Aruba adds NAC policy server

By Tim Greene, Network World, 08/15/07

Sponsored by:
Aruba Networks can now supply all the network access control gear needed to support devices accessing corporate networks regardless of whether they connect via wired, wireless or remote access.

Through an OEM relationship with NAC vendor Bradford Networks, the company now offers a NAC policy server of its own that establishes what policies need to be enforced based on endpoint assessment, connection method and behavior of the device.

Previously, Aruba’s Mobility Controller gear could enforce policies dictated by other vendor’s NAC servers, but Aruba didn’t sell a policy server.

The relabeled Bradford gear, called Aruba Endpoint Compliance System (ECS), comes in three models to support varying numbers of users. The E-50 supports up to 1,000 users, the E-100 supports up to 6,000 users and the Network Security Manager can manage groups of E-100 devices to support tens of thousands of users, Aruba says.

ECS can manage identities of individuals by associating them with media access control addresses, the users' roles in the company, IP addresses, how the device is attached to the network and time of day.

Stateful Layer 3 firewalls within Aruba Mobility Controllers enforce policies based on data they gather from endpoints and other security devices such as intrusion-prevention systems.

The Controller can also push enforcement to Aruba wireless access points, and using a feature called Remote AP, this can extend NAC to remote access users. If the remote user accesses the Internet via an Aruba access point, the access point will grant access as dictated by the NAC policy server.

As the status of a user and the user’s machine changes, the policy being enforced can also change. So if a student logged into the college network from the library moves into a classroom, that change of location can trigger a policy change that blocks peer-to-peer and Internet traffic, Aruba says.

Aruba is also announcing that its gear supports both Cisco’s and Microsoft’s NAC architectures and has issued application notes to help customers configure the gear to work together. Aruba also recently joined Trusted Computing Group, which is working on standards for interoperability of NAC gear. The company hasn’t issued application notes for TCG compliance.

Pricing for Aruba’s E-50 starts at $10,500 and for E-100 at $21,000. A Network Security Manger costs $17,500.

Aruba adds NAC policy server

By Tim Greene, Network World, 08/15/07

Sponsored by:
Aruba Networks can now supply all the network access control gear needed to support devices accessing corporate networks regardless of whether they connect via wired, wireless or remote access.

Through an OEM relationship with NAC vendor Bradford Networks, the company now offers a NAC policy server of its own that establishes what policies need to be enforced based on endpoint assessment, connection method and behavior of the device.

Previously, Aruba’s Mobility Controller gear could enforce policies dictated by other vendor’s NAC servers, but Aruba didn’t sell a policy server.

The relabeled Bradford gear, called Aruba Endpoint Compliance System (ECS), comes in three models to support varying numbers of users. The E-50 supports up to 1,000 users, the E-100 supports up to 6,000 users and the Network Security Manager can manage groups of E-100 devices to support tens of thousands of users, Aruba says.

ECS can manage identities of individuals by associating them with media access control addresses, the users' roles in the company, IP addresses, how the device is attached to the network and time of day.

Stateful Layer 3 firewalls within Aruba Mobility Controllers enforce policies based on data they gather from endpoints and other security devices such as intrusion-prevention systems.

The Controller can also push enforcement to Aruba wireless access points, and using a feature called Remote AP, this can extend NAC to remote access users. If the remote user accesses the Internet via an Aruba access point, the access point will grant access as dictated by the NAC policy server.

As the status of a user and the user’s machine changes, the policy being enforced can also change. So if a student logged into the college network from the library moves into a classroom, that change of location can trigger a policy change that blocks peer-to-peer and Internet traffic, Aruba says.

Aruba is also announcing that its gear supports both Cisco’s and Microsoft’s NAC architectures and has issued application notes to help customers configure the gear to work together. Aruba also recently joined Trusted Computing Group, which is working on standards for interoperability of NAC gear. The company hasn’t issued application notes for TCG compliance.

Pricing for Aruba’s E-50 starts at $10,500 and for E-100 at $21,000. A Network Security Manger costs $17,500.

Aruba adds NAC policy server

By Tim Greene, Network World, 08/15/07

Sponsored by:
Aruba Networks can now supply all the network access control gear needed to support devices accessing corporate networks regardless of whether they connect via wired, wireless or remote access.

Through an OEM relationship with NAC vendor Bradford Networks, the company now offers a NAC policy server of its own that establishes what policies need to be enforced based on endpoint assessment, connection method and behavior of the device.

