ACMA Day2 Ver2.2

Download as pdf or txt
Download as pdf or txt
You are on page 1of 263

Aerohive Networks

ACMA

Part II
HiveManager Advanced Topics

1 | © 2018 Aerohive Networks. All Rights Reserved.


WLAN DESIGN

2 | © 2018 Aerohive Networks. All Rights Reserved.


Coverage Design

•Primary coverage goals are:


• High data connectivity
• Roaming

•Coverage goals are accomplished via:


• High data rates: Strong received signals
• High data rates: High SNR
• Roaming: Primary and secondary coverage

3 | © 2018 Aerohive Networks. All Rights Reserved.


dBm and mW conversions
dBm milliwatts

+30 dBm 1000 mW 1 Watt


1/10th of 1 Watt
+20 dBm 100 mW 1/100th of 1 Watt
+10 dBm 10 mW 1/1,000th of 1 Watt
0 dBm 1 mW 1/10th of 1 milliwatt
–10 dBm .1 mW 1/100th of 1 milliwatt
–20 dBm .01 mW 1/1,000th of 1 milliwatt
–30 dBm .001 mW 1/10,000th of 1 milliwatt
1/100,000th of 1 milliwatt
§ Very Strong –40 dBm .0001 mW 1 millionth of 1 milliwatt
§ Great –50 dBm .00001 mW 1 ten-millionth of 1 milliwatt
§ Weak –60 dBm .000001 mW 1 hundred-millionth of 1 milliwatt
–70 dBm .0000001 mW 1 billionth of 1 milliwatt
§ Do not care
–80 dBm .00000001 mW Noise Floor
§ No Signal –90 dBm .000000001 mW
–95 dBm .0000000002511 mW
4 | © 2018 Aerohive Networks. All Rights Reserved.
Notes Below
Coverage recommendations

• -70 dBm: high data rate connectivity

• -65 dBm: Voice over Wi-Fi

5 | © 2018 Aerohive Networks. All Rights Reserved.


Receiver Sensitivity

Data Rate Receive


(2.4 GHz) Sensitivity

1 Mbps -101 dBm

6 Mbps -91 dBm

MCS 0 -90 dBm


54 Mbps 36 Mbps 18 Mbps 6 Mbps

11 Mbps -89 dBm

24 Mbps -87 dBm

54 Mbps -79 dBm

MCS 7 -77 dBm

• Minimum signal strength at which a MCS 15 -75 dBm

data rate can be achieved MCS 23 -74 dBm

6 | © 2018 Aerohive Networks. All Rights Reserved.


Receiver Sensitivity

• Strong received
signal and high
SNR needed to get
the higher data
rates
54 Mbps 36 Mbps 18 Mbps 6 Mbps

• Receive sensitivity
of client and APs
radios varies
between vendors
and chipsets
7 | © 2018 Aerohive Networks. All Rights Reserved.
Dynamic Rate Shifting

• Mobility can cause


shifts in data rates
• Weaker signal and
54 Mbps 36 Mbps18 Mbps 6 Mbps
lower SNR results in
lower data rates
• APs and client radios
upshift and downshift
data rates based on
Warning: Low data rates consume airtime receive sensitivity
thresholds
8 | © 2018 Aerohive Networks. All Rights Reserved.
Layer 2 Retransmissions

Transmitting radio sends a unicast frame

CRC passes

Receiver radio sends L2 ACK frame

9 | © 2018 Aerohive Networks. All Rights Reserved.


Layer 2 Retransmissions

Transmitting radio sends a unicast frame

CRC fails
No ACK frame sent by receiver

Transmitting radio sends L2 retransmission

10 | © 2018 Aerohive Networks. All Rights Reserved.


Layer 2 Retransmissions - Cause

CRC fails

• RF interference (Layer 1)
• Low SNR (Layer 1) (bad design)

11 | © 2018 Aerohive Networks. All Rights Reserved.


Layer 2 Retransmissions - Effect

• Throughput goes down

• Latency goes up

12 | © 2018 Aerohive Networks. All Rights Reserved.


Signal-to-Noise Ratio (SNR)

Received signal = -70 dBm

Received signal = -88 dBm

SNR = 25 dB
SNR = 7 dB

Ambient noise floor = - 95 dBm


13 | © 2018 Aerohive Networks. All Rights Reserved.
Signal-to-Noise Ratio (SNR)

• High SNR needed to


prevent L2
retransmissions
• Radios will use
modulation and
coding schemes (MCS)
that produce higher
data rates

14 | © 2018 Aerohive Networks. All Rights Reserved.


SNR Recommendations

• 20 dB or greater

• 25 dB or greater for
voice-grade networks

• 32 dB or greater to use
256 QAM modulation

15 | © 2018 Aerohive Networks. All Rights Reserved.


Roaming

BSSID #1 BSSID #2

• Primary Coverage: -70 dBm


AP #1 AP #2

• Secondary coverage: -75 dBm


Roaming client station

• Clients make the roaming decision


16 | © 2018 Aerohive Networks. All Rights Reserved.
Data Rates versus Throughput

• Data rate is not TCP throughput


• Medium contention protocol of CSMA/CA
consumes much of the available bandwidth
• Aggregate TCP throughput in a legacy a/b/g
environment is 40% – 50% of data rate
• Aggregate TCP throughput in an 802.11n/ac
environment is 60% – 70% of data rate

17 | © 2018 Aerohive Networks. All Rights Reserved.


Capacity Design – Age Old Question

• How many clients per AP?


• It depends

• What type of applications


• How many clients
• What type of clients

18 | © 2018 Aerohive Networks. All Rights Reserved.


Capacity Design - Applications

Application Required Throughput


Email/Web browsing 500 Kbps – 1 Mbps

Printing 1 Mbps

SD video streaming 1 Mbps – 1.5 Mbps

HD video streaming 2 Mbps – 5 Mbps

19 | © 2018 Aerohive Networks. All Rights Reserved.


Capacity Design – Client Capabilities

• Not all clients are created equal

• Laptops are usually equipped


3x3:3 MIMO radios

• Mobile devices that are 1x1:1


consume much more airtime

20 | © 2018 Aerohive Networks. All Rights Reserved.


Client Capabilities - Example

client Example data rate


1x1:1 802.11n 65 Mbps
1x1:1 802.11ac 78 Mbps
2x2:2 802.11n 130 Mbps
2x2:2 802.11ac 156 Mbps
3x3:3 802.11n 195 Mbps
3x3:3 802.11ac 260 Mbps

• Mobile devices with lesser capability consume


more airtime
21 | © 2018 Aerohive Networks. All Rights Reserved.
Airtime Consumption

• RF is a half-duplex medium

• At any given time only one


radio can transmit on a
frequency domain
(channel)

• Everybody takes turns

22 | © 2018 Aerohive Networks. All Rights Reserved.


Airtime Consumption – Multiple SSIDs

Beacon: SSID #1
• Multiple SSIDs create
Beacon: SSID #2
more layer two 802.11
management
Beacon: SSID #3 overhead
Beacon: SSID #4 • Extra set of beacons,
probe responses, etc…
Beacon: SSID #5 consume airtime
Beacon: SSID #6

Beacon: SSID #7
23 | © 2018 Aerohive Networks. All Rights Reserved.
User Profiles – Assignment Rules

• Consolidate SSIDs
• Multiple User Profiles can be linked to a single SSID
• Different groups of users connected to the same SSID
can be assigned different access control rules
• The result is that different VLANs, firewall policies,
rate-limiting policies, etc can be assigned to different
groups of users

24 | © 2018 Aerohive Networks. All Rights Reserved.


