WLAN management takes to the cloud

The cloud is everywhere today, offering the possibility of all manner of IT functions on a software-as-a-service (SaaS) basis. In this test, we looked at three companies that provide WLAN management services in the cloud, and we came away impressed.

Because of the mission-critical nature of network management and the fact that these tools have traditionally lived on-site, there is some understandable skepticism toward cloud-based WLAN management. But we discovered that cloud-based management offers an interesting path to reducing cost, improving productivity and offering a range of functions that otherwise would involve sizeable capital investments.

The idea of moving wireless LAN management to the cloud has proven so interesting that a number of vendors are now delivering these services. We tested three cloud-based offerings: HiveManager Online from Aerohive Networks, D-Link’s CloudCommand and Meraki’s Cloud Controller.

We wanted to find out if there is a compromise in capability between cloud and traditional WLAN management systems. What do the economics really look like? And could cloud capability literally move the network operations center into the palm of one’s hand?

WLAN management: From nice-to-have to vital

Traditionally, WLAN management functions in enterprise-class products have been implemented either in a WLAN controller or in a separate appliance or server (virtual or otherwise), or sometimes, both. Small-to-midsize business products usually involve configuring firmware in each access point involved, via a secure-HTTP interface.

An effective centralized management console should be capable of performing all required functions across the entire network, no matter how large or distributed, easily exporting all key interfaces and intrinsic facilities.

Moving the management system into the cloud isn’t as big a departure as it might initially seem. Eliminating the need for local hardware (usually accessed via the browser-based client, as is required with the cloud) doesn’t seem like it should be a big deal, and many other mission-critical functions have gone the Web/cloud/SaaS route.

So, just how good are cloud-based wireless-LAN management systems? Is there any compromise in functionality? Can they perform in mission-critical settings? And do they represent a viable strategic direction for what is, again, a vital function?

Test parameters

The evaluation process in this case was a bit different from the typical Network World test, in that no throughput testing, functional verification or other benchmarking was performed. Rather, we compared features by examining the capabilities of each product, using a live installation. The results are assembled in Table 1.

We also noted what we liked — and didn’t — about each implementation. The table is not exhaustive — some of the products reviewed have literally hundreds of functions. But we wanted to make sure that an enterprise would be happy with the cloud service implementation in each case, so representative key functions are listed.

Each vendor was asked to provide two access points, the credentials necessary to access its cloud-based management service, documentation, pricing, and any other materials appropriate to a product review. We approached this test as a customer knowledgeable in WLANs, but unfamiliar with the details of each product, with the goal of discovering features and capabilities through actual use.

Aerohive Networks, D-Link and Meraki, all firms with a significant presence in the WLAN space, agreed to participate. All of the cloud-based management consoles run within a browser, and for this test we used Internet Explorer 8 running on Windows XP.

The test strategy was simple: For each vendor, we pretended to be novice customers deploying a WLAN for the first time. We followed vendor recommendations and documentation (as available) closely, noting any issues or problems as we went. We then walked through all of the facilities for each console, assembling the features table and noting any interesting items.

We verified all Wi-Fi settings using Fluke Network’s AirCheck handheld Wi-Fi Tester, which was a very convenient tool for this purpose. We need to point out that while comparing different consoles on their feature set makes sense for the purposes of this comparative review, customers should not make buying decisions based on features alone. Access point features and capabilities, system architecture, performance given specific traffic mix, and potentially many other parameters (like, for example, price) will come into play here. But the features and capabilities of the management console, including, where available, provisioning in the cloud, will have significant influence on the selection process and will, we believe increasingly serve as a differentiator.

Overall test results

Each service has its own strategy and emphasis, but we found no degradation of features set or performance, and thus concluded that there is no reason, based on available capabilities, that a cloud-based WLAN management system could not completely replace a local implementation.

Each product was easy to use, responsive, and, while functionality varied significantly, all provided at least the basic capabilities essential in enterprise-class WLAN operations.

All of these services are priced by the year on a per-access-point basis, with pricing as low as $4.75 per month per access point (Aerohive). While the analysis of a specific installation is required for an ultimate determination of value, the cost differential between a local implementation and using a cloud-based service can be significant. We’ve seen cases where the cost reduction afforded by using the cloud actually paid for the remainder of the system itself.

Aerohive HiveManager Online

Aerohive suggests getting started with HiveManager Online (which we, like Aerohive, will refer to as HMOL below) via a 25-minute online video that covers all the basics.

The video is entertaining and informative, and this is indeed a great place to get rolling with HMOL. It’s easy to skip over the parts that don’t apply to a particular situation. We also reviewed a very complete set of documentation, which included a Reviewer’s Guide that is sent as part of a customer evaluation. 

