Search the Community
-
Airheads Community
- Discuss
- Ideas
- Blogs
- Events
- You
- Support
- ClearPass Recipe Review
- ClearPass Recipe Submission
- Admin Tool - Assign Role in Bulk
- Admin Tool - User Search
-
Past Events
- WFD8
- CWNP Conf 2015
- Airheads Conference Vegas 2015
- Wlan Pro Conference 2015
- Airheads Conference Shanghai 2014
- WLAN Pro Conf EU 2014
- CWNP Conference 2014 (Sep 22 - 24)
- Airheads Local 2014
- Wireless Field Day 7 (Aug 6-8, 2014)
- Black Hat 2014 Contest
- Airheads EMEA Italy 2014 (June 9 - 13)
- Americas Airheads Conference 2014
- WLAN Professionals Summit 2014
- Airheads Roadshow 2013
- EMEA Airheads Conference 2013
- APJ Airheads Conference 2013
- Americas Airheads Conference 2013
- Americas Airheads Conference 2012
- APJ Airheads Conference 2012
- EMEA Airheads Conference 2012
- Airheads EMEA 2012 Contest: How to Enter - Contest Terms & Conditions
- Airheads EMEA 2012 Contest: Create your Entry to Win Here!
- Airheads Conferences Prior to 2012
- Americas Airheads Local Events 2012
- EMEA Airheads Local Events 2012
- Wireless Field Day 3 @ Aruba Networks
- Wireless Tech Field Day 2- Silicon Valley
- Wi-Fi Mobility Symposium- San Jose, CA USA
- Products
- Learning
- SDN Apps
- Connector Translation Testing area
Hi,
in one location users can´t connect to SSIDs broadcasting by a virtual controller (in other APs from the same VC do it).
I did a packet capture and see a lot of broadcast deauthentication packets.
I think that we are under an attack and I can´t find the source of this so, What can I configure on a aruba instant controller to avoid the attack?
Regards,
EF
-
Access Points
-
Instant Controller
-
Wireless Technology
-
...this so, What can I configure on a aruba instant controller to avoid the attack? Regards, EF...
@efelipe wrote:
Hi,
in one location users can´t connect to SSIDs broadcasting by a virtual controller (in other APs from the same VC do it).
I did a packet capture and see a lot of broadcast deauthentication packets.
I think that we are under an attack and I can´t find the source of this so, What can I configure on a aruba instant controller to avoid the attack?
Regards,
EFHonestly, nothing can protect against a broadcast disconnect attack except for MFP (management frame protection) support on clients, which is few and far between. I would try to shut down your entire WLAN, set a column in wireshark for signal strength while you are doing a wireless capture and see when the capture gets stronger to attempt to find the device that is generating your problem. The problem with a disconnect attack is that the source mac address is typically impersonated, so you might not be able to tell which access point it is coming from....
-
...spoofing? Another point is that in this zone I can see a lot of deauthentication brodcast frames...
Hi all.
I saw in several captures that packets for deauth to a client, beacon frames , probe and response frames to association... have signal power levels about -51dBm and -55dBm because I was doing the capture near to AP, but all deauthentication frames (2,4Ghz and 5Ghz bands) have signal upper to 70dBm, it seems come from another AP even the have the same source mac address, perhaps mac spoofing?
Another point is that in this zone I can see a lot of deauthentication brodcast frames, but in other zones (remember all APs belongs to the same VC) I can´t see the same frames.
So I think is a good idea is to implement 802.1w (mfp) but I read that only can do it CLI and this VC is managed by a Airwave, so how can I do it?
Regards,
EF -
MFP is only supported by a few clients, so it is not a practical solution. Did you try&n...
MFP is only supported by a few clients, so it is not a practical solution.
Did you try cutting power to the whole cluster to see if the traffic is still being sent?
Greetings All,
I'm looking to purchase the Aruba 7210 wireless controller along with 30 AP-335 wireless APs and 8 AP-334 wireless APs for my organization.
I'm a little confused about the licensing though, so I'm hoping someone can help me out with this.
Do I need to purchase a license for each of the APs that I intend to connect to the controller? If so, how do I determine exactly which license I need? Do I also have to purchase a license for the controller itself?