User Profiles – Assignment Rules

• User profile assignment rules


can be defined for a single
SSID
• Depending on the WLAN
security, rules can be based
on:
• RADIUS attributes
• PPSK User groups
• Client OS type
• Client MAC address
• Client Location
• Schedule

25 | © 2018 Aerohive Networks. All Rights Reserved.


Airtime Consumption – 2.4 GHz data rates

• Disabling lower data rates


reduces airtime consumption
and normally increases
performance
• Basic = 24
12 Mbps
• Disabled: 11 Mbps (
Legacy 802.11b clients will
not be able to connect)
• Disabled: 6,
6 Mbps
9, 12 and
and 9
18
Mbps
Mbps
OFDM
OFDM rates
rates

Default rates: Basic = 11 Mbps


26 | © 2018 Aerohive Networks. All Rights Reserved.
Airtime Consumption– 5 GHz data rates

• Disabling lower data rates


reduces airtime consumption
and normally increases
performance
12 Mbps
• Basic = 24 and 24only
Mbps
6 Mbps
• Disabled: 6, and 9
9 ,12 and
Mbps
18 OFDM
Mbps OFDM rates
rates

Default rates: Basic = 6, 12, and 24 Mbps


27 | © 2018 Aerohive Networks. All Rights Reserved.
Channel Reuse

Channel 1
• Co-channel
interference
(CCI) Channel 1

• APs consume
each other
airtime
Channel 1

Channel 1

28 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Reuse

Channel 11
• Primary goal of
channel reuse
patterns is to Channel 1
prevent co-channel
interference
• Reduces airtime
consumption by
Channel 1
isolating frequency
domains (channels) Channel 6

29 | © 2018 Aerohive Networks. All Rights Reserved.


Co-Channel Interference

Channel 11
• Does RF just
stop?
Channel 1
• Almost
impossible to
prevent CCI
at 2.4 GHz
Channel 1

Channel 6

30 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Reuse

Channel 11
• CCI is not static and
always changing
Channel 1
• Client transmissions
cause CCI

Channel 1

Channel 6

31 | © 2018 Aerohive Networks. All Rights Reserved.


5 GHz channel re-use scheme
5.15 5.25 5.35 5.47 5.725

120

128
132
136
112
100
104
108

140
124
116
44

64
36
40

48
52
56
60

U-NII-1 U-NII-2A U-NII-2C

100 52 108 132 60 124 56 120 48 128

36
116 140 40 104 64
44 136 112 36

32 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Bonding

client 20 40 80 MHz
MHz MHz
1x1:1 78 162
802.11ac Mbps Mbps
2x2:2 156 324 702 Mbps
802.11ac Mbps Mbps
3x3:3 260 540 1170
802.11ac Mbps Mbps Mbps
• More frequency space
provides higher data rates
33 | © 2018 Aerohive Networks. All Rights Reserved.
Channel Bonding

• Bonding results in +3 dB
increase of noise floor
• Lower modulation data
rates will be used
• Increase odds of CCI
• Degrades performance

34 | © 2018 Aerohive Networks. All Rights Reserved.


40 MHz Channels - Europe

46
• Two channel 40 MHz
reuse
38 46
• Results in CCI
38

44
36
40

48
46 38 20 MHz

46 38 46 40 MHz
38 38
46

35 | © 2018 Aerohive Networks. All Rights Reserved.


40 MHz Channels - Europe

134
• Nine channel 40 MHz reuse
38 118
• Decreased possibility of CCI
102

153
149

157
161

120

128
132
136
112
100
104
108

140
124
116
44
36
40

48
151 38
46 38 46 151 159 102 110 118 126 134

126 159
110

36 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Bonding Best Practices

• Only use 40 MHz if DFS


channels available
• Only use with thick walls
• Might not use in multiple
floors
• 80 MHz does not scale in
the enterprise
• Do not mix 40MHz and
20MHz
37 | © 2018 Aerohive Networks. All Rights Reserved.
Low Power is Good
High Transmit Power

• Capacity Problems
• Increase CCI
• Hidden Node
• Mismatch power
between clients and AP
• Roaming – Sticky
problems
• Turn down the power!
38 | © 2018 Aerohive Networks. All Rights Reserved.
39

Device Specific Settings – TPC

• Aerohive APs (6.6r1 or higher) support Transmit Power Control (TPC)


• Clients that also support TPC can adjust their power to match the AP transmit
power
• Helps reduce contention interference caused by clients

Warning: Some legacy clients


may have connectivity issues
when TPC is enabled

39 | © 2018 Aerohive Networks. All Rights Reserved.


Use the Environment

• Wall attenuation is good


• Reduces CCI
• Maximizes channel reuse
Concrete poured

Concrete block

• Isolates contention domain


Drywall
Brick

40 | © 2018 Aerohive Networks. All Rights Reserved.


Use the Environment

• Wall attenuation is good


• Reduces CCI
• Maximizes channel reuse
• Isolates contention domain
41 | © 2018 Aerohive Networks. All Rights Reserved.
Avoid Mounting APs in Hallways

• Mounting APs in hallways is a common mistake


• Does not provide adequate coverage for rooms
• CCI and airtime consumption nightmare

42 | © 2018 Aerohive Networks. All Rights Reserved.


One AP per room

• One AP per room may be needed for capacity

• 5 GHz can be achieved with proper channel


reuse and power levels
43 | © 2018 Aerohive Networks. All Rights Reserved.
One AP per room design

• Walls must be VERY thick - concrete, brick, etc.


• 5 GHz radios power level 9 dBm (8 mw) or lower
• No channel bonding – 20 MHz channels only
44 | © 2018 Aerohive Networks. All Rights Reserved.
One AP per room

• 2.4 GHz radios will all interfere with each other


• Disable two out of every three 2.4 GHz radios
• Power levels of 0 dBm – 6 dBm (1mw – 4 mw)
45 | © 2018 Aerohive Networks. All Rights Reserved.
One AP per room

• Even then CCI still may occur in 2.4 GHz

46 | © 2018 Aerohive Networks. All Rights Reserved.


One AP per room design – Dual 5 GHz?

• Fixed 5 GHz radios


• Disable two out of every three 2.4 GHz radios?
• Instead convert two out of every three of the
adjustable radios to 5 GHz
47 | © 2018 Aerohive Networks. All Rights Reserved.
Dual 5 GHz design guidelines

• DFS channels will need to be enabled

• When possible, pair non-DFS channels with DFS channels (This


ensures connectively for clients that do not support DFS)

48 | © 2018 Aerohive Networks. All Rights Reserved.


Dual 5 GHz design guidelines

In the USA there are eight non-DFS channels. Example


pairings of non-DFS channels with DFS channels (This
ensures connectively for clients that do not support DFS)
AP250 Channel Pairing AP250 Channel Pairing

AP #1 36/100 AP #5 149/116
AP #2 40/104 AP #6 153/132
AP #3 44/108 AP #7 157/136
AP #4 48/112 AP #8 161/140

49 | © 2018 Aerohive Networks. All Rights Reserved.


Dual 5 GHz design guidelines

In Europe, there are only four non-DFS channels. If multiple


dual 5 GHz APs are deployed it will be necessary to also
pair DFS channels

AP250 Channel Pairing AP250 Channel Pairing

AP #1 36/116 AP #5 100/140
AP #2 40/120 AP #6 104/136
AP #3 44/124 AP #7 108/132
AP #4 48/100 AP #8 112/128

50 | © 2018 Aerohive Networks. All Rights Reserved.


RADIO PROFILES

51 | © 2018 Aerohive Networks. All Rights Reserved.


Login to HiveManager NG
Students login

• Using Chrome, browse to the HiveManager


Virtual Appliance instance for your class

(the URL is supplied by the instructor)

• Everyone in class will use the same


Hivemanager!

