RUCKUS Virtual SmartZone – Data Plane (vSZ-D)
NFV-Compliant WLAN Secure Data Plane Manager

Overview:

NFV Data Plane Aggregation Solution for VSZ-E and VSZ-H

Enterprises and Service Providers must meet growing demands for how to more efficiently handle user data in distributed networks. Today's wireless customer expectations require delivering secure, high-performance, reliable and scalable WiFi services. The RUCKUS virtual SmartZone – Data Plane (vSZ-D) is a virtualized WLAN solution that assists to meet these demands.

Designed as a Network Functions Virtualization (NFV) application, vSZ-D can be easily deployed within an existing vSZ-E or vSZ-H network to provide secure and flexible user data plane management in either distributed or centralized configurations. This can address customer requirements to secure guest network Internet traffic, meet PCI compliance, and optimize VoIP quality by managing aggregates traffic through the secure tunnels. Leveraging the vSZ-D NFV architecture can also lower TCO/CAPEX costs and scales upwards to 10K APs and 100K clients per instance.

The RUCKUS virtual SmartZone controller platform is the industry’s most scalable Wi-Fi controller platform that enables service providers and enterprises to leverage virtualization technologies to deploy superior Wi-Fi management systems on standard x86 based systems. The virtual SmartZone platform with its unique clustering architecture provides a scale-as-you grow model in the true sense by completely obviating the need for specialized hardware.

With the introduction of the Virtual SmartZone Data Plane (vSZ-D), RUCKUS launches an industry-first offering for sophisticated data plane capabilities in a virtualized form factor. The vSZ-D enables RUCKUS APs that are managed by a Virtual SmartZone controller to support WLANs that tunnel user data. The vSZ-D is built on Intel's DPDK1 framework and has been architected from the ground up to support aggregation of data from these tunnels (with encryption) at large scales with minimal data forwarding latencies. Designed for flexibility, the vSZ-D can be deployed in a centralized data center along with the network controller or can be deployed at specific venues in a distributed architecture while managed by a centralized controller. This architecture provides significant business and deployment benefits to mobile operators or enterprises.

vSZ-D can scale to handle tunneled data from upwards of 10K APs and 100K clients all managed by a single Virtual SmartZone controller instance to meet the requirements of the largest enterprise or service provider. The vSZ-D can be deployed in a private cloud to support one specific network deployment or in a public cloud that can support hundreds or even thousands of managed WLAN networks. vSZ-D instances can run on open-source KVM hypervisor or VMware vSphere hypervisor.

vSZ-D provides tremendous business value and architectural benefits in its ability to minimize CAPEX spending, minimize TCO and maximizing Wi-Fi deployment functionality. This approach is consistent with the industry trend toward Software Defined Networks (SDN) and ETSI Network Functions Virtualization (NFV) that segregates the control plane from the data plane.

Network Function Virtualization

Network Function Virtualization (NFV) is an extension of the basic computer virtualization. NFV takes this concept one-step further, adding design flexibility through segregation of major network functions and allowing them to operate in independent VM contexts.

Benefits:

Secure Tunneled WLANs
Enables forwarding of user data traffic through secure tunnels on RUCKUS APs when managed by Virtual SmartZone controllers

Flexible & Scalable Deployment Architectures
An industry-first support for centralized and distributed deployment architectures while enabling independent data plane and control/management plane scaling.

Depending upon the application and customer requirements, VM elements can be deployed distributed or centralized. vSZ-D aligns with the NFV concept, which results in a direct impact on CAPEX and TCO. RUCKUS has applied the NFV concept to the vSZ and vSZ-D design, which results in cost savings, increased service scalability, and multiple deployment options.

Deployment and Operational Simplicity
Works seamlessly with vSZ controllers, simplifying the need for Wi-Fi network management

Site Level QoS and Policy control
Service policy and QoS can be applied to the aggregated data flow on a site level rather than a per WLAN or AP, thus simplifying and optimizing policy decisions for Wi-Fi network operators.

