’s offshore SAP Managed Services Team, based in India, was set up in less than one day for about 20 shared-service resources. Only a one-time set up of all user accounts was required on the wireless controller. RAP devices were shipped to the SAP consultant in India, who had only to plug them into a local WAN to obtain secure access to our SAP implementation and voice over Wi-Fi calling. We’re current expanding this model to other Aruba business partners and hundreds of remote and mobile workers.

As a result of this project, Aruba reduced the utilization of costly wired ports by overlaying wireless LAN access for the majority of our work force. We reduced the number of closet switches and lowered power and cooling requirements up to 20%. Employee office moves no longer require IT support as the users can now sign-on to a single corporate SSID from anywhere in the world using wireless access. Deploying a wireless office saved on upfront, non-refundable costs such as a cubicle wiring - this has reduced IT network administration costs by 10-15%. Mobile employees can now connect their laptops to the corporate LAN without local IT assistance, regardless of the county in which they’re operating. This eliminates the need for local IT network administrators in branch offices. Nor is IT assistance required to install VPN clients, issue secure tokens, or deal with VPN misconfiguration and client problems. By deploying RAP devices with build in VPN capabilities, we actually gained more control and insight into remote clients for trouble-shooting purposes.

Assumptions
Total # of network users: 500
Size of existing facilities (in square feet): 60,000
Average number moves/add/changes per year, per employee: 0.50

Estimated Cost of the legacy wired network
Number of switch ports required to support current users: 1,200
Number of access layer switches required for current usage: 26
Annual Capital Expense to support the 'Wired Edge': $182,888
Annual Operating Expense to support the 'Wired Edge': $83,417
Total annual cost of the 'Wired Edge': $266,305

The New 'Rightsized Network'
Number of switch ports decommissioned after Rightsizing: 675
Number of switches decommissioned after Rightsizing: 14
Annual reduction in costs through Rightsizing: $149,796

3-Year Cost Assessment
Reduction in 'Rightsized Network' Costs (3 years): $449,389
Total 3-year cost savings through Rightsizing: $398,546

Savings Summary (Projected savings over next 3 years)
Savings from “Network Rightsizing”: $398,546
Savings from reduced IT support costs: $200,000
Savings from increased use of Vo-FI calling: $600,000
Savings from power, cabling and cooling costs: $ 50,000
Total projected savings over 3 years: $ 1,248,546

Is it possible to champion Green IT by shifting to Wi-Fi AND save money? You bet. Aruba’s IT infrastructure is living proof that Green IT can both save money and help the planet.

Plastic and the All-Wireless Workplace

2009-02-22T22:43:00.000-08:00

When IT engineers discuss the “all-wireless workplace,” they don’t intend the phrase to be taken literally. Electric power, fire/life safety systems, and heating, ventilation, air conditioning, and refrigeration (HVACR) systems all rely on wire cabling for their operation. So, too, do the high speed cores of data networks, where a combination of 10 gigabit Ethernet and even higher speed fiber optic cabling serve as highways for data, voice, and video packets. These cabling applications are unlikely to disappear in even the distant future.

Rather, the phrase “all-wireless” refers to the means by which users access a data network. Wireless LANs used to be considered a nice-to-have overlay on top of a primarily Ethernet –based wired LAN. No longer. The advent of high-speed adaptive 802.11n wireless LANs has stood the structured-cabling world on its head.

Consider that a typical corporate user is outfitted with 3-4 Ethernet ports. That’s four closet switch ports, possibly multiple power-over-Ethernet (PoE) injectors, four cable runs up to 100 meters each, and a four jack plastic wall plate. Per person.

In contrast, twenty users can be serviced simultaneously by a single 802.11n access point – fed by a single gigabit Ethernet drop and PoE injector – thereby eliminating roughly 80 Ethernet cables, switch ports, and wall outlets. Across even a small enterprise the savings will be substantial.

