Cisco Wireless Control System

Figure 1. Cisco Wireless Control System (WCS)

Product Overview

Cisco Wireless Control System (WCS)

Figure 2. Enterprise Wide RF Intelligence

General Management

• Configuration templates: With Cisco WCS, administrators can assign a template to one or all of the wireless LAN controllers or access points in a mobility group. They can then select the mobility group name and apply the template across the entire mobility group domain. A variety of wireless LAN controller templates are available to manage system, WLAN, security, access control, 802.11 a/b/g/n, mesh, rogue devices, TFTP servers, and management configurations (Figure 3 and Figure 4).

• Bulk provisioning of Cisco wireless LAN controllers: All Cisco wireless LAN controllers can be provisioned in bulk by importing a CSV file into Cisco WCS.

• Software management: With Cisco WCS, upgrades to Cisco wireless LAN controllers and access points can be performed from a centralized location, with a single click of a mouse.

• User group-based privilege management: Network administrators can create Cisco WCS user groups and assign management task level privileges to each individual user group.

• Network auditing: Network administrators can audit wireless LAN controller and access point configurations by network location, mobility group, or device. Discrepancies between the configuration stored in Cisco WCS and the current configuration of the access point or controller can be displayed. Network administrators can remediate configuration discrepancies by retaining either the Cisco WCS configuration or the configuration stored on the device. Using network auditing in conjunction with Cisco WCS configuration templates delivers powerful real-time configuration management of connected controllers and access points.

• RADIUS and TACACS+ support for secure access: Cisco WCS supports Simple Network Management Protocol (SNMP) version 3 and Terminal Access Controller Access Control System (TACACS+) for the highest level of network management capabilities and security. SNMP version 3 can be used for communication between a Cisco WCS server and individual wireless LAN controllers. Cisco WCS also supports SNMP version 1 and version 2, which allows other network management platforms to query it. TACACS+ is a Cisco protocol that supports authentication, authorization, and accounting (AAA) servers. Cisco WCS uses TACACS+ to authenticate and authorize access to specific Cisco WCS features.

• HTTP and HTTPS interface: Network administrators can access Cisco WCS via any standard browser running HTTP or Secure HTTP (HTTPS), which helps ensure anytime, anywhere access to Cisco's management capabilities.

Figure 3. Cisco WCS Configuration Templates

Figure 4. Cisco WCS Configuration Group Templates

Virtual Domains

Figure 5. Cisco WCS Virtual Domains Grouped by Hierarchical Domains

• Define the areas of the wireless network that individual IT administrators (users) can manage.

• Customize virtual domain names by geographical regions, customer names, building, campus, or other customized parameters to meet each organization's individual needs.

• Create up to 128 distinct hierarchical virtual domains.

• Maintain tight control of the wireless network infrastructure that is managed by each IT administrator.

Network Monitoring

Figure 6. Visualize RF Coverage

Network Troubleshooting

• Client Troubleshooting Tool: A built-in client troubleshooting tool allows network administrators to quickly and easily troubleshoot problems with a client. Detailed client information is displayed on a troubleshooting dashboard to aide network managers in quickly troubleshooting client problems. This tool includes a summary page with a list of the defined problem and suggested troubleshooting actions as well as a log analysis to capture log messages from the controller and a detailed event history. This tool helps network managers debug Layer 1 to Layer 3 client problems using a step-by-step method (Figure 7).

Figure 7. Client Troubleshooting Tool

• Client debugging logs and statistical reports: Cisco WCS can collect, save, export and open debug logs for Cisco Aironet and Cisco Compatible Extensions version 5 client devices. These logs can facilitate the generation of client troubleshooting tickets. Real-time and historical statistical reports and a consolidated summary of the troubleshooting tests that were used on the diagnostic channel of these devices can be generated.

• Integration with Cisco Secure Access Control Server (ACS) View Server 4.0: The Cisco WCS client troubleshooting tool integrates with Cisco Secure ACS View Server 4.0 to provide aggregated client status information from multiple Cisco ACS Servers. This supports easy troubleshooting of client problems associated with client authentication failures.