• Login with credentials supplied by instructor:

Admin: [email protected]
Password: Aerohive123

52 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Radio Profile
1. Create a New Radio Profile for 2.4 GHz Radio

§Configure >
Common Objects
• On the left
navigation, select
Radio Profiles

• Click to
create a new
radio profile
53 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Radio Profiles
2. Set Name and Radio Mode

•Name: 2.4GHz-X

•Click and drag the


slider bar until the
display window
reads g/n

54 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Radio Profiles
3. Configure Tx power and Maximum Clients

• Maximum Transmit Power: 15 dBm

• Maximum Number of Clients: 55

55 | © 2018 Aerohive Networks. All Rights Reserved.


Background Scan

• APs perform background scans every 10 minutes to


evaluate the RF environment and for WIPS

56 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Selection – Limit Channel Selection

§ Allows for limiting the channel selection to non-overlapping


channels.ACSP

57 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Selection – Dynamic Switching

§ APs select channels automatically at boot-up using ACSP


§ APs can dynamically change channels later based on a CRC
threshold
58 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Radio Profiles
4. Optimizing Radio Usage – Enable Band Steering

• Turn on Band Steering


• Band Steering Mode: Encourage 5.0 GHz band usage

59 | © 2018 Aerohive Networks. All Rights Reserved.


Band Steering
© Aerohive Networks, Proprietary & Confidential

• Balance band use: Clients can be steered to either band. Allocate a 50/50
mix to balance the clients between the bands.
• Encourage 5 GHz band use: Most clients will go, but if they insist on 2.4, let
them stay.
• Enforce 5 GHz band use: If a client supports 5 GHz
60 | © 2018 Aerohive Networks. All Rights Reserved.
Band Steering Animation

2.4GHz Client 2.4GHz & 5GHz Client 2.4GHz & 5GHz Client
(Out of Range of 5GHz) (In of Range of 5GHz)

Connected at 2.4GHz & 2.4GHz & Connected5GHz


at
2.4GHz 2.4GHz Connected at
5GHz 2.4GHz &
2.4GHz 5GHz 5GHzResponse
Probe Response 5GHz 2.4GHz
Response 5GHz
Response
Probe Probe

61 | © 2018 Aerohive Networks. All Rights Reserved.


62

Lab: Radio Profiles


5. Optimizing Radio Usage – Client Load Balancing

• Turn on Client Load Balancing Note: When using client load


balancing, the same type of load-
• Select ž Number of Clients balancing mode must be selected
on both radios since this is an AP
function vs. an individual radio.
62 | © 2018 Aerohive Networks. All Rights Reserved.
Load Balancing Animation

3 clients
21 clients 6 clients
21 clients 60 clients
24 21 clients

63 | © 2018 Aerohive Networks. All Rights Reserved.


63
Load Balancing

• WARNING: If roaming is a requirement, Load Balancing


should NEVER be used.

• Load Balancing should only be used in very high density


networks: E.g. gym, auditorium, large lecture hall.

• Load Balancing is often beneficial in very high density


deployments where all the APs are deployed in the
same open area.
64 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Radio Profiles
6. Optimizing Radio Usage – Radio Settings

• Verify þ Enable
short guard
interval

• Click to
save your 2.4
GHz Radio Profile

Note: The SGI yields a 10% increase in performance


with 802.11n and 802.11ac clients. Do not use SGI in
very high multipath environments
65 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Radio Profile
7. Create a New Radio Profile for 5 GHz Radio

§Configure >
Common Objects
• On the left
navigation, select
Radio Profiles

• Click to
create a new
radio profile
66 | © 2018 Aerohive Networks. All Rights Reserved.
67

Lab: Radio Profiles


8. Name 5 GHz Radio Profile

• Name: 5GHz-X
• Select ac

§Click and
drag the slider
bar until the
display window
reads ac
67 | © 2018 Aerohive Networks. All Rights Reserved.
5 GHz Channels
5.15 5.25 5.35 5.47 5.725 5.825 5.925

5.85

120

128
132
136

153
112

144
100
104
108

140

149

165
169
124

181
116

157

173
161

177
84
44

64
36
40

48
52
56
60

68
72

80

88
92
96
76
U-NII-1 U-NII-2A U-NII-2B U-NII-2C U-NII-3 U-NII-4
38 46 54 62 70 78 86 94 102 110 118 126 134 142 151 159 167 175

42 58 74 90 106 122 138 155 171

50 82 114 163

Dynamic Frequency Selection


68 | © 2018 Aerohive Networks. All Rights Reserved.
5 GHz Channels

• 20 MHz channels should normally be used

• 40 MHz channels can sometimes be used if the


dynamic frequency selection (DFS) channels are
enabled

• Never use channel bonding in very high density


environments

69 | © 2018 Aerohive Networks. All Rights Reserved.


Channel Width – 802.11ac

§80 MHz wide channels should only be used as a SOHO


solution; never in an enterprise where high capacity
coverage is a goal

§For high capacity, select 20 MHz (or 40 MHz at most)

70 | © 2018 Aerohive Networks. All Rights Reserved.


Default 80 MHz Channel Width – 802.11ac

§This option allows the APs to remember its channel and


power selections during a reboot. This decreases the time
required for APs to return to serving client traffic. APs can
still be configured to recalculate channel and power
settings dynamically at regular intervals and based upon
CRC thresholds.
71 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Radio Profiles
9. Channel Width and DFS

• Set Channel Width to 20 MHz

• Turn on Dynamic Frequency Selection

72 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Radio Profiles
10. Optimizing Radio Usage – Client Load Balancing

Note: If you choose to use


load balancing, it must be
enabled on both bands
and the same type of load
balancing should be
selected.

• Turn on Client Load Balancing

• Select ž Number of Clients


73 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Radio Profiles
11. Optimizing Radio Usage – Radio Settings

• Check þ Enable
short guard
interval

• Click to
save your 5 GHz
Radio Profile

Note: The SGI yields a 10% increase in performance


with 802.11n and 802.11ac clients. Do not use SGI in
very high multipath environments
74 | © 2018 Aerohive Networks. All Rights Reserved.
SDR Radio Profile

SDR offers dynamic WIFI0 = 5


OFF
2.4 GHz
GHz
ACSP (Automatic
Channel Selection
Protocol) scanning. WIFI1 = 5 GHz

For dual-5 GHz APs, SDR automatically scans and selects either a 2.4 or a
5 GHz profile that will provide the best coverage. If the current coverage is
determined to be acceptable, SDR will not make any changes. For devices
that do not support dual-5 GHz radios, SDR scans and automatically shuts
down 2.4 GHz radios when they are not required for good coverage.

75 | © 2018 Aerohive Networks. All Rights Reserved.


SDR Radio Profile

§Initial ACSP Process

WiFi0: 2.4GHz
WiFi1: 5Ghz RF Redundancy NO
ACSP SDR Above WiFi0 stays on
Channels are Detection 2.4GHz
STARTS STARTS threshold?
assigned to both Algorithm
radios

YES

Final channels and Power Selection


Assign WiFi0 to Ensure channel
Tx-Powers are Both WiFi0 and
5GHz separation
assigned Wifi1

ACSP-SDR
COMPLETES

76 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Radio Profile
12. Create a New Radio Profile for Software Defined Radio SDR

§Configure >
Common Objects
• On the left
navigation, select
SDR Radio Profiles

• Click to
create a new
radio profile
77 | © 2018 Aerohive Networks. All Rights Reserved.
78

Lab: Radio Profiles


13. Name SDR Radio Profile
• Name: SDR-X

• Do not save yet

Note: Radio Profile Candidates are for dual 5 GHz APs, select a radio
profile for 2.4 GHz and 5 GHz. This selection is not required for non-
dual-5 GHz APs.

