Q. What is the Cisco
® 6500 Series Wireless LAN Services Module?
A. The Cisco Catalyst 6500 Series Wireless LAN Services Module (WLSM) is an advanced services module for the Cisco Catalyst 6500 Series switch. It supports Cisco Aironet Series access points that are operating autonomously. It incorporates Cisco Wireless Domain Services (WDS) for the enterprise and performs the following functions:
• Cisco Centralized Key Management to help ensure security of client roams
• Authentication of Cisco Aironet® autonomous access points within the network infrastructure
• Layer 2 and Layer 3 roaming and client mobility management
Q. Is the Catalyst 6500 Series WLSM in the wireless data traffic path?
A. No. The Catalyst 6500 Series WLSM is not in the forwarding path for wireless data traffic. The 8-Gbps fabric connection is specifically reserved for aggregated access point radio management information, as well as mobility-related protocols and client IEEE 802.1X authentication traffic.
Q. What customers will deploy the Catalyst 6500 Series WLSM?
A. The Catalyst 6500 Series WLSM was developed for midsize businesses, universities, and service providers who are using autonomous access points and want an integrated enterprise-class wired and wireless LAN.
FEATURES AND BENEFITS
Q. What are the main features and benefits of the Catalyst 6500 Series WLSM?
A. The Catalyst 6500 Series WLSM provides customers with enterprise-class scalability, security, availability, roaming, and simplified manageability. The module delivers an enterprise-class integrated wired and wireless solution. Major features and benefits of the Catalyst 6500 Series WLSM include:
• Fast secure Layer 3 roaming-Provides secure, sub-50 ms, autonomous access point to autonomous access point handoff times with support for latency-sensitive applications such as voice over IP (VoIP), video streaming, VPN over wireless, and client/server-based applications.
• Industry-leading scalability-Supports up to 600 Cisco Aironet Series access points running Cisco IOS® Software, operating autonomously and up to 6000 Cisco Aironet, Cisco Compatible, or Wireless Fidelity (Wi-Fi) certified client devices.
• Network investment protection-Protects existing network infrastructure investments. The Catalyst 6500 Series WLSM does not force changes to the underlying wireline infrastructure or require special client devices.
• Single point of ingress-Provides a single point of ingress for all wireless traffic, which allows for consistent wireline and wireless control and policy enforcement.
• Support for up to 240 logical mobility groups-Separate mobility groups may be assigned for different user classes, such as enterprise data, enterprise voice, and guest access.
• Simplified deployment and management-Deployable anywhere in the network from the wiring closet, to the core, to the data center. The Catalyst 6500 Series WLSM offers "out of the box" registration, configuration, and management of Cisco Aironet Series autonomous access points, including self-healing resiliency complemented by the capabilities of the CiscoWorks WLSE.
• Rich, intelligent network services-Transparently extends and virtualizes the Cisco Catalyst 6500 Series' rich, intelligent network services to wireless users, including:
– Industry-leading quality of service (QoS) and rate-limiting controls
– Proven Layer 2-7 security services such as stateful firewalls, intrusion detection systems (IDSs), IP Security (IPSec) VPN, and wire-rate access control list (ACL) enforcement
– Powerful noninvasive monitoring of all traffic using the network access module (NAM) with full protocol decoding on a real-time and historical basis that can identify application response delays, and validate QoS policies
– Award-winning fast stateful Layer 2 and Layer 3 failover of network traffic forwarding that increases wireless network availability and resiliency to maximize user productivity
– Graceful tunnel resiliency for maintaining network connectivity for existing wireless clients during a WLSM failure
– Active and standby WLSM in a Catalyst 6500 chassis providing failover capabilities within a single chassis
• Enterprise class security with support for Network Admission Control (NAC) Layer 2 support; Wi-Fi Protected Access (WPA); and WPA2. Extension of Cisco Catalyst 6500 Series rich intelligent network security services to the wireless edge including denial of service (DoS) prevention access control lists (ACLs), firewall, intrusion detection, and IP Security (IPSec) VPN.
Q. How does the Catalyst 6500 Series WLSM maximize network availability and resiliency?
A. Integration of wireless services into the Catalyst 6500 Series switch via the Catalyst 6500 Series WLSM ensures that WLAN traffic is carried by an infrastructure device that supports critical high availability features such as layer 3 Supervisor Engine Stateful Switchover (SSO) and Non-Stop Forwarding (NSF). Additionally, the Catalyst 6500 Series WLSM works with the CiscoWorks WLSE to support self-healing autonomous access point optimization and resiliency.
DEPLOYMENT AND MANAGEMENT
Q. Where is the best place to deploy the Catalyst 6500 Series WLSM?
A. The Catalyst 6500 Series WLSM supports a flexible deployment configuration. It can be deployed anywhere in the network from the wiring closet, to the core, to the data center.
Q. What changes need to be made to the underlying wireline infrastructure or client devices to support the Catalyst 6500 Series WLSM during deployment?
A. No changes to the underlying wireline infrastructure or client devices are required when installing the Catalyst 6500 Series WLSM.
Q. Is deploying a Catalyst 6500 Series WLSM simple?
A. Yes. To deploy a Catalyst 6500 Series WLSM, a customer simply inserts a Catalyst 6500 Series WLSM into an existing Catalyst 6500 Series switch anywhere in the network. The deployment is then completed in two simple steps. First, the autonomous access points automatically download their configurations from a CiscoWorks WLSE or run their existing configurations. Next, the autonomous access points automatically connect to the Catalyst 6500 Series WLSM. Deploying a Catalyst 6500 Series WLSM is that simple.