Features:

Multiple Hypervisor Support

• Supports the most widely deployed VMware and KVM hypervisors

Dynamic Data Plane Scaling

• Supports 1Gbps, 10Gbps or even higher throughput capacities to support all types of enterprise and carrier deployments that can be dynamically tuned without needing software updates

Seamless Integration with vSZ Controller

• Simple integration and management with vSZ controller clustering architecture enables support for multiple vSZ-D instances
• 2 vSZ-D instances per vSZ instance
• 8 vSZ-D instances per vSZ cluster of 4 instances
• The vSZ controller runs in Active/Active (3+1) mode for extremely high availability. Each vSZ-D runs as an independent virtual machine instance that is managed by the vSZ controller

Superior Data Plane Functions

• Encrypted tunnel aggregation from all types of WLANs (Captive portal, 802.1x, HS2.0), VLANs, DHCP Relay, NAT traversal

Deployment:

Deployment Example - Distributed

Deploy vSZ-D on each site or venue for data plane aggregation and vSZ controller cluster in the data center for centralized management. Well suited for larger businesses high-density venues and multi-site enterprises.

Deployment Example - Centralized

Deploy vSZ-D alongside the vSZ controller in the data center for centralized data plane aggregation from all sites. Well suited for managed services providers targeting small and medium businesses.

RUCKUS APs managed by vSZ controllers provide service providers and enterprises with smart traffic redirection that is enhanced with the vSZ-D offering tremendous architecture flexibility that is unrivalled in the industry.

Specifications:

	Virtual SmartZone - DataPlane
Secured data plane tunneling	Enables forwarding of user data traffic through secure tunnels on RUCKUS APs when managed by Virtual SmartZone controllers.
Multiple hypervisor support	Supports the most widely deployed VMware and KVM hypervisors
NFV flexible architecture	Complete separation of Control+Management plane (vSZ) and data plane functions (SmartZone Data Plane) via separate VMs that support distributed and centralized deployments providing compelling architecture flexibility.
Works seamlessly with virtual SmartZone	vSZ acts as the controller for RUCKUS APs as well as SmartZone Data Plane providing seamless configuration and management capabilities.
Up to 10 SmartZone Data Planes per vSZ and up to 40 SmartZone Data Planes per cluster	The vSZ controller runs in Active/Active (3+1) mode for extremely high availability. Each SmartZone Data Plane runs as an independent virtual machine instance that is managed by the vSZ controller.
vSZ Zone affinity for SmartZone Data Plane	This feature enables RUCKUS APs in a particular zone establish tunnels with the SmartZone Data Plane in that particular zone. Provides flexibility for distributed and managed services deployments where the SmartZone Data Planes can be co-located on-premise with RUCKUS APs (vSZ Zones) on medium/large high density sites that need tunneling. With up to 40 SmartZone Data Planes per cluster, the SZ 3.5 release can potentially support a large number of such distributed deployments.
DHCP server and NAT	This feature enables a high scale DHCP Server on the SmartZone Data Plane. The  DHCP Server is a high-scale server specifically designed and architected for Wi-Fi deployments that provide near-real time IP address assignment combined with NAT this provides tremendous value to the operator since it avoids mac-address scaling limits and high costs on the network infrastructure (switches).
Legal Intercept	This feature is useful from a Legal Intercept requirements perspective and enables the ability to mirror packets in both uplink and downlink directions for Wi-Fi clients that  have a CALEA warrant.
Support for northbound tunnels L2oGRE	This feature enables SmartZone Data Plane to forward WiFi client traffic to a specified 3rd party WAG (Wireless Access Gateway) over L2oGRE protocol standard.
IPv6 support	Supports IPv6 addressing for the SmartZone Data Plane interfaces as well as support forwarding of IPv6 client traffic
L3 Roaming (inter SmartZone Data Plane tunnels)	This feature enables L3 Roaming when traffic is tunneled to the SmartZone Data Plane. The feature relies on inter SmartZone Data Plane flexi-vpn tunnels that are dynamically created with minimal user intervention. L3 Roaming can be enabled based on VLANs or subnets.

¹ Actual throughput numbers will vary depending on infrastructure and traffic type

Documentation:

Download the RUCKUS Virtual SmartZone - Data Plane Datasheet (PDF).