Aruba Instant & Cloud Wi-Fi

Reply
MVP
Posts: 2,927
Registered: ‎10-25-2011

[Tutorial] Building a VPN from a IAP Cluster to a Wireless Contoller

[ Edited ]

Hello! in this guide ill teach you how to build a VPN tunnel from your IAP Cluster to the wireless controller

Prerequisites: you need a controller on 6.2 .x version!

 

There are many modes in which you can build this tunnel but expecifically ill teach you how to build a vpn tunnel to the controller on local network Nated by VC

 

First let see the config on the IAP

 

Lets go to VPN option on the IAP

vpn.PNG

 

 

You select IPSEC and on the primary host you put the ip address of the controller which should have a port mapping to your controller with a public ip address with the ipsec ports

 

then click next

 

vpn2.PNG

 

 

Here you add the networks that you want to reach on your  central site, the default gateway would be the public ip address of the controller.

 

Click finish

 

Now go to more again and go to DHCP Server

dhcp.PNG

add a new scope with a ramdom vlan, with a network of your preference.  When you fniish click ok

 

Now lets go to the SSID creation

Create a new network

 

ssid.PNG

There you put network assigned, and you put static and put the random vlan you created before, then you can set whatever you need on the other paramehters and click finish.

 

We are done on the Instant APs

 

 

Now on the controller side

 

You need to add the mac address of the IAP on your controller like this

(Aruba3400) #local-userdb-ap add mac-address 00:11:22:33:44:55 ap-group test

 

Or you can add it on the gui on the remote APS whitelist

 

After that you need to create a vpn pool like this

(Aruba3400) # ip local pool "rapngpool" <startip> <endip>

 

You can do it also by gui on vpn services.

 

Take in mind that the range you put in there should be a routable range that exist on the controller. for example  in my case for this demostration i used this vpn range

vpnrange.PNG

 

Becauase i got a interface vlan like this

 

interfacevlan.PNG

Which as you see that range is routable in my controller(not sure if you guys get my point?)

 

 

Then you need to create a IAP role like this

(Aruba3400) (config) #ip access-list session iaprole

(Aruba3400) (config-sess-iaprole)#any host <radius-server-ip> any src-nat (Aruba3400) (config-sess-iaprole)#any any any permit

(Aruba3400) (config-sess-iaprole)#!

(Aruba3400) (config) #user-role iaprole

(Aruba3400) (config-role) #session-acl iaprole

(Aruba3400) (config-role) #

(Aruba3400) (config) #aaa authentication vpn default-iap

(Aruba3400) (VPN Authentication Profile "default-iap") #server-group default

(Aruba3400) (VPN Authentication Profile "default-iap") #default-role iaprole

(Aruba3400) (VPN Authentication Profile "default-iap") #!

(Aruba3400) (config) #

 


Now if you got many address pools like me for many different things like this

addresspools.PNG

 

then you will need to select the correct one on the iap role like this

 

You go to the iaprole on access control and look for the l2tp pool and select the correct one, in my case is vpn liek this

l2protocol.PNG

 

After this you are done!

 

you can check if the vpn is up by doing show iap table

And you should see your vpn up in there...

 

Anyways i hope this help you guys

 

Cheers

Carlos

 

[Mod note: edited title for readability]

----------------------------------------------------
Product Manager - Aruba Networks
Alternetworks Corp
Aruba
Posts: 1,368
Registered: ‎12-12-2011

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

This is a great overview.  I would also add that folks understand all the DHCP (L2,L3,Local) depending on your scenario.  The one in the post above is basically a local DHCP server and ALL client traffic is NAT'ed out of the virtual controller.  It really depends on the scenario.  

 

For L2 extension like our traditional RAPs, it would be L2,Centralized

 

For a L3 extension which should be used for remote teleworkers or branch offices, please review and consider L3,Distributed.  It is what I recommend almost 100% of the time.  

Seth R. Fiermonti
Consulting Systems Engineer - ACCX, ACDX, ACMX
Email: seth@hpe.com
-----
If you found my post helpful, please give kudos
MVP
Posts: 2,927
Registered: ‎10-25-2011

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

thanks Seth

Ill try making a tutorial forhte L3 deployment another day

 

Cheers

Carlos

----------------------------------------------------
Product Manager - Aruba Networks
Alternetworks Corp
MVP
Posts: 1,408
Registered: ‎10-25-2011

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

Can I make a suggestion that you post this to the Aruba Solution Exchange??
Pasquale Monardo | Senior Network Solutions Consultant
ACDX #420 | ACMP
[If you found my post helpful, please give kudos!]
Aruba Employee
Posts: 30
Registered: ‎07-12-2010

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

Great guide NightShade1.  

 

Take a look at the solution, https://ase.arubanetworks.com/solution/name/iap_vpn/, on Solution Exchange.  This solution helps configure IAP VPN to Mobility Controller either over distributed L2 or distributed L3.  I just added a link on the solution to this thread as an additional reference point for other users.

MVP
Posts: 2,927
Registered: ‎10-25-2011

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

Excellent link thank you very much!

 

Cheers

Carlos

----------------------------------------------------
Product Manager - Aruba Networks
Alternetworks Corp
MVP
Posts: 2,927
Registered: ‎10-25-2011

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

Did you just made that tutorial? hahaha it just got like 10 mins there :)

----------------------------------------------------
Product Manager - Aruba Networks
Alternetworks Corp
Aruba Employee
Posts: 30
Registered: ‎07-12-2010

Re: [Tutorial]Building a VPN from a IAP Cluster to a Wireless Contoller

It's actually been around since August but it shows when the solution was last modified, which was just recently to add a link to this thread.  

Occasional Contributor II
Posts: 31
Registered: ‎05-04-2011

Re: [Tutorial] Building a VPN from a IAP Cluster to a Wireless Contoller

[ Edited ]

 

Carlos,

 

I followed your turtorial, and I'm still having some issues.

 

I do have a unique setup that may differ from normal production environments.

 

Using ArubaOS 6.3.1.2

Instant 6.3.1.2-4.0.0.3

 

I'm trying to make this function in a test environment without the availability of public IP facing the internet.  So all IP interfaces are private.  This could add some issue itself.

 

I do have a router/firewall in between the IAP and the controller, on the recommendation that I could have a route to the controller in addition to the VPN tunnel.  This could cause two paths which could interfere my testing.

 

First issue is getting the VPN connected.  I do not see the the vpn in the "show iap table"

However, the VPN shows "up" in the Instant UI.  

I also see the IAP in the AOS Monitor tab > Clients > (two entries, one for the inner and one for the outer IP)  

 

Behavior seen is the VPN status on the IAP goes up and down.  The inner IP address changes each time it does this.

I can't access any of my controller VLANs that I have set up in the route section for the VPN on the IAP.

 

Any suggestions?

 

Regards,

Colin

 

 

 

MVP
Posts: 2,927
Registered: ‎10-25-2011

Re: [Tutorial] Building a VPN from a IAP Cluster to a Wireless Contoller

Hello Collin King

If you cannnot see the tunnel up on show iap table then the tunnel is not up...

 

Can you show me some kind of network diagram? to see what you are doing in your lab?

 

Cheers

Carlos

----------------------------------------------------
Product Manager - Aruba Networks
Alternetworks Corp
Search Airheads
Showing results for 
Search instead for 
Did you mean: