WLANs Embrace Identity-Based Networking

Wireless LANs are finally receiving the serious attention of corporate IT departments. As evidence of this fact, consider the growing number of WLAN switch manufacturers. The latest entry into this business foray is Trapeze Networks. The company's initial product line, known as the WLAN Mobility System, has just come to market.

One key feature of this offering is what the company calls "identity-based networking." Using the WLAN Mobility System, users can log in once and retain their access privileges and policies while they physically roam across the network. IT administrators can provide this capability without having to modify their network backbones, clients, or protocols.

The WLAN Mobility System is made up of four components: Mobility Exchange, Mobility Points, Mobility System Software, and the RingMaster tool suite. The Mobility Exchange (MX) is a switch that combines wired Ethernet and wireless IEEE 802.11 capabilities into one box. This control server then communicates with numerous intelligent access points, which are known as Mobility Points (MPs).

Essentially, the Mobility Exchange capitalizes on the trend for efficient power distribution via a Power-over-Ethernet (POE) architecture. It features 20 10/100-Mbps POE ports along with 2-Gbps Ethernet uplinks. The disk-shaped Mobility Points come in two versions: a single and a dual radio. The single radio supports either IEEE 802.11a or 802.11b. In contrast, the dual radio supports both 802.11a and 802.11b. Trapeze expects to ship 802.11g and 802.11a/g versions soon.

The Mobility Exchange controls all of the connected Mobility Points (see figure). For increased system availability, the MX can be equipped with redundant, hot-swappable power supplies. The MX was designed for installation in a typical LAN-based wiring closet. Each MX supplies 46 VDC nominal with a wattage per port of 12 W. The total wattage budget for all 20 ports is 240 W.

The WLAN Mobility System stands out for distributing the data processing amongst the Mobility Points. This architecture relies on "fit" access points. These access points get their name from the fact that they lie somewhere between traditional "fat" APs and basic radio transceivers, or "thin" APs. As "fit" APs, the Mobility Points perform basic RF functions in addition to packet encryption.

The MPs do not provide data storage, however. All sensitive data is kept on the controlling MX instead of the individual Mobility Points. This approach eliminates the security compromises that can arise from leaving substantial network and user intelligence on unsecured, remote access points. The architecture also makes it easier to remotely configure Mobility Points from one MX central location.

In terms of security, each MP implements the IEEE 802.11i draft standard, which includes the Temporal Key Integrity Protocol (TKIP) and the NIST Advanced Encryption Standard (AES). As part of the 802.1X framework, Trapeze's Mobility Points provide dynamic Wired Equivalent Privacy (WEP) keys with multicast key rotation. The MPs also listen for rogue access points or ad-hoc connections. They can even triangulate their position.

An impressive software package complements the hardware side of the WLAN Mobility System. The Mobility System Software controls everything across the MX networks. It allows the transparent roaming of all wireless users within the network. The software also enables the MXs to handle such important security tasks as authentication, authorization, and accounting (AAA). In addition, it tracks all of the users throughout the network.

The final component of the Trapeze Mobility System is a software program dubbed RingMaster. As the name implies, RingMaster brings order to the often circus-like task of WLAN pre-deployment and post-deployment planning, configuration, verification, management, and optimization. RingMaster can create a complete configuration layout of the potential wireless network. Once a graphical representation is imported for the office space under design, the site survey can be quickly generated. Various graphical representations can be used, ranging from a GIF image to AutoCAD DXF layout.

During system layout, RingMaster is smart enough to apply RF-signal-attenuation factors to walls, doors, windows, and other structures. A graphical deployment tool within RingMaster automatically generates the placement of MX and MP units to optimize coverage, power usage, and RF channel assignment. If non-coverage areas still exist, the IT administrator can drag-and-drop another MP from the menu bar to the desired location on the screen.

The Mobility System starter kit, which includes one MX, two MPs, and the Mobility System Software and RingMaster tool suite, is priced at $9500.