For example: I'm seeing item JW500AAE which is labeled as Aruba PEF VIA License for 7210 Controller E-LTU. The cost on this is about $16,000. Then I see JW472AAE Aruba Controller Per AP Capacity License E-LTU for $75.00 each.
So, basically, I'm getting really confused on exactly what I need to purchase to get this project rolling. I would have thought that the APs would have come with a license (especially for the asking price of $1,600 or so per AP.) But when I contacted the vendor, they said I needed to buy a license for each AP on top of the unit cost. They also advised me that the licenses have to be bought again after a set period of time.
Any advice is very much appreciated!
-
Wireless Technology
-
...- Aruba Controller Per AP Capacity License This is a perpetual license that allows one access...
I finally got in touch with one of my vendors who was able to explain the licensing to me. The answer is:
For 90% of most deployments, 2 licenses are typically used:
1) JW472AAE - Aruba Controller Per AP Capacity License
This is a perpetual license that allows one access point to be managed by the controller. You need one of these for every access point you want to connect to and manage with the controller. Your basic license.
2) JW473AAE - Aruba Controller Per AP PEF License
This is a license that must be acquired on top of the JW472AAE license. This license isn't mandatory, but it allows more advanced role-based access controls on a per AP basis. (Like if you wanted to have a restricted network and an open network, but you had one or two devices that normally connect to the open network but need access to resources only available on the restricted network.)
It's important to note that the PEF license augments the capacity license - it does not replace it. (Think: more $$ to use more features.)
My vendor said that for 90% of most deployments they see, the above two license types are really the only two to be concerned with. There are others that offer increasing functionality and features at an exponential price increase.
Also, Aruba does offer non-perpetual licenses that must be renewed every year. So, be very careful and talk to your vendor before you actually buy any licenses. In most scenarios, you'll probably want the perpetual licenses. There are; however, cases where an annual license may be a better fit for you.
In closing: I noticed that there seem to be large-quantity license "packs" available at significantly better prices than buying the licenses individually. For certain enterprise deployments, these options may be more viable.
My Opinion: It honestly confuses me why Aruba has made this process so complicated. They have two series of AP: IAP and AP. IAP can work with or without a controller whereas AP are marketed specifically for use with a controller. Why they charge $1500+ for an AP and then force you to pay more just to be able to use it seems a little "greedy" to me. I'd say that if you're going to market a product to work with another product, the licensing should be included in the price - especially at that price point.
Don't get me wrong ... Aruba's got some really nice high-quality stuff ... but you can tell they like some of their stuff just a little too much.
-
Yes, I contacted your sales team a few days ago and was told I'd have a call-back or an email...
Yes, I contacted your sales team a few days ago and was told I'd have a call-back or an email between then and a day or so ago.
They still haven't called me back or emailed me, so I'll try them again.
I'll post the answer I find out on here for others to benefit from.
-
...RF Features including Wireless IDS/IPS. Please work with your Aruba partner or local Aruba...
PEF-VIA is basically to support the VIA VPN Agent.
Most of our customers have LIC-AP + LIC-PEFNG and many + LIC-RFP.
The LIC-PEFNG allows role-based access, stateful firewalling of client traffic and AppRF application recognition and prioritization.
LIC-RFP allows advanced RF Features including Wireless IDS/IPS.
Please work with your Aruba partner or local Aruba sales team to decide which licenses you need, in what quantity, and what they give you.
-
Follow-Up to my post: The JW500AAE Aruba PEF VIA License for 7210 Controller E-LTU appears...
Follow-Up to my post:
The JW500AAE Aruba PEF VIA License for 7210 Controller E-LTU appears to be for a firewall, which I'm not interested in deploying or using.
Based on what I have been able to find so far, I'm guessing I only need to purchase the Capacity licenses for each AP I want to connect to the 7210 controller. (JW472AAE)
Am I understanding this correctly?
Problem: Need to have a switch in a remote area of my office that is not reachable by wiring. (wireless signal is strong there)
Possible soultuion?
Is it possible for me to put a POE switch in that location and connect an IAP and mesh it into current Wireless Network and thus allow the switch to join the network?
-
Instant Controller
-
...some time yesterday discussing with engineering on how to make this work with IAP. For controller...
