10-21-2014 02:32 PM
I have two locals that are setup with a GRE tunnel to 2 DMZ controllers. Guest connects to the guest SSID and the local controllers tunnel their traffic over to the DMZ controller using the GRE tunnel. This is working great.
I have a clearpass the sits on the DMZ. How do I direct the guest traffic to the DMZ CPPM after they are tunneled?
From the afp.arubanetworks.com it says to set the DMZ end of the tunnel to untrusted, but it doesn't mention what else is required. I know that I need some sort of wired-aaa-profile that need to be triggered for traffic coming from that tunnel. Please advise and let me know if I can provide any info that might help you to help me ;)
Solved! Go to Solution.
10-21-2014 03:20 PM
Lead Mobility Engineer @ Integration Partners
AMFX | ACMX | ACDX | ACCX | CWAP | CWDP | CWNA
10-21-2014 04:24 PM - edited 10-21-2014 04:30 PM
The VLAN that the guests will be assigned to on the DMZ controller needs to have a wired-AAA profile associated with it. This AAA profile will have an initial role assigned that contains a captive portal role/profile assigned. The DMZ end of the tunnel should be "untrusted" to trigger the AAA profile assigned to the VLAN. An example configuration (VLAN 666 is the guest VLAN on the DMZ controller)...customize per your needs. The changes are made on the DMZ controller.
interface tunnel 5
tunnel source 220.127.116.11
tunnel mode gre 48
tunnel destination 18.104.22.168
tunnel vlan 666
aaa authentication captive-portal dmz-guest-cp
access-list session logon-control
access-list session captiveportal
aaa profile guest-dmz
vlan 666 wired aaa-profile dmz-guest-logon
Systems Engineer, Northeast USA
ACCX | ACDX | ACMX
10-22-2014 11:54 AM
Perfect, thank you very much all.
Clembo, I set it up like you mentioned and it worked perfectly.
I have one more question:
The DMZ controllers are Master local. Guest now get their dhcp from the DMZ master, if that one fails, how do I configure the dhcp pool between the two dmz controllers? Is it the same exact scope or do I split the scope in between the two controllers?
Thank you for your help.
10-22-2014 12:45 PM
You need to split the scopes because both controllers will respond.
If my post is helpful please give kudos, or mark as solved if it answers your post.
ACCP, ACMP, ACMX #294