Q. What components are needed to deploy the Catalyst 6500 Series WLSM?
A. A Cisco Catalyst 6500 Series Supervisor Engine 720 must be installed in the Catalyst 6500 Series switch prior to deploying the Catalyst 6500 Series WLSM. Cisco Aironet Series autonomous access points and the CiscoWorks WLSE are required. Using the optional Cisco Secure Access Control Server (ACS) and Cisco Aironet or Cisco Compatible client devices further enhances the wireless network's capabilities.
Q. What Cisco Aironet Series access points are supported by the Catalyst 6500 Series WLSM?
A. The Catalyst 6500 Series WLSM supports Cisco Aironet Series 1240AG, 1230AG, 1200, 1130AG, and 1100 access points running Cisco IOS Software and operating autonomously. The Cisco Aironet 1300 Series access point/bridge is supported when deployed in access point mode. Cisco Aironet 350 Series access points are not supported.
Q. How many Cisco Aironet Series access points and client devices can one Catalyst 6500 Series WLSM support?
A. At initial installation, up to 600 Cisco Aironet Series access points running Cisco IOS Software and up to 6000 Cisco Aironet, Cisco Compatible, or Wi-Fi certified client devices can be supported by one Catalyst 6500 Series WLSM.
Q. What operating system does the Catalyst 6500 Series WLSM support?
A. The Catalyst 6500 Series WLSM supports Cisco IOS Software.
Q. Does the Catalyst 6500 Series WLSM support per-user ACLs?
A. Yes. The Catalyst 6500 Series WLSM provides per-user ACLs on a per mobility group basis.
Q. Is the Catalyst 6500 Series WLSM fabric-enabled?
A. Yes. The Catalyst 6500 Series WLSM is a Cisco Express Forwarding 256-class module, with a connection to both the classic 32-Gbps bus and a single 8-Gbps fabric channel. This provides a cost-effective module and supervisor engine interoperability for maximum flexibility.
FAST SECURE LAYER 3 ROAMING
Q. What is fast secure roaming?
A. Fast secure roaming enables a client to change its connection between access points in the same subnet (Layer 2 roaming) or between subnets (Layer 3 roaming) to support time-sensitive applications such as VoIP, video streaming, VPN over wireless, and client/server-based applications. Fast secure roaming includes two features-access-point-assisted channel scanning and fast IEEE 802.1X rekeying.
Q. What is the difference between Layer 2 and Layer 3 roaming?
A. Layer 2 roaming occurs within a subnet at the MAC layer. Layer 3 roaming occurs between subnets at the IP layer. With Layer 3 roaming, users can roam across access points that are on different subnets or connected to different wiring closet switches located on different routed/broadcast domains. The need for users to roam across subnets is common to most large network deployments.
Q. How does the Catalyst 6500 Series WLSM provide fast secure roaming across subnets?
A. The Catalyst 6500 Series WLSM provides fast secure roaming across subnets by building Fast Secure Roaming Tunnels (FSRTs). FSRTs provide a logical Layer 3 network over the existing network infrastructure. This logical Layer 3 network can pass through and over different subnets. The Catalyst 6500 Series WLSM maintains a mobility database containing the client's IP address, MAC address, Service Set Identifiers (SSIDs), and the autonomous access point to which the SSIDs are associated. When a client roams, the Catalyst 6500 Series WLSM allows the client to maintain its Layer 3 address, providing network connectivity for that client so that it can reach all of the other nodes in the same subnet. The mobility database is updated when the client roams. The system keeps track of where the user is, allowing the user to maintain connectivity with network resources. With the Catalyst 6500 Series WLSM, autonomous access points are authenticated prior to passing traffic to the wireline infrastructure. No data traffic is allowed beyond the autonomous access point and into the FSRT until after IEEE 802.1X authentication has been completed.
Q. What is the fast secure Layer 3 roaming time for the Catalyst 6500 Series WLSM?
A. Autonomous access point to autonomous access point handoff time is less than 50 ms, including secure IEEE 802.1X rekeying.
Q. How was Layer 3 roaming addressed for autonomous access points prior to the Catalyst 6500 Series WLSM?
A. Before Catalyst 6500 Series WLSM Layer 3 roaming, campus spanning VLANs were used for autonomous access point deployments. This created large broadcast/failure domains that were difficult to manage. Since campus spanning VLANs are not recommended for robust, scalable networks, customers were sacrificing roaming requirements over network design best practices. With the Catalyst 6500 Series WLSM, customers no longer need campus spanning VLANs-the module supports fast secure Layer 3 roaming via the FSRT.
Q. What IEEE 802.1X authentication types are supported by the Catalyst 6500 Series WLSM for fast secure Layer 3 roaming?
Q. Are other IEEE 802.1X authentication types supported by the Catalyst 6500 Series WLSM for basic Layer 3 roaming?
A. Yes. The Catalyst 6500 Series WLSM does not have any client requirements for basic Layer 3 roaming support. When users roam using EAP types that are not supported for fast secure roaming, additional latency will be introduced as the user roams, requiring the user to perform a full 802.1X reauthentication every time they roam.