Welch Allyn assumes no responsibility for any injury to anyone, or for any illegal or improper use of the product, that may result from
failure to use this product in accordance with the instructions, cautions, warnings, or statement of intended use published in this
manual.
For patent information, please visit www.welchallyn.com/patents.
For information about any Welch Allyn product, or to contact your nearest Welch Allyn representative, go to
Welch Allyn connected workstations, servers and patient monitors utilize standards based
communications protocols including, but not limited to, 802.3 for wired Ethernet and
802.11a/b/g for wireless. This guide specifies the requirements and recommendations
needed to successfully complete and maintain a Welch Allyn patient monitoring system in
your wireless or wired network.
Implementation and maintenance of a stable and usable integrated network is the sole
responsibility of the customer.
Although ultimately your responsibility, Welch Allyn recommends that you conduct a
hazards analysis per IEC 80001 to determine if any issues exist that should be mitigated
to ensure your patients safety.
2IntroductionWelch Allyn Network installation
2
Acuity
Implementation
Welch Allyn has split the best practices into two groupings to bring transparency in
making the changes necessary for success. Some items that are included in an individual
group may only function correctly if corresponding changes are made in one or both
groups. This inter-dependence makes implementation a company-wide undertaking. If the
clinical staff manages the Acuity system and is responsible for its use and maintenance,
increased communication of the changes made by the IT staff that may impact the Acuity
system and the network is recommended.
To ensure the Acuity system operates as intended, the network must meet latency,
coverage, jitter, and other network requirements described in this document and the
directions for use. Typically, data flows via UDP/TCP from the medical device to an Access
Point (AP), through the Health Delivery Organization’s (HDO’s) layer-3 network to the
wireless controller, through HDO’s layer-3 network to an Acuity server. A successful site
validation is the final step in ensuring the system is ready for implementation.
In all additions and changes to the hospital physical environment or the network
environment, verify coverage and proper system operation continue to meet the
requirements indicated in this document and the directions for use. Conduct a hazardanalysis per IEC 80001 to determine if issues exist that should be mitigated to ensure
patient safety and to continue compliance with recommendations in this document.
While these settings should not pose a risk to any currently installed systems, it is in your
best interest to fully review and understand the implications when making these changes.
The Welch Allyn support team and local wireless systems engineer are valuable assets
throughout this process.
Best practices
Welch Allyn has identified the following required network settings that improve
performance of Acuity systems and Welch Allyn patient monitoring devices. The
Performance impact column summarizes the network behavior that may be seen if the
best practice is not followed.
The settings in these tables require the expertise of an IT Department or consultant with a
similar knowledge base. Each of these recommendations has been reviewed by Welch
Allyn to insure minimal impact on existing networks. Settings listed in these tables may
affect wired and wireless communications and based on testing should not pose a risk to
installed security policies.
You are ultimately responsible for the functionality of the network. Review each of these
changes and make sure to backup the current settings before making changes.
4AcuityWelch Allyn Network installation
LAN/WLAN requirements
Each of the following tables reflects a different equipment manufacturer. To skip directly
to the table created for the manufacturer of your equipment, click on one of the following
links:
•“Aruba LAN/WLAN requirements” on page 5
•“Cisco LAN/WLAN requirements” on page 7
Best practicesAcuity5
Aruba LAN/WLAN requirements
Best practiceAffected types Without best practice
Bandwidth17% Proportional Bandwidth allocation for APs and
Welch Allyn virtual APs/Packet-Shaping.
Certificates For out of box operation use Welch Allyn certificates and
RADIUS Servers.
WirelessIncreased probability of dropped patient data
packets on busy wireless networks.
Wired, wireless Welch Allyn will be unable to debug system issues
such as monitors unable to connect to Acuity.
Hospital is responsible for debugging connectivity
issues at installation and throughout system life.
Critical IT support On a Shared or Customer Installed network, the
customer shall provide 24/7, mission-critical support for their network
Data rates
• a band -- 6Mbps required
Interference Signal to Noise Ratio (SNR) 15dBWirelessHigh noise level causes dropped packets.