It’s no wonder that noted Burton Group industry analyst Paul Debeasi in 2007 penned a much-cited report titled 802.11n: The End of Ethernet? in which he notes that 802.11n and its successor products will erode the switched Ethernet market. Or that industry analyst Yankee Group noted in a report titled It’s the Economy, Stupid: Yankee Group’s 2009 Predictions that by the end of this year 802.11n will cause a slowdown, followed by a decline, in wired network switch port sales.

The movement from wired to all-wireless network access will have significant cost and environmental ramifications – and will be the subject of many future posts. For now let’s investigate just one facet of the cable displacement movement – plastic.

Cable insulation, cable management/trunking systems, and wiring device accessories like plugs and boots, are make of plastic. PVC, polyethylene, polypropylene, synthetic rubber, MIC, nylon, phenol formaldehyde. Cabling systems are virtual chemistry sets, and each chemical has an impact on the environment - when the part is made, when it’s used, should it catch fire, and when it is ultimately discarded.

In The Green Building Handbook authors Tom Woolley and Sam Kimmons have been kind enough to list and rank the environmental impact of wiring according to energy consumption, resource consumption, global warming, acid rain, ozone depletion, toxicity, photochemical smog, occupational health, recycling impact, and hormone disruption…among other factors.

It should come as no surprise that the manufacture of copper cable has a substantial impact on energy consumption, resource consumption, global warming, ozone depletion, etc. In fact, virtually every component of a structured cabling system – the cable, cable insulation, cable management, plugs, sockets, wall plates, and cable ties – requires considerable energy to create and consumes vast amounts of non-biological resources.

However, the dirty little secret is the toxicity of the plastics used in these parts. PVC is a commonly used insulation material, and contains lead and other toxic chemicals. Not only does it require special handling at the disposal site – something it rarely receives – but it produces highly toxic chemicals when burned. Polyethylene, polypropylene, synthetic rubber, and nylon are only slightly less toxic.

The Green Building Handbook includes a well laid-out table on page 60 where you can study in greater detail the environmental damage done during the life-cycle of a wiring system. Just remember that every time an Ethernet system needs to be expanded, moved, or replaced, the environmental toll rises. This handbook should be mandatory reading for every IT manager!

Adaptive 802.11n is a high speed way to make the world a better place sooner. For the sake of the planet, the all-wireless workplace cannot arrive soon enough.

Network Management: The Achilles Heel of Wireless LAN Vendors

2009-02-13T17:09:00.000-08:00

Purchasing a single, all-encompassing wired + wireless + network management network solution from single vendor is, at first blush, very alluring - one purchase order, one source of service, one throat to choke. However, the reality of that decision can be very painful. Gartner analyst Mark Fabbi took on this subject in a 2006 report titled Vendor Influence Curve: A Model for Dealing with Major Vendors, when he wrote that no single vendor offered best-in-class products across the board. Relying on a single vendor deprives a user of the best available solution.

This is especially true in wireless network management. Long the backwater of wireless LAN vendors, whose focus on the physical layer generally comes at the exclusion of network management and human-machine interface design, network management is the Achilles heel of most wireless LAN vendors. That is the reason why a vendor's own management tool is usually not the best available for that vendor's own devices.

What then should users look for in a management tool? Focus on how feature-rich the tool is, how intuitive it is to use, and how well it integrates with both legacy and new wireless gear. A feature-rich management solution should address the limitations of proprietary platforms, and deliver a broad suite of options that would not otherwise be available, including:

Automated device discovery across any network infrastructure (WAN or LAN) of products from multiple vendors;
Group-based policy definition for the efficient management of large networks;
Centralized configuration for all wireless vendors' devices to eliminate manual processes and the opportunity for human error;
Compliance audits to enforce security policies at all times;
User-based monitoring of all wireless vendors' devices for real-time information and rapid trouble-shooting;
Diagnostics and alarms for fast problem resolution;
Integrated reporting package that encompasses all wireless vendors' devices for intelligent planning and performance measurement;
Automated RF management to continuously optimize Wi-Fi performance;
Role-based allocation of management and support duties.

The solution is a comprehensive, vendor-neutral network management system.