78 | © 2018 Aerohive Networks. All Rights Reserved.


79

Lab: Radio Profiles


14. Configure SDR Schedule

You can customize the time(s)


that the AP will reconfigure its
SDR settings.
• Enable SDR during a
scheduled time range
§Time range: 1:00AM
to 4:00AM
§Click to save
your SDR Radio Profile

79 | © 2018 Aerohive Networks. All Rights Reserved.


DFS return and Zero Wait DFS

•After a DFS event, you


can now choose to
have an AP return to its
previously assigned
static DFS channel.

•AP can use one radio


to scan DFS channel
after DFS event to
expedite return to DFS
channel (certain
models only)
80 | © 2018 Aerohive Networks. All Rights Reserved.
Zero Wait DFS - example

Start Finish
Start

81 | © 2018 Aerohive Networks. All Rights Reserved.


Smart Antenna

•Dynamic Polarization
Switching changes

•Change polarization
based on client(s)

•Adjust polarization to
provide best polarization
for client device

•RSSI and SNR increase

82 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Radio Profiles
15. Summary

§Note: We are not assigning the radio


profiles to the APs in class

• A radio profile can be assigned to


numerous APs via multi-select

• We discuss assigning radio profiles in


the next module, Device Specific
Settings

83 | © 2018 Aerohive Networks. All Rights Reserved.


DEVICE SPECIFIC SETTINGS

84 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings - APs

• Device specific settings can be configured for individual APs


• From Monitor > Devices click the Host Name of the device
• The Device monitoring details window will appear

85 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings - APs

• Select Configuration
> Device
Configuration
• Configurable settings
unique to this one AP
are available

86 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – Network Policy

• Host name: APs must have a unique


host name

• Network Policy: A different network


policy can be assigned via the drop-
down box

87 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – Mgt0 Interface

• By default, the management


interface (mgt0) of the AP will
receive an IP address via DHCP
• The AP can be configured for a
fallback address if the mgt0
interface does not receive a DHCP
offer
• The mgt0 interface can also be
configured with a static IP address

88 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – Mgt0 VLAN

• The Management VLAN and Native VLAN for the mgt0


interface can be defined for the AP

• The VLAN settings override the management and native


VLAN configured in the Network Policy
89 | © 2018 Aerohive Networks. All Rights Reserved.
Device Specific Settings – Radio Interface

• Select Configuration >


Interface Settings

• The APs radio and Ethernet


interfaces can be
configured

90 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – Radio Profile

• Radio interfaces can be


further defined

• Toggle between the 2.4


GHz and 5 GHz radio tabs

• Radio Profile: Select a pre-


defined radio profile

91 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings - Radio Usage

§Radio Usage options:


• þ Client Access is the default
setting that allows Wi-Fi client
connectivity
• þ Backhaul Mesh Link* enables
the radio to function as either a
mesh point or mesh portal
• þ Selecting both allows for
mesh and client connectivity at
the same time

92 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings - Radio Usage

• Select þ Sensor (for Presence) and the radio will function as a full-time sensor for
Presence Analytics or WIPS
• Note: Must also enable Presence Server settings in the Radio Profile

93 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings - Static Channels

• Radio interfaces can be


assigned a static channel
• Channel: From the drop-
down box, select a static
channel

94 | © 2018 Aerohive Networks. All Rights Reserved.


Exclude Channels from Auto Selection

• Any channel can be excluded from a dynamic channel plan.


• Requires HiveOS 6.6r1 or higher
• By default, US firmware uses channel channel 165 within dynamic auto-selection channel plan.
• Many devices do not support channel 165 and it can now be excluded.
• Channels 149 and 153 might be other 5 GHz channels to exclude to avoid interference with Apple TVs
using AirPlay:
§ http://help.apple.com/deployment/ios/#/apd8fc751f59

95 | © 2018 Aerohive Networks. All Rights Reserved.


Exclude Channels from Auto-Selection

• Exclude channels
from auto-selection
are off by default in
device specific
settings

96 | © 2018 Aerohive Networks. All Rights Reserved.


Exclude Channels

• Exclude Channels On
• þ Select the channels
to be excluded from
the dynamic channel
plan
• Example: þ 149 þ 153

97 | © 2018 Aerohive Networks. All Rights Reserved.


Transmission Power Floor

• Transmission power floor and maxdrop commands were added in 6.6r1


HiveOS to lower the power floor.
• These commands are configurable in AP radio interface settings

98 | © 2018 Aerohive Networks. All Rights Reserved.


Transmission Power Floor Commands

• The Aerohive dynamic RF protocol: Automatic Channel Selection


Protocol (ACSP) by default, will only lower the transmission power
of the AP radios to 11 dBm
• Transmission Power Floor
Sets the minimum transmit power for automatic adjustment
Default: 5 dBm; Range: 2-20 dBm
• Transmission MaxDrop
Sets the maximum drop in transmit power
Default: 5 dBm; Range: 0-20 dBm

99 | © 2018 Aerohive Networks. All Rights Reserved.


Transmission Power Floor

• Select either 2.4 GHz or


5 GHz radio
• Use the slider bar to
adjust the Transmission
Power Floor
• Use the slider bar to
adjust the Transmission
Maxdrop

100 | © 2018 Aerohive Networks. All Rights Reserved.


101
Device Specific Settings – Static Power

§Transmission Power
• Select ⦿ Manual
• Use the slider bar to set a static transmit power level for the
radio

101 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – TPC

• Aerohive APs (6.6r1 or higher) support Transmit Power Control (TPC)


• Clients that also support TPC can adjust their power to match the AP transmit
power
• Helps reduce contention interference caused by clients

102 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – TPC

• Select either 2.4 GHz


or 5 GHz radio

• Select þ Enable client


transmission power
control

• ¤ Auto sets the client


transmit power to
match the AP
Note: TPC 802.11h must also be supported by transmit power
the client devices

103 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – SSIDS

§ SSIDs can be enabled or disabled at the individual radio level


! Click OFF
! Click ON

§ SSIDs can also be enabled or disabled globally for all AP radios in the SSID profile settings in a
Network Policy

104 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – Wired Interfaces

§ Ethernet interfaces can be also be enabled or disabled


§ VLAN settings of the Network Policy can be overridden
§ Transmission Type and Speed normally should be selected automatically

105 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – Credentials

§You have the option to


assign every device
unique CLI login
credentials:
• Click Device Credentials
• Enter and confirm
password for the Root
Administrator
• You can also create a
CLI password for a Read
Only Administrator
• Passwords that are
created are unique to
this one device
106 | © 2018 Aerohive Networks. All Rights Reserved.
Device Specific Settings – Credentials

§You have the option to


statically assign CAPWAP
server addresses
• Click Device Credentials
• Primary CAPWAP Server:
Enter the IP address or
host name
• Secondary CAPWAP
Server: Enter the IP
address or host name

*Useful for on-premises NG servers


107 | © 2018 Aerohive Networks. All Rights Reserved.
Device Specific Settings AP250 & AP550

• WiFi0 interface is a
software-definable
radio that can transmit
on either the 2.4 GHz or
5 GHz bands

108 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings AP250 & AP550

• Select the WiFi0 tab

• Operating Mode: From


the drop-down, select
5 GHz

• Select a static 5 GHz


channel or allow the
AP to automatically
assign its channels

109 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings AP250 & AP550

• Select the 5 GHz Radio


tab

• Select a static 5 GHz


channel

• Important: When using


both 5 GHz radios, the
channels must have at
least 3 x channel width
of frequency separation

110 | © 2018 Aerohive Networks. All Rights Reserved.