Jitter Packet-to-Packet jitter shall be 400ms.Wired, wireless Dropped packets, data loss and dropped
Labeling Welch Allyn VLAN ports should be clearly marked on the
physical switches.
Network latency Round-trip peak network latency between Acuity
Central station and its patient monitor 800ms.
Packet transport Packets should be passed through switches and
routers in cut-through mode, or hardware based switching, not storeand-forward-only mode (applicable to older switches/hubs).
Power redundancy All network equipment used for patient
monitoring shall have a redundant power supply and emergency
power.
Priority Welch Allyn data should have priority over other data. Welch
Allyn data is configured for 802.11e Access Category Voice.
QoS Hardware Quality of Service (QoS) support should be configured
to map 802.11e QoS bits to a hard-wired tag.
Wired, wireless Possible extended downtime if network support
cannot be reached.
WirelessVital signs monitors will not connect.
connections.
Wired, wireless Harder to debug system issues. Mixing of IT and
patient data could result in loss of data due to
broadcast storms.
Wired, wireless Dropped packets and data loss.
WiredDropped packets and data loss.
Wired, wireless Data loss and downtime due to power outages.
Wired, wireless Mixing of IT and patient data priority may result in
lost data.
WiredIncreased probability of dropped patient data
packets on busy wireless networks.
RADIUS server When using EAP authentication, the controller must
be configured to communicate with low-latency RADIUS servers.
Unreliable communication with a RADIUS server, even in the presence
of a secondary RADIUS server, seriously impedes performance.
Redundancy Redundant coverage in patient areas (i.e. patient rooms)
where patients are likely to be unattended. Labs and Transport areas
require only single coverage but redundant coverage is recommended.
Roaming across subnets Keep the Welch Allyn wireless VLAN/
SSID flat (no roaming across subnets).
Rules/Firewall Use separate rules and roles for Welch Allyn patient
data and other IT data. Rules and roles should be identified using
Welch Allyn specific names.
Separate VLAN Keep Welch Allyn patient monitors on their own
VLAN and SSID.
Wired, Wireless Dropped packets, data loss, and dropped
connections.
WirelessPrevents the loss of data due to a single AP failure.
WirelessSuccess for roaming across subnets depends on the
hospital’s Layer-3 network. Hospital is responsible
for validation of proper roaming across subnets.
WirelessIT changes to the Aruba controller that
inadvertently affect Welch Allyn patient monitoring
are more likely. Patient data subject to issues on
wired network such as broadcast storms. Shorter
battery life for patient monitors.
Wired, wireless IT changes to the Aruba controller that
inadvertently affect patient monitoring are more
likely. Patient data subject to issues on wired
network such as broadcast storms. Shorter battery
life for patient monitors.
6AcuityWelch Allyn Network installation
Best practiceAffected types Without best practice
Signal strength First wireless signal: RSSI Value
-65dBm for (802.11a APs set to 25mW). Second wireless signal:
WirelessDropped packets and loss of connectivity due to
poor wireless coverage.
RSSI Value -70dBm for (802.11a APs set to 25mW).
SNMP read-only access Welch Allyn servers (Acuity systems) shall
have SNMP read-only access to Aruba controllers to log performance
data and generate alerts.
Wired, wireless Limited ability to proactively respond to system
issues. Debugging by Welch Allyn Remote
Technical may not be possible. Extended
troubleshooting times.
Spanning Tree Protocol (STP) STP should be turned off for the
Wired, wireless Dropped connections.
Welch Allyn specific VLAN/SSID. Use resilient links (spanning port
fast) for all wired interfaces connected to continuous monitors,
wireless controllers, or Welch Allyn Servers.
Mismatched connections Connections between gigabit and
FastEthernet interfaces should be avoided. If these interfaces are
appliances connected through the interface.
configured, use them for light traffic only, and do not rely on autonegotiation. Ensure that you configure speed and duplex settings to
100Mbps and Full Duplex.
Connection speed All Acuity systems must be connected to the
WiredDropped packets, data loss.
network using the same Ethernet speed.
