What is our primary use case?
We have two types of controllers in our network. One is a Cisco Wireless Controller, which is software-based, and the second one is an SD-WAN Controller, which is hardware-based.
We have installed this controller in the two buildings. One is in Lahore, and one is in Karachi. In one of them, there are around 54 wireless LANs and 54 wireless routers for 200 to 300 customers, and the other one is also serving 250 to 300 customers.
We are using its latest version. It is deployed on-premises because as per the regulations, we cannot put not any controller on the cloud for the banking infrastructure. That's why we install the controller on the site.
We have installed it for secure connectivity while roaming within the building. We have four VLANs. One is the wireless one for the most senior executives. We have a grading system in the bank. The senior vice president, the executive vice president, and the president are in one group. The second VLAN or Wi-Fi is for the assistant vice president and the vice president. The third one is for all users from OG-3 officers to OG-1. The fourth one is for any guests who walk into our building, such as vendors or workers who come into the office building.
What is most valuable?
Wireless connectivity is the main feature. It is also securely integrated with ISE, which is valuable because, in the banking industry, we also cover the security aspect. This Wi-Fi controller integrates with the ISE system that we have. Every user that comes on the wireless needs to log in with the domain. If they don't, it will not allow the user to join the network. This is the key feature of this solution. If we install any other wireless, they give us MAC address binding. They also give us hardware address connectivity, but Cisco Wireless supports integration with ISE, and the ISE part is an option for the application posture. When we implement the application posture on the upper file system, if anyone connects to the network wirelessly or wired, they can only access specific applications. For example, if I give them permission only for Word and Excel, they would just be able to open Word and Excel on their laptops. If I give them access to the email system, they will just be able to open their email. This is the main benefit of the integration with Cisco ISE.
What needs improvement?
The main concern is the length and overlapping. We have to put on four to six access points on the same floor, and we face the issue of overlapping areas. If Cisco can extend the range of their indoor APs, we would need to install just one or two access points, and it would eliminate the problem of the overlapping area.
They should provide built-in features for safe authentication. Right now, we integrate with ISE and FortiClient for this feature. We first check the NAC, and after the NAC and before the domain, a token password installed on their mobile or a physical token is required to join the network. If Cisco had built-in authentication, we would be able to eliminate one product from our network.
For how long have I used the solution?
We have been using this controller since 2012.
What do I think about the stability of the solution?
It is stable and reliable. In the last seven to eight years, we had zero downtime in our production environment. That's also because we have it in cluster mode. So, if one controller fails, the second one will automatically take over.
What do I think about the scalability of the solution?
It is very easy to scale. The controller license that we currently have can handle 500 APs, but we have only 50 to 60 APs. We can just add APs and go on. We should put only 80% load on a device, so when we reach 400 APs, we need to add a controller.
How are customer service and support?
We have the Cisco Wireless Controller agreement. If we face any issue, we engage our first-level support. If the issue is non-critical, such as at a branch level, we engage the second level of support. If the issue is at the core level, then we directly engage the third-level support to resolve the issue. If the issue is still not resolved, we open the case through the Cisco website, and a Cisco engineer is available. Cisco also has three levels: one, two, and three. If you have a severity level three, Cisco engages someone within 15 to 20 minutes. If the severity level is one, Cisco engages someone after two, three, or four hours. They engage as per the case severity. I am satisfied with their support.
How was the initial setup?
It is straightforward. With some clicks, you can add and delete everything. It is very simple. If you have the knowledge, everything is simple. If you're untrained, you need some time to understand things.
In terms of duration, in a 10-floor building in Lahore, for a room, the cabling work and firewall configuration take three to four days. Some of the configurations can take four to five days.
What about the implementation team?
We have a team of people certified in Cisco and Huawei, and we directly engage with Cisco. We eliminate other vendors, which has two benefits. One benefit is the knowledge from Cisco, and the second benefit is that it eliminates the cost of the support. When any vendor comes to your site and offers services, they charge 10% to 20% of the SLA cost.
Cisco gave us a contract team, and we directly engaged with Cisco for installation and integration. We have support at levels one, two, and three. At level four, when there is a hardware failure, we go to Cisco and open an RMA. Cisco then sends us a new product that we install personally. We don't need any vendor support.
Their maintenance is done quarterly. The hardware support team uninstalls our APs on off days, cleans them up, loads the required things, and then reinstalls them. If they find any defect in the physical box, they just open an RMA. Cisco then gives us a new product, and we install the product.
There are two people who work on the controller and access points. Customer enrollment is handled by the desktop support team, which is a 30 people team. Out of them, 10 to 15 people take care of user access. The core team has only two network guys.
The other part is the hardware support team, and for the whole bank, there are 30 to 40 people for any kind of hardware support. Any person is available to replace the AP. It is just a few-minute job. They just plug out the cable, do the installation. When APs come on the network, they directly go to the controller, and the controller updates their software and pushes the configuration. It is an easy task.
What's my experience with pricing, setup cost, and licensing?
Its cost is a little bit higher than other products. Fortinet and Huawei are cheaper. If we were not a bank, I would go for Huawei or Fortinet because they are cheap, and I don't need that much security. A financial institute, a university, or a medical institute would need security to protect the customer data. That's why we buy this high-end product that has integrated security features.
What other advice do I have?
I would recommend it based on the requirements. Any medical, educational, financial, and government sector can go for Cisco with closed eyes. A retail shop, store, or restaurant doesn't require Cisco. They just need internet access, and they can go with Huawei, Fortinet, Ruckus, or any other third party. You need to know your requirements before deciding on a solution.
I would rate this solution an eight out of 10.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.