Vendor-neutral network management is a relatively recent market development but one that is expected to become de rigueur. According to Daniel Corsetti, IDC’s former senior analyst for enterprise networks, vendor-neutral network management is the wave of the future because a single, consolidated management console has distinct operational advantages:

From one integrated easy-to-use console, all wireless LAN users, devices, and intrusion attempts can be seen at a glance;
Users can select from which wireless LAN vendor(s) they purchase products, today or tomorrow, based on price/performance instead of a vendor's head-lock;
Device configurations can be remotely managed, policies set, and RF settings and firmware adjusted, across a building or across continents - lowering IT overhead and reducing operating costs.

Vendor-neutral management systems can also extend the usable life of legacy wireless LAN infrastructure by an average of 1 to 2 years, a 20-40% increase in service life based on typical infrastructure replacement schedules.

A single-console overview of the wireless network makes a heterogeneous, multi-vendor network appear homogeneous - simplifying training, problem recognition, and fault remediation. Management tools earn their keep when a problem arises: the swift detection of a problem source, analysis of its impact on users, and recommendations for fault resolution are the defining characteristics of a great management system. Managing a single vendor network without access to network-critical data is a recipe for disaster. So is managing a multi-vendor network with multiple management tools.

Users of the vendor-neutral AirWave Wireless Management Suite report up to a 75% reduction in problem resolution time and a 40% reduction in support calls. The AirWave tool supports a broad range of wireless hardware including products from Cisco (Aironet, Airespace, and earlier models), HP ProCurve/Colubris, Aruba, Proxim, Symbol, Enterasys, Juniper, LANCOM, Trapeze/Belden, Nomadix, Avaya, Enterasys, Alcatel, and others. The suite also supports “intelligent” and “thin” APs, mesh devices, point-to-point, and WiMAX outdoor networks.

So the next time you're confronted by a vendor pushing a proprietary management tool, remember Mark Fabbi's words and walk on by. Look instead for a best-in-class, vendor-neutral management solution - you'll save money and retain control over your network.

Voice-Over-Wi-Fi Options for the All-Wireless Workplace

2009-02-10T08:33:00.000-08:00

Pervasive WLANs can and will be leveraged to remove dependence on wiring to desktop phones, and to enable mobility inside the enterprise for employees who are frequently away from their desks. Just a there exist different classes of enterprises and users, so too are there different voice over Wi-Fi solutions - no one solution will be dominant across the enterprise.

A recent article by Michael Finneran in the No Jitter blog provides the catalyst to explore these solutions in greater depth. Finneran suggests that UMA, a carrier-based FMC architecture, is not suited for the enterprise, in part because it has no integration with the PBX or UC network. We agree that UMA is not suitable for all employees, but there is certainly a segment of users in most enterprises that would benefit from UMA, and indeed we believe certain types of organization could profitably convert to UMA en masse.

The “right” form of FMC depends on how the telephony service is used. If the objective is to support users who roam within a building, single-mode Wi-Fi phones can do the job. Phones from Polycom (formerly Spectralink), Cisco, and others that were been developed for distinct vertical markets (retail, manufacturing, healthcare) are increasingly finding their way into schools, universities and even mainstream enterprises. Most of these phones support WPA2/802.1X security, and because they are designed for an enterprise environment their inter-access point handover performance and PBX integration is good.

If the objective is to support users on the move within and outside buildings, the right solution depends on the current PBX infrastructure, the user’s needs, and the budget. One option is to simply use a cellular phone whenever there is a strong enough signal. While not usually cost-effective, and lacking any form of PBX integration, it may be sufficient for some users. The other options involve some form of FMC.

The simplest, most comprehensive and most widely-used form of FMC today is UMA. There are perhaps 2 million UMA phones in use, compared to perhaps 2,000 – 20,000 for alternative, PBX-anchored FMC solutions. The UMA phone automatically switches to Wi-Fi when it detects good reception from a suitable access point, returning to cellular when it loses a usable Wi-Fi signal. When on Wi-Fi, the phone sets up an IPSec tunnel over the Internet to a gateway at the cellular carrier’s site: all signalling and media traffic is carried through this tunnel, so it never interacts with the enterprise WLAN or PBX.