UDP broadcast forwarding Allow UDP broadcasts on ports 7711-
WiredConnections cannot be established.
7720 from Welch Allyn VLAN to the Acuity Central station.
Wired connection Interconnects between all switches and all Aruba
WLAN controllers with gigabit Ethernet.
1. The 7% bandwidth allocation will support up to 20 connected Welch Allyn patient monitors per AP. If no Welch Allyn patient monitors are associated with the
AP the bandwidth is free to be used by other devices.
WiredWith only 100Mbs connections dropped packets
and data loss can occur.
Best practicesAcuity7
Cisco LAN/WLAN requirements
Best practiceAffected types Without best practice
Authentication/Encryption WPA2-PSK- AES Only
WirelessOther encryption methods not supported. No
connectivity.
Data rates
• a band -- 6Mbps required
Interference Signal to Noise Ratio (SNR) 15dBWirelessHigh noise level causes dropped packets.
Jitter Packet-to-Packet jitter shall be 400ms.Wired, wireless Dropped packets, data loss and dropped connections.
Labeling Welch Allyn VLAN ports should be clearly marked on the
physical switches.
Network latency Round-trip peak network latency between
Acuity Central station and its patient monitor
800ms.
Packet transport Packets should be passed through switches and
routers in cut-through mode, or hardware based switching, not
store-and-forward-only mode. (Applicable to older switches/hubs).
Power redundancy All network equipment used for patient
monitoring shall have a redundant power supply and emergency
power.
Priority Welch Allyn data should have priority over other data.
Welch Allyn data is configured for 802.11e Access Category Voice.
QoS Hardware Quality of Service (QoS) support should be
configured to map 802.11e QoS bits to a hard-wired tag.
Redundancy Redundant coverage in patient areas (i.e. patient
rooms) where patients are likely to be unattended. Labs and
Transport areas require only single coverage but redundant
coverage is recommended.
WirelessVital signs monitors will not connect.
Wired, wireless Harder to debug system issues. Mixing of IT and
patient data could result in loss of data due to
broadcast storms.
Wired, wireless Dropped packets and data loss.
WiredDropped packets and data loss.
Wired, wireless Data loss and downtime due to power outages.
Wired, wireless Mixing of IT and patient data priority may result in lost
data.
WiredIncreased probability of dropped patient data packets
on busy wireless networks.
WirelessPrevents the loss of data due to a single AP failure.
Roaming across subnets Keep the Welch Allyn wireless VLAN/
SSID flat (no roaming across subnets).
Rules/Firewall Use separate rules and roles for Welch Allyn
patient data and other IT data. Rules and roles should be identified
using Welch Allyn specific names.
Separate VLAN Keep Welch Allyn patient monitors on their own
WLAN, SSID, and VLAN.
Signal strength First wireless signal: RSSI Value
-65dBm for (802.11a APs set to 25mW). Second wireless signal:
RSSI Value -70dBm for (802.11a APs set to 25mW).
Spanning Tree Protocol (STP) STP should be turned off for the
Welch Allyn specific VLAN/SSID. Use resilient links (spanning port
fast) for all wired interfaces connected to continuous monitors,
wireless controllers, or Welch Allyn Servers.
Mismatched connections Connections between gigabit and
FastEthernet interfaces should be avoided. If these interfaces are
configured, use them for light traffic only, and do not rely on autonegotiation. Ensure that you configure speed and duplex settings to
100Mbps and Full Duplex.
WirelessSuccess for roaming across subnets depends on the
hospital’s Layer-3 network. Hospital is responsible for
validation of proper roaming across subnets.
WirelessIT changes to the Cisco controller that inadvertently
affect patient monitoring are more likely. Patient data
subject to issues on wired network such as broadcast
storms. Shorter battery life for patient monitors.
Wired, wireless IT changes to the Cisco controller that inadvertently
affect patient monitoring are more likely. Patient data
subject to issues on wired network such as broadcast
storms. Shorter battery life for patient monitors.
WirelessDropped packets and loss of connectivity due to poor
Connection speed All Acuity systems must be connected to the
network using the same Ethernet speed.
