Arubaos 8: Understanding Aruba Airgroup Principles
Total Page:16
File Type:pdf, Size:1020Kb
ArubaOS 8: Understanding Aruba AirGroup Principles Herman Robers, EMEA Security CSE October 2019 #ArubaAirheads Agenda • AirGroup Basics • Centralized vs Distributed • Best Practices • How to configure and verify #ArubaAirheads 2 From the End User perspective #ArubaAirheads 3 From the End User perspective Display Print Listen Control #ArubaAirheads 4 (1) Discovery & Communication [mDNS Query] – Step 1: Discovery. mDNS (5353) or SSDP (1900) is used to discover services offered #ArubaAirheads 5 (2) Discovery & Communication [mDNS unicast response] #ArubaAirheads 6 (1) Discovery & Communication [mDNS Query] – Step 1: Discovery. mDNS (5353) or SSDP (1900) is used to discover services offered #ArubaAirheads 7 (2) Discovery & Communication [mDNS unicast response] #ArubaAirheads 8 (1) Discovery & Communication [SSDP Query] – Step 1: Discovery. mDNS (5353) or SSDP (1900) is used to discover services offered #ArubaAirheads 9 (2) Discovery & Communication [SSDP Response] #ArubaAirheads 10 (3) Discovery & Communication [client -> server unicast] Direct communication client to printer/speaker/tv #ArubaAirheads 11 Designed for home use – used in Enterprise –Designed for consumer/home use: Assumes single L2 domain and open communication. –Challenges when used in the Enterprise: - The (multicast) discovery does not cross L2 boundaries / subnets - If it would work across subnets, scale and usability is an issue: - Large lists are unusable to find your local resource - Lot of airtime used for the multicast discovery in larger subnets - Who is allowed to use services? - Communication across the subnet possible? #ArubaAirheads 12 (3) Discovery & Communication [client -> server unicast] Direct communication client to printer AirGroup will just take care of the Discovery. Make sure the unicast traffic is possible! - Inter-user traffic (SSID) - Inter-VLAN traffic (Firewall, guests-VLAN?) - Role based access firewall rules #ArubaAirheads 13 AirGroup Overview • Enterprise class Zero-Configuration-Networking for Bonjour & DLNA services, and SSDP • Mobility Master (Centralized mode) / Mobility Controller (Distributed mode) / Instant AP terminates mDNS/SSDP multicast messages • Unicast responses to queries • Context-awareness of services across network • Supported in tunnel and decrypt-tunnel forwarding modes • Supports both wired and wireless devices • ClearPass Policy Manager for device (self) registration & sharing policies #ArubaAirheads 14 AirGroup Support – Aruba Instant (6.x/8.x) – Mobility Master-Managed Device (8.x) Centralized mode (AirGroup runs on MM) Distributed mode (AirGroup runs on MD) – Master Controller Mode (6.x/8.x) – Stand-alone Controller (6.x/8.x) #ArubaAirheads 15 FYI: Bonjour, mDNS, DLNA, SSDP, UPnP Apple Bonjour (marketing name) is used by most Apple Devices for service discovery and uses mDNS (udp 5353 multicast). DLNA (Digital Living Network Alliance, marketing name) uses SSDP (Simple Service Discovery Protocol, udp 1900 multicast) for discovery. SSDP was incorporated into the UPnP protocol stack. For this presentation: Bonjour = mDNS and DLNA = SSDP #ArubaAirheads 16 Exception: Bluetooth Discovery and AirGroup for AppleTV Where AirGroup was equivalent to AppleTV Airplay, it isn’t anymore: – Bluetooth Discovery: Apple device to discover an Apple TV that is within the Bluetooth range. –AirGroup supports only mDNS-based device discovery and does not support Bluetooth based device discovery mechanism. –Bluetooth cannot be disabled – Ad-hoc WiFi network: Apple TV Generation 3+ when connected wirelessly will form an ad-hoc network between the client and the Apple TV, which will bypass the existing WiFi network. –Ad-hoc can be disabled under the management profile for organized-owed Apple TV’s (AirPlay Security) #ArubaAirheads 17 What does AirGroup do? Periodic query for services Block mDNS/SSDP Build server table Build user table Proxy services (filtered, unicast) 1) Block multicast mDNS/SSDP between clients on the network 2) Based on the blocked packets, build a table of clients 3) AP/MD Actively query available services, build table of services 4) Proxy services to clients (even across subnets, across wired/wireless) 5) Filter service discovery based on Role/VLAN/ClearPass #ArubaAirheads 18 AirGroup in more detail #ArubaAirheads 19 (1) Discovery & Communication [mDNS Query] 192.168.31.10 = Mobility Master #ArubaAirheads 20 Centralized vs Distributed – Centralized Distributed • MM contains all AirGroup info • Operates the same as in 6.x • MM sends RADIUS requests to ClearPass • Roaming can be an issue between MDs when configured • Same scaling numbers as 6.x • Uses Openflow to get mDNS/Bonjour/SSDP/DNLA messages from the MD to the MM • All config must be placed in /md • Wired devices and duplication #ArubaAirheads 21 Best Practices – Centralized Distributed • Only enable services that are going to be used • Useful when there are many small sites • 2 or less controllers • Disable openflow