Anyfi Networks Carrier Wi-Fi System User manual

1 of 25
Anyfi Networks
Carrier Wi-Fi System
GATEWAY
REFERENCE GUIDE
Overview
Installation
Basic Configuration
Wi-Fi Client Isolation
Wi-Fi Security Settings
IEEE 802.1X and EAP
RADIUS for AAA
GRE for Payload
System Monitoring
Västergatan 31 B
21121 Malmö
Sweden
[e-mail]

2 of 25
COPYRIGHT
Copyright © 2013-2014 Anyfi Networks AB
NOTICES
Anyfi Networks proprietary.
Anyfi is a registered trademark of Anyfi Networks AB.
All other trademarks are the property of their respective owners.
RELEASE DATE: 14th of April 2014
DOCUMENT REVISION: R1C v11
RELEASED WITH: CARRIER WI-FI SYSTEM R1C

iii
GATEWAY REFERENCE GUIDE R1C
iii of 25
Contents
Preface ............................................................................................................................................v
Intended Audience...........................................................................................................................v
Document Conventions....................................................................................................................v
Advisory Paragraphs .................................................................................................................v
Typographic Conventions......................................................................................................... vi
Chapter 1: Functionality Overview...............................................................................................1
Concepts and Principles..................................................................................................................2
Tunnel Termination Point...........................................................................................................2
Service.......................................................................................................................................2
Chapter 2: Installation...................................................................................................................3
Installing as a Virtual Appliance.......................................................................................................3
Installing as a Vyatta Package.........................................................................................................3
Upgrading to a Newer Version.........................................................................................................5
Chapter 3: Configuration...............................................................................................................6
Basic Networking .............................................................................................................................6
Basic Examples................................................................................................................................7
Open Wi-Fi.................................................................................................................................7
Secure Wi-Fi..............................................................................................................................7
Wi-Fi Client Isolation........................................................................................................................8
Wi-Fi Security Settings.....................................................................................................................9
RADIUS Settings............................................................................................................................10
Authentication..........................................................................................................................10
Authorization............................................................................................................................10
Accounting...............................................................................................................................11
SDWN Settings..............................................................................................................................11
Controller .................................................................................................................................12

iv
GATEWAY REFERENCE GUIDE R1C
iv of 25
UDP/IP Port Range..................................................................................................................12
Load Balancing and Failover...................................................................................................13
Chapter 4: Integration..................................................................................................................14
RADIUS for AAA............................................................................................................................14
Authentication..........................................................................................................................14
Authorization............................................................................................................................15
Accounting...............................................................................................................................17
GRE for User Payload ...................................................................................................................18
SNMP for System Monitoring.........................................................................................................18

v
GATEWAY REFERENCE GUIDE R1C
v of 25
Preface
This document details how to install, configure and integrate the Gateway component of
our Carrier Wi-Fi System.
Intended Audience
This document is intended for system and network administrators. Readers should have
specific knowledge in the following areas:
Networking and data communications
Internet protocol (IP)
Readers lacking experience with the Vyatta Network OS are encouraged to study its
online documentation.
Readers lacking a basic understanding of Software-Defined Wireless Networking
(SDWN) concepts are encouraged to study the materials available at
www.anyfinetworks.com/resources.
Document Conventions
This guide contains advisory paragraphs and uses the below typographic conventions.
Advisory Paragraphs
This guide uses the following advisory paragraphs:
Warnings alert you to situations that may pose a threat to your system or subscriber's
security, as in the following example:
WARNING Bridging unauthenticated Wi-Fi traffic to a network interface may
pose a security threat to the associated network.
Cautions alert you to situations that might affect service, as in the following example:
CAUTION Restarting a running system will interrupt service.
Notes provide important information about the structure or functioning of the system, as

vi
GATEWAY REFERENCE GUIDE R1C
vi of 25
in the following example:
NOTE The Controller is a controller in the Software-Defined Networking (SDN)
sense of the word, not in the typical corporate WLAN sense.
Typographic Conventions
This document uses the following typographic conventions:
Monospace
Examples, command-line output, and representations of
configuration nodes.
Also commands, keywords, and file names, when mentioned
inline.
bold Monospace
Your input: something you type at a command line.
italics
An argument or variable where you supply a value.
Also concepts and principles when mentioned inline.
<key>
A key on your keyboard, such as <Enter>. Combinations of keys
are joined by plus signs (“+”), as in <Ctrl>+c.
[ arg1 | arg2]
Enumerated options for completing a syntax. An example is
[enable | disable].
num1–numN
A inclusive range of numbers. An example is 1–65535, which
means 1 through 65535, inclusive.
arg1..argN
A range of enumerated values. An example is eth0..eth3, which
means eth0, eth1, eth2, or eth3.
arg[ arg...]
arg[,arg...]
A value that can optionally represent a list of elements (a space-
separated list in the first case and a comma-separated list in the
second case)

1
GATEWAY REFERENCE GUIDE R1C
1 of 25
Figure 1: The Gateway integrated towards a Wi-Fi Gateway in a 3GPP mobile core.
Chapter 1: Functionality Overview
The Software-Defined Wireless Networking (SDWN) architecture separates the radio
access problem from service definition. The Gateway network element plays an essential
role in the latter area, allowing an operator to design and implement a carrier Wi-Fi
service in the trusted environment of a data center or mobile core, safe in the knowledge
that the radio access problem can be separately addressed later.
The Gateway implements an IEEE 802.11 stack, complete with WPA and WPA2
security; CCMP (AES) and TKIP (RC4) ciphers; Pre-Shared Key (PSK) and IEEE
802.1X authentication; and RADIUS interfaces for authentication, authorization and
accounting.
NOTE The Gateway serves as a gateway in the Software-Defined Wireless
Networking (SDWN) sense; it processes IEEE 802.11 frames coming in and going out
on SDWN data plane tunnels. While the Gateway can also be configured as an IP
gateway we recommend operating it as a pure Layer 2 element instead.

