(Aruba650) # (Aruba650) #show version Aruba Operating System Software. ArubaOS (MODEL: Aruba650-US), Version 6.1.2.4 Website: http://www.arubanetworks.com Copyright (c) 2002-2011, Aruba Networks, Inc. Compiled on 2011-10-20 at 20:17:40 PDT (build 30768) by p4build ROM: System Bootstrap, Version CPBoot 1.0.0.0 (build 23274) Built: 2010-01-19 11:11:41 Built by: p4build@re_client_23274 Switch uptime is 3 hours 6 minutes 51 seconds Reboot Cause: Power Failure. Supervisor Card Processor XLS 408 (revision B1) with 890M bytes of memory. 32K bytes of non-volatile configuration memory. 256M bytes of Supervisor Card System flash (model=NAND 256MB). (Aruba650) #show license License Table ------------- Key Installed Expires Flags Service Type --- --------- ------- ----- ------------ mKvVa89A-0bv9DyjK-+bEiyu5I-IzhxnGNg-4bJbboVk-umw 2010-05-14 Never E Power Over Ethernet 21:11:00 UKWFpxUk-KA5ltC4p-0vpKPoZu-FmBRfeEz-u4nNbzHe-5mc 2011-11-30 Never E RF Protect: 16 13:20:52 GdLlYLdq-f6ESWjPo-Qcd2PPgt-zuWOarOF-GkheoIAQ-5MM 2011-12-09 Never E Next Generation Policy Enforcement Firewall Module: 16 23:49:57 License Entries: 3 Flags: A - auto-generated; E - enabled; R - reboot required to activate (Aruba650) #show license limits License Limits -------------- Limit Value ----- ----- 8 Access Points 0 Ortronics Access Points 16 RF Protect 0 xSec Module 0 120abg Upgrade 0 121abg Upgrade 0 124abg Upgrade 0 125abg Upgrade 16 Next Generation Policy Enforcement Firewall Module 0 Advanced Cryptography 0 Service provider AP (Aruba650) #show ap active Active AP Table --------------- Name Group IP Address 11g Clients 11g Ch/EIRP/MaxEIRP 11a Clients 11a Ch/EIRP/MaxEIRP AP Type Flags Uptime Outer IP ---- ----- ---------- ----------- ------------------- ----------- ------------------- ------- ----- ------ -------- 00:1a:1e:c7:d1:96 PCST 192.168.1.18 0 AP:1/18/22 0 AP:161/23/23 65 3h:3m:32s N/A 00:1a:1e:c7:ce:34 PCST 192.168.1.11 0 AP:1/22/22 0 AP:48/20/23 65 3h:3m:31s N/A Flags: a = Reduce ARP packets in the air; A = Enet1 in active/standby mode; B = Battery Boost On; C = Cellular; D = Disconn. Extra Calls On; d = Drop Mcast/Bcast On; E = Wired AP enabled; K = 802.11K Enabled; n = Don't convert IPv6 Mcast RA to Ucast L = Client Balancing Enabled; M = Mesh; N = 802.11b protection disabled; P = PPPOE; R = Remote AP; X = Maintenance Mode; 2 = Using IKE version 2; Channel followed by "*" indicates channel selected due to unsupported configured channel. "Spectrum" followed by "^" indicates Local Spectrum Override in effect. Num APs:2 (Aruba650) # show running-config Building Configuration... version 6.1 enable secret "******" hostname "Aruba650" clock timezone THA -8 location "Building1.floor1" controller config 13 ip NAT pool dynamic-srcnat 0.0.0.0 0.0.0.0 ip access-list eth validuserethacl permit any ! netservice svc-netbios-dgm udp 138 netservice svc-snmp-trap udp 162 netservice svc-syslog udp 514 netservice svc-l2tp udp 1701 netservice svc-ike udp 500 netservice svc-https tcp 443 netservice svc-smb-tcp tcp 445 netservice svc-dhcp udp 67 68 netservice svc-pptp tcp 1723 netservice svc-sccp tcp 2000 netservice svc-telnet tcp 23 netservice svc-sec-papi udp 8209 netservice svc-netbios-ssn tcp 139 netservice svc-sip-tcp tcp 5060 netservice svc-tftp udp 69 netservice svc-kerberos udp 88 netservice svc-http-proxy3 tcp 8888 netservice svc-noe udp 32512 netservice svc-cfgm-tcp tcp 8211 netservice svc-adp udp 8200 netservice svc-pop3 tcp 110 netservice svc-lpd-tcp tcp 631 netservice svc-rtsp tcp 554 netservice svc-msrpc-tcp tcp 135 139 netservice svc-dns udp 53 netservice svc-h323-udp udp 1718 1719 netservice svc-h323-tcp tcp 1720 netservice svc-vocera udp 5002 netservice svc-http tcp 80 netservice svc-http-proxy2 tcp 