Alcatel-Lucent OmniAccess 6000

WIRELESS LAN SWITCH

The Alcatel-Lucent OmniAccess 6000 (OAW-6000) Wireless LAN Switch is a new approach to scaling, securing, and managing 802.11 networks for enterprises implementing business-critical applications over wireless networks. For headquarters or campuses, the OmniAccess 6000 delivers high-performance wireless LAN with dynamic radio frequency (RF) management and advanced services such as application-aware security, wireless intrusion protection, seamless user mobility, location tracking and bandwidth management. The Alcatel-Lucent OmniAccess 6000 is a 3U high, four-slot chassis that seamlessly integrates into any layer-2/layer-3 wired network without requiring the reconfiguration of the network logically or physically. Fully redundant, the Alcatel-Lucent OmniAccess 6000 supports up to six Gigabit Ethernet uplinks to connect to the wired network. It also provides up to 72 10/100 Mbps power over Ethernet (802.3af) ports if direct connectivity to access points, layer-2 switches, servers, or computers is required. The Alcatel-Lucent OmniAccess 6000 smallest conguration supports up to 48 access points (APs), and 1 Gbps of encrypted throughput. The same OmniAccess 6000 can scale seamlessly to support up to 512 APs and 7.2 Gbps of encrypted throughput.

F E A T U R E S

Policy-based network access control

B E N E F I T S

Policy based access control and business policies are translated into network controls, and violators are detected and then blocked before anything ever happens. A single authentication security system provides the means of knowing what/who are using the network. Removes the headaches of oldfashioned manual control of wireless devices allowing the administrator to specify performance standards. Automatically disables the devices by preventing users from associating with them and noties administrator of their location for removal. Provides detection and visibility of intruders to administrators to prevent malicious wireless attacks.

Universal authentication

Adaptive radio management
Rogue and interfering access point detection
Wireless intrusion protection
Data encryption Network security Availability
Prevents intruders from eavesdropping on sensitive data through use of modern protocols. Processes traffic based on user identity and other parameters instead of just source/destination addresses. Supports business critical applications that cant tolerate downtime by providing VRRP-based hot standby, modular software design with protected memory, and automatic AP failover. Users are able to move freely without the need to restart sessions or re-authenticate each time they move in the campus. Intuitive web-based interface provides logical organization of features, while the industry-standard command line interface allows experienced network managers to be up and running quickly. Can view both wired and wireless network elements and topologies from a single screen. No reconguration of existing network components are necessary to integrated the OmniAccess WLAN platform into the network. Provides facilities for client remediation, allowing out-of-spec client devices to repair themselves.
Seamless user mobility Centralized management
Seamless wired-wireless integration Endpoint integrity
Unmatched scalability The OmniAccess 6000 is the only modular WLAN controller in the industry. It gives the ability to seamlessly grow a WLAN network by supporting as little as 48 access points (APs) and scaling up to 512 APs. The benet is a pay-as-you-grow approach to wireless LANs. By supporting and managing up to 512 APs from a single location, the OmniAccess 6000 drastically reduces the operating expenses of a WLAN infrastructure. Other approaches would require the deployment of many WLAN controllers increasing the complexity of the network. Policy-based, network access control A core feature of the Alcatel-Lucent OmniAccess 6000 is the ability to separate users into individual roles, and then apply differentiated access and authorization controls to those roles based on policy. In the past, IT managers wrote business policies, requested that users comply, and then reprimanded users who violated the policies. With AlcatelLucents OmniAccess policy based access control, business policies are

