Controllerless Networks

Hello Marcus

I just saw this release note

Awsome vlan poolin! though you guys alrady had it in mind i put that idea but didnt got any kudos:(

Anyways i would like to know whats the idea that aruba got with the instants?

It will eventually will be a replacement for small controllers  i mean  there are coming  lot of new features... and all the good features that the controller has you are bringing them to the instants... not all but the important one i think...

Can you enligh me to know what is the Aruba vision with instant?  

---

 

Anyways i would like to know whats the idea that aruba got with the instants?

It will eventually will be a replacement for small controllers  i mean  there are coming  lot of new features... and all the good features that the controller has you are bringing them to the instants... not all but the important one i think...

Can you enligh me to know what is the Aruba vision with instant?  

---

Controllers will not go away.  At this point there are some features that our controllers do that Instant does not.  A couple that come immediately to mind are RAP and VIA.  Additionally, in very large deployments controllers may be a better choice in that the edge switches do not need to be configured with trunk ports spanning out to each AP.

We are expanding the IAP feature set to tie in to the Distributed Enterprise model in which case you may have a large enterprise running Aruba controllers at the main campus then have remote sites running IAP.  As IAP now supports VPN termination to an Aruba controller it allows the remote sites most of the Aruba feature benefits plus VPN connectivity back to corp.  Note, in this model the controller is not managing the IAP but is just acting as a concentrator.   As such, IAP plays in the SMB, mid-market, distributed retail, distributed enterprise, as well as K-12.

Thanks Marcus

One last question

Is the Captive portal with time and special webpage is coming anytime soon with instant or you do not have that in mind yet??

I ask you this because i have got a quite a group of custumers that already asked me this...

Becasue they got budget for instant and not for the controller and APS cause of the licenising  + the controller.... the thing is that most of them always want the captive portal with time for users like with the controller and that the guest user dissapear at the time that you told it to...

Some of them are small sites of like 20 or 30 users... but then the budget goes too high with controller based solution... and when you presetn them the instant they are like ahhhhhh but i dont have the Guest captive portal is not the same.... haha

---

@NightShade1 wrote:

Is the Captive portal with time and special webpage is coming anytime soon with instant or you do not have that in mind yet??

 

---

Can you be more specific on how you would like these two features to work?  I can check with Product Management once I have more detail.

Time -- are you referring to setting a time-out.  Something like 60 minutes per user?  You can do this with ClearPass / Radius today.

Special Webpage - are you referring to the ability to upload your own background like the controller?

   In the very least, IAP does allow you to redirect a guest to the page of your choice post-auth.

Special Webpage so non IT personal can give Guest Access, and just have permission to add users for guest

Time

In which you will be able to set a time for the user let say a new guest come you can put it well he will stay one day and you can put one day or he willl stay 4 hours then you can put 4 hours

Specially that... doesnt need to be a super captive portal... but clients are looking those two things on their instant at least for now... or at least the ones that have asked me...

They dont like the captive portal in which the IT personal have to manage neither that you have to manuallly set a user and password and manually have to delete it... and if hyou leave a general one... if someone else give it to you it will work... and well thats the part they dont like... or at least is the feedback i have got....  But these kind of custumer also is the one that does not have like the budged for the controller + the ap license.....

Another qusetions...

Even with the vlan poolin the limitation for this will be 1024 users per VC?its more a limitation of hardware and not of performance ?

Cheers

Carlos

Even with Vlan pooling the limit of 1,024 concurrent clients still applies.

I will talk to Product Management after the holidays about your CP requests.  You may also want to file them under the "Ideas" page.

Okay Marcus

Do you recomend the ideas on airheads or the ideas on the partner site?

"Enahancement Requests" on Partner Center under "Services & Support" would probably be best.

---

@NightShade1 wrote:

Thanks Marcus

One last question

Is the Captive portal with time and special webpage is coming anytime soon with instant or you do not have that in mind yet??

 

I ask you this because i have got a quite a group of custumers that already asked me this...

Becasue they got budget for instant and not for the controller and APS cause of the licenising  + the controller.... the thing is that most of them always want the captive portal with time for users like with the controller and that the guest user dissapear at the time that you told it to...

Some of them are small sites of like 20 or 30 users... but then the budget goes too high with controller based solution... and when you presetn them the instant they are like ahhhhhh but i dont have the Guest captive portal is not the same.... haha

 

---

I have exactly this with our proposals.  Customer wants a configurable (and decent) captive portal, but then adding the licences and controller pushes it over the affordability limit.

So, I've tested this idea.  Small controller, 620, with only single licences.  GRE tunnel from IAPs to controller, and then you have a proper captive portal and guest provisioning.  There's a few caveats, but as a proof of concept, I've passed this to our product team so it can be included in future proposals.

I have another post somewhere with more details, but can give more details here if needed.

:-)

As a follow-on to my previous message we have added new integration features to our Mobility Access Switch (S2500 & S3500) that allow the IAP and MAS to communicate with each other and take action automatically.   The items shown below are enabled on the MAS with the latest release of SW for the MAS - AOS 7.2 which was also just released.

Rogue AP Containment
When a rogue AP is detected by IAP, the IAP sends out the MAC Address of the rogue AP to the MAS using the Aruba’s proprietary LLDP TLV protocol (MAC information TLV with action as Blacklist). The MAS blacklists the MAC address of the rogue AP and turns off the PoE on the port or the MAS installs a bridge entry with the source MAC command as DROP to discard the packets originating from or carried to the Rogue AP.

PoE Prioritization
When an IAP is plugged into a PoE enabled port on the Mobility Access Switch, the Mobility Access Switch automatically increases the PoE priority from low (default) to high. This only occurs if the poe-profile associated with the given port is using the poe-factory-initial profile and the default poe-priorty has not been manually changed.

GVRP Integration
Configuring GVRP in Mobility Access Switch enables the switch to register/de-register the dynamic VLAN information received from a GVRP applicant such as an IAP in the network. GVRP support also enables the switch to propagate the registered VLAN information to the neighboring bridges in the network.

Marcus,

i don't see anything n the documentation about mixed authentication modes.

---

@AgentEd wrote:

Marcus,

 

i don't see anything n the documentation about mixed authentication modes.

---

Page 9 of the Release Notes and page 144 of the 6.2 User's Guide------see "MAC + 802.1X Authentication" and "MAC + Captive Portal Authentication".