design for wireless project....need help....

[azeemo157]

Hi Team

i have a requirement from client and need suggestions on the design. Client has 1 main office and 5 remote branches. client requires wireless in all offices. approx 600 access points with 100 in each location client requires all wireless access points to be registered at HO controller and a redundant controller to be at the branch. if the controllet @ HO goes down access point to be served by the controller local to the site.

Is this type of a design possible ? kindly do help me in suggesting the best for my clent.

Thanks !!!

[Scott Fella]

You can do it that way if you want. The wlc at HQ will have to be able to support all 600 AP's just in case. The only thing is that since traffic is going to terminate back to HQ, a fail of the HQ WLC will force devices to re-associate and obtain a new ip address from the local site. So a failure of the HQ WLC will disrupt wireless connectivity. Also be aware of devices that have static address will not work since the ip address would be at the HQ and not available at the remote site.

Thanks,

Scott Fella

Sent from my iPhone

[Scott Fella]

Just to add, if all services come back to HQ, maybe placing the redundant WLC at HQ would be better. I'm also assuming you have multiple paths back to HQ so a WAN failure is close to impossible. If you have services at each site, maybe placing two WLCs at each site would be better, this way traffic doesn't have to transverse back and fourth.

Sent from Cisco Technical Support iPhone App

[aaroncoffman]

Azeemo157,

Reading your requirements FlexConnect (HREAP) came to mind almost immediately. Does the client need all traffic to be taken back the the controller at the HQ or could the traffic be distributed local to the AP? If the client would like the traffic taken back to the controller may I ask why? I have FlexConnect deployed at numerous sites and since it works for my clients requirements they are very happy with it. At the moment my biggest grievance from an administrative standpoint is the current bug regarding client statistics (traffic, ip, username).

Have you thought of FlexConnect?

Regards,

Aaron

[azeemo157]

hi all, thanks for the reply. I did read about HREAP but the question that came to my mind is lets say at SITE A i have 100 access point and 1 controller. I also have controller at the HQ. Now using Hreap all the access point will register with the HQ. Now in case of WAN faliure will these access point still support all the SSID's ascoiated and the users with it using the local controller at SITE A ?

Also can this behave the other way around, as in if an access point at site A will register with the controller local at SITE A and in case the controller fails it registers with the controller at HQ.

[aaroncoffman]

Azeemo157,

Well, the 5508 only supports a maximum of 500 access points. If these sites have 6500 chassis and you were going to be utilizing WiSM2 blades which now support 1000 access points. If you did decided to go H-REAP the Flex 7510 could be a solution for you but it requires it's directly connected switch to have at least one 10gig interface. So the question really is, what kind of controllers were you looking at utilizing?

[azeemo157]

I can see that 7510 has 2 1 gig interface also. Cant it use this to connect to the switch ? Is it really required that i have 10 GIG interface ? i beleive 7510 is the controller to go for as it has scalibility upto 3000 access points. but i also beileve that an access point can have upto 3 controllers 1 primary and 2 secondary. will this also work in flexconect ? As in if i deploy flexconnect can it have 1 primary controller and 2 backup controller ?

[Scott Fella]

The 7500 has two 10 gig connections that can be used. So you will need a 10 gig module to connect that to. You don't need to use a tertiary wlc unless you have one available. Usually two is good enough. Again.. You need to decide if you want to go local or h-reap. You can go either way, but why put one wlc in HQ and the other at the remote site. If your concern is 100% redundancy, then put two out at each site. If you have more money to use, then add another WLC at HQ for your tertiary. Now I don't think you need more than a 5508-500 at HQ because the percentage of loosing all 6 sites WLC's is pretty slim. If you go h-reap, then put the WLC's at HQ. Get 3 5508-500 for redundancy unless you have the WiSM2. If you have 10gig, then two 7500's will do. You have many options.

Thanks,

Scott Fella

Sent from my iPhone

[aaroncoffman]

The 7510 absolute requires the 10 gig interface be utilized.

The 7510 is also H-REAP (FlexConnect) only. You cannot use local mode, monitor mode, mesh mode at this time.

Any AP in any mode can have a Primary, Secondary and tertiary controller.

The biggest difference between FlexConnect and local mode is that in FlexConnect the traffic can be dropped local to the AP. Where as in local mode the traffic is tunneled back to the controller.

That is why I suggested FlexConnect. FlexConnect also offers standalone mode so even if connectivity to the controller is lost users can still utilize wireless, unless they're using webauth.

One thing to keep in mind is that capwap needs a one to one NAT. PAT cannot be used.

Sent from Cisco Technical Support iPhone App

[Scott Fella]

The WLC's just need to have the same SSIDs and AP Groups to make this work. You have a unique setup because of one wlc at HQ and a wlc at the remote site. If the limitations of H-REAP doesn't pertain to you, then it should be an option for you to look at. It really doesn't matter which wlc is primary or secondary because the AP's will place traffic on the local subnet.

Sent from Cisco Technical Support iPhone App

[azeemo157]

The client requires authentication, so there will be ACS deployed at the HQ. this will cater to all the remote sites. Also there is MSE with IPS as i also require Rouge AP detection. There will be Access points at each remote site which will be configured in monitor mode only. So in flex conect will this not work ? 

[aaroncoffman]

The 7510 Flex Controller would not work for this particular application at this time. Although you could still utilize FlexConnect APs if you dont need AAA override. If you don't have 6500 chassis it looks like your option is only the tried an true 5508.

In your situation redundant controllers offsite seems pointless since you'll be leveraging an ACS at the HQ, unless you'll have redundant ACS servers offsite.

Sent from Cisco Technical Support iPhone App

Sent from Cisco Technical Support iPhone App

[azeemo157]

Hi Aaron

Can u please confirm the following, since the client says that he needs a local controller i cannot help it but give him one and one at the HQ. I have a total of 600 AP's so i am planning to register 300 with 1 controller and 300 at the other at the HQ. Now if i have the primary controller for the AP to be the one local to the site and the secondary one to be at the HQ and ACS is situated at the HQ, will it work ? The only issue is if the WAN link is down then then the authentication via ACS wil not work. correct ?

[aaroncoffman]

As long as the controller has connectivity to the ACS you should be good.

If you lose the either controller, assuming you have a 500 count license on both controllers you will have 100 access points that will not be able to associate with a controller. If you plan accordingly you can set the failover priority on the access points to try and reduce the negative ramifications of this. The negative ramifications are dependent of the deployment type and scenario of course.

Sent from Cisco Technical Support iPhone App

[Scott Fella]

Is your WAN bandwidth large enough for traffic to be in local mode back to HQ? Since you decided h-reap will not work, this means all traffic will run back to the WLC since the APs will be in local mode. If the APs are primary to the local site or vice versa, any AP's that move from one WLC to another will force users to re-associate and obtain a new ip address from the wlc the AP just joined. So what you have to consider, since you need a wlc at HQ, is if your WAN can handle a whole site, 100+ AP, in local mode. That is why in your situation, it might be best to have two WLC's at each site. Just my opinion.

Sent from Cisco Technical Support iPhone App