• Radio Resource Management (RRM): Troubleshooting and maintenance of the WLAN network is simplified with the RRM tool. This tool provided visibility into wireless network performance and radio frequency statistics. The RRM dashboard is easy to read and enhances awareness of critical events, coverage, or lack of coverage, and configuration anomalies (Figure 8).

Figure 8. RRM Tool Dashboard

• Integration with Cisco Spectrum Expert: Cisco WCS supports integration with Cisco Spectrum Expert. This integration allows customers to use the Cisco Spectrum Expert tool to investigate non-Wi-Fi interference sources within the vicinity of the Cisco lightweight access points that are affected by interference. When the source of the interference is determined, customers can remove, move, shield, adjust, or replace the device that is generating the interference. This tool can be used to assist with network troubleshooting (Figure 9).

Cisco WCS can be configured to receive non-Wi-Fi interference device traps from Cisco Spectrum Expert when a new device that is causing interference is discovered by Cisco Spectrum Expert. Cisco WCS can be configured to support the following actions:

– Enable the reception of a trap from Spectrum Expert (Cardbus). The authentication mechanism is set up by adding the laptop IP address as a valid trap transmitter to Cisco WCS.

– Issue an interference alarm.

– Configure the severity of the alarm, with a default value of minor.

– Associate the alarm with a specific access point.

Users can set trap filters and threshold values within Cisco Spectrum Expert so that traps are generated only for significant interference events.

Learn more about the Cisco Spectrum Expert by visiting http://www.cisco.com/en/US/products/ps9393/index.html.

Learn more about spectrum intelligence by reading the brochure Cisco Spectrum Intelligence Solution Simplifies Detection, Classification, Location, and Troubleshooting of RF Interference.

Figure 9. Cisco WCS integration with Cisco Spectrum Expert

Reports

• Exporting of reports into comma separated values (CSV) or PDF format.

• Automating and scheduling of exported reports.

• Sending e-mail notifications upon report generation.

• Specifying target or logical entity groups when generating a report.

• Configuring and customizing reports by frequency and polling to reduce the costs of unnecessary network polling and database storage

• Configuring data storage and saving parameters. Hourly aggregated data can be stored for up to 31 days. Daily aggregated data can be stored for up to 90 days. Weekly aggregated data can be stored for up to 54 weeks.

Table 1. Cisco WCS Report Summary

Figure 10. Access Point Report and Inventory Report

Figure 11. Controller Utilization Performance Report and Busiest Client Report

Figure 12. PCI Compliance Assistance Report

Simplified Ease-of-Use

• A quick search box that enables searches across the entire WLAN for access points, controllers, or client devices by their MAC address, IP address, or name. This reduces the time required to identify and isolate devices with incorrect operations or security settings (Figure 13).

• Advanced searches with an option for saving

• Access control list (ACL) provisioning supports creating reusable grouped IP addresses and reusable protocols

• An extensive selection of access point and controller templates with specialized tab areas that simplify the selection and design of configuration parameters. These templates can be scheduled to be applied at a future day or time to support automated controller provisioning and software management at anytime, without manual intervention.

• Reuse and apply controller templates to one or all wireless LAN controllers.

• Configuration auditing supports auditing of the configuration of each wireless LAN controller to confirm that it's running configuration is identical to the configuration listed in Cisco WCS database.

• List page record sizes are configurable to up to 500 records per page

• Customizable dashboard with interactive real-time charts and tables to meet each organization's individual networking requirements

• Alarm configuration by severity level

• Scheduled shut off of WLAN and access point radios supports deactivation of the unified wireless LAN as needed to meet security requirements during business or non-business hours.

• Auto-provisioning of wireless LAN controllers supports remote configuration of controllers at branch offices or remote locations.

• Distinctive floor map icons indicate the device type including: authorized and unauthorized client devices, authorized and rogue access points, Wi-Fi tags, and chokepoints when the Cisco Wireless Location Appliance is deployed with Cisco WCS. The rogue access point icon also changes color to differentiate between a variety of states, including alert, pending, contained, threat, contained pending, trusted missing, on network, and off network.