UMA is simple, it works well, a reasonable range of handsets includes Nokia, Windows Mobile from various vendors and BlackBerries, and it meets the basic needs of the outside-the-building employee. Build-it-yourself Wi-Fi coverage, a single phone number, good cost savings are available with no behavioral changes on the part of the user. UMA does not integrate with the PBX, but that’s the reverse side of simplicity. At just the incremental cost of the phone, plus an optional $10/month, UMA is certainly the low-cost FMC solution. For the many employees who today use their cellphone for nearly every call, UMA is a good answer.

The second indoor-outdoor solution is a dual-mode phone operating in ‘two-number’ mode, i.e., a Nokia E-series such as an E71 or a Windows Mobile smartphone. The VoIP capabilities of these phones (particularly Nokia) are extensive. The E71 includes a full SIP stack on top of a Wi-Fi interface with the best inter-access point handover performance available today. It can be integrated with any SIP-capable PBX over an enterprise WLAN using the most stringent Wi-Fi security, WPA2/802.1X.

Very little behavioral adaptation is required. When someone calls your cellular number, the phone rings. When someone calls your PBX number, your phone rings when you are in WLAN coverage, otherwise it goes to enterprise voicemail. Most modern voicemail systems with an email notification feature will then push the voice message to the phone over the cellular network. Outgoing calls can be directed via the PBX when Wi-Fi is connected, or revert to cellular. The user gets one device that works as a cellphone + PBX phone inside the enterprise, and as a smartphone with e-mail when roaming away from the enterprise.

The shortcomings of the ‘two-number’ solution are that there is no single-number option (is that too obvious?), it requires a SIP-capable PBX, and it often requires a per-extension SIP license fee from the PBX vendor. And because there’s no handover between Wi-Fi and cellular, if you walk out of the building during a call, the connection is going to drop. But assuming that the PBX and WLAN are ready, this solution can be yours for the price of the phone, with no additional monthly charges. If users are prepared to give up their desk sets and switch to an E71 or equivalent, this option can be very cost effective.

As we have rolled-out an all-wireless workplace within Aruba, we have found that some employees prefer to use a desk phone while working in the office, but a cell phone-like device while roaming. A desk phone provides a large, easily-read display of calling name/number, one-finger dialing won’t push the phone across the desk, the handset can be cradled on the shoulder, and there’s typically a speakerphone function with good acoustics. All of these are problematic with a cell phone form factor…unless manufacturers release more docking stations with a corded handset or headset. While we introduced a number of Aruba employees to softphone applications on their PCs, most still prefer a separate device, either in deskphone or mobile phone form. Even so, we would acknowledge that softphones in general appear to be enjoying some popularity in enterprise settings.

All Aruba employees are given a Remote Access Point (RAP) device for use at home, providing direct access to the corporate servers and PBX without requiring any client software. Effectively this provides inside-the-firewall access when WPA2/802.1X is used. The RAP can be used with a dual-mode phone, or with a wired deskphone on the second Ethernet port to get PBX dial-tone while at home. This solution has proven exceptionally useful to employees and addresses 99% of the needs of remote workers for voice and data communications. It is possible to combine this approach with other FMC solutions such as extension-to-cellular to access PBX features when cellular-only coverage is available, and with full-fledged single-number solutions.

Full FMC solutions Agito, DiVitas, and others provide comprehensive single-number reach with cellular/Wi-Fi handover. But their penetration of enterprises may be gradual. Firstly, their solutions require a software client on the phone. They also require a data centre server that communicates with the PBX, to allow simultaneous call legs over Wi-Fi and cellular, with coordinated switching for handover. Further, these solutions are expensive, ranging from $100 - $400 a seat, and CIOs will have to consider how much the soft-dollar productivity benefits worth in hard cash, and if this level of functionality is considered business-critical when less expensive, slightly less capable alternatives are available?

These issues are typical of early-stage technology. While they will be addressed over time as customers field systems and report their experiences, we see them as significant obstacles to market acceptance in the near future.