WiredDropped packets, data loss.
UDP broadcast forwarding Allow UDP broadcasts on ports
7711-7720 from Welch Allyn VLAN to the Acuity Central station.
Wired connection Interconnects between all switches and all
Cisco WLAN controllers with gigabit Ethernet.
WiredConnections cannot be established.
WiredWith only 100Mbs connections dropped packets and
data loss can occur.
Best practicesAcuity9
WLAN Controller requirements
Welch Allyn has identified the following requirements specific to a network and Acuity
implementation.
While many of these settings involve changes to the controllers themselves, some may
involve the wired infrastructure.
Each of the following tables reflects a different equipment manufacturer. To skip directly
to the table created for the manufacturer of your equipment, click on one of the following
links:
•“Aruba controller requirements” on page 10
•“Cisco controller requirements” on page 12
10AcuityWelch Allyn Network installation
Aruba controller requirements
Best practiceAffected types Without best practice
Advanced Radio Management (ARM) settings:
• Power save aware scan = enabled.
• VOIP aware = enabled
• Scan interval = 180 seconds
Authentication/Encryption EAP-TLS,
Channel advertisement Advertise
(Broadcast SSID).
1
WPA2-PSKWirelessOther encryption methods not supported. No connectivity.
802.11h capability
WirelessAPs perform ARM scanning at the time when PSP clients
are scheduled to send data, resulting in lost data.
WirelessDecreased number of 802.11a channels available. If APs
are on channels that require 802.11h capability, they will
not be available to patient monitors, resulting in RF
coverage holes.
Channel Switch Announcement (CSA) Disable.WirelessWhen CSA is enabled, data loss when changing channels
Client Match DisableWirelessIncreased probability of disconnects and roams in busy
Controller redundancy Aruba controller hardware should
include controller redundancy, either one to one or one to many
(1:1 or N:1).
Data Keep
using a Stateful Firewall. Acuity rules, policies, and roles should
be separated from rules, policies, and rules used for other IT
data.
Fast roaming/multi-association Disabled.WirelessDropped packets during patient monitor movement.
Firmware version Use
Aruba Operating System:
• 3.2.0.1-WA1
• 3.3.1.19
• 3.3.2.10
• 3.3.2.18
Supported hardware versions •WirelessUsing non-validated hardware may cause data loss.
• 800
• 2400
• 5000
• 6000
• SC1
• SC2
• 620
• 650
• 3200
• 3400
• 3600
Opportunistic Key Caching (OKC) Enabled.WirelessDropped packets during patient monitor movement.
patient telemetry data and general IT data separated
Welch Allyn-validated versions of the
• 5.0.3.3
• 6.1.2.7
• 6.2.1.2
• 6.3.1.6
• 7200
• MK3(5000)
• MK3(6000)
• AP60
• AP61
• AP65
• AP70*
• AP92
• AP105
• AP125
• AP135
WirelessFailure of a non-redundant controller would cause the
Wired, wireless IT changes to the firewall policies that inadvertently
WirelessUsing a non-validated version of firmware may induce
may
occur.
regions of network.
entire system to fail.
affect patient monitoring are more likely. Patient data
subject to issues on wired network such as broadcast
storms. Shorter battery life for patient monitors.
data loss.
*AP70 only validated for versions prior to 5.0.3.3
Quality of Service (QOS) Wireless/Wired
Welch Allyn patient data with AC_VO (Access Category Voice).
1. Aruba 6.2 and later: adjustable via CLI only, see rf armprofile command.
LAN shall support
Wired, wireless Increased data loss for patient data.
Best practicesAcuity11
Best practiceAffected types Without best practice
Security Use
monitors:
• IP access-list session WelchAllyn_ACL
• any host 255.255.255.255 udp 7711 7720 permit queue high
tos
• any alias Acuity-servers udp 1001 65535 permit queue high
tos
• user alias Acuity-servers any permit disable-scanning
• any svc-icmp permit
• any svc-dns permit
• any svc-dhcp permit
• any svc-http permit
• any svc-ntp permit
• any tcp 5650 permit queue high
• any tcp 5680 permit queue high
• any tcp 5695 permit queue high
the following ACL for Welch Allyn patient
56 dot1p-priority 7
56 dot1p-priority 7
WirelessFailure for monitor to establish session with Acuity
server,
increased data loss for patient data.