Two of Aerohive’s HiveAP 320 access points were connected to our LAN, and we fired up the HiveManager Online console. The required credentials are provided via e-mail. But it’s basically plug in the access points and log in to HMOL. A little parameter setting (password, time zone, etc.) and you’re on the air.

HMOL provides exactly the same functionality as HiveManager running on a local server or appliance and, as such, is designed to manage large-scale, enterprise-class deployments.

HMOL comes in Express Mode and Enterprise Mode, which can be thought of as beginner and advanced. Express Mode, despite its name, offers a very robust set of functions and that’s the place to start.

We made a cursory pass through Enterprise Mode, noting that settings applied in Express Mode carry over to Enterprise Mode, but not the reverse — so be warned that switching back isn’t an easy task. And the differences between the two were fairly minor for most installations regardless.

The most important function in a WLAN management system is to configure access points, SSIDs and related security items. This is all very easy and intuitive in HMOL Express, reminiscent of “wizard” features that we’ve seen over the years in a wide variety of products.

Everything is easy, but it’s possible to dig into very low-level settings if you wish, including setting access point transmit power, for example. Once you’re done, upload the settings, reboot the access points and you’re done. The Home screen in HMOL provides an overview of key operational status. As with all of the products reviewed here, our No. 1 wish would be the ability to customize this page to our specific preferences.

HMOL also excels at monitoring, with a wide variety of data available, including RF interference, radio channel, transmit power and noise floor, detailed event logs and a lot more. It’s possible to upload floor plans and maps for complete documentation as well as operator visualization of access point locations. And, while all of this is very easy to use, the online help function is detailed and complete, just in case a quick reference is needed.

Overall, we were impressed with the range and scope of function, and at the same time, how simple and intuitive the user interface is — one of the best we’ve seen.

D-Link CloudCommand

While D-Link is best known as a supplier of residential-class networking components, the company has a substantial presence in the SMB space. Its new DAP-2555 AirPremier N AP is a dual-band product designed for business use and managed by CloudCommand, a cloud-based management console from PowerCloud Systems. PowerCloud is an OEM SaaS company, and CloudCommand is also available from a few other companies.

Setup is very easy — just plug in the access points, go to the D-Link CloudCommand website, register with contact info, enter UICs for each access point (on a label on the bottom of each), enter SSID, set encryption options and guest access preferences, name the access points and enter their location, review everything and press enter — that’s literally it. The console of CloudCommand is quite simple, with just a few tabs for a Dashboard snapshot view of settings, status and activity.

An interesting security option is to augment WPA2 with what PowerCloud calls Individual Device Authorization (IDA), a variant on the per-user key theme, in this case delivering credentials out-of-band via text messaging. Individual tokens are entered via the browser, and can be individually revoked as required.

We did notice that one of our test access points would not come online, and this situation, likely a defective unit, was correctly identified by CloudCommand. D-Link will replace any defective access points, of course, under warranty.

Somewhat curious, a review of a pre-release of the user manual for the DAP-2555 shows a very robust set of functionality, but little of this is currently exported via CloudCommand — and the option to enable full configurability and control is missing from the current firmware.

This means that it will currently be necessary to log in to each access point for detailed configuration — exactly what a centralized management console is designed to avoid. Again, D-Link is really just getting started here, so we expect that this mismatch will be corrected.

Overall, CloudCommand is a simple but effective management console that would be especially at home in smaller installations. And we anticipate that PowerCloud will be adding new features on a regular basis, although the big question is how quickly their OEMs will roll out new releases. The only other real issue relates to documentation — there isn’t much besides an FAQ file, and there’s only very limited context-sensitive help with no explanation of many items and options. We expect, again based on conversations with company representatives, that this oversight will be corrected shortly.

Meraki Cloud Controller

Meraki was one of the firms that originated the concept of cloud-based deployment, and all of its access point products are provisioned via its cloud-based Cloud Controller service. Setup is a piece of cake: Via Meraki’s secure site, create an account, enter your order number (sent by Meraki via a confirmation email at time of purchase) and you’re in. The remaining configuration of security and related items is trivial. Interestingly, Meraki allows users to enter the location of access points on a map for quick reference later, a feature that could be very useful in widely distributed networks.

In fact, though, the entire console is very easy to use, with context-sensitive help and a crisp, logical layout. It’s easy to find what you’re looking for, but documentation could be better. Selecting the help tab ultimately results in a search that may produce a lot of irrelevant information — and it would be great if help popped up in a separate window (as is the case with Aerohive) so you could see the help and the screen you’re working with at the same time. There is, however, a very complete manual available for download, along with many other useful documents.