Previously, Aruba’s Mobility Controller gear could enforce policies dictated by other vendor’s NAC servers, but Aruba didn’t sell a policy server.

The relabeled Bradford gear, called Aruba Endpoint Compliance System (ECS), comes in three models to support varying numbers of users. The E-50 supports up to 1,000 users, the E-100 supports up to 6,000 users and the Network Security Manager can manage groups of E-100 devices to support tens of thousands of users, Aruba says.

ECS can manage identities of individuals by associating them with media access control addresses, the users' roles in the company, IP addresses, how the device is attached to the network and time of day.

Stateful Layer 3 firewalls within Aruba Mobility Controllers enforce policies based on data they gather from endpoints and other security devices such as intrusion-prevention systems.

The Controller can also push enforcement to Aruba wireless access points, and using a feature called Remote AP, this can extend NAC to remote access users. If the remote user accesses the Internet via an Aruba access point, the access point will grant access as dictated by the NAC policy server.

As the status of a user and the user’s machine changes, the policy being enforced can also change. So if a student logged into the college network from the library moves into a classroom, that change of location can trigger a policy change that blocks peer-to-peer and Internet traffic, Aruba says.

Aruba is also announcing that its gear supports both Cisco’s and Microsoft’s NAC architectures and has issued application notes to help customers configure the gear to work together. Aruba also recently joined Trusted Computing Group, which is working on standards for interoperability of NAC gear. The company hasn’t issued application notes for TCG compliance.

Pricing for Aruba’s E-50 starts at $10,500 and for E-100 at $21,000. A Network Security Manger costs $17,500.

Aruba Plans November 11n AP Launch

WLAN infrastructure vendor Aruba Networks says it doesnt feel the need to wait for 100% ratification of the putative 802.11n standard for higher-performance wireless networking, hoping it to be near enough that an AP launch should be possible in the November timeframe. The Sunnyvale, California-based vendor held back from launching an AP during the recent flurry of activity that coincided with the Interop show.

Companies like Trapeze, Meru and Colubris all launched 11n APs, albeit in pre-standard form, of course, and a new kid on the block, Aerohive, emerged from stealth mode with a controller-less architecture that it touted as being more 11n-friendly than everything else out there. Ratification pushed back Mike Tennefoss, head of strategic marketing for Aruba, pooh-poohed these moves, however, arguing that with final ratification of the standard by the IEEE having recently been pushed back till mid-to-late 2008, its irresponsible to push something today.

He argued that the devices unveiled in recent months were all designed to make a splash for press purposes, but may actually be counterproductive for the vendors who have launched them. These smaller guys are attention-seeking, he began, but they may also be making themselves hostages to fortune, in that there is the potential for confusion in their own sales teams between pushing 11n or the b/g APs. He inferred that the two major players who have not so far pronounced on 11n, i.e. Cisco and Aruba, are adopting a more responsible attitude.

Furthermore, he added, while 11n holds the promise of a lower density of APs in a given network being able to cover the same area and number of users, customers deploying these new APs into existing b/g environments wont be benefiting from this saving, since theyll have to continue with their existing b/g density. Only once the standard is firmed up enough, his argument went, will it make sense to launch an AP that will enable a complete network refresh of a customers infrastructure, when they will be able to take advantage of the lower AP density.

Another issue he raised was that of the different power requirements of the higher-performance next-gen WLAN technology. 11n needs a new PoE injector so as to provide PoE Plus [802.3af], because it has greater power requirements, he began. This also means GbE cabling, because Cat5 100BaseT doesnt support it. It must be at least 1000BaseT. Aruba already offers GbE ports on its high-end controller, the 6000. While it's still too early for an 11n launch from Aruba, Tennefoss said "we don't need to wait for 100% ratification." Instead, he went on, "we hope it'll be near enough ratified around November."

Aruba vs. Meru and Aerohive Referring specifically to Meru, whose 11n offering entailed a change to its architecture, with the introduction of a third-tier of sub-controllers between the central box and the APs, Tennefoss said this was making a virtue of necessity. 11n is a challenge for Meru because their controller cant handle it, since its an off-the-shelf PC in a rack-mount box, which means lack of throughput and processor power, By contrast, he went on, we do purpose-built boards and processors, which means that the latency in our controllers is virtually nil.