SSID Configuration Avoid
802.11b/g radios of an AP.
SSID/Radio settings
• Radio Beacon Interval set to =100 msec
• DTIM set to 10
• a band Only
• Enable short preamble
• 6Mbps Data rate mandatory
• Forward UDP ports 7711 -7720
• Radio High throughput enabled (disabled)
• Interval between Identity Requests = 3
• Quiet Period after Failure Authentication=3
• WPA-key-period 2000
• Disable channel 165
User role Assign
value. Set the class attribute on the RADIUS server to the string
that is the role assigned; Welch Allyn patient monitors.
VoIP traffic Limit
open connections per AP.
Wireless Multimedia (WMM) Enabled.WirelessPatient Monitors will disconnect during movement.
WLAN Optimization Aruba
• Controller CPU utilization <50%
• Radio channel utilization <40%
• Number of SSIDs per AP 4
• Number of clients per AP 30
• Controller memory utilization 20Mb
• Average RSSI of all clients -67
• AP Received packet error rate 50%.
user role based on the RADIUS server class
VoIP traffic on 802.11a to no more than three
duplicate SSID on the 802.11a and
recommends the following:
dBm
WirelessClient devices may roam from the 802.11a radio on an AP
WirelessLoss of connection and data, patient monitor will not
WirelessPatient monitors not assigned to a role. Unable to
WirelessHaving more than three connections per AP has the
Hardware,
wireless
to the 802.11b/g radio rapidly, creating loss of data.
connect.
connect to Acuity server.
potential to increase patient data loss.
When network performance is outside recommended
parameters,
WirelessDecreased number of 802.11a channels available. If APs
are on channels that require 802.11h capability, they will
not be available to patient monitors, resulting in RF
coverage holes.
Channel Switch Announcement (CSA) Disable.WirelessWhen CSA is enabled, data loss when changing channels
Controller
General (GUI)
• Broadcast Forwarding = Enabled
Interfaces:
• Welch Allyn VLAN Interface
DHCP Information
• Primary DHCP Server = Primary Acuity IP address
• Secondary DHCP Server = Secondary Acuity IP address
Advanced
• Spanning Tree = Disabled
• *DHCP Proxy = Enabled (default)
Controller (CLI)
• EAPOL Key timeout: change default 1000 to 3000 by using
the following command: config advanced eap eapol-keytimeout 3000
Data Keep patient telemetry data and general IT data
separated using a Stateful Firewall. Acuity rules, policies, and
roles should be separated from rules, policies, and rules used
for other IT data.
Firmware version Use Welch-Allyn validated versions of the
Cisco Operating System:
• 6.0.202.0
• 7.0.116.0
• 7.0.220.0
• 7.2.110.0
• 7.4.110.0
• 8.0.100.0
Hardware supported
• Controller: 4400 series, WiSM1 and 5500 series, WiSM2
• Access Point: AP1230ag, AP1131ag, AP1240ag, AP1142n,
1252n, AP 3502, AP 3702
Radio Resource Manager (RRM) Settings Enabled (default)
• Customers should ensure AP transmit power and
channelization is optimized on VLANs used by Acuity.
• Cisco recommends enabling RRM. Optimal range should be
11 – 17 dBm.
WirelessLoss of connection and data.
Wired, wireless IT changes to the firewall policies that inadvertently
WirelessUsing non-validated firmware may cause data loss.
Wired, wireless Using non-validated hardware may cause data loss.
Wired, wireless Increased data loss for patient data.
may occur.
*DHCP Proxy enabled (default) causes the Welch Allyn
device service screen DHCP address to display the virtual
port address of the controller instead of the IP address of
the DHCP server (no impact to performance).
affect patient monitoring are more likely. Patient data
subject to issues on wired network such as broadcast
storms. Shorter battery life for patient monitors.