Dual 5 GHz design guidelines

• 20MHz channels need 60MHz of


separation
• 40MHz channels need 120MHz of
separation

• Important: When using both 5 GHz radios, only use 20 MHz


channels. Never use 40 MHz or 80 MHz channels.

• Important: When assigning static channels, select channels


that are 3 x channel width apart.

111 | © 2018 Aerohive Networks. All Rights Reserved.


Dual 5 GHz design guidelines

§Consider the type of 5 GHz channel planning that might be needed if you have
multiple dual 5 GHz APs deployed throughout an entire building:

• DFS channels will need to be enabled

• Pair non-DFS channels with DFS channels (This ensures connectively for
clients that do not support DFS)

112 | © 2018 Aerohive Networks. All Rights Reserved.


Dual 5 GHz design guidelines

Example pairings of non-DFS channels with DFS channels


(This ensures connectively for clients that do not support
DFS)
AP250 Channel Pairing AP250 Channel Pairing

AP #1 36/100 AP #5 149/116
AP #2 40/104 AP #6 153/132
AP #3 44/108 AP #7 157/136
AP #4 48/112 AP #8 161/140

113 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – AP Multi-select

§Some device specific settings can


be configured for multiple APs using
muti-select:

• Select þ Multiple APs

114 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – AP Multi-select

• A network policy can be assigned to multiple APs


• Select policy from the drop-down box

115 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – AP Multi-select

• Radio profiles can be assigned to multiple APs using multi-select


• Radio Usage can be assigned to multiple APs using multi-select

116 | © 2018 Aerohive Networks. All Rights Reserved.


Device Specific Settings – AP Multi-select

• Device CLI credentials can be


assigned to multiple APs using
multi-select
• Static CAPWAP server addresses
can be assigned to multiple APs
using multi-select
• Shared-Key for CAPWAP
authentication between APs and
HiveManager NG can be assigned
via multi-select

*Useful for on-premises HiveManager


servers
117 | © 2018 Aerohive Networks. All Rights Reserved.
Device Specific Settings - Mesh

• Select Interface Settings


• Select the 5 GHz Radio tab
• Deselect No Change
118 | © 2018 Aerohive Networks. All Rights Reserved.
Device Specific Settings - Mesh

• Select þ Client Access


• Select þ Backhaul Mesh
• Click
119 | © 2018 Aerohive Networks. All Rights Reserved.
Mesh

Wireless user traffic can be routed to the


wired network via a mesh backhaul, reducing
installation cost and providing fault tolerance.

120 | © 2018 Aerohive Networks. All Rights Reserved.


Mesh

§ By default, if each Aerohive AP is an access portal (Ethernet connected) it selects a


different channel for its mesh/access interface so that more bandwidth is available for
clients

121 | © 2018 Aerohive Networks. All Rights Reserved.


Mesh

§ The channel map shows two Aerohive APs using channel 153 and two Aerohive APs
using 161 which provides double the bandwidth of a single channel mesh solution

122 | © 2018 Aerohive Networks. All Rights Reserved.


DEVICE CLASSIFICATION

123 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Maps

• Objects can be assigned by


classification

• Devices such as APs must be


linked to topology maps

124 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification - VLANs

§ VLAN objects support device classification:


• Use Case #1 – device classification with VLAN objects
can be used to assign user VLANs (Example in upcoming lab)

• Use Case #2 – device classification with VLAN objects


can be used to assign management VLANs to Aerohive
devices
User VLANS 8, 16 User VLANs 10, 20

Floor1 L2-Switch L2-Switch Floor2

Router

125 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

Use Case #3 – Time zone settings for


device clocks

West Coast East Coast

126 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Templates

Device Template: Corp Switches Device Template: Branch Switches

Use Case #4 – device classification


with for different switch port settings

Corp Site Branch Office

PoE PoE

127 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: CWP

Atlanta

Use Case #5 – Different captive web


portals can be used at different
locations

Seattle

128 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

• Time zones can be assigned to


devices by classification

• Devices such as APs must be


linked to topology maps

129 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

Additional
Settings > Policy
Settings > Device
Time Zone
• Select þ Apply
time zone to
devices via
classification
• Click +

130 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

• Time Zone: select


the desired Time
Zone
• Click Add
• Assignment
Rules: click +

131 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

• Name: West-Coast
• Click +
• Click Device
Location
• Select the desired
location, building or
floor
• Click Select

132 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

• Observe the first rule

• Scroll down and


click

133 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

Repeat the steps for the


next time zone:
• Time Zone: select the
desired time zone
• Click Add
• Assignment Rules: click
+

134 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

• Name: East-Coast
• Click +
• Click Device
Location
• Select the desired
location, building or
floor
• Click Select

135 | © 2018 Aerohive Networks. All Rights Reserved.


Device Classification: Time Zones

• Observe the
assignment rules

• Click Save

• Click Next

136 | © 2018 Aerohive Networks. All Rights Reserved.


LAB: DEVICE CLASSIFICATION

137 | © 2018 Aerohive Networks. All Rights Reserved.


Login to HiveManager NG
Students login

• Using Chrome, browse to the HiveManager


Virtual Appliance instance for your class

(the URL is supplied by the instructor)

• Everyone in class will use the same


Hivemanager!

• Login with credentials supplied by instructor:

Admin: [email protected]
Password: Aerohive123

138 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs

User VLANS 8, 16 User VLANs 10, 20


Floor1 L2-Switch L2-Switch
Floor2

Router

Network Policy: Corp-X User Profile: Teacher

Floor1 VLAN 8
SSID: Teacher Floor2 VLAN 10

User Profile: Student


SSID: Student
Floor1 VLAN 16
Floor2 VLAN 20

139 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
1. Step one

• Click the
Configure tab

• Select your
Corp-X Network
Policy

140 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
2. Add a new SSID SSID

Click Wireless Networks tab

• Click to add an SSID profile


• Select All other Networks (standard)

141 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
3. Add a new SSID

• SSID Name: Teacher-X


Tip: Press the tab key to auto-fill
the next textbox

• SSID Broadcast Name:


Teacher-X

Do NOT click Save yet

142 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
4. Select PSK security

• Scroll down
• Select Personal
WPA/WPA2 PSK

• Select þ Show
Password
• Key Value: aerohive123

Do NOT click Save yet

143 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
5. Create a default User Profile

• holder

• Scroll down ê to User Access Settings


• Default User Profile:
• Click + to add a new User Profile
144 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Device Classification for User VLANs
6. Create a VLAN object

• User Profile Name:


Teacher-X
• VLAN: Click +

145 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
7. Create a VLAN object

• Name: Teacher-VLANs-X
• Default VLAN ID: 1
• Select þ Apply VLANs to devices using classification

146 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
8. Create a VLAN object

• Click +
• VLAN ID: 8Y
• Click Add

147 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
9. Create a VLAN object

• Click +
• VLAN ID: 10Y
• Click Add

148 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
10. Create an assignment rule

• Verify both VLANs


• Next to VLAN 8Y, click + under Assignment Rules

149 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
11. Create an assignment rule

• Name: Rule-A-X
• Click +
• Select Device Location

150 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
12. Create an assignment rule

• Expand the location


tree to the building
designated by the
instructor
• Select X-Floor1

• Click Select

151 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
13. Create an assignment rule

• Click Save

152 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
14. Create an assignment rule

• Next to VLAN 10Y, click + under Assignment Rules

153 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
15. Create an assignment rule

• Name: Rule-B-X
• Click +
• Select Device Location

154 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
16. Create an assignment rule

• Expand the location


tree to the building
designated by the
instructor
• Select X-Floor2

• Click Select

155 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
17. Create an assignment rule

• Click Save

156 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
18. Save the VLAN object

• Expand the assignment rules to verify


• Click Save to save the VLAN object

157 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
19. Save the User Profile object

• Click Save to save the User Profile object

158 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
20. Save the SSID Profile object

• Click Save to save the SSID Profile object

159 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
21. Deploy Policy

• Verify your new Teacher-X SSID


• Click on the Deploy Policy tab
160 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Device Classification for User VLANs
22. Deploy Policy

• Select þ only the access point/device whose name begins with your
student number 0X
• Click

Note: Please only select your AP. Do not upload your policy to other APs during
class.

