Prerequisites

This topic specifies the resources and systems required for configuring Network Segmentation.

System resources required

  • Minimum one Virtual SmartZone (vSZ) controller.
  • The following SmartZone Data Plane (vSZ-D) controllers are supported -

    SmartZone Data Plane (vSZ-D)

    Release vDP SZ-100D Series (SZ-104D / SZ-124D) SZ-144D
    5.1 ✓ ✓ —
    5.2.1 ✓ ✓ ✓
    6.1.2 ✓ ✓ ✓
    7.0.0 ✓ ✓ ✓
    7.1.0 ✓ — ✓
    7.1.1 ✓ — ✓
  • Minimum one SmartZone Data Plane (vSZ-D) controller.
  • Two or more Access Points (APs) which are compatible with the 6.1.1 controller.
  • For switch usage in network segmentation:
    new info for Phase 2
    • One or more of the following switches as the distribution switch: RUCKUS ICX 7550, RUCKUS ICX 7650, or RUCKUS ICX 7850. (VxLAN is supported only on these models.)
    • One or more of the following switches as access switches (also called "edge switches"). Switches: RUCKUS ICX 7150, RUCKUS ICX 7250, RUCKUS ICX 7450, RUCKUS ICX 7550, RUCKUS ICX 7650, or RUCKUS ICX 7850.
    Note: Also, see "ICX Switch Preparation for Network Segmentation" below.

Required systems:

  • Cloudpath server installed.
  • vSZ controller installed and the cluster is operational.
  • Admin account required for Cloudpath and vSZ systems.
  • vSZ-D installed and managed by vSZ.
  • Operational APs installed and managed by vSZ.
  • Cloudpath should be able to communicate with SmartZone management interface.
  • Ensure that the Cloudpath server certificate is in the controller trust store. Otherwise, the Network Segmentation feature will not work since the controller will not be able to communicate with Cloudpath.
  • Ensure that all ICX switches are upgraded to firmware version 09.0.10d (or any 09.0.10 patches that may become available after 09.0.10d).
    Note: The 10.0.00 release branch does not currently support network segmentation.
  • It is necessary that the customer has licenses set up for DHCP and NAT servers.

ICX Switch Preparation for Network Segmentation:

  • Distribution switches:
    • The loopback interface must be able to communicate with, or be routeable to, the data interface of the data plane.
    • The data path between distribution switches and data planes must have an MTU size of at least 1568 bytes.
      Phong - Is "bytes" correct here?
    • The ICX switches must be able to communicate with, or be routeable to, the SmartZone control plane.
  • Access switches: All client ports must be added to the web-authentication VLAN.
    • Switches must be able to communicate with, or be routeable to, the Cloudpath server.
    • Switches must be able to communicate with, or be routeable to, the SmartZone control plane.
  • Managing switches for network segmentation:
    • Configure the switches to be managed by SmartZone.
    • Add the switches to a switch group to participate in network segmentation.
    • Configure the AAA authentication server (must be a Cloudpath server) for the switch group.
    • Enable flex-authentication on each of the access switches.