For the new products, Aruba added more intelligence to the onsite access points, and crafted a controller that, like the access points, can pull down from a master Aruba controller the needed configuration settings, and security and management policies.

"They have really tried to think through the provisioning and troubleshooting," DeBeasi says. "You take it out of the box, plug it in, enter an IP address and the device just phones home and gets provisioned by the remote controller."

Branch locations never have IT staff, and often have employees who know little about computers or networking. "I haven't played with it yet," DeBeasi says, "but from talking with Aruba, if you have a teenager at 7-11, he can just press a reset button, or fire up a screen and read off what he sees to a help desk guy back at corporate."

The new products are:

* Remote Access Point (RAP) 2: about the size of thick stack of playing cards, it has one 802.11b/g radio, and two Ethernet ports for VoIP phones or other devices. Price: $99.

* RAP-5: about the size of an upright book, it has a single 802.11a/b/g radio (11n with an integrated antenna is an option), five Ethernet ports, a USB port for a 3G cellular modem and hardware-based encryption. Price: starts at $395.

* 600 Branch Office Controller: supportsas many as 256 users on multiple access points (eight locally connected via Ethernet or Wi-Fi mesh, and as many as 32 remotely connected), gigabit Ethernet, standard Power over Ethernet, ExpressCard slot for a 3G modem, a server for network-attached storage (NAS), support for a range of WAN connections. Integrated 802.11n Wi-Fi is an optional feature. Price: starts at $1,495.

The RAPs are available now. The 600 series controller ships in June.

All the new products can be shipped to a branch or home office, and easily installed by employees there, according to Tennefoss.

The user plugs in the access point to a power outlet, connect it the office DSL router. Connect a laptop, bring up an entry screen and enter the IP address (supplied by the IT department) of a remote Aruba controller. Hit "return" and the RAP connects to that controller, authenticates via preloaded security certificates, sets up a secure IPSec tunnel, and then downloads a small firewall agent. The agent enforces the centrally configured, enterprise policies via the RAP's (or the 600 controller's) integrated firewall.

The new products support Network Address Translation traversal, and the control and data channels are encrypted.