He added that, for large campus deployments, Aruba can also deploy slave controllers for local handling of traffic while a central switch is doing all the management. Meru also doesnt do central encryption or network management, he went on. As for Aerohive, he argued that its technology is a solution in search of a problem, referring to it as a very expensive system architecture squeezed by Ruckus and Netgear from below and us from above.

As for its more serious competitor, i.e. Cisco, Tennefoss argued that Aruba has distinct advantages in terms of security. They take a port-centric view, whereby the user comes through a particular port to access the network, rather like a VPN, whereas we assign credentials to the user and follow them, he went on. Ciscos view limits flexibility, and all the features require another box per feature. Even our fixed-mobile convergence offering doesnt require large infrastructure investments, unlike theirs. Thin, ma non troppo Tennefoss revealed that the 11n AP now being developed by Aruba includes hardware acceleration, with a stateful firewall and mobile routing for split tunnelling in the device.

In other words, while Aruba made its name in WLAN switching, i.e. the generation of infrastructure that relied on an centrally switched overlay network and thin APs, apps such as firewalling and routing are actually running in the AP. Indeed, Tennefoss went on, while Aruba shuns the idea of encryption and decryption in the AP, we can perform these functions in our mesh nodes to enable P2P networking with them, though we dont like the idea of security keys sitting on a node out in the car park.

Our View Tennefoss comments about those of Arubas competitors who launched 11n APs in May respond to their claims that his company isnt offering 11n yet because its centralized architecture, and in particular its execution of encryption and decryption in the controller, impede it. There has certainly been a lot of what Marxists used to call revisionism underway in the switched WLAN camp of late, with first Trapeze, then Meru moving intelligence back out towards the edge of their networks, whether onto the APs themselves or to a local sub-controller halfway between the central switch and the thin AP. Colubris, meanwhile, has been talking up this tri-plane arrangement for well over a year.

The drivers for those architectural changes have been VoWiFi, which is more latency-intolerant that the average data app, and no 11n, with its promise of greater bandwidth, concomitant with higher performance demands on the network infrastructure. Aruba insists that its architecture requires no fundamental changes for the coming storm, however, and the proof of the pudding will have to be in the eating. Lets also see how Cisco, which is market leader in terms of APs deployed in the field, will address the perceived challenges of voice on WLAN and the new high-performance 11n technology.

By Rik Turner
Computer Business Online

Aruba Plans November 11n AP Launch

WLAN infrastructure vendor Aruba Networks says it doesnt feel the need to wait for 100% ratification of the putative 802.11n standard for higher-performance wireless networking, hoping it to be near enough that an AP launch should be possible in the November timeframe. The Sunnyvale, California-based vendor held back from launching an AP during the recent flurry of activity that coincided with the Interop show.

Companies like Trapeze, Meru and Colubris all launched 11n APs, albeit in pre-standard form, of course, and a new kid on the block, Aerohive, emerged from stealth mode with a controller-less architecture that it touted as being more 11n-friendly than everything else out there. Ratification pushed back Mike Tennefoss, head of strategic marketing for Aruba, pooh-poohed these moves, however, arguing that with final ratification of the standard by the IEEE having recently been pushed back till mid-to-late 2008, its irresponsible to push something today.

He argued that the devices unveiled in recent months were all designed to make a splash for press purposes, but may actually be counterproductive for the vendors who have launched them. These smaller guys are attention-seeking, he began, but they may also be making themselves hostages to fortune, in that there is the potential for confusion in their own sales teams between pushing 11n or the b/g APs. He inferred that the two major players who have not so far pronounced on 11n, i.e. Cisco and Aruba, are adopting a more responsible attitude.

Furthermore, he added, while 11n holds the promise of a lower density of APs in a given network being able to cover the same area and number of users, customers deploying these new APs into existing b/g environments wont be benefiting from this saving, since theyll have to continue with their existing b/g density. Only once the standard is firmed up enough, his argument went, will it make sense to launch an AP that will enable a complete network refresh of a customers infrastructure, when they will be able to take advantage of the lower AP density.

Another issue he raised was that of the different power requirements of the higher-performance next-gen WLAN technology. 11n needs a new PoE injector so as to provide PoE Plus [802.3af], because it has greater power requirements, he began. This also means GbE cabling, because Cat5 100BaseT doesnt support it. It must be at least 1000BaseT. Aruba already offers GbE ports on its high-end controller, the 6000. While it's still too early for an 11n launch from Aruba, Tennefoss said "we don't need to wait for 100% ratification." Instead, he went on, "we hope it'll be near enough ratified around November."