8080 netservice svc-sip-udp udp 5060 netservice svc-nterm tcp 1026 1028 netservice svc-noe-oxo udp 5000 alg noe netservice svc-papi udp 8211 netservice svc-natt udp 4500 netservice svc-ftp tcp 21 netservice svc-microsoft-ds tcp 445 netservice svc-svp 119 netservice svc-smtp tcp 25 netservice svc-gre 47 netservice svc-netbios-ns udp 137 netservice svc-sips tcp 5061 netservice svc-smb-udp udp 445 netservice svc-cups tcp 515 netservice svc-esp 50 netservice svc-v6-dhcp udp 546 547 netservice svc-snmp udp 161 netservice svc-bootp udp 67 69 netservice svc-msrpc-udp udp 135 139 netservice svc-ntp udp 123 netservice svc-icmp 1 netservice svc-ssh tcp 22 netservice svc-lpd-udp udp 631 netservice svc-v6-icmp 58 netservice svc-http-proxy1 tcp 3128 netexthdr default ! ip access-list session control user any udp 68 deny any any svc-icmp permit any any svc-dns permit any any svc-papi permit any any svc-cfgm-tcp permit any any svc-adp permit any any svc-tftp permit any any svc-dhcp permit any any svc-natt permit any any svc-sec-papi permit ! ip access-list session allow-diskservices any any svc-netbios-dgm permit any any svc-netbios-ssn permit any any svc-microsoft-ds permit any any svc-netbios-ns permit ! ip access-list session v6-icmp-acl ipv6 any any svc-v6-icmp permit ! ip access-list session validuser any any svc-sec-papi permit network 169.254.0.0 255.255.0.0 any any deny any any any permit ipv6 any any any permit ! ip access-list session vocera-acl any any svc-vocera permit queue high ! ip access-list session v6-https-acl ipv6 any any svc-https permit ! ip access-list session icmp-acl any any svc-icmp permit ! ip access-list session captiveportal user alias controller svc-https dst-nat 8081 user any svc-http dst-nat 8080 user any svc-https dst-nat 8081 user any svc-http-proxy1 dst-nat 8088 user any svc-http-proxy2 dst-nat 8088 user any svc-http-proxy3 dst-nat 8088 ! ip access-list session v6-dhcp-acl ipv6 any any svc-v6-dhcp permit ! ip access-list session allowall any any any permit ! ip access-list session v6-dns-acl ipv6 any any svc-dns permit ! ip access-list session https-acl any any svc-https permit ! ip access-list session sip-acl any any svc-sip-udp permit queue high any any svc-sip-tcp permit queue high ! ip access-list session dns-acl any any svc-dns permit ! ip access-list session ra-guard ipv6 user any icmpv6 rtr-adv deny ! ip access-list session tftp-acl any any svc-tftp permit ! ip access-list session skinny-acl any any svc-sccp permit queue high ! ip access-list session srcnat user any any src-nat ! ip access-list session vpnlogon user any svc-ike permit user any svc-esp permit any any svc-l2tp permit any any svc-pptp permit any any svc-gre permit ! ip access-list session logon-control user any udp 68 deny any any svc-icmp permit any any svc-dns permit any any svc-dhcp permit any any svc-natt permit ! ip access-list session allow-printservices any any svc-cups permit any any svc-lpd-tcp permit any any svc-lpd-udp permit ! ip access-list session v6-allowall ipv6 any any any permit ! ip access-list session cplogout user alias controller svc-https dst-nat 8081 ! ip access-list session http-acl any any svc-http permit ! ip access-list session dhcp-acl any any svc-dhcp permit ! ip access-list session v6-http-acl ipv6 any any svc-http permit ! ip access-list session captiveportal6 ipv6 user alias controller6 svc-https captive ipv6 user any svc-http captive ipv6 user any svc-https captive ipv6 user any svc-http-proxy1 captive ipv6 user any svc-http-proxy2 captive ipv6 user any svc-http-proxy3 captive ! ip access-list session ap-uplink-acl any any udp 68 permit any any svc-icmp permit any host 224.0.0.251 udp 5353 permit ! ip access-list session allowall1 any any any