When FMC in any or all its forms can deliver benefits that exceed its costs, it will succeed in penetrating the enterprise. We believe that no one FMC architecture is suitable for all applications: rather the right architecture must be selected from a palette of choices, and it is incumbent upon the wireless LAN vendor to offer a canvas on which the different colors of FMC can be rendered. This is a daunting technical challenge which only Aruba, Cisco, and possibly Motorola could hope to undertake.

In this note we have covered the range of voice over Wi-Fi and FMC solutions available in conjunction with enterprise WLANs. These range from wireless deskphones and softphones through single-mode and dual-mode cellular/Wi-Fi devices. The latter can bridge the cellular and PBX worlds in various modes, ranging from single-number cellular-only (UMA) to the converged device (but separate network) two-number solution to full seamless single-number handover with a comprehensive FMC solution.

One of the advantages of UMA in particular its simplicity. It might be a 70% solution, but the remaining 30% is so fraught with complexity that it sometimes looks ideal by comparison. We believe many enterprise users and CIOs are ready to embrace an inexpensive single-number solution even if it is not integrated with the PBX.

Pervasive wireless enterprise phone systems are inevitable: the business case for rightsizing out wired in favor or wireless solutions is too compelling. From the environmental aspect alone, eliminating wired phone cable drops, plastic wall plates, and wired desk sets represents a major opportunity to reduce an enterprise’s carbon footprint while reaping considerable monetary savings.

The means to that end is less clear. We believe there will be no “big-bang” solution to FMC, a single creation writ whole in one fell swoop. Enterprises will eventually reach the goal by taking small steps and achieving incremental improvements. UMA looks like a promising next step on the stairway - the riser is short and manageable because of the availability of robust adaptive wireless LANs, the tread deep and wide because of the prevalence of suitable handsets. The open question is how big a stretch is necessary to reach the next tread.

Wired+Wireless Don’t Connect

2009-02-06T14:54:00.000-08:00

The all-wireless workplace is wreaking havoc among cable and wiring device manufacturers, accustomed as they were to years of fast growth due to Ethernet overbuilding. The salad days are over and the stark new world is one with fewer wired ports and more wireless users. Like other businesses, cable and wiring device companies need to grow to survive. To do so they have to find new, expanding market opportunities. Were you such a manufacturer, how would you cope? Hold that thought.

The economic turmoil roiling the economy is also impacting the networking market, putting immense pressure on smaller niche players. Within the wireless world a Darwinian cleansing is in full swing. Aruba and Cisco, the two leading enterprise wireless LAN vendors, have pulled away from the pack, leaving the remaining vendors to fight for business, recognition, funding.

Where only a year ago an IPO looked like a viable exit path for many of those vendors, that door is now firmly closed. Bridge loans, where available, are anathema to existing investors who are rightfully fearful about losing alpha position to new creditors should the venture go belly up. Even venture capital partners are taking a very hard line with portfolio companies, refusing to invest new funds and telling companies to spend every dollar/yen/euro/yuan as if it were their last – because it might well be. Were you a niche wireless LAN vendor, how would you cope?

The confluence of interests between the cable and wiring device vendors – in search of a growing market but at risk of misstepping in a new field in which they are not expert – and weak wireless LAN vendors panicked for an exit strategy - makes for strange bedfellows. And poor strategy. The reason the weak wireless LAN vendors are in such poor shape is because their products / architecture / messaging / support was/were not up to snuff; something a new owner can't change that overnight or without significant investments. Instead of sliding down the drain and out of the gene pool, struggling wireless LAN vendors are being scooped up in nets trolled by cable and wiring device manufacturers that believe they’ve caught a bargain. Sadly for them, and their shareholders, the results prove otherwise.