Aruba vs. Meru and Aerohive Referring specifically to Meru, whose 11n offering entailed a change to its architecture, with the introduction of a third-tier of sub-controllers between the central box and the APs, Tennefoss said this was making a virtue of necessity. 11n is a challenge for Meru because their controller cant handle it, since its an off-the-shelf PC in a rack-mount box, which means lack of throughput and processor power, By contrast, he went on, we do purpose-built boards and processors, which means that the latency in our controllers is virtually nil.

He added that, for large campus deployments, Aruba can also deploy slave controllers for local handling of traffic while a central switch is doing all the management. Meru also doesnt do central encryption or network management, he went on. As for Aerohive, he argued that its technology is a solution in search of a problem, referring to it as a very expensive system architecture squeezed by Ruckus and Netgear from below and us from above.

As for its more serious competitor, i.e. Cisco, Tennefoss argued that Aruba has distinct advantages in terms of security. They take a port-centric view, whereby the user comes through a particular port to access the network, rather like a VPN, whereas we assign credentials to the user and follow them, he went on. Ciscos view limits flexibility, and all the features require another box per feature. Even our fixed-mobile convergence offering doesnt require large infrastructure investments, unlike theirs. Thin, ma non troppo Tennefoss revealed that the 11n AP now being developed by Aruba includes hardware acceleration, with a stateful firewall and mobile routing for split tunnelling in the device.

In other words, while Aruba made its name in WLAN switching, i.e. the generation of infrastructure that relied on an centrally switched overlay network and thin APs, apps such as firewalling and routing are actually running in the AP. Indeed, Tennefoss went on, while Aruba shuns the idea of encryption and decryption in the AP, we can perform these functions in our mesh nodes to enable P2P networking with them, though we dont like the idea of security keys sitting on a node out in the car park.

Our View Tennefoss comments about those of Arubas competitors who launched 11n APs in May respond to their claims that his company isnt offering 11n yet because its centralized architecture, and in particular its execution of encryption and decryption in the controller, impede it. There has certainly been a lot of what Marxists used to call revisionism underway in the switched WLAN camp of late, with first Trapeze, then Meru moving intelligence back out towards the edge of their networks, whether onto the APs themselves or to a local sub-controller halfway between the central switch and the thin AP. Colubris, meanwhile, has been talking up this tri-plane arrangement for well over a year.

The drivers for those architectural changes have been VoWiFi, which is more latency-intolerant that the average data app, and no 11n, with its promise of greater bandwidth, concomitant with higher performance demands on the network infrastructure. Aruba insists that its architecture requires no fundamental changes for the coming storm, however, and the proof of the pudding will have to be in the eating. Lets also see how Cisco, which is market leader in terms of APs deployed in the field, will address the perceived challenges of voice on WLAN and the new high-performance 11n technology.

By Rik Turner
Computer Business Online

Aruba Plans November 11n AP Launch

WLAN infrastructure vendor Aruba Networks says it doesnt feel the need to wait for 100% ratification of the putative 802.11n standard for higher-performance wireless networking, hoping it to be near enough that an AP launch should be possible in the November timeframe. The Sunnyvale, California-based vendor held back from launching an AP during the recent flurry of activity that coincided with the Interop show.

Companies like Trapeze, Meru and Colubris all launched 11n APs, albeit in pre-standard form, of course, and a new kid on the block, Aerohive, emerged from stealth mode with a controller-less architecture that it touted as being more 11n-friendly than everything else out there. Ratification pushed back Mike Tennefoss, head of strategic marketing for Aruba, pooh-poohed these moves, however, arguing that with final ratification of the standard by the IEEE having recently been pushed back till mid-to-late 2008, its irresponsible to push something today.

He argued that the devices unveiled in recent months were all designed to make a splash for press purposes, but may actually be counterproductive for the vendors who have launched them. These smaller guys are attention-seeking, he began, but they may also be making themselves hostages to fortune, in that there is the potential for confusion in their own sales teams between pushing 11n or the b/g APs. He inferred that the two major players who have not so far pronounced on 11n, i.e. Cisco and Aruba, are adopting a more responsible attitude.