Malin, first, this is NOT a direct support board and it shouldn't be thought of as anything more than a volunteer-based community support community. People like myself (Arubans) do not spend our entire day waiting for or looking for responses to follow up on. Well, maybe Colin does. So no one is ignoring you, sometimes we are working in the background on your behalf while doing our regular job (none of us get paid to haunt these boards). Hope that makes sense.
That said, I spent some time yesterday discussing with engineering on how to make this work with IAP. For controller-based solutions, it works fine because we can configure the number of IPs allowed per mac address on the WLAN. Unfortunately IAP does NOT allow this modification to the WLAN stack, so the only application that will work in your case is to use 501 as a wired client bridge for a single device with mac cloning.
If you want to get another IAP-205, that will absolutely support mesh bridging to bridge the network for however many devices you have on the remote IAP. There are numerous pages on setting that up. My apologies for that not working.
-
The best solution would be the HP 501 802.11ac wireless bridge here: https://www.amazon.com...
The best solution would be the HP 501 802.11ac wireless bridge here: https://www.amazon.com/J9835A-Wireless-802-11B-Desktop-Wall-Mountable/dp/B00HEK8E3Y
-
What was the 501 associating to (AP model, OS, controller if applicable, etc)? There are some...
What was the 501 associating to (AP model, OS, controller if applicable, etc)? There are some settings that would need to be adjusted on your WLAN to support this if you are putting more than one device behind the 501.
-
Well the 501 network bridge connect to an hp popw switch and the aruba iap 205 doesn't work, ...
Well the 501 network bridge connect to an hp popw switch and the aruba iap 205 doesn't work, the 5 devices connected to switch keep dropping the connection. The 501 is not that configurable so are there changes needed on the iap?
Come ono guys, at aruba don't make a suggestion and then drop off. I even opened a case with hpe support for the bridge and they are no help.
-
Note the 501 supports UP TO 15 wired devices behind it, so if you have more than the switch+14...
Note the 501 supports UP TO 15 wired devices behind it, so if you have more than the switch+14 devices to backhaul, then mesh will be your next logical solution. otherwise if it's a handful of devices, then the 501 is much easier.
-
Does it have to be the matching iaps? What is minimum iap ca use Sent from my Windows 10 phoneDoes it have to be the matching iaps? What is minimum iap ca use
Sent from my Windows 10 phone -
Any IAP model should mesh together so long as it can run the same firmware version on the 205.
Any IAP model should mesh together so long as it can run the same firmware version on the 205.
We are having a debate at work on whether a particular configuration should be using a “Forward mode” of “bridge” or “tunnel” in the “Wired AP” profile used on the “Ethernet interface port configuration” applied to an Access Point.
Here’s the setup. We are a large campus with many buildings. A typical building has fiber coming in to a main switch. The main switch is connected to child switches which could be connected to their own child switches and so on. Access Points (APs) and other devices are connected to these switches and the different types of devices are partitioned into VLANs. The Ethernet ports on the APs are always configured to “tunnel” forward mode. Thus, traffic from an AP tunnels back to the Mobility controller while traffic from other devices on the same switch follows whatever paths have been established for it. Hopefully this makes perfect sense.
Now consider a building, X, that does not have fiber coming in to it but which has a switch to support wired connections within the building, including APs, like any other building. Building X is across the street from Building Y, which does have fiber and is setup as described in the previous paragraph. In order to connect Building X to the network, we use Aruba mesh nodes to create a wireless bridge from Building X to Building Y. In the abstract, you could view Building X as just another floor of Building Y, which connects to building Y’s main switch via a wireless bridge instead of a copper wire.
The wireless bridge is composed of a mesh “point” located at Building X, and a mesh “portal” located at Building Y. Of course the “Mesh Cluster” profile is using encryption so that unencrypted traffic, like a telnet password for logging in to Building X’s switch, is not broadcast out on the public airwaves. And of course the “Forward mode” of the “Wired AP” profile for the mesh point at Building X is set to “bridge,” since there is no controller to tunnel to in Building X. Hopefully I am stating things clearly and have not lost the audience.
