Technology Considerations

Architecture Principles

When considering the architecture of your WLAN, your assessment must encompass many points. This section examines some of the factors that affected the enterprise WLAN deployment at Cisco Systems, as follows:

• Topology

• 802.11 wireless networking standards

• Client-to-AP ratio

• Signal strength

• Roaming

• Radio cell architecture

• Global naming standards

• Cisco Aironet access points

• Cisco Secure Access Control Server (ACS)

Topology

Early in the planning stage, the Cisco IT WLAN Architecture team decided that the WLAN would be a secondary network complementing the existing wired network (that is, a separate "overlay" network). Each large building would use a single Layer 3 domain within each building to help ensure session integrity for wireless devices moving within or between floors. Effectively, each building had a unique wireless subnet, where both the access points and the wireless devices shared IP addresses from a common Class C address pool. However, in line with prudent IP address management, smaller buildings with fewer than 20 or 30 users shared a common VLAN for both wired and wireless devices.

After careful traffic analysis, Cisco IT built its architecture on a user-to-AP ratio of 25:1 would provide acceptable performance. At that time (early 2000), it was deemed unlikely that all 25 users would be accessing the WLAN at the same time and even more unlikely that they would all be simultaneously sending or receiving large amounts of data. Because the WLAN was an overlay network, those users who needed to use bandwidth-intensive applications such as network backups or video streaming were encouraged to use the wired network and not depend on the wireless network for these functions.

However, Cisco IT has found that adoption has been extremely high. Within 12 months of deployment, Cisco IT commissioned an internal "Voice of the Client" survey, which showed that 92 percent of staff were using the WLAN on a weekly basis; furthermore, 27 percent of users were relying upon the WLAN as their "primary or only network access medium." Even with the limitation of the 802.11b data rate of 11 Mbps (or actual throughput of 6 Mbps), day-to-day performance has not been adversely affected and is deemed perfectly acceptable for the vast majority of user activity. Comments from users have been overwhelmingly positive.

In some instances, directional antennas have been used to more narrowly focus the signal, reducing the power required to achieve full coverage. Where necessary, rather than increasing transmit power to exceed 20mW, additional access points are installed to cover "dead" spots.

Each time the user switches from one access point to another, connectivity is momentarily lost, necessitating reauthentication. Numerous reauthentication requests can increase load on the authentication server, which can adversely affect service. This situation can be particularly notable in wireless voice applications, with clearly discernable "stutter" as the client reassociates and authenticates.

The naming standard is as follows:

For example, for the third access point on the second floor of a New York office, the access point name could be NYC-AP2c.cisco.com

Cisco IT has found that a consistent naming standard allows for easier management.

Cisco Aironet Access Points

When originally deployed, the Cisco Aironet 350 Series Access Point was selected as the standard access point. The Cisco Aironet 350 Series was the most advanced, fully featured wireless access point available. It supported the 802.11b protocol standard (the most advanced at that time), which provides data rates of up to 11 Mbps. The Cisco Aironet 350 Series also supported inline Power over Ethernet (PoE), which greatly simplifies installation and reduces costs by eliminating the need for separate, dedicated power cabling to the main supply.

Today, Cisco IT is expanding and enhancing its initial Cisco Aironet 350 Series deployments by installing Cisco Aironet 1000, 1100, and 1200 Series access points. These access points support new 802.11 standards and additional feature enhancements and options for modular and flexible WLAN deployments, including the centralized, controller-based architecture or the distributed autonomous access point architecture. At the time of writing, approximately 25 percent of the access points were the 1200 series. This percentage will rise to 100 percent with the NexGen WLAN.

The Cisco Secure ACS is used as the standard AAA server for the global WLAN and for other recently introduced services such as 802.1x-based port authentication for wired Ethernet ports in public areas and Network Access Control (NAC), part of the Cisco Self-Defending Network security strategy. Pairs of Cisco Secure ACSs were deployed at strategic locations worldwide.

To date, more than 3100 Cisco Aironet access points have been deployed worldwide, supporting more than 50,000 users. This includes over 37,000 full-time Cisco employees, as well as over 10,000 temporary, contractor, and vendor staff. A WLAN as widely used as this requires a robust management capability. Because a dedicated wireless management system was not available in 2000, the Cisco wireless network was managed through EMAN, an internally developed web-based enterprise-management framework. Today, Cisco IT also uses the CiscoWorks WLSE, a Cisco appliance for managing WLAN deployments.

To address this issue, Cisco made the decision to adopt third-party wireless software for all platforms. This adoption ensures that a common software application is used for all operating systems (Windows 2000, Windows XP, Linux, MacOS, and so on), regardless of the particular adaptor used in the relevant laptop (Cisco adaptors, Intel Centrino laptops, Macintosh PowerBooks, and so on).

The third-party supplicant also provides a consistent management toolset to allow for centralized profile management and configuration.

A centralized client management solution is also used to facilitate software distribution and updates.

Service dashboards, which are internal intranet websites, also provide service information, user communication, software, and self-service configuration utilities for all users. All Cisco staff can use dashboards for instructions on how to manually configure or update their systems. Because dashboards are based on standard HTML pages, they are platform agnostic and suitable for all platforms and clients that support HTTP.

Service and Support

Network devices, systems, and applications on the Cisco global network are managed according to levels of impact to the business. Service or support levels fall into four categories:

Within this support-level structure, Cisco Secure ACSs are managed as a P1 device because they are critical not only for WLAN access, but also for NAC, an element of the Cisco Self-Defending Network security strategy. The wireless network was originally managed as a P4 because it was considered a secondary network to the wired network. However, because of widespread adoption and usage within Cisco, support for the WLAN has become equivalent to P2. Cisco envisions that the NexGen WLAN, based upon more advanced and intelligent wireless networking technologies, will be formally supported on a P2 basis.

Cisco has a four-tier support model, as follows:

A team of three and a half full time equivalent (FTE) staff makes up the Tier 2 IT WLAN network operations staff. Note that this effort is spread over several people in several countries but that the combined total is equivalent to 3.5 FTE.

A team of two and a half FTE makes up the Tier 3 IT WLAN architecture team. This includes the global program manager responsible for enterprise wireless strategy and architecture.

Cisco budgets US$120,000 per annum as the fully loaded cost of an FTE. This cost includes salary, assets, workplace costs, business costs, and so on, and is not indicative of salary alone. This results in annualized cost of second-line Tier 2 support of US$420,000.

Because of the nature of the Cisco business and the maintenance of a Tier 3 architecture team, Cisco does not include these costs in the day-to-day annualized support costs. Cisco believes the maintenance of a dedicated architecture team is not indicative of a typical enterprise because not all corporations are based in the networking industry.