Two in one, or migration of the access point controller to the gateway

It is believed that a serious network infrastructure – it should be expensive, and the more devices in it, the better. But is this principle always true? Let’s try to understand the example of managing Wi-Fi access points.

Introduction

Wi-Fi network management deserves close attention: both from the system or network administrator, and when introducing special equipment. Otherwise, you can easily get very interesting, but undesirable “oddities” when working with network devices.

One of such examples was considered by us in the article Synchronization of Wi-Fi access points for collaboration.

The same article provides information about specialized Wi-Fi controllers, with the help of which control is performed. But what does it do? Do you have to buy another device, configure it, update firmware and so on?

This is another point of failure (for example, the power supply may fail after a power surge), and another object for maintenance (at least occasionally you need to update the firmware).

Fortunately, Zyxel engineers have provided a more versatile option, adding access point management features to other devices, in particular to firewalls.

This approach is more convenient for managing the network infrastructure as a whole. Although it is theoretically possible to imagine the separation of duties from a series: one person only administers the Internet gateway, the other only administers Wi-Fi controllers and access points, but in practice this approach is extremely rare, usually there is one network administrator or an entire administrative link, whose responsibilities include maintaining the entire network.

Access point management is supported by almost all series of network gateways: ATP, USG, VPN, ZyWALL and USG FLEX. Actually, the network administrator has a place to roam in terms of choice.

A universal approach to managing access points and organizing a gateway in questions and answers

We offer readers answers to the most frequently asked questions (FAQ) that will help you better navigate when choosing alternative options.

Questions and answers on the general organization of infrastructure and business processes

Question 1. For what cases is this approach: the gateway and the AP controller – two in one – the most convenient?

Answer: Convenient for small companies and large organizations.

For small companies, this is convenient for reducing costs at the time of establishing a business: one device costs less than two. Accordingly, it is easier for the “coming admin” to administer one device.

For large companies, this approach is convenient in that it eliminates the additional point of failure that needs maintenance. This is important, for example, when using power management systems (watchdogs), which automatically restart the device by power when certain conditions occur.

Question 2. Could it be that because of the placement on the same device between managing access points and maintaining the functions of the Internet gateway, there will be competition for hardware resources: processor, memory?

No, if you purchase the appropriate device for the desired number of access points. Any device: ATP, USG, USG FLEX, VPN, ZyWALL is designed with a balance between the number of maximum possible Wi-Fi users and ensuring maximum gateway performance when accessing the Internet.

Quite the contrary, having an Internet gateway separately and an access point controller (NXC) separately, you can get the same performance imbalance, for example, when the access controller has already been upgraded to a more efficient one, and the Internet gateway has not yet (or vice versa).

Licensing Questions and Answers

Question 3. Which of the following devices: ATP, USG, VPN, USG FLEX are better suited for managing access points.

Answer: All of these devices do a good job of managing your wireless network. The set of Wi-Fi controller functions is approximately the same. Another thing is that there may be other critical areas for business, for example, VPN access functions (VPN series) or enhanced security mechanisms (ATP series).

Therefore, it would be more correct to use an integrated approach when designing a future network and upgrading an existing one.

If we talk only about the cost of the devices themselves, then the most budget option is the VPN series.

Question 4. For which of the VPN series models can the NXC2500 be replaced to make it cheaper and which model – for the most complete replacement?

Answer: If there are less than 36 points, then at the entry level it is enough ZyWALL VPN50if more – then on ZyWALLVPN100.

Figure 1. ZyWALL VPN50 firewall.

Question 5. A similar question for older models. What are we changing from VPN
NXC5000, to make it cheaper and change the NXC5500 so that it is as much as possible
full replacement?

Answer: If there are less than 132 points, then at the entry level it is enough ZyWALL VPN300,
if more – then you need to use ZyWALL VPN1000.

Figure 2. ZyWALL VPN300 firewall.

Figure 3. ZyWALL VPN1000 Firewall.

Important. Speaking about the initial level, we are discussing just the simplest situation — only Wi-Fi control. For example, the VPN50 may not be suitable if you need to use a redundant WAN channel over a twisted pair cable, for which the VPN100 has a special second WAN port, and starting from the VPN300 you can reconfigure any of the available network interfaces.

As mentioned above, depending on the number of points, instead of the NXC series, you can use not only the VPN series, but also others.

Table 1 shows the number of access points that can be controlled “right out of the box” (without acquiring a license):

Table 1. The number of access points available for management by default.