Here is where the disagreement comes in. Should the “Forward mode” of the “Wired AP” profile for the mesh portal at Building Y be set to “bridge” or “tunnel?” Before you answer, consider an ordinary AP located in Building X. Like an AP in any other building, it will establish a tunnel back to the controller. If the mesh portal in Building Y is also set up to tunnel, then the tunneled traffic from the AP in Building X will be placed inside a second tunnel created by the mesh portal. Consider also an ordinary PC in Building X. If the mesh portal in Building Y is set up to tunnel, then, unlike a PC in any other building, this PC’s traffic will be tunneled back to the Mobility controller by the mesh portal before it is released to be routed wherever it wants to go. You have probably detected which side of the debate I fall on.
The argument in favor of “bridge” mode is that the only purpose of the wireless bridge (be careful, we are using the word “bridge” in different contexts here and it means slightly different things) is to emulate a copper connection between a child switch in Building X, and its parent switch in Building Y. There is no extra trunking required, the switches are configured like they are in any other building.
The argument in favor of “tunnel” mode is unclear but there seems to be strong sentiment in favor of it. Perhaps someone on this forum can offer some insight as to why tunnel mode should be preferred to bridge mode in this use case. Perhaps there is some consideration that I have overlooked that would explain a preference for tunnel mode.
All commentary is welcome. Anyone care to weigh in?
- Tags:
- airwave
-
...style. If bridge or tunnel is making (1) administration harder (2) application visibility...
As long as there is not a situation where there is limited bandwidth, it is a matter of personal style. If bridge or tunnel is making (1) administration harder (2) application visibility limited or (3) traffic degraded, choose the opposite forwarding mode.
-
+1 for bridge mode, especially if there are APs on the other side of that mesh point, don't want...
+1 for bridge mode, especially if there are APs on the other side of that mesh point, don't want double encapuslation up to the controller.
FWIW over the years with almost no exceptions, each Aruba mesh network I have seen where it was providing backhaul connectivity to campus buildings, ran the wired ports in bridge mode.
-jeff
Hello,
I am creating an 802.11ac wave 2 wireless environment for a healthcare building. 5 floors, 325 devices per floor and using cisco voice phones. I am looking at Aruba wireless controllers and wondering the pros and cons to using a virtual wireless controller vs a physical one?
Any feedback would be appreciated.
-
Controllers
-
Wireless Technology
-
The benefit of a physical controller is that the performance is predictable and it has hardware...
The benefit of a physical controller is that the performance is predictable and it has hardware acceleration for encryption features and a TPM for enhanced security. If you deploy on VM, you will need to make sure that you have the required resources reserved for the virtual mobility controller.
As your question is quite broad, the local Aruba sales team should be able to help/guide you towards the best solution in your case.
-
if you have budget it's better to use physical appliance (it gives more benefits)
if you have budget it's better to use physical appliance (it gives more benefits)
Need some suggestions: Should I go with Outdoor IAP or Outdoor MESH?
I am designing a outdoor MESH network for a food processing site with 3 plants. There is limited cable/fibre ran among the plants on site. So Wireless MESH is prefered and four access points are required (one will be wired in business office and three for the plants). Attached screenshot is for illustration purpose of the setup. The MAX distance between plant to business office OR each plant is 200 Meters. The MESH setup is only for connecting different plants not for wireless clients.
If I use the Outdoor IAP, I can save money of controller assuming Outdoor MESH AP needs controller; If I use the Outdoor MESH AP (such as MST200), then I got the benifit of built-in directional attenna.
BTW, Can I use Aruba MeshConfig tool for managing/monitoring/troubleshoot MST200 without a controller?
Suggestions?
/S
-
Mesh Routers
-
...as your links, are they two separate PtP links or are you looking for redundant portals and points...
MST200s are stand-alone FatAP, you can use MeshConfig to manage and monitor MSTs/MSRs. Note that MST200 is 11n AP, and will not be as fast or feature-rich as the 11ac IAPs or AOS APs.
As far as your links, are they two separate PtP links or are you looking for redundant portals and points between two buildings? If they are two separate PtP links, are the spatially separated such that the two PtP pairs will not be able to hear each other?
-
.../MSRs. Note that MST200 is 11n AP, and will not be as fast or feature-rich as the 11ac IAPs or AOS APs...
jhoward wrote:MST200s are stand-alone FatAP, you can use MeshConfig to manage and monitor MSTs/MSRs. Note that MST200 is 11n AP, and will not be as fast or feature-rich as the 11ac IAPs or AOS APs.