On 16 July 2008, upon completing the acquisition of Trapeze Networks, John Stroup, Belden’s President and Chief Executive Officer, was quoted in a press release as saying:

“Belden’s strategy is to provide our customers with the world’s most reliable signal transmission solutions for mission-critical applications, encompassing wireless systems as well as optical fiber, copper cable, and related connectivity products. Mobility is a requirement among our enterprise customers, and today’s wireless technology provides the performance and security that make wireless an indispensable component of the enterprise network. The acquisition of Trapeze Networks uniquely positions Belden to address the enterprise market with a full complement of signal transmission solutions. We are eager to introduce Trapeze Networks’ technology to Belden’s enterprise customers.”

Fast forward to yesterday when Belden announced its 4th quarter and full year 2008 results, including the Trapeze wireless division they acquired on a trolling expedition. Customers just aren't buying into the wired+wireless synergy story, this despite Belden being a first class cable manufacturer. Belden's operating loss in 2008 was $342.2 million, and the net loss was $361.0 million, $8.08 per diluted share. The earnings report stated that Trapeze revenues for the 12 month period were only $13.7M, resulting in an operating loss of $54M.

The fact is that not all wireless LANs are created equal – the 30 January 2009 posting in this blog highlights that point. Acquiring companies and customers alike that compare competing solutions side-by-side, mano-a-mano, and check performance across a wide range of clients and with a range of interference sources will see the differences. Marketing literature is not a sound basis for comparison. Or acquisition.

As for wired+wireless double-play strategies, consider this. Most enterprises use Cisco wired networks at the core, but the largest enterprises use Aruba wireless LANs as an overlay. Why do they do this when Cisco offers a wired+wireless solution? Gartner analysts Mark Fabbi and Alan Mac Neela summarized it best in Exploiting the Enterprise Networking Commoditization Curve when they noted that networks are not homogeneous systems but rather building blocks. They recommend that users select the best building blocks for each element of the network – core, edge switching, wireless LAN, etc. – and resist pressure to buy a single-vendor solution. Why? Because no one single vendor excels across the range of building blocks. Aruba excels at building wireless LANs. Niche wireless LAN vendors don't, a sad lesson that Belden is learning the hard way.

So set aside the false promise of wired+wireless synergies and look instead for best-in-class building blocks. That way you'll catch the genuine article.

Wireless LAN Architecture

2009-01-30T10:53:00.000-08:00

This year is the tenth anniversary of the 802.11 Wi-Fi standard. A true success story, 802.11 has completely transformed how we access data networks. What had been a market filled with islands of proprietary wireless implementations has morphed into a community of standards-based vendors.

The "micro-cell" architecture at the heart of 802.11 blankets the coverage area with radio signals operating at different channels, like a colorful patchwork quilt. As Wi-Fi clients - laptops, smart phones, PDAs, barcode scanners - roam, they maintain connection with the network by moving between adjacent cells. This architecture was modeled after the overwhelmingly successful micro cell architecture employed universally throughout the cellular industry.

Standards-based Wi-Fi clients have a well defined set of characteristics, allowing them to properly associate and interoperate with standards-based Wi-Fi infrastructure. Interoperability can be validated by independent, third-party testing organizations - such as the Wi-Fi Alliance - providing end users with peace of mind that products work as expected. Component vendors - such as Wi-Fi radio IC manufacturers - can produce a common set of part in high volume, driving down the cost to users.

That is not to say that all Wi-Fi networks are identical. There are very significant throughput, security, ease-of-use, scalability, and life-cycle cost differences between solutions from different vendors. Adaptive Wi-Fi solutions - ones that optimize performance automatically as the RF environment changes - offer significant advantages over less capable non-adaptive networks, for instance. However, even these different solutions all start from a standards-based Wi-Fi micro cell architecture. Client interoperability is a given.

Not so with the handful of vendors that have bucked the standards trend and opted to deliver proprietary Wi-Fi networks. The most egregious example is the so-called single channel architecture. Instead of making the best use of all available Wi-Fi channels, the single channel architecture operates all of the clients and infrastructure on a single channel. The argument is that doing so allows clients to be switched instantaneously by a central controller between radios covering adjacent areas as the client roams. This is stated to be especially important for voice communications, where a fast transfer improves the user experience, and cellular networks are held up as an existence proof of this assertion.