• One-click software upgrade simplifies the process for upgrading Cisco WCS to run the latest software release.

Figure 13. Cisco WCS Quick Search and New Search

Cisco Context-Aware Mobility Solution

Figure 14. Cisco Context-Aware Mobility Solution -High Resolution Map for Rogue Device Detection

Figure 15. Cisco Context-Aware Mobility Solution-Location Services

Figure 16. Cisco WCS Location Notifications Summary

Secure Guest Access

• Single-click guest provisioning that reduces errors made by provisioning personnel when they are issuing guest access credentials.

• An HTML image file that can be uploaded to the controller to replace the default Web authentication page that guests traditionally see when logging into a controller-based guest network. This customized page can be previewed prior to activation.

• Customized automated guest access by time of day and date.

• Customizable guest user login failure message and logout verification Web page helps enhance the overall guest-user experience and minimize help desk calls.

• Pre-provisioning of guests prior to their arrival at the site by sending them login credentials by email.

• Limits can be placed on the number of guest users that provisioning personnel can create during a given time period to help maintain network security.

• The existing LDAP infrastructure can be used to authenticate guest users via Web authentication.

• Per-user bandwidth limits on guest traffic to enhance network security and performance.

• Per-SSID guest portals to provision separate portals for different guest user groups.

• Restriction of guest users by their network location: campus, building, or floor area.

• Guest user passwords automatically generated or manually defined.

Figure 17. Cisco Unified Wireless Network Secure Guest Access

Figure 18. Cisco WCS Secure Guest Access Configuration

Voice over Wireless LAN

• Voice WLAN parameter settings: Voice is latency sensitive. Several WLAN parameters need to be modified to allow for both voice and data on the same network. Cisco WCS voice tools adjust critical WLAN parameters to support VoWLAN.

• Voice troubleshooting tools: Troubleshooting degraded voice quality problems can be difficult In a WLAN environment. Cisco WCS supports queries for traffic stream metrics (TSM) such as packet latency, packet jitter, packet loss and roaming time to determine the cause of voice quality problems.

• Voice Readiness Tool: The Cisco WCS Voice Readiness Tool (VRT) provides a visual indication of the RF coverage and provides an assessment of the readiness of the deployment for VoWLAN. The tool displays three distinct color-coded regions on the floor map highlighting areas of good, moderate and poor RF coverage (Figure 19). This helps identify insufficient coverage areas that could potentially experience voice quality issues. The VRT also takes advantage of calibration data, when available, to provide an estimate of the RF coverage levels and suitability of the network for VoWLAN. The tool can be queried for a visual representation of the RF coverage for current access point power levels or maximum access point power levels.

• VoWLAN Audit Tool: The Cisco WCS VoWLAN Audit Tool automates configuration checks and supports the definition of rules to validate Cisco wireless LAN controller configurations based on the VoWLAN deployment guide recommendations. Configuration violations can be presented as a report or an alarm. This tool helps organizations save time when performing configuration checks of Cisco wireless LAN controllers based on the suggested VoWLAN deployment guidelines.

Figure 19. Cisco WCS Voice Readiness Tool (VRT)

Wireless Security and Network Protection

Figure 20. Cisco WCS Security Summary

• Intrusion Detection System (IDS)/Intrusion Prevention System (IPS): Cisco WCS supports robust IPS/IDS with the Cisco Secure Wireless Solution and Adaptive Wireless IPS that integrates with the Cisco Self-Defending Network and Network Access Control (NAC). This solution takes a comprehensive approach to security-at the wireless edge, wired edge, WAN edge, and through the data center. When an associated client sends malicious traffic through the Cisco Unified Wireless Network, a Cisco wired IDS device detects the attack and sends shun requests to Cisco wireless LAN controllers, which will then disassociate the client device.

• wIDS signature tuning and management: Cisco WCS reduces false alarms and increases event fidelity by supporting a configurable "interval" for all IDS signatures.