As far as your links, are they two separate PtP links or are you looking for redundant portals and points between two buildings? If they are two separate PtP links, are the spatially separated such that the two PtP pairs will not be able to hear each other?
Sorry, just added some clarification to my orginal post. The site has three plants and wired AP will be at business office. I am not really worried about speed per say. There would not be whole lot of traffic on this MESH, mainly for process control network data.
-
..., and configure wired interfaces for whatever network(s) you need them to backhaul. that's it. ...
Yes, essentially configure the MST200 IP address, the Mesh SSID and PSK, set neighbor whitelist, and configure wired interfaces for whatever network(s) you need them to backhaul. that's it.
No license on MeshConfig. Just purchase it and install on a Windows server somewhere.
-
...neighbor whitelist, and configure wired interfaces for whatever network(s) you need them to backhaul....
jhoward wrote:Yes, essentially configure the MST200 IP address, the Mesh SSID and PSK, set neighbor whitelist, and configure wired interfaces for whatever network(s) you need them to backhaul. that's it.
No license on MeshConfig. Just purchase it and install on a Windows server somewhere.
When you say "Just purchase it", you mean the MST200 unit not the MeshConfig, right? If not, would you mind sharing a part# for purchasing the MeshConfig?
Hello,
Yesterday captive portal on our controller 7205 stopped working. I tried to login to web management and it's not working either. Tried with different browsers and computers.
APs work with radius client's normally.
SSH to controller works.
Controller has been restarted.
What should i try to get web-management (and captive portal) to work again?
Any help would be appreciated.
-
Controllers
-
Looks like the Web Server has stopped responding. # show web-server statistics Error in...
Looks like the Web Server has stopped responding.
# show web-server statistics Error in fetching statistics, Web Server is not respoding
This is still the same issue after a reboot and a httpd service restart? This might be a known issue with the OS you are running. Maybe speak to TAC or check the release notes for a possible fix.
-
Controller firmware update solved the problem.
Controller firmware update solved the problem.
-
...; default Management user's WebUI access method  ...
ArubaOS 6.5.3.0
# show web-server profile
Seems to be ok to my understanding...
Web Server Configuration
------------------------
Parameter Value
--------- -----
Cipher Suite Strength high
SSL/TLS Protocol Config tlsv1 tlsv1.1 tlsv1.2
Switch Certificate default
Captive Portal Certificate wlan2
IDP Certificate default
Management user's WebUI access method username/password
User absolute session timeout <30-3600> (seconds) 0
User session timeout <30-3600> (seconds) 900
Maximum supported concurrent clients <25-320> 75
Enable WebUI access on HTTPS port (443) false
Web Skype4B Listen Protocol/Port Config N/A
Enable bypass captive portal landing page false
Exclude Security Headers from HTTP Response false# show web-server statistics
Error in fetching statistics, Web Server is not respoding
#process restart httpd
I've tried to restart httpd and doesn't seem to help. (also restarted controller)
Captive portal has valid certificate from public ca.
To be honest i'm not sure about webgui certificate.Only logged on using ip-address.
No firewall policies on management ports.
-
...been applied to the management ports on the controller?
What version of ArubaOS are you running? Is the CWP/GUI secured with a certificate? The default certificate which has been shipped with controllers has been revoked so this maybe an issue.
Do you see any issues when running the below command?# show web-server profileHave you tried restarting the service as well?
#process restart httpd
Has there been any firewall policies been applied to the management ports on the controller?
-
ssh into the controller and type "show audit-trail" to see what might have been changed.
ssh into the controller and type "show audit-trail" to see what might have been changed.
-
ArubaOS 6.5.3.0 Restarted controller. Restatred httpd service multiple times....
ArubaOS 6.5.3.0
Restarted controller.
Restatred httpd service multiple times.
Issue remains.
-
...this: config t web-server profile captive-portal-cert default Nevermind. ...
How long ago did you change the Captive Portal Certificate?
Try changing it back like this:config tweb-server profilecaptive-portal-cert defaultNevermind. Please open a TAC case.