permit ! ip access-list session dynamic-session-acl any any any src-nat pool dynamic-srcnat ! ip access-list session noe-acl any any svc-noe permit queue high ! ip access-list session svp-acl any any svc-svp permit queue high user host 224.0.1.116 any permit ! ip access-list session ap-acl any any svc-gre permit any any svc-syslog permit any user svc-snmp permit user any svc-snmp-trap permit user any svc-ntp permit ! ip access-list session h323-acl any any svc-h323-tcp permit queue high any any svc-h323-udp permit queue high ! ip access-list session v6-logon-control ipv6 user any udp 68 deny ipv6 any any svc-v6-icmp permit ipv6 any any svc-v6-dhcp permit ipv6 any any svc-dns permit ! vpn-dialer default-dialer ike authentication PRE-SHARE ****** ! user-role ap-role access-list session control access-list session ap-acl ! user-role default-vpn-role access-list session allowall access-list session v6-allowall ! user-role employee access-list session allowall access-list session v6-allowall ! user-role voice access-list session sip-acl access-list session noe-acl access-list session svp-acl access-list session vocera-acl access-list session skinny-acl access-list session h323-acl access-list session dhcp-acl access-list session tftp-acl access-list session dns-acl access-list session icmp-acl ! user-role default-via-role access-list session allowall access-list session v6-allowall ! user-role guest-logon captive-portal "default" access-list session logon-control access-list session captiveportal access-list session v6-logon-control access-list session captiveportal6 ! user-role guest access-list session http-acl access-list session https-acl access-list session dhcp-acl access-list session icmp-acl access-list session dns-acl access-list session v6-http-acl access-list session v6-https-acl access-list session v6-dhcp-acl access-list session v6-icmp-acl access-list session v6-dns-acl ! user-role stateful-dot1x ! user-role authenticated access-list session allowall access-list session v6-allowall ! user-role logon access-list session logon-control access-list session vpnlogon access-list session v6-logon-control ! ! controller-ip vlan 1 interface mgmt shutdown ! dialer group evdo_us init-string ATQ0V1E0 dial-string ATDT#777 ! dialer group gsm_us init-string AT+CGDCONT=1,"IP","ISP.CINGULAR" dial-string ATD*99# ! dialer group gsm_asia init-string AT+CGDCONT=1,"IP","internet" dial-string ATD*99***1# ! dialer group vivo_br init-string AT+CGDCONT=1,"IP","zap.vivo.com.br" dial-string ATD*99# ! interface gigabitethernet 1/0 description "GE1/0" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/1 description "GE1/1" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/2 description "GE1/2" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/3 description "GE1/3" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/4 description "GE1/4" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/5 description "GE1/5" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/6 description "GE1/6" trusted trusted vlan 1-4094 ! interface gigabitethernet 1/7 description "GE1/7" trusted trusted vlan 1-4094 ! interface vlan 1 ip address 192.168.1.249 255.255.255.0 ! ip default-gateway 192.168.1.1 uplink wired vlan 1 uplink disable ap mesh-recovery-profile cluster RecoveryqJt9sPFRxNmf/hK0 wpa-hexkey 66ee15446d82e3320847e3272e145c6d0368e468fb0894f2cabdc37bb50cbe5b8ae036579b056a311e1819e1f69c490b44ada47470e9002af3eced7984dd173647aff772b2a5fed2f282e39d52e2a786 wms general poll-interval 60000 general poll-retries 3 general ap-ageout-interval 30 general adhoc-ap-ageout-interval 5 general sta-ageout-interval 30 general learn-ap disable general persistent-neighbor enable general propagate-wired-macs enable