Wireless Access

Ok, I've poured over the VRDs for campus design till my eyes are crossing, and still not able to get this right. It might be that what I am trying to do just can't be done this way so I'm asking for help on my design...

Here's the setup:

• (1) chassis with (3) controllers, all 6000s. Aruba_Master, Aruba_Local1, and Aruba_Local2
• VRRP instance 42 is configured between Master and Local 1
• The VIP for instance 42 is what the DNS (A) record for aruba-master points at.
• Master and Local1 are configured in Master/Standby and that is working fine. Database sync is working, VRRP is working. 
• Total of about 480 APs in our network. We have licenses split between the three controllers 256/256/256. 
• Each of the locals get about half the APs. So about 240 to Local1, 240 to Local2.

What I want to do is set up two more VRRP instances:  Local1 <-> Master,  and Local2 <-> Master. Then have that single virtual IP be the primary LMS on those two system policies, rather than using primary and backup LMS ips.

However, if I try to do that on Controller1, which is currently the backup master, the APs all go into a reboot cycle and claim they cannot connect to the VIP for that VRRP instance, even though I can ping it and I can SSH to it and reach the Local1 controller using that VIP.

What am I missing? On a possibly related note, I now see that all the APs configured to use Local1 as primary LMS and Master as backup LMS are heading to Master instead of Local1. So Local1 has 0 APs registered to it despite the reboots.

Edit:  Software is 6.1.3.6-AirGroup_37387 on all three controllers.

A Backup master cannot terminate APs, period.

Welp, that answers that then. Hmm. So how to set up redunancy for the APs then? Ideas?

And here's another question...

If I leave the licenses on the standby master, will it accept APs in the event of the primary Master failing? 

That would be silly, as I doubt I can have a VRRP instance monitoring another VRRP IP.

If the primary fails, the access points that are pointed to the VRRP will then be accepted by the backup.

In your current scenario, you only have two targets:  the VRRP and the ip address of local2.  In the first AP-Group, the LMS-IP is the VRRP.  In the second AP-Group the LMS-IP is the ip address of local2.  If you make it a single master and two locals, you can theoretically have access points on all three controllers, but no backup for your master.

Consider this option:

If you want to talk a design that makes all of your 6000  capacity, put in place 2 3200s as master/backup with minimal licensing and make the VRRP between them answer to aruba-master.  Make all of your remaining 6000s locals to the 3200s.  The 3200s will then redirect your access points based on ap-group  to the 3 6000s in a number of N+1 scenarios, if you would like.  Please speak to an Aruba Engineer who knows your network to see if this would even be feasible with your current setup.

Ok, so I guess our best bet is to buy another 256 licenses, and have 256 free on either end of Master VRRP <> Local2 with the load just split between the two of them.? We had originally split it this way to reduce cost by having to only buy 150% of total capacity instead of 200%

If I did that, then:

- Master failure = Local1 becomes Master, Local1 takes Master's half of the APs.

- Local 2 failure = Master takes all APs.

- Local 1 failure = no effect, except that Master has no backup.

Problem with your dual 3200 proposal is that our chassis only has four slots. Hrm. 

Something like this?

---

@TESC-DanScherck wrote:

Ok, so I guess our best bet is to buy another 256 licenses, and have 256 free on either end of Master VRRP <> Local2 with the load just split between the two of them.? We had originally split it this way to reduce cost by having to only buy 150% of total capacity instead of 200%

 

If I did that, then:

 

- Master failure = Local1 becomes Master, Local1 takes Master's half of the APs.

- Local 2 failure = Master takes all APs.

- Local 1 failure = no effect, except that Master has no backup.

 

Problem with your dual 3200 proposal is that our chassis only has four slots. Hrm. 

---

The 3200s are single-U controllers that do not fit into a chassis.  They would not be in the chassis.  They would exist simply to answer access points that come up and route half to controller #1, and half to controller#2.  Controller #3 would be the backup LMS for both AP-Groups and function as the +1 in the N+1

Please check with your local SE to see if this would even be feasible.