161 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Device Classification for User VLANs
23. Device Update – Delta Update

• Verify that only 1


device will be
updated
• Select þ Update
Network Policy and
Configuration
• Select ¤ Delta
Configuration
Update

• Click
162 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Verification

• Students will now connect their devices to the configured


SSID.

• Students will then test wireless connectivity to the SSID your


managed APs now transmitting
Teacher-X

163 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Verify Client VLANs

Monitor > Clients


• Verify the VLANs of the
connected clients

• Students with APs


linked to Floor1 will be
assigned to VLAN 8Y

• Students with APs


linked to Floor2 will be
assigned to VLAN 10Y
164 | © 2018 Aerohive Networks. All Rights Reserved.
LAB: WIPS

165 | © 2018 Aerohive Networks. All Rights Reserved.


Login to HiveManager NG
Students login

• Using Chrome, browse to the HiveManager


Virtual Appliance instance for your class

(the URL is supplied by the instructor)

• Everyone in class will use the same


Hivemanager!

• Login with credentials supplied by instructor:

Admin: [email protected]
Password: Aerohive123

166 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
1. Choose Additional Settings

• Select your Network Policy in the guided


configuration
• Click Additional Settings

167 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
2. Choose WIPS

• Scroll down

• Select WIPS (bottom


left navigation)

• Scroll up

168 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
3. Enable WIPs policy

• Wireless Intrusion
Prevention System
(WIPS)
• Click ON

169 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
4. Choose WIPS

• Name: WIPS-X
• Select þ
Determine if
detected rogue
APs are
connected to
your wired
(backhaul)
network
Note: This setting is used for
Rogue AP classification
170 | © 2018 Aerohive Networks. All Rights Reserved.
Wired Detection

Wired: 00:11:22:33:44:50
Wireless: 00:11:22:33:44:55

Alert: Rogue AP

Rogue AP
1. Rogue AP wired interface 4. Aerohive AP compares the
sends ARP broadcasts wireless and wired MAC
2. Switch floods out all ports addresses
3. Aerohive APs learn the wired 5. If MAC addresses are in a
MAC address of the rogue range of 64 above or 64
AP below, the device is
4. Wireless MAC address Rogue Client classified as a Rogue AP
(BSSID) of rogue AP is
detected when the
Aerohive APs perform scans

171 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
5. MAC OUIs

All other WIPS settings are used to classify


discovered APs as Unauthorized
• Add any MAC OUIs for APs that you do not want
classified as unauthorized
172 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Configure a WIPS Policy for Rogue AP detection
6. SSID detection

• Select þ Detect rogue


access points based
on hosted SSIDS
• ⦿ Select an SSID
• From the drop-down,
select your company
SSID(s)
• Select þ Check the
Note: This setting is used for Unauthorized type of encryption
classification. Any AP that is broadcasting • Click Add
SSIDs other than what you designate will be
classified as Unauthorized.

173 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
7. Client detection

•Select ON Detect if wireless clients have formed


an ad hoc network

• Select þ Enable rogue client reporting

174 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
8. Mitigation

• Select ⦿ Manual
Semi Automatic mitigation
requires an administrator to
manually enable once a rogue
AP is detected
• Click Save

175 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection
9. Deploy Policy

• Select þ only the access point/device whose name begins with your
student number 0X
• Click

Note: Please only select your AP. Do not upload your policy to other APs during
class.

176 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Configure a WIPS Policy for Rogue AP detection 10. Device
Update – Delta Update

• Verify that only 1


device will be
updated
• Select þ Update
Network Policy and
Configuration
• Select ¤ Delta
Configuration
Update

• Click
177 | © 2018 Aerohive Networks. All Rights Reserved.
Sensor Mode

• All access points perform off-channel


scanning
• Aerohive APs will detect rogue and
unauthorized APs during the scanning
• Aerohive APs can service clients on
the home channel and still scan off-
channel for rogue devices
• Aerohive APs can also be configured
as full-time WIPS sensors

178 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
1. Monitor > Security

• Select Monitor > Security

179 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
1. Monitor > Security

• Select Rogue APs


• Adjust desired timeline
180 | © 2018 Aerohive Networks. All Rights Reserved.
Detected AP Classification

• Rogue: AP detected on the wired network


• Unauthorized Rogue: Unauthorized AP eventually
detected on the wired network
• Unauthorized: Any other APs detected
• Neighbor: Manual classification for non-Aerohive APs
181 | © 2018 Aerohive Networks. All Rights Reserved.
Lab: Monitor Rogue APs
2. Rogue APs

Classification Connected
Rogueclients
BSSID
RogueRogue
SSID Vendor
Rogue Location AP Detection
ReportingClassification Times
Reason

• Select þ Rogue

182 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
3. Unauthorized APs

Classification Connected clients


Unauthorized
Unauthorized Reporting
Unauthorized
APUnauthorized
BSSID AP AP Detection
Classification
AP Location
SSIDAP Vendor Reason
Times

• Select þ Unauthorized

183 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
3. Neighbor APs

• Select þ desired Unauthorized AP


• Click Classify
• Choose Neighbor
• Click Yes

184 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
4. Neighbor APs

• Select þ Neighbor
• AP has be re-classified as a Neighbor
• Neighbor APs are not considered to be threats

185 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
5. Rogue Clients

Lab: Configure a WIPS Policy


for Rogue AP detection
4. Neighbor APs
Select Rogue Clients

186 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Monitor Rogue APs
6. WIPs Reporting

Click the Report Icon


Choose either Once or Recurring Report

187 | © 2018 Aerohive Networks. All Rights Reserved.


Rogue AP Triangulation

• From a topology
map, choose the
View Heat Map
tab
• Devices: Click Real
• Select þ Rogue

188 | © 2018 Aerohive Networks. All Rights Reserved.


Rogue AP Triangulation

• Reporting Aerohive APs


can triangulate the
location of a rogue AP.

• Two conditions needed to


triangulate a rogue AP:
1.Three or more Aerohive
APs must detect the
rogue.
2.RSSI of > -75 dBm

189 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Mitigate Rogue APs
1. Monitor > Security

• Select an Unauthorized Rogue AP


• Start mitigation Mitigate > Start > Yes
190 | © 2018 Aerohive Networks. All Rights Reserved.
Mitigation

191 | © 2018 Aerohive Networks. All Rights Reserved.


Lab: Stop Mitigation
3. Monitor > Security

• Note: The Mitigation column tracks APs that are


being mitigated.
• Turn off mitigation Mitigate > Stop

192 | © 2018 Aerohive Networks. All Rights Reserved.


MONITORING DEVICES

193 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor - Devices

§Real-time and
historically monitoring of
Devices such as APs
and Switches
• Multiple sortable
columns
• Multiple Filters
• Utilities and Actions
• Device Updates
• Click the Column
Picker icon to choose
available columns

194 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Devices

§ Column view changes based on selections


§ Column view unique to each administrator

195 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Devices


• Click and hold on any column header

• Drag the column header to desired location


• Release the header and the column order changes
• Columns can be moved left or right

196 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Devices

• Column width can be adjusted


• Click the column divider
• Hold the cursor, drag the column and release

197 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Devices

• By default only 10 devices are displayed per page

• Choose 20|50|100 to display more devices per page

• You can also advance through the devices one page at a time

198 | © 2018 Aerohive Networks. All Rights Reserved.