2 Alcatel-Lucent OmniAccess 6000
translated into network controls and violators are detected and then blocked before they ever gain access to the network. Access control decisions are based on congurable policy criteria, including user identity, device identity, device integrity, application used, physical location of user, time of day, authentication method, and SSID. Universal authentication Knowing who and what devices are using the network is a cornerstone of every security system. Authentication provides a means to acquire this knowledge. The Alcatel-Lucent OmniAccess 6000 supports a wide variety of authentication methods ensuring compatibility with the numerous end-user devices that are common in enterprise networks. With one security system, devices as disparate as industrial sensors, barcode scanners, IP phones, PDAs, and laptop computers are all provided appropriate levels of access.
Multiple industry-standard authentication methods are supported including 802.1x, Web-based captive portal, RSA SecureID, PPP/L2TP for VPN access, IPSec/XAUTH for VPN access, RADIUS snooping for 802.1x-proxy authentication, and MAC-address authentication. Standard authentication databases are supported, including RADIUS, and LDAP. An internal database can also be used. Adaptive radio management The Alcatel-Lucent OmniAccess 6000 allows the network manager to deploy a wireless network as effortlessly as a wired network. The RF spectrum is constantly changing as people, furniture, and equipment are moved around, making automatic control and management of the RF space a critical requirement. Adaptive radio management removes the headaches from old-fashioned manual control of these devices, allowing the administrator to specify performance standards that the radio network will constantly seek to achieve.
The Alcatel-Lucent OmniAccess 4324 used in conjunction with AlcatelLucent OmniAccess APs includes the following industry-leading radio management capabilities: Automatic channel selection Automatic power selection 3-dimensional access point (AP) location planning tool Interference detection and avoidance Coverage hole detection Congurable performance thresholds Self-healing around failed radios Radio load balancing Wireless RMON statistics Rogue access point detection The Alcatel-Lucent OmniAccess wireless system constantly scans all channels of the RF spectrum capturing native 802.11 trafc and learning about all wireless APs. A patent pending classification algorithm, determines if the detected APs are legitimate APs, rogue APs or interfering APs. An interfering AP is one that has not been authenticated to the corporate network, but is not deemed to be a potential security breach. Rogue APs are those that are deemed hazardous to the network. If rogue APs are detected, the Alcatel-Lucent OmniAccess wireless system will automatically detect and disable the devices by preventing users from associating with them. Administrators are also notified of the location of rogue APs so that they may be physically removed. Wireless intrusion protection The Alcatel-Lucent OmniAccess wireless intrusion detection capabilities eliminate the need for a separate system of RF sensors and RF security by providing extraordinary capabilities to the Alcatel-Lucent OmniAccess wireless switching system. This gives administrators visibility and the power to thwart malicious wireless attacks. These attacks include wireless probing/discovery, denial of service (DoS), impersonations, man-in-the-middle, and unauthorized intrusions. As new

attacks emerge, the system is exible enough to incorporate new attack signatures while in service. In addition to attack protection, the AlcatelLucent OmniAccess wireless system enforces wireless security policies, which includes the ability to detect and prevent weak WEP initialization vectors (IVs), AP mis-configuration, ad-hoc networks, unauthorized NIC types, and wireless bridges. Data encryption The AlcatelLucent OmniAccess WLAN system is designed to work in environments where the physical media cannot be protected against eavesdropping such as wireless networks or the Internet. The Alcatel-Lucent OmniAccess 6000 enables a large number of tested and proven encryption protocols to prevent intruders from eavesdropping on sensitive data. These protocols include AES-CCMP (WPA2), AES-CBC (up to 256 bits), DES, Triple-DES, WEP (64 or 128 bit), TKIP (WPA1), MPPE (PPTP), and SSL (up to 128 bit). Network security The AlcatelLucent OmniAccess WLAN system was built from the ground up with security in mind, and includes a full ICSA-certified stateful firewall that can process traffic based on user identity as well as other parameters, rather than just simple source/ destination addresses. A number of security features allow the Alcatel-Lucent OmniAccess 6000 to be installed in the most securityconscious environments, including ICSA-certied internal rewall, system log integrity, hardened OS resistant to known attacks and exploits, controlpath encryption of communication between Alcatel-Lucent OmniAccess WLAN platforms, and access control lists (ACLs).
Availability The Alcatel-Lucent OmniAccess WLAN system enables support for business critical applications that require high availability. The Alcatel-Lucent OmniAccess WLAN system provides a number of features that support high- availability including VRRP based hot standby, modular software design with protected memory, and automatic access point failover. Seamless user mobility Mobility is a key requirement in modern enterprise networks, and is more important each day as voice over WLAN (VoWLAN) demands emerge and laptop computers continue to replace stationary desktop computers. Alcatel's mobility services enable users to move freely without the need to restart sessions or re-authenticate each time. The Alcatel-Lucent OmniAccess 6000 enables and enhances user mobility through features such as wireless fast roaming, transparent inter-subnet (L3) roaming, proxy mobile-IP support for roaming between multiple WLAN switches, and proxy DHCP. Centralized management Manageability and conguration are top concerns when introducing any type of device to an enterprise data network. The Alcatel-Lucent OmniAccess WLAN system offers clustering capabilities that allow an OmniAccess WLAN switch to congure and manage up to 32 other WLAN switches. When a policy change is made to the master device, this change is automatically pushed to other devices in the cluster. The intuitive Web-based interface provides logical organization of features, while the industry-standard command line interface allows experienced network managers to be up and running quickly.

