WEBVTT

1
00:00.000 --> 00:05.600
So we just got done talking about this concept of an anchor controller and a

2
00:05.600 --> 00:11.840
foreign controller. The idea here is that even though I'm attached currently,

3
00:11.840 --> 00:17.520
here's my wireless station, my laptop, I'm attached to a access point that is

4
00:17.520 --> 00:23.600
then attached to the foreign wireless LAN controller and even though I'm here

5
00:23.600 --> 00:23.840
on

6
00:23.840 --> 00:29.980
the right, I am part of a subnet, let's say 10.10.5.x once again. I'm part of

7
00:29.980 --> 00:35.150
a subnet that lives over here where this other wireless LAN controller lives.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:29.980 --> 00:35.150
a subnet that lives over here where this other wireless LAN controller lives.

8
00:35.150 --> 00:35.260
So

9
00:35.260 --> 00:40.160
this is going to have a trunked connection down to some kind of multi-layer

10
00:40.160 --> 00:40.540
switch

11
00:40.540 --> 00:47.630
and maybe there's an SVI here for the 10.10.5 subnet. So if we think about it

12
00:47.630 --> 00:47.700
from

13
00:47.700 --> 00:53.060
a routing perspective, if for example I've got a core switch here in the middle

14
00:53.060 --> 00:53.260
and

15
00:53.260 --> 00:58.820
so this is doing multi-layer functionality and it gets a packet in

16
00:58.820 --> 01:07.310
that's destined for 10.10.5.x whatever this host is, then we're going to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:58.820 --> 01:07.310
that's destined for 10.10.5.x whatever this host is, then we're going to

17
01:07.310 --> 01:07.700
forward it

18
01:07.700 --> 01:13.700
to this layer three device which would mean that it can be delivered to what

19
01:13.700 --> 01:18.460
appears to be the wrong wireless LAN controller. But because we have this

20
01:18.460 --> 01:24.590
relationship between anchor and foreign controller, now when the packet gets

21
01:24.590 --> 01:24.780
sent

22
01:24.780 --> 01:29.240
through the layer three network, so this is part of the layer three world now,

23
01:29.240 --> 01:29.820
it's

24
01:29.820 --> 01:36.380
going to get delivered to the anchor side and then it will get forwarded to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:29.820 --> 01:36.380
going to get delivered to the anchor side and then it will get forwarded to the

25
01:36.380 --> 01:41.460
foreign controller and then to where it belongs. It's a little bit of a, well I

26
01:41.460 --> 01:45.060
wouldn't say the most efficient path thing in the world but it does make

27
01:45.060 --> 01:50.100
something give us an interesting architecture, something that we might be

28
01:50.100 --> 01:53.860
able to do a little bit more with this than we were doing before. Because

29
01:53.860 --> 01:54.220
before

30
01:54.220 --> 01:57.940
what we were doing was saying, "Hey I've got an access point over here, I start

31
01:57.940 --> 02:02.540
here, I roam over here through this layer three boundary and I use the anchor
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:57.940 --> 02:02.540
here, I roam over here through this layer three boundary and I use the anchor

32
02:02.540 --> 02:02.740
and

33
02:02.740 --> 02:07.860
foreign controller in order to stay on my old subnet." That's cool. But what if

34
02:07.860 --> 02:08.140
I

35
02:08.140 --> 02:15.540
use this as my starting point? So I start on the right, I call that my foreign

36
02:15.540 --> 02:19.940
controller and now I define my anchor controller somewhere else. What does

37
02:19.940 --> 02:26.300
this accomplish? What it accomplishes is it places my wireless stations point

38
02:26.300 --> 02:26.460
of

39
02:26.460 --> 02:31.300
presence over here where the anchor controller is. Because remember the first
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
02:26.460 --> 02:31.300
presence over here where the anchor controller is. Because remember the first

40
02:31.300 --> 02:36.540
time the network truly sees traffic from this station, my underlying got a

41
02:36.540 --> 02:40.100
little out of control there, but the first time it sees a packet from this

42
02:40.100 --> 02:45.300
wireless station, it's here. Coming from the anchor wireless lane controller as

43
02:45.300 --> 02:45.460
it

44
02:45.460 --> 02:49.860
arrives on whatever upstream layer two network exists and eventually probably

45
02:49.860 --> 02:56.340
gets routed to the layer three world. So why would I want a wireless device to

46
02:56.340 --> 03:02.260
show up, have a point of presence, in a location where it isn't? It's not in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:56.340 --> 03:02.260
show up, have a point of presence, in a location where it isn't? It's not in

47
03:02.260 --> 03:02.460
that

48
03:02.460 --> 03:07.690
location, it's over here where we've now said that it's starting out attached

49
03:07.690 --> 03:08.060
to

50
03:08.060 --> 03:12.540
the foreign controller. Well a great application for this would be guest