• RF attack signatures and management frame protection: Cisco WCS helps IT staff to create customizable attack signature files that can be used to rapidly detect common RF-related attacks, such as denial of service (DoS), Netstumbler, and FakeAP. Cisco WCS can be programmed to automatically generate alarms if an attack is detected. The detailed security summary enables IT staff to identify recurring security threats before they can cause significant harm.

• Management frame protection: Cisco WCS supports management frame protection (MFP) to monitor the authentication of 802.11 management frames by the wireless network infrastructure and client devices. MFP allows the network to detect spoofed frames from access points, malicious users impersonating infrastructure access points or Cisco Aironet client devices.

• Rogue detection, location, and containment: The Cisco WCS platform uses patent-pending technology to constantly monitor the RF environment looking for unauthorized access points and ad-hoc 802.11a/b/g/n networks. If unauthorized devices appear, Cisco WCS can be used to determine their location and assess the level of threat. The state of a rogue access point is easily determined by the color of the rogue access point icon displayed on the Cisco WCS floor plan map. If deemed malicious, IT managers can use Cisco WCS to properly contain these rogue devices. Detailed trending reports help to identify potential recurring problems. Standalone access points can be color-coded and marked as friendly or non-rogue.

• Access point wired port authentication with 802.1X: Cisco WCS also authenticates access points plugged into a wired network port using 802.1X to validate credentials. This helps to prevent wireless attacks on the wired network and reduces exposure to wireless security threats. It also eases installation and authentication of new access points on 802.1X-enabled networks.

• Policy creation and enforcement: Cisco WCS contains a service policy engine (Figure 21) that allows network administrators to easily create virtual LAN (VLAN), RF, quality of service (QoS), and security policies. With Cisco WCS, IT staff can create multiple unique service set identifiers (SSIDs) with individual security parameters. For example, a "guest" SSID can be secured with Web authentication; a "voice" SSID might be required to take advantage of the Wired Equivalent Privacy (WEP) capabilities inherent to voice handsets; and normal data traffic can be secured using 802.11i or IP Security (IPSec). Cisco WCS can be used to enforce security policies across an entire Cisco Unified Wireless Network, in individual Cisco wireless LAN controllers, or on individual lightweight access points.

Figure 21. Policy Engine

• User exclusion lists: IT staff can use Cisco WCS to proactively exclude specific users from associating with the wireless network. In addition, if unusual activity is detected, offending devices can be flagged and excluded if they are considered to be malicious. These devices cannot access wireless LAN services until timing on the exclusion list expires, or the IT staff decides to grant them wireless LAN access.

Wireless LAN Planning and Design

Figure 22. Planning Tool

Google Earth Integration

Migrate CiscoWorks WLSE to Operate as a Cisco WCS

Simplified Standalone Access Point Migration and Monitoring

• Standalone Access Point Migration Tool: Cisco WCS includes an easy-to-use migration tool that supports the simultaneous upgrading of up to 10 Cisco Aironet standalone access points of the same model number. Using this tool reduces the time required to migrate standalone access points.

• Standalone Access Point Monitoring: Organizations can now easily monitor their existing standalone access points from a Cisco WCS console in preparation for migration. Cisco WCS, running release 4.2 and later, can receive basic status and alarm information from standalone access points. These access points are then categorized as authorized access points on Cisco WCS heat maps. This helps optimize the WLAN and increase WLAN security.

All Cisco Aironet standalone access point models can be monitored as well as the standalone access points of Cisco 800, 1800, 2800, and 3800 Series integrated services routers.

Learn more about migrating to the unified architecture by reading the Feature Brief-Simplified Migration of Standalone Access Points to Operate as Lightweight Access Points in the Cisco Unified Wireless Network.

Cisco WCS Demonstration License

Features and Benefits

Table 2. Features and Benefits of Cisco WCS

Summary

Product Specifications

Table 3. Product Specifications for Cisco WCS

Cisco WCS Licenses

Ordering Guide