Wireless Access

I have two WLANs setup. Identical in everyway except one is secured and one is open. The secured one gets an IP on every device tried (with the proper key) and is fine. Trying t connect to the "open" one tries to obtain an IP 3 times then switches to the secured one.

Obviously I am missing something simple.

DHCP server Windows Server 2008 R2.

Thoughts?

Do you have an "ip helper-address" on the VLAN interface of the VLAN that is not working?  That would direct broadcast (DHCP) traffic to your DHCP server.

You mention that both wlan profiles are setup the same way , Are you using the same VLAN for both setups ?

Yes. Both on VLAN1. Both set to Tunnel.

What is the role that a user on the new SSID end up in?  Is it allowing DHCP?

AP-800 5.0.4.4.

Guest. Changed to Authenticated but didn't seem to matter.

DHCP does not seem to be individually controlled in this version. Or I am missing it. Set both up using the Wizard.

Not sure what this is?

QinQ Outer VLAN

can you please share the following : show wlan virtual-ap <virtual-ap name> for the open and secure setup

Cool! New command to learn! (for me, relative newbie)

Virtual AP profile "MSDPT_Fast"
-------------------------------
Parameter                                       Value
---------                                       -----
QinQ Outer VLAN                                 0
Virtual AP enable                               Enabled
Allowed band                                    all
AAA Profile                                     MSDPT_Fast
802.11K Profile                                 default
SSID Profile                                    MSDPT_Fast
VLAN                                            1
Forward mode                                    tunnel
Deny time range                                 N/A
Mobile IP                                       Enabled
HA Discovery on-association                     Enabled
DoS Prevention                                  Disabled
Station Blacklisting                            Enabled
Blacklist Time                                  3600 sec
Dynamic Multicast Optimization (DMO)            Disabled
Dynamic Multicast Optimization (DMO) Threshold  6
Authentication Failure Blacklist Time           3600 sec
Multi Association                               Disabled
Strict Compliance                               Disabled
VLAN Mobility                                   Disabled
Preserve Client VLAN                            Disabled
Remote-AP Operation                             standard
Drop Broadcast and Multicast                    Enabled
Convert Broadcast ARP requests to unicast       Enabled
Band Steering                                   Enabled
Steering Mode                                   prefer-5ghz
VLAN POOL SIZE                                  0
WMM Traffic Management Profile                  N/A

Virtual AP profile "MSDPT_Guest-vap_prof"
-----------------------------------------
Parameter                                       Value
---------                                       -----
QinQ Outer VLAN                                 0
Virtual AP enable                               Enabled
Allowed band                                    all
AAA Profile                                     MSDPT_Guest-aaa_prof
802.11K Profile                                 default
SSID Profile                                    MSDPT_Guest-ssid_prof
VLAN                                            1
Forward mode                                    tunnel
Deny time range                                 N/A
Mobile IP                                       Enabled
HA Discovery on-association                     Enabled
DoS Prevention                                  Disabled
Station Blacklisting                            Enabled
Blacklist Time                                  3600 sec
Dynamic Multicast Optimization (DMO)            Disabled
Dynamic Multicast Optimization (DMO) Threshold  6
Authentication Failure Blacklist Time           3600 sec
Multi Association                               Disabled
Strict Compliance                               Disabled
VLAN Mobility                                   Disabled
Preserve Client VLAN                            Disabled
Remote-AP Operation                             standard
Drop Broadcast and Multicast                    Disabled
Convert Broadcast ARP requests to unicast       Enabled
Band Steering                                   Enabled
Steering Mode                                   prefer-5ghz
VLAN POOL SIZE                                  0
WMM Traffic Management Profile                  N/A

Are you trying to configure as a guest with a captive portal ? if that's not what you are trying to do  and you are not trying to do anything special under that ssid then do the following:

Your issue might be related to the setup under the aaa config 

Do the following :

(controller) (config) #aaa profile MSDPT_Guest-aaa_prof

(controller) (config) #(AAA Profile "(AAA Profile "MSDPT_Guest-aaa_prof #") #initial-role authenticated (unless you already using this role for something else then just create a new one) - Try this as a test first and then customize it to whatever you are trying to accomplish

But if you want to restrict the user behind that ssid then you need to create another user-role and apply all the restrictions under that role :

(controller) (config) #user-role OPEN-AUTH

No captive portal. We use Lightspeed as a content filter. After getting an IP, before getting on the internet, it captures the traffic for a login (unless there is a client already installed).

Nothing special.

Both now set to Authenticated as the initial role and guest on the MAC authentication.

No change.

Tried to compare to other working controllers, but they are all at 6+.

Any reason they can't use the same "authenticated" role in 5?

Decided to delete the Guest profile and start over. It won't let me. Claims it is used by the secure profile. I don't find anywhere that the secured setup references the guest setup. Database error?

You can use the show references command to determine where that particular profile is being use 

References to AAA Profile "MSDPT_Guest-aaa_prof"
------------------------------------------------
Referrer                                            Count
--------                                            -----
wlan virtual-ap "MSDPT_Guest-vap_prof" aaa-profile  1
Total References:1

Getting conflicting information between the GUI and CLI.

GUI shows an additional WLAN named Aruba-AP and claims the others reference it and therefore it cannot be delete.

CLI doesn't show it:

Virtual AP profile List
-----------------------
Name                  References  Profile Status
----                  ----------  --------------
default               1
MSDPT_Fast            1
MSDPT_Guest-vap_prof  1
MSDPT_S2              1

Can't post a screenshot, right?

In the WLAN wizard at the profiles are grayed out and there is an "error" message at the bottom, in red, stating a reference to one of the others. Like:

MSDPT_Guest has been modified such that it is no longer editable from this Wizard. REASON: Dot 1x profile(MSDPT_Guest-aaa_prof) is also referenced by another AAA AP profile(MSDPT_S2)..
Use the full Configuration user interface to edit it.

This does not appear to be true in either the GUI full config or the CLI show references.

Next I decided to just disable that guest profile and make a new one, with the Wizard. Goes through all the steps, no errors, but does not create the WLAN. No SSID, Profile, AAA... nothing! Tried twice.

Perplexed.

Yes. Building level layer 3 has ip-helper on vlan. Does it need to be in the Aruba somewhere?