The Alcatel-Lucent OmniAccess WLAN switches are also integrated within Alcatel-Lucents OmniVista Enterprise network management application. OmniVista discovery and topology modules enable a network administrator to view both wired and wireless network elements and topologies from a single screen. In addition, OmniVista provides the network administrator with the ability to seamlessly initiate a Web-based management session to a specific OmniAccess WLAN switch.
Seamless wired-wireless Endpoint integrity The Alcatelintegration The Alcatel-Lucent Lucent OmniAccess 6000 provides OmniAccess WLAN platforms must be the ability to limit network access able to integrate into wired networks based on client integrity, such as without requiring reconguration of the state of the anti-virus software existing network components. The on the device or operating system Alcatel-Lucent OmniAccess 6000 patches. It also provides facilities (OmniAccess 6000) is built with a for client remediation, allowing number of features typically found in out-of-spec client devices to repair enterprise LAN switches. These features themselves. For endpoint security, give the OmniAccess 6000 the exiindustryleading solutions from Sygate bility to operate in several different Technologies, Inc. are use. They modes for maximum ease of inteinclude Sygate on Demand and Sygate gration. These features include 802.1D Secure Enterprise. spanning tree, 802.1Q VLAN tagging, 802.1p prioritization, IP DiffServ/TOS, IP tunnels using GRE or IPSec, DHCP server, and UDP forwarding (DHCP helper).
Alcatel-Lucent OmniAccess 6000 deployed as a WLAN appliance in the main office
Alcatel-Lucent OmniAccess 6000 deployed as a WLAN switch in a multi-building campus

T E C H N I C A L

S P E C I F I C A T I O N S
RF management and control Up to 16 ESSIDs per AP 3-dimensional RF site survey Distributed and centralized automatic AP calibration Self-healing around failed APs Load balancing number of users Load balancing usage-based Coverage hole and interference detection Wireless RMON/packet capture Plug-ins for Ethereal and Airopeek Timer-based AP access control Mobility 23 msec intra-switch roaming 1015 msec inter-switch roaming Intersubnet roaming Mobile IP support Proxy mobile IP Proxy DHCP VPN and firewall 4096 concurrent IPSec tunnels 256,000 stateful firewall policies (per-user and per-port) IPSec, PPTP, XAUTH VPN termination VPN dialer Customizable captive portal Network address translation Standard and extended ACLs Subscriber management Per-user or per-role assignments of firewall policies, bandwidth contracts, session prioritization, VLAN assignment Role derivation based on authentication, ESSID, encryption, or OUI Location based access control Quality of service Per-user and per-role bandwidth contracts Application-aware traffic classification and prioritization 802.1p support TOS support DiffServ Control Protocol support (DSCP tagging) Authentication servers Local RADIUS External RADIUS: Microsoft Active Directory, Microsoft IAS Radius Server, Cisco ACS Radius Server, Funk Steel Belted Radius Server, RSA ACEserver, Infoblox, Interlink Radius Server LDAP Environment Operating temperature: 0 to 40C (32 to 104F) Storage temperature: 0 to 50C (32 to 122F) Humidity: 5% to 95% (non-condensing) EMC FCC Part 15 Class A ICES-003 Class A VCCI EN 55022 Class A (CISPR 22 Class A) EN 61000-3, EN 61000-4-2, EN 61000-4-3, EN 61000-4-4, EN 61000-4-5, EN 61000-4-6, EN 61000-4-8, EN 61000-4-11 EN 55024 AS/NZS 3548 Class A Safety UL1950 CAN/CSA C22.2 No 950 IEC/EN60950 Low Voltage Directive (LVD) 73/23/EEC 21 CFR Chapter 1, Subchapter J, Part 1040.10 (Laser Safety) IEC/EN 60825-1, EN 60825-2 (Laser Safety)

Capacity and performance Up to 72 10/100 ports with PoE (802.3af) and serial over Ethernet capability Up to 6 GBIC uplink ports Up to 8192 users per switch Up to 8 Gbps of switch throughput Up to 7.2 Gbps of encrypted traffic (3DES) throughput Dedicated crypto processor RS-232 serial console (RJ-45 connector) Physical specifications Height: 5.85 in. (14.9 cm) 3U Width: 17.4 in. (44.2 cm) Depth: 12.5 in (31.8 cm) Fully Loaded Weight: 58 lbs (26.5 Kg) Fault tolerance VRRP for switch failover Automatic AP re-homing Redundant power supply Redundant fan Redundant supervisor card Multiple uplinks with redundancy 802.11 Transport, authentication, and encryption 802.11a 802.11b 802.11g 802.1x PEAP, TLS, TTLS, LEAP WEP, dynamic WEP, TKIP (WPA-1), 3DES, AES-CCMP encryption MAC address authentication Upgradeable to new encryption mechanisms