Furthermore, he added, while 11n holds the promise of a lower density of APs in a given network being able to cover the same area and number of users, customers deploying these new APs into existing b/g environments wont be benefiting from this saving, since theyll have to continue with their existing b/g density. Only once the standard is firmed up enough, his argument went, will it make sense to launch an AP that will enable a complete network refresh of a customers infrastructure, when they will be able to take advantage of the lower AP density.

Another issue he raised was that of the different power requirements of the higher-performance next-gen WLAN technology. 11n needs a new PoE injector so as to provide PoE Plus [802.3af], because it has greater power requirements, he began. This also means GbE cabling, because Cat5 100BaseT doesnt support it. It must be at least 1000BaseT. Aruba already offers GbE ports on its high-end controller, the 6000. While it's still too early for an 11n launch from Aruba, Tennefoss said "we don't need to wait for 100% ratification." Instead, he went on, "we hope it'll be near enough ratified around November."

Aruba vs. Meru and Aerohive Referring specifically to Meru, whose 11n offering entailed a change to its architecture, with the introduction of a third-tier of sub-controllers between the central box and the APs, Tennefoss said this was making a virtue of necessity. 11n is a challenge for Meru because their controller cant handle it, since its an off-the-shelf PC in a rack-mount box, which means lack of throughput and processor power, By contrast, he went on, we do purpose-built boards and processors, which means that the latency in our controllers is virtually nil.

He added that, for large campus deployments, Aruba can also deploy slave controllers for local handling of traffic while a central switch is doing all the management. Meru also doesnt do central encryption or network management, he went on. As for Aerohive, he argued that its technology is a solution in search of a problem, referring to it as a very expensive system architecture squeezed by Ruckus and Netgear from below and us from above.

As for its more serious competitor, i.e. Cisco, Tennefoss argued that Aruba has distinct advantages in terms of security. They take a port-centric view, whereby the user comes through a particular port to access the network, rather like a VPN, whereas we assign credentials to the user and follow them, he went on. Ciscos view limits flexibility, and all the features require another box per feature. Even our fixed-mobile convergence offering doesnt require large infrastructure investments, unlike theirs. Thin, ma non troppo Tennefoss revealed that the 11n AP now being developed by Aruba includes hardware acceleration, with a stateful firewall and mobile routing for split tunnelling in the device.

In other words, while Aruba made its name in WLAN switching, i.e. the generation of infrastructure that relied on an centrally switched overlay network and thin APs, apps such as firewalling and routing are actually running in the AP. Indeed, Tennefoss went on, while Aruba shuns the idea of encryption and decryption in the AP, we can perform these functions in our mesh nodes to enable P2P networking with them, though we dont like the idea of security keys sitting on a node out in the car park.

Our View Tennefoss comments about those of Arubas competitors who launched 11n APs in May respond to their claims that his company isnt offering 11n yet because its centralized architecture, and in particular its execution of encryption and decryption in the controller, impede it. There has certainly been a lot of what Marxists used to call revisionism underway in the switched WLAN camp of late, with first Trapeze, then Meru moving intelligence back out towards the edge of their networks, whether onto the APs themselves or to a local sub-controller halfway between the central switch and the thin AP. Colubris, meanwhile, has been talking up this tri-plane arrangement for well over a year.

The drivers for those architectural changes have been VoWiFi, which is more latency-intolerant that the average data app, and no 11n, with its promise of greater bandwidth, concomitant with higher performance demands on the network infrastructure. Aruba insists that its architecture requires no fundamental changes for the coming storm, however, and the proof of the pudding will have to be in the eating. Lets also see how Cisco, which is market leader in terms of APs deployed in the field, will address the perceived challenges of voice on WLAN and the new high-performance 11n technology.

By Rik Turner
Computer Business Online

iPhone may be disrupting the cisco based wireless network

On Duke's wireless network and iPhones


Duke University Office of Information Technology engineers have detected a series of wireless-network disruptions. They have reported nine such episodes since the problem was discovered late last week. Each event lasted no longer than 10 minutes and most users would have noticed no difference in their wireless service, though disruptions may have caused access delays or sluggish internet performance for isolated users.

Technicians have tracked the source of the disruption to people whose iPhones are registered to access Duke’s wireless network but cannot attribute the cause of the disruptions to the devices and are working with colleagues from Apple, makers of the iPhone, and Cisco, the vendor for Duke’s network equipment, to pinpoint the cause of the problem.

Their investigation continues. OIT will update this report as new information becomes available.