Anyfi networks Carrier wi-fi system User manual

1 of 25

Anyfi Networks

Carrier Wi-Fi System

GATEWAY

REFERENCE GUIDE

Overview

Installation

Basic Configuration

Wi-Fi Client Isolation

Wi-Fi Security Settings

IEEE 802.1X and EAP

RADIUS for AAA

GRE for Payload

System Monitoring

Västergatan 31 B

21121 Malmö

Sweden

info@anyfinetworks.com

2 of 25

NOTICES

Anyfi Networks proprietary.

Anyfi is a registered trademark of Anyfi Networks AB.

All other trademarks are the property of their respective owners.

RELEASE DATE: 14th of April 2014

DOCUMENT REVISION: R1C v11

RELEASED WITH: CARRIER WI-FI SYSTEM R1C

iii

GATEWAY REFERENCE GUIDE R1C

iii of 25

Contents

Preface ............................................................................................................................................v

Intended Audience...........................................................................................................................v

Document Conventions....................................................................................................................v

Advisory Paragraphs .................................................................................................................v

Typographic Conventions......................................................................................................... vi

Chapter 1: Functionality Overview...............................................................................................1

Concepts and Principles..................................................................................................................2

Tunnel Termination Point...........................................................................................................2

Service.......................................................................................................................................2

Chapter 2: Installation...................................................................................................................3

Installing as a Virtual Appliance.......................................................................................................3

Installing as a Vyatta Package.........................................................................................................3

Upgrading to a Newer Version.........................................................................................................5

Chapter 3: Configuration...............................................................................................................6

Basic Networking .............................................................................................................................6

Basic Examples................................................................................................................................7

Open Wi-Fi.................................................................................................................................7

Secure Wi-Fi..............................................................................................................................7

Wi-Fi Client Isolation........................................................................................................................8

Wi-Fi Security Settings.....................................................................................................................9

RADIUS Settings............................................................................................................................10

Authentication..........................................................................................................................10

Authorization............................................................................................................................10

Accounting...............................................................................................................................11

SDWN Settings..............................................................................................................................11

Controller .................................................................................................................................12

GATEWAY REFERENCE GUIDE R1C

iv of 25

UDP/IP Port Range..................................................................................................................12

Load Balancing and Failover...................................................................................................13

Chapter 4: Integration..................................................................................................................14

RADIUS for AAA............................................................................................................................14

Authentication..........................................................................................................................14

Authorization............................................................................................................................15

Accounting...............................................................................................................................17

GRE for User Payload ...................................................................................................................18

SNMP for System Monitoring.........................................................................................................18

GATEWAY REFERENCE GUIDE R1C

v of 25

Preface

This document details how to install, configure and integrate the Gateway component of

our Carrier Wi-Fi System.

Intended Audience

This document is intended for system and network administrators. Readers should have

specific knowledge in the following areas:

Networking and data communications

Internet protocol (IP)

Readers lacking experience with the Vyatta Network OS are encouraged to study its

online documentation.

Readers lacking a basic understanding of Software-Defined Wireless Networking

(SDWN) concepts are encouraged to study the materials available at

www.anyfinetworks.com/resources.

Document Conventions

This guide contains advisory paragraphs and uses the below typographic conventions.

Advisory Paragraphs

This guide uses the following advisory paragraphs:

Warnings alert you to situations that may pose a threat to your system or subscriber's

security, as in the following example:

WARNING Bridging unauthenticated Wi-Fi traffic to a network interface may

pose a security threat to the associated network.

Cautions alert you to situations that might affect service, as in the following example:

CAUTION Restarting a running system will interrupt service.

Notes provide important information about the structure or functioning of the system, as

GATEWAY REFERENCE GUIDE R1C

vi of 25

in the following example:

NOTE The Controller is a controller in the Software-Defined Networking (SDN)

sense of the word, not in the typical corporate WLAN sense.

Typographic Conventions

This document uses the following typographic conventions:

Monospace

Examples, command-line output, and representations of

configuration nodes.

Also commands, keywords, and file names, when mentioned

inline.

bold Monospace

Your input: something you type at a command line.

italics

An argument or variable where you supply a value.

Also concepts and principles when mentioned inline.

<key>

A key on your keyboard, such as <Enter>. Combinations of keys

are joined by plus signs (“+”), as in <Ctrl>+c.

[ arg1 | arg2]

Enumerated options for completing a syntax. An example is

[enable | disable].

num1–numN

A inclusive range of numbers. An example is 1–65535, which

means 1 through 65535, inclusive.

arg1..argN

A range of enumerated values. An example is eth0..eth3, which

means eth0, eth1, eth2, or eth3.

arg[ arg...]

arg[,arg...]

