Wireless Access

Good afternoon,

I'm currently trying to configure a RAP-2WG to connect back to our Aruba 3400 Controller.

For testing purposes i am connecting the RAP via a seperate ADSL circuit. After connecting, i try and browse the internet and am interruped by the provisioning screen as expected.

I then point the RAP at the public IP of our controller. The provisioning process seems to go OK (with "Successful" messages for 'Uplink Status, IP Information, Gateway Ping, TPM Certificates and Master Connectivity) and the RAP is then sent for reboot.

The problem comes after the reboot. The RAP seems to come back up OK (i.e. 4 green lights) but the laptop that i have connected to the RAP is not able to get a Network Connection ("No Network Access" and 169.254.88.2 IP Address).

I'm leaning towards a DHCP issue but thought i'd try and get some input from here first.

I apologise that my first post on here is a question but any suggestions would be much appreciated.

Cheers,

Matt

Yes sounds like a DHCP/VLAN issue.  Are you connecting wirelessly or wired to the RAP on this laptop?   If wirelessly, check the virtual AP assigned to the group the RAP is in and check the VLAN and forward mode.  If it is a wired connection, check the same on the Wired AP Profile for Ethernet Interface 1 on that AP Group.

Hi - thanks very much for the reply.

It's a wired connection so, in my RAP group, i've had a look at the settings under AP > Ethernet interface 1 port configuration > Wired AP Profile.

In here i've made sure that 'Wired AP enable' is ticked, 'Forward mode' is tunnel and 'Access mode VLAN' is a VLAN on our network that has a DHCP scope.

With these settings - still no luck.

Matt

Do you have the port set as "trusted"?   If not, What AAA profile is applied to hat Port Profile; and what "initial role" is set for that AAA profile?

I've tried the connection with Trusted on and off.

At the moment i've gone with 'Trusted' off and the AAA profile is the same that all our AP 105s use around our site.

When i trace the 'Initial Role' of the AAA profile the only configuration i think i see on there is an 'allow all' rule in the Firewall Policies.

Do you use 802.1X on your AP-105s?  If you are using the same AAA profile, it may be failing there if there is an 802.1X server group defined.   Try using a new AAA profile that has no 802.1X server group defined in it; and an initial role of authenticated (to see if it works; you can then tighten it up).

Rather than going back and forth, if you can send the relevant parts of the config, we may be able to help further.

Yeah the AAA profile for our 105s is using an 802.1X Authentication Server Group.

I've created a brand new AAA group with 'Initial Role', '802.1X Authentication Default Role' and 'MAC Authentication Default Role' all set to 'Authenticated'.

Still no luck.

I can put together the relevant parts of the config - what in particular would you be interested in seeing?

Matt

show ap-group <nameofgroup-RAP-is-in>

show ap wired-port-profile <nameofprofile-applied-to-eth1>

show ap wired-ap-profile <nameofprofile-applied-to-port-profile-above>

show aaa profile <nameofprofile-applied-to-wired-port-profile-above>

Morning,

Please see attached document for requested output.

Cheers,

Matt

Attachment(s)

Airheads.txt   3 KB 1 version