Filters

§Devices can be filtered by:


• Location
• Network policies
• Device types
• Connection state
• Management state
• SSIDs
• User Profiles

• Filters are unique to each administrator


• Filters remain consistent across all views

199 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Devices – Status Column

§Multiple device status icons:


• Connection State – green indicates the device is connected
to HiveManager NG via CAPWAP
• Connection State – red indicates the loss of CAPWAP
connectivity
• Connection State – indicates a simulated AP
• Presence icon – AP is functioning as a listening device for
Presence analytics

200 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Devices – Status Column

§Multiple device status icons:


• Audit icon – The HiveManager NG configuration matches
the configuration on the Aerohive device
• Audit icon – ! The HiveManager NG configuration does not
match the configuration on the Aerohive device
• The device needs to be updated with either a delta or
complete upload of the configuration

201 | © 2018 Aerohive Networks. All Rights Reserved.


Configuration Audit

• Exclamation audit icon


indicates changes to
device configuration
• Click the audit icon to display 3
different audit views
• Audit tab displays a summary view
of any configuration changes
• Click the Ignore button to clear
the audit icon without a delta
upload

202 | © 2018 Aerohive Networks. All Rights Reserved.


Configuration Audit

• Delta tab displays the delta


configuration changes that will
be send to the device with a
delta update that requires no
reboot
• Complete tab displays the entire
running configuration that will be
uploaded to the device via a
complete update that requires a
reboot

203 | © 2018 Aerohive Networks. All Rights Reserved.


Device 360°View

• Device 360°view is accessible from Monitor/Devices


• Click the Host Name of the device

204 | © 2018 Aerohive Networks. All Rights Reserved.


204
Device 360°View

• Device 360° view displays detailed information about the individual


client
• Monitoring > Overview displays in the first screen
205 | © 2018 Aerohive Networks. All Rights Reserved.
Device 360°View

• Monitoring > Wireless Interfaces displays information about the Wi-Fi radios
• Adjustable timeline view

206 | © 2018 Aerohive Networks. All Rights Reserved.


Device 360°View

• Monitoring > Wired Interfaces displays information about the Ethernet


interfaces
• Adjustable timeline view
207 | © 2018 Aerohive Networks. All Rights Reserved.
Device 360°View

• Monitoring > Connected Client displays information about client devices


connected to the AP
• Adjustable timeline view
208 | © 2018 Aerohive Networks. All Rights Reserved.
Device 360°View

• Monitoring > Events displays information about AP events such as client


authentications

209 | © 2018 Aerohive Networks. All Rights Reserved.


Device 360°View

• Device specific settings can also be


configured for each individual device
• Examples:
• Host Name
• IP address
• Interface settings
• Supplemental CLI

210 | © 2018 Aerohive Networks. All Rights Reserved.


LAB: MONITOR DEVICES
Spend 10 – 15 minutes to explore Device Monitoring

211 | © 2018 Aerohive Networks. All Rights Reserved.


MONITORING CLIENTS and USERS

212 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor - Clients

• Adjustable timeline
• Multiple sortable columns
• Multiple Filters
• Click the Edit icon to choose available columns
213 | © 2018 Aerohive Networks. All Rights Reserved.
Monitor Clients

• Column view changes based on selections


• Column view unique to each administrator

214 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Clients

• Column view changes based on selections


• Column view unique to each administrator

215 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor Clients

• Click and hold on any column header


• Drag the column header to desired location
• Release the header and the column order changes
• Columns can be moved left or right
216 | © 2018 Aerohive Networks. All Rights Reserved.
Monitor Clients

• Column width can be adjusted


• Click the column divider
• Hold the cursor, drag the column and release

217 | © 2018 Aerohive Networks. All Rights Reserved.


Monitor - Clients

§Clients can be filtered by:


• Location
• Operating System
• Wireless/Wired
• Connection state
• SSIDs
• User Profiles

• Filters are unique to each


administrator

218 | © 2018 Aerohive Networks. All Rights Reserved.


Client Health

• Client Health information can be seen in a pop-up balloon


• Click on the status health icon to view the pop-up
• Pop-up window will appear

219 | © 2018 Aerohive Networks. All Rights Reserved.


Client RSSI

• There is a graphical view for client RSSI


• RSSI initially displays as Excellent, Very Good, Good or Poor
• Click on RSSI and the Pop-up appears

220 | © 2018 Aerohive Networks. All Rights Reserved.


Client RSSI

Excellent -40 dBm to – 60 dBm


Very Good -61 dBm to -70 dBm
Good -71 dBm to -80 dBm
Poor -80 dBm to -90 dBm
221 | © 2018 Aerohive Networks. All Rights Reserved.
Client SNR

• There is a = graphical view for client SNR


• SNR initially displays as Very High, High, Medium, or Low
• Click on SNR and the Pop-up appears
222 | © 2018 Aerohive Networks. All Rights Reserved.
Client SNR

Very High > = 35 dB


High 34 dB to 25 dB
Medium 24 dB to 15 dB
Low <15 dB to 0 dB
223 | © 2018 Aerohive Networks. All Rights Reserved.
Client 360°View

• Client 360°view is accessible from Monitor/Clients


• Click on the MAC address of the device

224 | © 2018 Aerohive Networks. All Rights Reserved.


224
Client 360°View

• Client 360° view


displays detailed
information about
the individual client
• Adjustable timeline
available for each
client

225 | © 2018 Aerohive Networks. All Rights Reserved.


Monitoring - Users

• Monitor > Users


• Based on unique
credentials
• View number of
client devices
connected from a
single user

226 | © 2018 Aerohive Networks. All Rights Reserved.


226
Monitoring - Users

• Click User Name


• User Entity View
• Click the
individual client
icons

227 | © 2018 Aerohive Networks. All Rights Reserved.


LAB: MONITOR CLIENTS
Spend 10 – 15 minutes to explore Client Monitoring

228 | © 2018 Aerohive Networks. All Rights Reserved.


DASHBOARDS

229 | © 2018 Aerohive Networks. All Rights Reserved.


Dashboard

• The Dashboard is a broad overview of your wireless and wired network

• Instructor will now walk you through the dashboard widgets


230 | © 2018 Aerohive Networks. All Rights Reserved.
Network Summary

Dashboard Summary is a
quick instantaneous
report.

231 | © 2018 Aerohive Networks. All Rights Reserved.


Dashboard Reports

Reports allow you to


view, manage, and
create Network
Summary, PCI
Compliance, and WIPS
reports

232 | © 2018 Aerohive Networks. All Rights Reserved.


Dashboard Diagnostics

Diagnostics displays:
• Top Access Points by
Channel Utilization
• Top Access Points by CPU
Usage %
• Top Access Points by Retries

233 | © 2018 Aerohive Networks. All Rights Reserved.


Dashboard Inventory

Inventory displays:
• Device Count Rollup
• Configuration Status
• User Profiles
• User Groups
• Device Count by Model
• Device Count by OS
Version
• Device Count by Location
234 | © 2018 Aerohive Networks. All Rights Reserved.
Dashboard Inventory

Comparative analytics can provide insight into how your network is


performing compared with similar deployments of other Aerohive
customers. You can compare characteristics of your network with
similarly sized networks and similar client types within the same industry
235 |
or other industries.
© 2018 Aerohive Networks. All Rights Reserved.
Dashboard Presence

This widget reports


presence data
such as passersby,
engaged
customers, and
conversion rate
from passersby to
engaged
customers.

236 | © 2018 Aerohive Networks. All Rights Reserved.


LAB: DASHBOARDS
Spend 10 – 15 minutes to explore the Dashboards

237 | © 2018 Aerohive Networks. All Rights Reserved.