A value that can optionally represent a list of elements (a space-

separated list in the first case and a comma-separated list in the

second case)

GATEWAY REFERENCE GUIDE R1C

1 of 25

Figure 1: The Gateway integrated towards a Wi-Fi Gateway in a 3GPP mobile core.

Chapter 1: Functionality Overview

The Software-Defined Wireless Networking (SDWN) architecture separates the radio

access problem from service definition. The Gateway network element plays an essential

role in the latter area, allowing an operator to design and implement a carrier Wi-Fi

service in the trusted environment of a data center or mobile core, safe in the knowledge

that the radio access problem can be separately addressed later.

The Gateway implements an IEEE 802.11 stack, complete with WPA and WPA2

security; CCMP (AES) and TKIP (RC4) ciphers; Pre-Shared Key (PSK) and IEEE

802.1X authentication; and RADIUS interfaces for authentication, authorization and

accounting.

NOTE The Gateway serves as a gateway in the Software-Defined Wireless

Networking (SDWN) sense; it processes IEEE 802.11 frames coming in and going out

on SDWN data plane tunnels. While the Gateway can also be configured as an IP

gateway we recommend operating it as a pure Layer 2 element instead.

GATEWAY REFERENCE GUIDE R1C

2 of 25

Concepts and Principles

In this section we introduce some basic concepts and principles that we will use when

configuring the Gateway.

Apart from the concepts introduced below you should also be familiar with the following

IEEE 802.11 terms:

Station (STA)

Basic Service Set (BSS)

Extended Service Set (ESS)

Service Set Identifier (SSID)

Please refer to the IEEE 802.11 standard for their definitions.

Tunnel Termination Point

In terms of interfaces the Gateway resembles a carrier-grade Wi-Fi access point, except

that it sends and receives raw (encrypted) IEEE 802.11 frames not over radio but over

UDP/IP based SDWN data plane tunnels. Reflecting this resemblance with an access

point (AP) refer to it as a tunnel termination point (TTP).

There is however one noteworthy difference between an access point and the Gateway:

scale. An access point typically contributes one or two Basic Service Sets (BSSes) to an

Extended Service Set (ESS). A single Gateway can contribute millions: all the virtual

access points allocated on connected SDWN radios.

Service

The IEEE 802.11 standard refers to a logical network as an Extended Service Set (ESS),

which in turn consists of Distribution System (DS) and a number of Basic Service Sets

(BSS). An ESS is uniquely identified by its Service Set Identifier (SSID), a 32-byte string

containing the Wi-Fi network name. All access points within the ESS must thus be

configured with the same SSID.

We use the term service to refer to a logical network (essentially synonymous with ESS in

an IEEE 802.11 context). The Software-Defined Wireless Networking (SDWN)

architecture however operates on a scale (potentially millions of ESSes in a single

system) at which it is difficult to ensure the uniqueness of SSIDs. We therefore use a

Universally Unique Identifier (UUID), the service UUID, to uniquely identify a service.

All tunnel termination points providing access to a service must be configured with the

same SSID and service UUID.

GATEWAY REFERENCE GUIDE R1C

3 of 25

Chapter 2: Installation

We use the Vyatta Network OS as the base operating system for the Gateway. This

ensures access to advanced IP networking functionality on a secure and trusted platform,

and also facilitates installation in many different environments.

This software has been verified on the following versions of the Vyatta Network OS:

Vyatta Core 6.5

Vyatta Core 6.6

Brocade Vyatta 5400 vRouter

The above operating systems can be run on all major hypervisors as well as bare metal

x86 hardware. We provide software for both 32-bit and 64-bit architectures, but a 64-bit

OS is recommended.

Installing as a Virtual Appliance

We make example SDWN cores with integrated Gateways available at

www.anyfinetworks.com/download. These are distributed in Open Virtual Appliance

(OVA) format, essentially a bundle of virtual machines in one file. Each OVA file comes

with a Getting Started Guide containing step-by-step instructions on how to import the

example core in Oracle VM VirtualBox.

Installing as a Vyatta Package

It can sometimes be beneficial to install the Gateway software onto a running Vyatta

system. One example is public clouds like Amazon AWS, where AMIs for the supported

base operating systems are readily available. Another example is when the operator

wishes to use physical hardware for the installation. Vyatta Network OS can then be

installed on the hardware, followed by Gateway software.

First configure the Vyatta system to use Anyfi Networks’ software repository.