2
GATEWAY REFERENCE GUIDE R1C
2 of 25
Concepts and Principles
In this section we introduce some basic concepts and principles that we will use when
configuring the Gateway.
Apart from the concepts introduced below you should also be familiar with the following
IEEE 802.11 terms:
Station (STA)
Basic Service Set (BSS)
Extended Service Set (ESS)
Service Set Identifier (SSID)
Please refer to the IEEE 802.11 standard for their definitions.
Tunnel Termination Point
In terms of interfaces the Gateway resembles a carrier-grade Wi-Fi access point, except
that it sends and receives raw (encrypted) IEEE 802.11 frames not over radio but over
UDP/IP based SDWN data plane tunnels. Reflecting this resemblance with an access
point (AP) refer to it as a tunnel termination point (TTP).
There is however one noteworthy difference between an access point and the Gateway:
scale. An access point typically contributes one or two Basic Service Sets (BSSes) to an
Extended Service Set (ESS). A single Gateway can contribute millions: all the virtual
access points allocated on connected SDWN radios.
Service
The IEEE 802.11 standard refers to a logical network as an Extended Service Set (ESS),
which in turn consists of Distribution System (DS) and a number of Basic Service Sets
(BSS). An ESS is uniquely identified by its Service Set Identifier (SSID), a 32-byte string
containing the Wi-Fi network name. All access points within the ESS must thus be
configured with the same SSID.
We use the term service to refer to a logical network (essentially synonymous with ESS in
an IEEE 802.11 context). The Software-Defined Wireless Networking (SDWN)
architecture however operates on a scale (potentially millions of ESSes in a single
system) at which it is difficult to ensure the uniqueness of SSIDs. We therefore use a
Universally Unique Identifier (UUID), the service UUID, to uniquely identify a service.
All tunnel termination points providing access to a service must be configured with the
same SSID and service UUID.

3
GATEWAY REFERENCE GUIDE R1C
3 of 25
Chapter 2: Installation
We use the Vyatta Network OS as the base operating system for the Gateway. This
ensures access to advanced IP networking functionality on a secure and trusted platform,
and also facilitates installation in many different environments.
This software has been verified on the following versions of the Vyatta Network OS:
Vyatta Core 6.5
Vyatta Core 6.6
Brocade Vyatta 5400 vRouter
The above operating systems can be run on all major hypervisors as well as bare metal
x86 hardware. We provide software for both 32-bit and 64-bit architectures, but a 64-bit
OS is recommended.
Installing as a Virtual Appliance
We make example SDWN cores with integrated Gateways available at
www.anyfinetworks.com/download. These are distributed in Open Virtual Appliance
(OVA) format, essentially a bundle of virtual machines in one file. Each OVA file comes
with a Getting Started Guide containing step-by-step instructions on how to import the
example core in Oracle VM VirtualBox.
Installing as a Vyatta Package
It can sometimes be beneficial to install the Gateway software onto a running Vyatta
system. One example is public clouds like Amazon AWS, where AMIs for the supported
base operating systems are readily available. Another example is when the operator
wishes to use physical hardware for the installation. Vyatta Network OS can then be
installed on the hardware, followed by Gateway software.
First configure the Vyatta system to use Anyfi Networks’ software repository.
Enter configuration mode
vyatta@vyatta:~$ configure
[edit]
Add Anyfi Networks’
package repository
vyatta@vyatta# edit system package repository anyfi
[edit system package repository anyfi]
vyatta@vyatta# set url http://packages.anyfinetworks.com/vyatta

4
GATEWAY REFERENCE GUIDE R1C
4 of 25
[edit system package repository anyfi]
vyatta@vyatta# set components "main contrib non-free"
[edit system package repository anyfi]
vyatta@vyatta# set distribution stable
[edit system package repository anyfi]
vyatta@vyatta# top
[edit]
Review changes
vyatta@vyatta# show system package repository
+repository anyfi {
+ components "main contrib non-free"
+ distribution stable
+ url http://packages.anyfinetworks.com/vyatta
+}
repository community {
components main
distribution stable
password ""
url http://packages.vyatta.com/vyatta
username ""
}
[edit]
Commit, save and exit
configuration mode
vyatta@vyatta# commit
vyatta@vyatta# save
vyatta@vyatta# exit
Add Anyfi Networks’ PGP
key
vyatta@vyatta$ wget \
http://packages.anyfinetworks.com/vyatta/pubkey.gpg -O - | \
sudo apt-key add –
Update the software
package database
vyatta@vyatta$ sudo apt-get update
Once the repository has been added to the system installation of the Gateway software is
trivial.
Install the Gateway
software
vyatta@vyatta:~$ sudo apt-get install -y \
anyfi-gateway vyatta-anyfi-gateway
This will install two packages: vyatta-anyfi-gateway containing the Vyatta CLI
integration for the Gateway and anyfi-gateway containing the Gateway software
itself.
NOTE The Gateway software is freely available as part of the Community Edition
of our Carrier Wi-Fi System. Community Edition is unsupported and restricted to a
maximum of 100 radios and services, but can be used for both commercial and non-
commercial purposes. Contact [e-mail] regarding other licensing
options.