Meraki includes a clever and easy-to-use facility to set up custom splash pages, which can include authentication (username/password) beyond 802.11’s defined capabilities. The product is exceptionally strong in security (VPNs, RADIUS and more), with numerous options for managing traffic flow and QoS, and even checking for virus protection on clients. The company also includes a way for users to “make a wish” for new features and improvements, an interesting idea. Our biggest wish, by the way, for all of these products is the ability to customize the user interface so as to ignore options we don’t need and to customize the monitoring view for our preferences.

Meraki has steadily expanded its product offering with a line of routers, VPNs, Wi-Fi Hotzones and even systems management (clients and servers), all managed from the cloud. As we saw with Aerohive, this expansion of the scope of cloud-based management really shows the power of the cloud-services concept when put into practice, and points to what could indeed become a cloud-centric future for all of network management.

Analysis and conclusions

All of the products here easily handle the basics of multi access point wireless network management — adding and configuring access points, monitoring for exceptions and reporting, and doing all of this reasonably intuitively. While the Aerohive and Meraki products are quite robust, even smaller installations looking for simplicity will be happy with any of the products — responsiveness was uniformly excellent in all cases, so a local server has no real advantage in this dimension.

OK, the big question: despite all the positive press regarding the concept in general, cloud is indeed reminiscent of timesharing, harkening back to the era of mainframes and terminals. But we’re clearly today dealing with much more horsepower in networks, servers, and software, so the argument isn’t really about “back to the future,” as some IT veterans assert, but rather fundamental utility.

It’s about capabilities – services deployed cost-effectively, reliably, and location-independently – not hardware. It’s about the economics of the contemporary organization – minimizing capital and operating expense without compromising functionality – not having title to all of the required pieces. And while the breakpoint with respect to cost between local provisioning and cloud services will need to be determined, even the list pricing in each case is enticingly low enough to generate a lot of interest.

Thus the shift: It’s about fundamentally location-independent services, not products. As we’ve seen in the sampling explored here, the range of function is broad, the services responsive and simple to use, and each is clearly effective and worthy of further consideration.

The biggest argument against WLAN management in the cloud isn’t cost, but rather with respect to reliability — what if your connection to the Internet goes down? What if the ISP or management services provider suffers an outage? In the event of such a failure, the lack of WLAN management capabilities is likely to be the least of your worries, as most other IT operations are also likely to be affected. And, regardless, this challenge is addressed in the usual manner, through business operations continuity planning and related IT best practices.

With respect to the suppliers of WLAN management services themselves, we asked the question of each supplier: Are your operations distributed enough and fault-tolerant enough to withstand even a challenge as great as that represented by the recent earthquake and tsunami in Japan? Each responded positively, with D-Link, for example, noting that CloudCommand is hosted on Amazon’s EC2 cloud service. Of course, Amazon recently suffered an outage, but we are again talking about WLAN management, and it’s unlikely that a temporary outage in management services will have an adverse effect on the enterprise.

Where do we go from here? It’s pretty clear that our initial assumptions about no compromise in functionality and cost-effective deployment were correct. We’re also seeing announcements from such firms as AirTight, which recently augmented its cloud-based WLAN security and assurance capabilities with access also managed in the cloud. (AirTight was invited to participate in this test but declined, citing scheduling issues.)

And WaveLink recently announced a cloud-based version of its well-known Avalanche platform, this one aimed at mobile device management. (WaveLink has also hinted at WLAN management in the cloud for the future).

In addition, Enterasys enables its resellers with cloud-based wired and WLAN management capabilities in their Network Management Suite (NMS), and this angle is interesting, with the enabling of multi-tenancy an intriguing possibility for resellers everywhere. This shift in business models is almost as interesting as the technology, and we think both resellers and end-users alike will look at cloud-based management as a viable if not the preferable option with a bit more exposure.

Indeed, it would be hard to imagine any showstopper with respect to cloud-based WLAN management. And it’s easy to see how this model extends naturally and transparently to wired-LAN management as well. One need look no further than Meraki’s new Systems Manager service to see how the cloud can extend into most if not all enterprise IT management functions.

The most commonly stated concern, a disruption in WAN connectivity leading to a loss of management visibility and control, is no more of an issue here than with any other application, and is again addressed via known best practices with respect to WAN resilience, integrity and continuity.

Bottom line: the cloud is coming to WLAN management, and we expect a lot more activity here over the next few years.

Mathias is a principal at Farpoint Group, a wireless advisory firm in Ashland, Mass. He can be reached at craig@farpointgroup.com.