Controller-less WLANs

This article will have a focus on configuring DHCP option and understanding its limitation on the Aruba Instant™ Access Points running Aruba Instant™ 6.2.1.0-3.3.0.0 Software.

The configuration and verification steps mentioned in this article are tested on IAP 105 running 6.2.1.0-3.3.0.0 and Aruba Instant still does not support wired-client role-derivation with DHCP-OPTION attribute

Environment : This article applies to all the IAPs running a minimum OS version of 6.2.1.0-3.3.0.0.

If you create a  profile with the DHCP-Option rule type, the first two characters in the Value field must represent the hexadecimal value of the DHCP option that this rule should match, while the rest of the characters in the Value field indicate the DHCP signature the rule should match. To create a rule that matches DHCP option 55, the first two characters in the Value field must be the hexadecimal value of 55, which is 37.

The following table describes DHCP options that are useful for assigning a user role or VLAN.

In the Instant UI
 

1. In the Networks tab of the Instant main window, click the New link. The New WLAN window appears. Now Create a SSID, select “Employee” for Primary usage

2. On Vlan page, select Network assigned and dynamic, add vlan rules with DHCP-OPTION attribute.

3. On Security page, select PSK, Open or Enterprise security level. DHCP-OPTION doesn’t depend on Radius attribute.

4. On Access Page Create new rule, choose dhcp-option, then assign a role.

5. Click OK


In the CLI

(Instant Access Point)(config)# wlan ssid-profile test

(Instant Access Point)(SSID Profile "test") #enable

(Instant Access Point)(SSID Profile "test") # index 5

(Instant Access Point)(SSID Profile "test") #  type employee

(Instant Access Point)(SSID Profile "test") #  essid test

(Instant Access Point)(SSID Profile "test") #wpa-passphrase 8a3405dafce9fa02e5737c67c5d3c8f62237f4564902f703

(Instant Access Point)(SSID Profile "test") #opmode wpa2-psk-aes

(Instant Access Point)(SSID Profile "test") #max-authentication-failures 0

(Instant Access Point)(SSID Profile "test") #vlan 1

(Instant Access Point)(SSID Profile "test") #auth-server InternalServer

(Instant Access Point)(SSID Profile "test") #set-role dhcp-option starts-with 37010 testing

(Instant Access Point)(SSID Profile "test") #set-vlan dhcp-option starts-with 37010 99

(Instant Access Point)(SSID Profile "test") #rf-band all

(Instant Access Point)(SSID Profile "test") #captive-portal disable

(Instant Access Point)(SSID Profile "test") #dtim-period 1

(Instant Access Point)(SSID Profile "test") #inactivity-timeout 1000

(Instant Access Point)(SSID Profile "test") # broadcast-filter none

(Instant Access Point)(SSID Profile "test") #dmo-channel-utilization-threshold 90

(Instant Access Point)(SSID Profile "test") #local-probe-req-thresh 0

(Instant Access Point)(SSID Profile "test") #max-clients-threshold 64

(Instant Access Point)(SSID Profile "test") #wlan access-rule testing

(Instant Access Point)(SSID Profile "test") # vlan 99

(Instant Access Point)(SSID Profile "test") #rule any any match any any any permit

(Instant Access Point)(SSID Profile "test") #end

(Instant Access Point) #commit apply

An typical DHCP option configuration for Avaya™ Phone