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Add Anyfi Networks’

package repository

vyatta@vyatta# edit system package repository anyfi

[edit system package repository anyfi]

vyatta@vyatta# set url http://packages.anyfinetworks.com/vyatta

GATEWAY REFERENCE GUIDE R1C

4 of 25

[edit system package repository anyfi]

vyatta@vyatta# set components "main contrib non-free"

[edit system package repository anyfi]

vyatta@vyatta# set distribution stable

[edit system package repository anyfi]

vyatta@vyatta# top

[edit]

Review changes

vyatta@vyatta# show system package repository

+repository anyfi {

+ components "main contrib non-free"

+ distribution stable

+ url http://packages.anyfinetworks.com/vyatta

repository community {

components main

distribution stable

password ""

url http://packages.vyatta.com/vyatta

username ""

}

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

Add Anyfi Networks’ PGP

key

vyatta@vyatta$ wget \

http://packages.anyfinetworks.com/vyatta/pubkey.gpg -O - | \

sudo apt-key add –

Update the software

package database

vyatta@vyatta$ sudo apt-get update

Once the repository has been added to the system installation of the Gateway software is

trivial.

Install the Gateway

software

vyatta@vyatta:~$ sudo apt-get install -y \

anyfi-gateway vyatta-anyfi-gateway

This will install two packages: vyatta-anyfi-gateway containing the Vyatta CLI

integration for the Gateway and anyfi-gateway containing the Gateway software

itself.

NOTE The Gateway software is freely available as part of the Community Edition

of our Carrier Wi-Fi System. Community Edition is unsupported and restricted to a

maximum of 100 radios and services, but can be used for both commercial and non-

commercial purposes. Contact sales@anyfinetworks.com regarding other licensing

options.

GATEWAY REFERENCE GUIDE R1C

5 of 25

Upgrading to a Newer Version

The Gateway software can be upgraded with the commands below.

Update the index of

configured repositories

vyatta@vyatta:~$ sudo apt-get update

Upgrade the Gateway

software

vyatta@vyatta:~$ sudo apt-get install -y \

anyfi-gateway vyatta-anyfi-gateway

Restart the Gateway

vyatta@vyatta:~$ restart anyfi gateway

Stopping anyfi gateway: anyfi-gateway.

Starting anyfi gateway: anyfi-gateway.

This will install new versions of the two packages containing the Gateway software, if

such are available in Anyfi Networks' package repository.

CAUTION Restarting the Gateway will disrupt service for associated Wi-Fi

clients.

GATEWAY REFERENCE GUIDE R1C

6 of 25

Chapter 3: Configuration

In this chapter we show how to configure the Gateway for basic as well as more advanced

use-cases.

Basic Networking

The Gateway will need at least two network interfaces; one for its SDWN data and

control plane (UDP/IP) connections and a (logical) bridge for Wi-Fi client traffic

(Ethernet). We here assume that eth1 will be used for IP connectivity to the outside

world and eth2 will be used for Wi-Fi client traffic. In Chapter 4 we discuss how Wi-Fi

client traffic can instead be tunneled out over GRE.

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Configure basic IP

networking

vyatta@vyatta# set interfaces ethernet eth1 address x.x.x.x/xx

[edit]

vyatta@vyatta# set system name-server x.x.x.x

[edit]

vyatta@vyatta# set system gateway-address x.x.x.x

[edit]

Disable IP forwarding

vyatta@vyatta# set system ip disable-forwarding

[edit]

Configure bridging

vyatta@vyatta# set interfaces bridge br0

[edit]

vyatta@vyatta# set interfaces ethernet eth2 bridge-group bridge br0

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

The Gateway should now have basic IP connectivity and name resolution. You can verify

this with the ping command.

GATEWAY REFERENCE GUIDE R1C

7 of 25

Basic Examples

In this section we provide two example Wi-Fi network configurations.

Open Wi-Fi

We start by configuring an open Wi-Fi network with the SSID "ex-open".

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Create a Gateway instance

vyatta@vyatta# edit service anyfi gateway "open-gw"

[edit service anyfi gateway open-gw]

vyatta@vyatta# set controller x.x.x.x

[edit service anyfi gateway open-gw]

vyatta@vyatta# set bridge br0

[edit service anyfi gateway open-gw]

vyatta@vyatta# set ssid "Open Wi-Fi"

[edit service anyfi gateway open-gw]

vyatta@vyatta# top

[edit]

Review changes

vyatta@vyatta# show service anyfi gateway

+gateway open-gw {

+ bridge br0

+ controller x.x.x.x

+ ssid "Open Wi-Fi"

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

The newly created service should now be registered with the Controller. For more

information on how to distribute the service to clients refer to the Reference Guide for the

Controller.

WARNING Bridging unauthenticated Wi-Fi traffic to a network interface may

pose a security threat to the associated network.

Secure Wi-Fi

We now configure a WPA2 protected Wi-Fi network with EAP authentication.

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

GATEWAY REFERENCE GUIDE R1C

8 of 25

Create a Gateway instance

vyatta@vyatta# edit service anyfi gateway "1x-gw"

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# set controller x.x.x.x

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# set bridge br0

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# set ssid "Secure Wi-Fi"

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# set wpa2

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# set authentication eap radius-server x.x.x.x

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# set authentication eap radius-secret secret

[edit service anyfi gateway 1x-gw]

vyatta@vyatta# top

[edit]

Review changes

vyatta@vyatta# show service anyfi gateway

+gateway 1x-gw {

+ authentication {

+ eap {

+ radius-secret <secret>

+ radius-server x.x.x.x

+ }

+ bridge br0

+ controller x.x.x.x

+ ssid "Secure Wi-Fi"

+ wpa2 {

+ }

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

The newly created service should now be registered with the Controller. For more

information on how to distribute the service to clients please refer to the Reference Guide

for the Controller.

Wi-Fi Client Isolation

IEEE 802.11 provides full Layer 2 connectivity between all STAs connected to the same

Extended Service Set (ESS). This is however rarely the desired user experience in a

public Wi-Fi network, as it lets users access each other's shared folders etc. Carrier-grade

Wi-Fi access points therefore often provide a configuration option for so-called client

GATEWAY REFERENCE GUIDE R1C

9 of 25

isolation. When this feature is enabled two devices connected to the same access point

will be prevented from communicating directly with each other on Layer 2.

The Gateway provides a similar configuration option:

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Enable isolation of clients

on Layer 2

vyatta@vyatta# set service anyfi gateway "open-gw" isolation

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

Enabling isolation will prevent all STAs connected to the Gateway instance from

communicating directly with each other on Layer 2.

Wi-Fi Security Settings

The Gateway supports both WPA and WPA2 security protocols. Each security protocol

can be configured to use CCMP and/or TKIP block ciphers. It is also possible to

configure the group rekey interval and whether or not to renegotiate the group key after

every disassociation (strict rekeying).

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Enable WPA2 with CCMP

only

vyatta@vyatta# set service anyfi gateway "1x-gw" wpa2 ciphers ccmp

[edit]

Enable WPA with TKIP only

vyatta@vyatta# set service anyfi gateway "1x-gw" wpa ciphers tkip

[edit]

Set the group rekey

interval is seconds

vyatta@vyatta# set service anyfi gateway "1x-gw" rekey-interval 300

[edit]

Enable strict rekeying

vyatta@vyatta# set service anyfi gateway "1x-gw" strict-rekey

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

NOTE The Gateway supports hardware AES acceleration on Intel CPUs with the

AES-NI instruction set (Sandy Bridge and later). We therefore recommend this

platform and the AES-based CCMP cipher for high throughput processing of

encrypted Wi-Fi traffic.

GATEWAY REFERENCE GUIDE R1C

10 of 25

RADIUS Settings

In this section we illustrate how to configure the Gateway to use one or several RADIUS

servers for Authentication, Authorization and Accounting (AAA). In Chapter 4 we will

go into the details of RADIUS interface capabilities.

Authentication

The Gateway implements an IEEE 802.1X pass-through authenticator and can be

configured to use an external RADIUS server for EAP authentication.

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Configure RADIUS

authentication

vyatta@vyatta# edit service anyfi gateway "1x-gw" authentication

[edit service anyfi gateway 1x-gw authentication]

vyatta@vyatta# set eap radius-server x.x.x.x

[edit service anyfi gateway 1x-gw authentication]

vyatta@vyatta# set eap radius-port xxxx

[edit service anyfi gateway 1x-gw authentication]

vyatta@vyatta# set eap radius-secret secret

[edit service anyfi gateway 1x-gw authentication]

vyatta@vyatta# top

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

All EAP types that can provide IEEE 802.11 keying material are supported, including

EAP-SIM and EAP-AKA.

Authorization

The Gateway also implements a separate authorization step, e.g. for presenting a captive

portal after authentication (PSK or EAP) has completed. Note that two separate RADIUS

servers can be configured for authentication and authorization.

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Configure RADIUS

authorization

vyatta@vyatta# edit service anyfi gateway "1x-gw" authorization

[edit service anyfi gateway 1x-gw authorization]

vyatta@vyatta# set radius-server x.x.x.x

[edit service anyfi gateway 1x-gw authorization]

vyatta@vyatta# set radius-port xxxx

[edit service anyfi gateway 1x-gw authorization]

GATEWAY REFERENCE GUIDE R1C

11 of 25

vyatta@vyatta# set radius-secret secret

[edit service anyfi gateway 1x-gw authorization]

vyatta@vyatta# top

[edit]

Commit, save and exit

configuration mode

vyatta@vyatta# commit

vyatta@vyatta# save

vyatta@vyatta# exit

Accounting

Accounting information is provided on a RADIUS interface in standard RFC2866 format.

Note that up to two RADIUS accounting servers can be configured. This is useful in cases

where separate RADIUS servers are used for authentication and authorization, and both

require accounting information.

Enter configuration mode

vyatta@vyatta:~$ configure

[edit]

Configure RADIUS

accounting

vyatta@vyatta# edit service anyfi gateway "1x-gw" accounting