HIVEMANAGER ADMINISTRATION

238 | © 2018 Aerohive Networks. All Rights Reserved.


HiveManager Administration

The user icon contains links to the following:


Global Settings: Make changes that affect your account and your entire
enterprise
Switch HiveManager: Change from one VHM to another if you have more
than one associated with your login credentials.
About HiveManager: Version information and regional datacenter names.
Communications: Learn what’s new in in HiveManager and what is
planned for the near future.
Hide HiveManager Select Features: Remove Select prompts for 30 days.
(Connect only)
Logout: End your current session
239 | © 2018 Aerohive Networks. All Rights Reserved.
HiveManager Administration - Communications

The communications link contains information about


what is New in HiveManager, news about features
that are coming, previews, and any important
notifications such as upgrade windows.

240 | © 2018 Aerohive Networks. All Rights Reserved.


Account Management

• Multiple admin accounts can be created for HiveManager NG


• Administrator user accounts can have different read/write access based on
predefined administrative roles

241 | © 2018 Aerohive Networks. All Rights Reserved.


Account Management - Internal

• When creating a new user Role Based Access Control offers two choices:
• Internal user account: Admin/users from within the organization
• Outside users: Admin/users from outside the organization (resellers,
distributors…)
• To create an internal admin account, select ⦿ Create a new user account

242 | © 2018 Aerohive Networks. All Rights Reserved.


Account Management - Internal

• Email Address: Enter internal


company email address
• Name: Enter name
• Idle Session Timeout: Enter a value
between 5 and 240 minutes
• Assign a Role and a Location
• Click Save and Close

243 | © 2018 Aerohive Networks. All Rights Reserved.


Account Management - Internal

• Employee will receive an


email requesting that they
create a password for their
administrative account
• Click Setup Password

244 | © 2018 Aerohive Networks. All Rights Reserved.


Account Management - Internal

• They will be directed


HiveManager NG to create
the password
• Click Save and Next
• The new administrator can
now Login

245 | © 2018 Aerohive Networks. All Rights Reserved.


Account Management – Outside HiveManager NG online only

• Access can also be granted to outside users: Admin/users from outside the
organization (resellers, distributors…)
• To create an external admin account, select ⦿ Grant access to outside
users
• Important: Outside users must have existing HiveManager NG accounts
• NG Accounts are checked against their email address
• Outside accounts will be indicated by the EXT icon
246 | © 2018 Aerohive Networks. All Rights Reserved.
Role Based Access Control

• HiveManager NG supports RBAC


• When creating a new administrative
account you can assign a role
• A role defines what functions the admin is
able to access within HiveManager NG
• Access can be further restricted by
location – users will only have access to
devices in specific locations

247 | © 2018 Aerohive Networks. All Rights Reserved.


Role Based Access Control

• Roles can be assigned


access to certain
locations based in
topology maps
• Roles are assigned
based on tier two level
of topology maps
• The Administrator and
the Guest Management
role have universal
access and cannot be
assigned to unique
locations
248 | © 2018 Aerohive Networks. All Rights Reserved.
Role Based Access Control

• To view the topology map tiers, from the top-level menu, click Plan
• Tier one of the network map is called a network name and it is often
named after your organization.
• The definition of the second tier depends on how you define your network
map.
• You can assign either a geographic location, such as a city or town, or a
building to the network name.
• For role based access control, tier two is the most important tier because
its assignment determines the admin/user access.
• Example #1: Tier two based on locations
• Example #2: Tier two based on buildings

• RBAC access rights cannot be assigned by floor

§
249 | © 2018 Aerohive Networks. All Rights Reserved.
Role Based Access Control

• For role based access control, tier two is the most important
tier because its assignment determines the admin/user
access:

• Example #1: Tier two based on locations


• Example #2: Tier two based on buildings
• RBAC access rights cannot be assigned by floor

250 | © 2018 Aerohive Networks. All Rights Reserved.


Role Based Access Control

• Administrator
Administrator role provides full access to all configuration, monitoring,
and administrative functions. It is the only role that has access to
account and license management.
• Operator
Operator role provides full access to most functions including network
and device configuration. However, it does not allow access to user
account and license management.
• Monitor
Monitor role provides full access to troubleshooting and read-only
access to monitoring and configuration functions.
• Help Desk
Help Desk role provides full access to the Troubleshoot tab and search
access to the User 360 View and Client 360 View.
• Guest Management
Guest Management role provides access to create network
credentials.
• Observer
Observer role provides read-only access to most function except for
251 | © 2018 Aerohive Networks. All Rights Reserved.
account and license management.
Account Management

Audit Logs to monitor


administrative users

252 | © 2018 Aerohive Networks. All Rights Reserved.


License Management

• To install an entitlement key, click License Management, copy/paste the key,


click Apply
253 | © 2018 Aerohive Networks. All Rights Reserved.
Device Management Settings

• Device CLI passwords can always be globally set from Administration >
Device Management Settings
• Default Password: xxxxxxxxxx
• Confirm Default Password: xxxxxxxxxx
• Click Save
254 | © 2018 Aerohive Networks. All Rights Reserved.
HiveManager NG Logs

Multiple NG logs are available:


• Audit Logs
• Authentication Logs
• Accounting Logs
• SMS Logs
255 | © 2018 Aerohive Networks. All Rights Reserved.
SOFTWARE UPDATES

256 | © 2018 Aerohive Networks. All Rights Reserved.


Device Update – HiveOS firmware

• Deselect ☐Update Network


Policy and Configuration
• Select þ Upgrade HiveOS
• Options include:
§⦿ Upgrade to the golden HiveOS
version
§⦿ Upgrade to the latest HiveOS
version
§⦿ Upgrade to a specific HiveOS
version

257 | © 2018 Aerohive Networks. All Rights Reserved.


©

Device Update – HiveOS firmware

§By default the HiveOS


update will be
§⦿ Active after 5 seconds
after the push completes and
is followed by an automatic
reboot

§Other options:
§⦿ Active at next reboot
§Requires a manual reboot
§⦿ Activate at the following time
§Set a specific activation and
reboot

258 | © 2018 Aerohive Networks. All Rights Reserved.


Reboot Devices in Order

• Switch reboots do not interfere with the AP HiveOS upgrade process.


• HiveManager NG automatically upgrades and reboots the switch and APs
connected to the switch in a proper order.
• This enhancement prioritizes the reboot order in this way: AP mesh nodes, AP
portals, and then switches.

259 | © 2018 Aerohive Networks. All Rights Reserved.


Reboot Devices in Order

• HiveOS updates and configuration updates of unlike devices can


performed at the same time with a single update
• Below are some of the scenarios:

Switch -> AP Router -> Switch -> AP Meshed APs

260 | © 2018 Aerohive Networks. All Rights Reserved.


Reboot Devices in Order

Single configuration push from HiveManager


The expected behavior is that
YES
Are you done? the configuration is pushed
Branch Router* NO from HiveManager NG a single
time while the inbuilt
YES configuration logics and fault
Are you done? prevention system iterates
Switch NO
through stages automatically.
YES
Are you done? The end result is a fault tolerant
Portal APs NO configuration update process.

YES
Are you done?
Mesh APs NO
261 | © 2018 Aerohive Networks. All Rights Reserved.
Complete Updates

• Complete Updates of any


configuration or HiveOS
updates require a reboot

• After the configuration or


firmware is pushed, the slider
bar will stop at about 68%

• Timestamp will appear once


the reboot is complete and
the APs re-establish CAPWAP
connectivity
262 | © 2018 Aerohive Networks. All Rights Reserved.
Thank you

263 | © 2018 Aerohive Networks. All Rights Reserved.

You might also like