-
...; (i had it bookmarked on management workstation) If i understood your question.....
i've tried with both:
https://<ip address>:4343
and
https://<ip address>
Both give same error.
URL used to work with https://<ip address>
(i had it bookmarked on management workstation)
If i understood your question...
-
Hello Getting same issue as described. Restarts do not fix. (hostname) # show web-server...
Hello
Getting same issue as described. Restarts do not fix.
(hostname) # show web-server stat
Error in featching statistics, Web Server is not responding
Did OP come up with a solution?
Is there a way to see on the controller or airwave the device name of an ipad, windows and android devices?
What i have done so far was enabling AMON and also create a custom view on airwave to see the LAN hostname
I can see a FEW devices name... but i mean out of 100 i just see like 25 or 20...
Iam missing configuration? or is not possible?
Cheers
CArlos
-
AirWave
-
Aruba OS
-
I guess the hostname is okay on airwave He just want to see the hostname for now... He is getting...
I guess the hostname is okay on airwave
He just want to see the hostname for now...
He is getting clearpass but he does not have it yet...
He wants to see in airwave the hostname at least so he can locate the device... or at least know to who belongs that ma address...
-
...doing mac authentication. Do you want a username, a hostname or what?
I don't know if it overrides the username.
The question is, what do you want there? if you are using clearpass, there is a way to return the username as a real username when you are doing mac authentication. Do you want a username, a hostname or what?
-
..., the network must support dynamic dns registration of DHCP hostnames into DNS. Airwave will then do...In ArubaOS 6.5 there is a parameter that allows you to use the mdns name as the computers username if the device is not using 802.1x. it is in the AAA profile.
If you are using any other ArubaOS, the network must support dynamic dns registration of DHCP hostnames into DNS. Airwave will then do the reverse DNS lookup to find out the hostname... -
Collin If the user is using mac authentication It will override username if we use the aruba os 6...
Collin
If the user is using mac authentication
It will override username if we use the aruba os 6.5? becuase the username is the mac address
-
...support dynamic dns registration of DHCP hostnames into DNS. Airwave will then do the reverse DNS lookup...
Collin
i configured this on the client
"If you are using any other ArubaOS, the network must support dynamic dns registration of DHCP hostnames into DNS. Airwave will then do the reverse DNS lookup to find out the hostname... "
This worked pretty good!
Thank you!
Hello, I'm trying to figure out what the difference is between configuring the ip address of an airwave server on my MM controller, vs. adding the ip of my controller to airwave. If I add the airwave ip to my controller, nothing seems to happen -- airwave doesn't pick it up. But the documentation is unclear about what to put for the snmp community string -- is this the community string on the airwave server that "pushes" data to airwave? Or is it pulled from airwave, and this should be the snmp community configured on the controller? Are there any logs showing what the controller is trying to do when you set the ip of the airwave server?
Thanks,
Mike
Hi we are curious which one to use for our customers:
- 6.4.2.6-4.1.1.13
- 6.4.2.6-4.1.3.1
Our customers use Client Match, Network printing, Cloud services, Google Cast and Apple TV.
Which one is better, or which one to choose? I don't understand both releases...
ps we use AMP 8.2.1
Thanks in advance.
-
AirWave
-
Instant Controller
-
That would suggest to use 4.1.1.13 instead of 4.1.3.1 (or 4.1.3.0 even). Thanks for checking....That would suggest to use 4.1.1.13 instead of 4.1.3.1 (or 4.1.3.0 even).
Thanks for checking. Curious about the outcome. -
...? Or 4.1.3.2?It's still saying 4.1.1.13. Not 4.1.3.0, not 4.1.3.1, not 4.1.3.2. So... should we use 4.1.1.13 ? Or 4.1.3.2?
-
the automatic firmware check on our Virtual Controller (2 IAP 205's) says 4.1.3.0 is the latest....
the automatic firmware check on our Virtual Controller (2 IAP 205's) says 4.1.3.0 is the latest. How come? It should be 4.1.3.1, right?
PS: also, how do I check if both controllers updated their firmware, and not just 1? Through the web-interface of the virtual controller it doesn't seem to show which firmware an IAP has. It only shows which firmware the VC has.
-
4.1.3.1 fixes a security vulnerability and should be used.
4.1.3.1 fixes a security vulnerability and should be used.
