What Are WLAN Reliability Features?
- Dual link mechanism
To improve AC reliability, two ACs can be deployed to implemented dual-link backup. When the active AC fails or the CAPWAP tunnel between an AP and the active AC fails, service traffic of the AP can be switched to the standby AC to ensure uninterrupted service transmission for wireless users. Attack defense measures that are used on wired networks can also be used on WLANs to improve reliability of WLAN service servers and clients.
- N+1 backup mechanism
A standby AC can provide backup services for multiple active ACs, which reduces device purchase costs. However, this mode has lower reliability than hot-standby backup. N+1 backup is a cold backup mode, and does not back up AP or STA information. An AP establishes a link with only one AC. During an active/standby switchover or a revertive switchover, the AP and STAs must go online again and services are temporarily interrupted. The service interruption time in N+1 backup mode is longer than that in dual-link cold backup mode. A standby AC can provide backup services for multiple active ACs.
Supported versions: V200R005C00 and later
- Hot Standby Backup (HSB) mechanism
When the active AC fails, service traffic is immediately switched to the standby AC without service interruption. This improves connection availability. HSB can fast detect whether the active AC is faulty so that the standby AC can become the new active AC in a timely manner. The active/standby switchover is implemented rapidly with little impact on services.
- WLAN service protection mechanisms: IP source guard (IPSG), DHCP snooping, statically configured MAC-IP table, and dynamic ARP inspection (DAI)
- IPSG: This function defends against IP packet attacks by filtering out packets with forged IP addresses.
- DHCP snooping: This function protects WLAN servers and clients against from ARP, IP, or DHCP packets with forged IP and MAC addresses.
- Statically configured IP-MAC table: Users can configure static IP addresses as required, which are valid after successful 802.1X authentication. Entries on APs are maintained on the AC, during which IP-MAC mapping entries are obtained. When packets cannot match IP-MAC mapping entries, the IPSG function can check static entries for the static binding relationship. If any static binding relationship is found, packets are allowed to pass. Otherwise, the packets are considered invalid.
- DAI: It is an ARP security technology that detects ARP packets, discards ARP packets that do not match the DHCP snooping binding table, and records ARP attack logs. DAI can also limit the rate of ARP packets. DAI protects a device from ARP snooping attacks and prevents errors in the ARP cache table.