O R D E R I N G

PART NUMBER DESCRIPTION

I N F O R M A T I O N

OAW-6000-PS2 OAW-6000-PS4 OAW-SC-1-48 OAW-SC-1-128 OAW-SC-2-256 OAW-LC-2G OAW-LC-2G24F OAW-LC-2G24FP OAW-SC1-48-PEF OAW-SC1-48-WIP OAW-SC1-48-ESI OAW-SC1-48-CIM OAW-SC1-PEF OAW-SC1-VPN OAW-SC1-WIP OAW-SC1-AAA OAW-SC1-ESI OAW-SC1-CIM OAW-SC2-PEF OAW-SC2-VPN OAW-SC2-WIP OAW-SC2-AAA OAW-SC2-ESI OAW-SC2-CIM
Alcatel-Lucent OmniAccess 6000 chassis for non PoE configurations. Includes one modular 4-slot 19" chassis, one fan tray, two 200 watt auto-sensing 110V/240V AC PSU, one accessory kit. Alcatel-Lucent OmniAccess 6000 chassis for non PoE configurations. Includes one modular 4-slot 19" chassis, one fan tray, two 200 watt auto-sensing 110V/240V AC PSU, one accessory kit. OmniAccess Supervisor Card I with adaptive RF management and support for up to 48 access points. One OAW-6000 chassis can accommodate one or two Supervisor Cards. OmniAccess Supervisor Card I with adaptive RF management and support for up to 128 access points. One OAW-6000 chassis can accommodate one or two Supervisor Cards. OmniAccess Supervisor Card II with adaptive RF management and support for up to 256 access points. One OAW-6000 chassis can accommodate one or two Supervisor Cards. OmniAccess 2GE Line Card with support for two GBIC uplinks. GBIC adapters shall be ordered separately. OmniAccess 2GE24F Line Card with support for 24 auto-sensing 10/100 interfaces and two GBIC uplinks. GBIC adapters shall be ordered separately. OmniAccess 2GE24FP Line Card with support for 24 auto-sensing 10/100 interfaces with power over Ethernet (PoE) and two GBIC uplinks. GBIC adapters shall be ordered separately. Requires an OAW-6000-PS4 chassis. Policy Enforcement Firewall Module for the OAW-SC-1-48 (48 AP license). Wireless Intrusion Protection Module for the OAW-SC-1-48 (48 AP license). External Services Interface Module for the OAW-SC-1-48 (48 AP license). Client Integrity Module for the OAW-SC-1-48 (48 AP license). Policy Enforcement Firewall Module for the OAW-SC-1-128 (128 AP License) VPN Server Module for the OAW-SC-1-128 (128 AP License) Wireless Intrusion Protection Module for the OAW-SC-1-128 (128 AP License) Advanced AAA Module for the OAW-SC-1-128 (128 AP License) External Services Interface Module for the OAW-SC-1-128 (128 AP License) Client Integrity Module for the OAW-SC-1-128 (128 AP License) Policy Enforcement Firewall Module for the OAW-SC-2-256 (256 AP License) VPN Server Module for the OAW-SC-2-256 (256 AP License) Wireless Intrusion Protection Module for the OAW-SC-2-256 (256 AP License) Advanced AAA Module for the OAW-SC-2-256 (256 AP License) External Services Interface Module for the OAW-SC-2-256 (256 AP License) Client Integrity Module for the OAW-SC-2-256 (256 AP License

OAW-SC1-48-VPN VPN Server Module for the OAW-SC-1-48 (48 AP license). OAW-SC1-48-AAA Advanced AAA Module for the OAW-SC-1-48 (48 AP license).
To learn more, contact your dedicated Alcatel-Lucent representative, authorized reseller, or sales agent. You can also visit our Web site at www.alcatel-lucent.com. This document is provided for planning purposes only and does not create, modify, or supplement any warranties, which may be made by Alcatel-Lucent Technologies relating to the products and/or services described herein. The publication of information contained in this document does not imply freedom from patent or other protective rights of Alcatel-Lucent Technologies or other third parties. Brick is a registered trademark of Alcatel-Lucent. ActiveX is a trademark of Microsoft Corporation. Java is a trademark of Sun Microsystems, Inc. NEBS is a trademark of Telcordia Technologies. Pentium is a registered trademark of Intel Corporation. Solaris is a trademark of Sun Microsystems, Inc. Sun is a registered trademark of Sun Microsystems, Inc. UL is a registered trademark of Underwriters Laboratories. Windows is a registered trademark of Microsoft.

www.alcatel-lucent.com

Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent logo are trademarks of Alcatel-Lucent. All other trademarks are the property of their respective owners. Alcatel-Lucent assumes no responsibility for the accuracy of the information presented, which is subject to change without notice. 2007 Alcatel-Lucent. All rights reserved.P/N 031670-00 Rev B 7/07