51
03:12.540 --> 03:18.540
access. And the idea here is we can create a guest anchor controller and this

52
03:18.540 --> 03:18.660
is

53
03:18.660 --> 03:25.860
going to assist us with our security and specifically with the isolation of our

54
03:25.860 --> 03:33.660
guest network. So our guests, our wireless stations are showing up in our space
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
03:25.860 --> 03:33.660
guest network. So our guests, our wireless stations are showing up in our space

55
03:33.660 --> 03:33.660
,

56
03:33.660 --> 03:38.060
let's say we're a hospital or maybe we're a library or something like that. And

57
03:38.060 --> 03:46.180
we're offering Wi-Fi not only to our guests but also to our employees. So now

58
03:46.180 --> 03:50.660
I have an internal device here, maybe this is a doctor's laptop or the

59
03:50.660 --> 03:55.490
librarian's laptop, and it's communicating with the exact same access point as

60
03:55.490 --> 03:56.260
this

61
03:56.260 --> 04:03.020
here, this is just my happy user that's trying to use the Wi-Fi. Well where
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
03:56.260 --> 04:03.020
here, this is just my happy user that's trying to use the Wi-Fi. Well where

62
04:03.020 --> 04:08.140
exactly would we want this user to be? We don't necessarily love the fact that

63
04:08.140 --> 04:13.860
the user that's logging in here is part of the same network as my internal

64
04:13.860 --> 04:14.300
users.

65
04:14.300 --> 04:20.340
In fact if we think about it, what our guests really want in most cases and

66
04:20.340 --> 04:26.110
really all we're offering them is access to none other than the internet. I don

67
04:26.110 --> 04:26.300
't

68
04:26.300 --> 04:31.860
need to give them access to the servers and the resources that exist here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
04:26.300 --> 04:31.860
need to give them access to the servers and the resources that exist here

69
04:31.860 --> 04:36.620
wherever I am, my headquarters location or again my hospital or whatever the

70
04:36.620 --> 04:41.540
situation is. They don't need access to those internal resources. Normally I

71
04:41.540 --> 04:41.740
would

72
04:41.740 --> 04:46.300
just use VLANs to isolate them but now I can go a step further. I can use the

73
04:46.300 --> 04:46.580
guest

74
04:46.580 --> 04:51.370
anchor. What this now allows me to do, let's just draw this over here now, let

75
04:51.370 --> 04:51.500
's

76
04:51.500 --> 04:58.540
say that my guest anchor is out in this space and where would I want it to be?

77
04:58.540 --> 05:07.980
Well where I can put it is on the other side of my firewall. In fact I can use
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
04:58.540 --> 05:07.980
Well where I can put it is on the other side of my firewall. In fact I can use

78
05:07.980 --> 05:16.820
the firewall to effectively allow my guest users to be transported to the guest

79
05:16.820 --> 05:22.380
anchor controller and then pass the traffic through the firewall to get out

80
05:22.380 --> 05:30.340
to the internet. Now what I've done is I've created an isolated guest network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
05:22.380 --> 05:30.340
to the internet. Now what I've done is I've created an isolated guest network

81
05:30.340 --> 05:37.500
using an anchor controller that lives in the DMZ. The DMZ is that funny space

82
05:37.500 --> 05:41.220
where it's not on the internet. I didn't say put the wireless lane controller

83
05:41.220 --> 05:45.780
outside the firewall down here. That would be bad for our users or at least

84
05:45.780 --> 05:49.940
we're not really taking good care of our guests because we're just placing them

85
05:49.940 --> 05:53.740
right onto the internet and we're not firewalling any of that traffic. But

86
05:53.740 --> 05:58.180
instead I can place it adjacent to the firewall so it's not on my internal

87
05:58.180 --> 06:02.820
network here but it's also not directly on the internet instead it's part of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
05:58.180 --> 06:02.820
network here but it's also not directly on the internet instead it's part of

88
06:02.820 --> 06:08.730
that DMZ. So the guest anchor architecture is a great way to leverage this

89
06:08.730 --> 06:09.180
anchor

90
06:09.180 --> 06:13.740
and foreign concept to transport my guests so that their point of presence

91
06:13.740 --> 06:18.740
is in the DMZ. I still offer some basic protections with the firewall to allow

92
06:18.740 --> 06:22.820
for outgoing traffic flows without allowing them to just have face the

93
06:22.820 --> 06:27.540
full waves of what comes in from the internet. And so I'm doing right by them

94
06:27.540 --> 06:32.340
there and at this point I don't need to worry about my guests either being
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
06:27.540 --> 06:32.340
there and at this point I don't need to worry about my guests either being

95
06:32.340 --> 06:37.140
nefarious or otherwise unwittingly potentially serving as launch points

96
06:37.140 --> 06:41.500
for attacks in my internal network.