on roles that do not use mDNS • Bandwidth / latency constraints. • Block mDNS in the roles that do not need • One MM for world in US and sites in Asia airgroup with low bandwidth/high latency • Limit servers to locations • No not use limiters such as AP Group. • Check messaging rates • Auto associate ap-name doesn’t apply for wired devices • If you want to apply policies to wired devices, use MAC address based policy with ClearPass or CLI • Auto associate for wireless is recommended for optimum performance #ArubaAirheads 22 AOS 8 – AirGroup working reference: Wired device using Dynamic AOS 8 version Wired device Without Dynamic Segmentation Segmentation 8.2.1.x Yes No (Note 1) 8.3.0.x Yes No (Note 1) 8.4.0.x Yes Yes Note 1: Due to an issue with an OpenFlow bug, the AirGroup device is not being picked up through the tunnel (Bug # 176930) #ArubaAirheads 23 Scalability AOS 8 - Centralized – AirGroup can scale to support up to 100,000 devices in which up to 17,000 servers can exist. – In centralized mode, on Mobility Master, the mDNS packet limit is 1750 pps. In mixed mode, the mDNS packet limit of 1750 pps applies only for centralized mode. #ArubaAirheads 24 Scalability limits are based on: Memory Utilization • Memory utilization is affected by; • AirGroup servers and Users, • Total number of AirGroup servers and users cannot exceed the limit defined by the top end stand- alone controller CPU Utilization • CPU utilization is measured by the rate at which a stand-alone controller receives mDNS packets per second. • The rate of mDNS packets per second depends on the number of AirGroup servers, users, and number of applications installed on these devices. • When the number of mDNS packets per second exceeds the limit, AirGroup drops the additional packets (Centralized – dropped at MM, in Distributed at limit of MC’s (Mobility Controllers)) #ArubaAirheads 25 Scalability Limit in Stand-alone or Distributed Controller AOS 8 AOS 8.x AOS 8.x Stand-alone Controller Model Servers Users 7240 10000 20000 7220 7000 15000 7210 5000 10000 7205 2000 6000 7030 1000 3000 7024 600 1400 7010 500 1500 7005 300 700 Note: This data is taken from the 8.2.1.0 and 8.3.0.0 User Guides #ArubaAirheads 26 mDNS Packet Limits in Stand-alone Controller or Distributed Mode Stand-alone Controller Model or Distributed Mode mDNS packets per second (pps) Mobility Master – in centralized Mode (10k) 1750 7280 150 (Note 1) 7240 150 7220 90 7210 90 7205 60 7030 75 7024 75 7010 45 7005 45 Note 1: In the 8.3.0.x User Guide there is an error showing 7280 supporting 1750 PPS. Note 2: This data is taken from the 8.2.1.0 and 8.3.0.0 User Guides Note 3: Command to determine the number of mDNS packets received per second by a managed device: show airgroup internal-state statistics #ArubaAirheads 27 Centralized mode: Open Flow Packet Forwarding – After Open Flow connection has been established between the Mobility Master and the managed node, the MM sends OF Flows to the MD. – When AirGroup is enabled(mDNS and DLNA) then 2 flows are pushed to the MD. – When AirGroup IPv6 is enabled, then 2 more flows are pushed to the MD IPv4/IPv6 – When AirGroup Vlan Aggregation is enabled then 1 more flow is pushed to the MD mDNS Open flow-table details on controller, pushed from MM: (EmeaEvent01) #show openflow flow-table | include 5353,1900,60001 * * * 0x86dd ::/0 ::/0 17 * 5353 (Output:controller) * * * 0x800 * * 17 * 1900 (Output:controller) * * * 0x86dd ::/0 ::/0 17 * 1900 (Output:controller) * * * 0x800 * * 17 * 5353 (Output:controller) * * * 0x800 192.168.4.5 222.173.190.239 17 60001 60001 (Output:controller) Flow for mDNS packet: port 5353 IPv4/IPv6 DLNA VLAN AGGREGATION 192.168.4.5 = MD ‘o’ represents open flow #ArubaAirheads 28 Fun fact: Open Flow Packet Forwarding 222.173.190.239 in hex: de.ad.be.ef (0xdeadbeef) 186.173.202.254 in hex: ba.ad.ca.fe (0xbaadcafe) http://www.catb.org/jargon/html/D/DEADBEEF.html: DEADBEEF: /dedbeef/, n.The hexadecimal word-fill pattern for freshly allocated memory under a number of IBM environments, including the RS/6000. Some modern debugging tools deliberately fill freed memory with this value as a way of converting heisenbugs into Bohr bugs. As in “Your program is DEADBEEF” (meaning gone, aborted, flushed from memory); if you start from an odd half-word boundary, of course, you have BEEFDEAD. See also the anecdote under fool and dead beef attack. #ArubaAirheads 29 VLAN Aggregation – AP VLAN aggregation allows the discovery of wired mDNS or SSDP devices which do not have L2 connectivity with the Mobility Master or a stand-alone controller or which do not trunk on the Mobility Master or a stand-alone controller. – An AP, which is in the same VLAN as the wired mDNS or SSDP device which does not trunk on Mobility Master or a stand-alone controller receives and forwards the mDNS or SSDP packets from the wired mDNS or SSDP devices to the Mobility Master or a stand-alone controller. – The AP forms a separate split tunnel (0x8000) and aggregates all mDNS or SSDP traffic. Up to 4094 VLANs are supported.