SSID Configuration Avoid duplicate SSID on the 802.11a and
802.11b/g radios of an AP.
Note This is not Cisco-specific. This is a general wireless
guideline.
WirelessClient devices may roam from the 802.11a radio on an AP
to the 802.11b/g radio rapidly, creating loss of data.
Best practicesAcuity13
Best practiceAffected types Without best practice
SSID/WLAN settings
Security:
• Layer 2 Security = WPA+WPA2
WPA+WPA2 Parameters:
• WPA Policy = Disabled
• WPA2 Policy = Enabled
• WPA2 Encryption = AES
• Auth Key Mgmt = PSK
Quality of Service (QOS)
• Platinum (voice)
Wireless Multimedia (WMM):
• WMM Policy = Required
• 7920 AP CAC = Disabled
• 7920 Client CAC = Disabled
Advanced:
• Allow AAA Override = Disabled
• Coverage Hole Detection = Enabled
• Enable Session Timeout = Disabled
• Aironet IE = Disabled
• Diagnostic Channel = Disabled
• Override Interface ACL
IPv4 = None
IPv6 = None
• P2P Blocking Action = Disabled
• Client Exclusion = Disabled
• Maximum Allowed Clients = 0
• Static IP Tunneling = Disabled
• Wi-Fi Direct Clients Policy = Disabled
• Maximum Allowed Clients per AP Radio = 200
• Passive Client = Disabled
• Client Profiling = Disabled
• Media Session Snooping = Disabled
WirelessLoss of connection and data.
Off Channel Scanning Defer:
• Scan Defer Priority = Enable only 6 and 7
• Scan Defer Time (msecs) = 2000
DHCP:
• DHCP Server (Override) = Disabled
• DHCP Addr. Assignment (Required) = Disabled
Management Frame Protection (MFP) = Disabled
DTIM Period (in beacon intervals):
• 802.11a/n (1-255) = 10
• NAC = Disabled
Load Balancing and Band Select:
• Client Load Balancing = Disabled
• Client Band Select = Disabled
VoIP traffic Limit VoIP traffic on 802.11a to no more than three
open connections per AP.
WirelessHaving more than three connections per AP has the
potential to increase patient data loss.
14AcuityWelch Allyn Network installation
Best practiceAffected types Without best practice
WLAN Optimization Cisco recommends the following:
• Controller CPU utilization <50%
• Radio channel utilization <33%
• Number of clients per AP 25
• Controller memory utilization <70%
• Average RSSI of all clients -67
• AP Received packet error rate <10%.
dBm
Hardware,
wireless
When network performance is outside recommended
parameters,
potential loss or corruption of data.
Validation
The validation process begins immediately following the Acuity System installation. Many
of the criteria used to ascertain the stability and usability of the installed system have
been covered previously in this document. Testing of these criteria involve the use of a
laptop utilizing AirMagnet Surveyor Pro and an 802.11a wireless card. The basic testing
requirements are listed in the table below. This testing is standard across all installed
802.11a systems installed by Welch Allyn.
CriterionMeasuresRequirement
Device connectivityA patient monitor needs to be attached to the
during signal testing to ensure
system
dropout does not occur in edge conditions.
The patient monitor should remain
connected without any extended gaps
of greater than 4 seconds and should
not completely disconnect from the
network at any time during the test.
First signal strengthThe received signal strength of the nearest AP RSSI -65dBm
Network up-timeAmount of time the network transporting
Packet latencyRound-trip peak network latency between
Packet-to-packet jitterJitter times between packetsPacket-to-Packet 400ms
Second signal strengthThe received signal strength of the next
Signal to Noise Ratio (SNR)The difference between the received signal
UDP broadcastThe ability to communicate with the central
patient
data is available during any 24 hour
period
Acuity
Central station and its patient monitors
AP
closest
strength and the detectable noise floor
Acuity monitoring station and patient
monitoring devices
Up-time 99.9% over a 24 hour period
Latency should be 800ms
RSSI -70dBm
15dB
UDP Broadcasts between ports 77117720 should be in pass-through mode
rather than store-and-forward mode
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.