What goes unstated is that cellular networks migrated to a micro cell architecture because they could not otherwise scale network size. The coverage and fast switching "issues" cited by single channel vendors actually aren't issues at all - they've all been solved by adaptive micro cell networks.

Worse yet, by forging a proprietary solution the single channel vendors have gone against the tide with regard to client interoperability. Wi-Fi clients expect to move between cells operating on different channels, and many operate erratically when they hear multiple signals from different radios on the same channel. For example, the Frances Xavier Warde School noted that their single channel network was unable to work with Intel-based clients (http://www.arubanetworks.com/company/news/release.php?id=142), a horrific situation given the prevalence of these devices.

The other issue with single channel architectures is the inability of independent analysts to understand the limits and integrity of underlying architecture. The vendors hold close-to-the-vest the "secret sauce" that makes these networks function, and the revisions they make to add features over time.

A case in point. One single channel vendor offers two completely different ways of broadcasting the identity of radios with which the clients associate, one called shared bssid and the other per-station bssid. Shared bssid broadcasts the same radio name from all radios, a characteristic that in part is responsible for confusing Intel clients. Per-station bssid sends a different name from each radio on a client-by-client basis, putting considerable burden on the controller that has to track all of the name/client associations. Per-station bssid and shared bssid scale differently, work only with select radios within the vendor’s product line, and have very different performance limitations.

It seems inappropriate to ask a customer to understand the ramifications of these different approaches. Especially when adaptive micro cell architecture doesn't so burden the customer and offers superior performance.

As we celebrate the 10 year anniversary of the 802.11 Wi-Fi standard, and watch as the adoption of adaptive micro cell Wi-Fi networks grows apace, one can only wonder why anyone would choose a proprietary alternative. Does anyone remember the Wang word processor? There's a reason why it disappeared from the landscape, and no doubt it's only a matter of time - perhaps a very short time - before the same fate meets the single channel architecture.

Welcome to the Green Island News

2009-01-29T17:50:00.000-08:00

We are today witnessing the coalescence of multiple technology breakthroughs into products that herald a fundamental shift in where and how we work:

* High-speed 802.11n wireless LANs and portable computing platforms make it feasible to deploy an all-wireless workplace free from the constraints of wired Ethernet access ports;

* Multi-core processors and hardware-based encryption accelerators make possible high-throughout wireless LAN access points and controllers capable of handling the volumes of encrypted traffic, and the wide range of applications, expected in an all-wireless workplace;

* Energy efficient semiconductors and power supplies make possible products that perform more functions but consume less energy than previous alternatives;

* Infrastructure-based controls and Quality of Service can deliver the reliability and determinism required by a broad range of applications, from computer connectivity to telephony and streaming video;

* Identity-based security with central encryption, strong authentication, and access control policies enable roaming users to be correctly identified, regardless of where or how they access the network, thereby enhancing mobility in ways not possible using legacy security mechanisms.

What lies before us is a workplace in which users have greater mobility to choose where they work, copper cabling takes a backseat to Wi-Fi as the primary access method, and information technology (IT) infrastructure does more but uses less power. “All-wireless” as used in this context is a metaphor for a workplace that affords secure mobility to its users. That workplace could be in a traditional office or campus, at home, or on the road.

Our newfound mobility will have profound environmental, economic, human, and social effects. Sustainability (in terms of energy and resource consumption), user efficiency and productivity, space/architectural/urban planning, and the total cost of network/facility ownership will all be impacted. Additionally, unfettered mobility will result in a wide range of new applications and jobs - perhaps even whole new categories of employment - not previously anticipated or conceivable.

The objective of The Green Island News is to discuss the technology and companies behind this sea change, and to explore the micro- through macro-level impact of the all-wireless workplace. The scope is very broad, the topics very wide. The perspective will be one of an industry insider looking outwards, and hopefully will cast a different light on the subject than one finds in the popular press.

If you're interested in research on Green Island-related topics, please consider participation in The Green Island Project. For details please see www.arubanetworks.com/company/green_island.php.