general stat-update enable general collect-stats disable general learn-system-wired-macs disable ! wms-local system max-system-wm 1000 wms-local system system-wm-update-interval 8 crypto ipsec transform-set default-boc-bm-transform esp-3des esp-sha-hmac crypto ipsec transform-set default-rap-transform esp-aes256 esp-sha-hmac crypto isakmp eap-passthrough eap-tls crypto isakmp eap-passthrough eap-peap crypto isakmp eap-passthrough eap-mschapv2 vpdn group l2tp ! ! vpdn group pptp ! tunneled-node-address 0.0.0.0 adp discovery enable adp igmp-join enable adp igmp-vlan 0 voice rtcp-inactivity disable voice sip-midcall-req-timeout disable ssh mgmt-auth username/password mgmt-user admin root 1cb3468b01f190a6d9653d8f93988704a63278dfa9d7e8eec8 no database synchronize database synchronize rf-plan-data ip mobile domain default ! ip igmp ! ipv6 mld ! no firewall attack-rate cp 1024 ! firewall cp ! firewall cp packet-capture-defaults tcp disable udp disable sysmsg disable other disable ! ip domain lookup ! country US aaa authentication mac "default" ! aaa authentication dot1x "default" ! aaa authentication dot1x "dot1x-employee" ! aaa server-group "default" auth-server Internal set role condition role value-of ! aaa profile "default" ! aaa profile "employee-aaa" dot1x-default-role "employee" ! aaa profile "guest-aaa" initial-role "guest-logon" ! aaa authentication captive-portal "default" no logout-popup-window protocol-http logon-wait maximum-delay 5 ! aaa authentication wispr "default" ! aaa authentication vpn "default" ! aaa authentication vpn "default-rap" ! aaa authentication mgmt ! aaa authentication stateful-ntlm "default" ! aaa authentication stateful-kerberos "default" ! aaa authentication stateful-dot1x ! aaa authentication wired ! web-server ! papi-security ! guest-access-email ! voice logging ! voice dialplan-profile "default" ! voice real-time-config ! voice sip ! aaa password-policy mgmt ! control-plane-security no cpsec-enable ! ids management-profile ! ids ap-rule-matching ! valid-network-oui-profile ! ap system-profile "default" ! ap regulatory-domain-profile "default" country-code US valid-11g-channel 1 valid-11g-channel 6 valid-11g-channel 11 valid-11a-channel 36 valid-11a-channel 40 valid-11a-channel 44 valid-11a-channel 48 valid-11a-channel 149 valid-11a-channel 153 valid-11a-channel 157 valid-11a-channel 161 valid-11a-channel 165 valid-11g-40mhz-channel-pair 1-5 valid-11g-40mhz-channel-pair 7-11 valid-11a-40mhz-channel-pair 36-40 valid-11a-40mhz-channel-pair 44-48 valid-11a-40mhz-channel-pair 149-153 valid-11a-40mhz-channel-pair 157-161 ! ap wired-ap-profile "default" ! ap enet-link-profile "default" ! ap mesh-ht-ssid-profile "default" ! ap mesh-cluster-profile "default" ! ap wired-port-profile "default" ! ap mesh-radio-profile "default" ! ids general-profile "default" ! ids rate-thresholds-profile "default" ! ids signature-profile "default" ! ids impersonation-profile "default" ! ids unauthorized-device-profile "default" ! ids signature-matching-profile "default" signature "Deauth-Broadcast" signature "Disassoc-Broadcast" ! ids dos-profile "default" ! ids profile "default" ! rf arm-profile "default" ! rf optimization-profile "default" ! rf event-thresholds-profile "default" ! rf am-scan-profile "default" ! rf dot11a-radio-profile "default" ! rf dot11g-radio-profile "default" ! wlan dot11k-profile "default" ! wlan voip-cac-profile "default" ! wlan ht-ssid-profile "default" ! wlan edca-parameters-profile station "default" ! wlan edca-parameters-profile ap "default" ! wlan ssid-profile "default" ! wlan ssid-profile "ssid-employee" essid "PCST_Employee" wpa-passphrase 32d4e2bd115eea4fadefa46b0c8de8db2d99e637d0668e25 ! wlan ssid-profile "ssid-guest" essid "PCST_Guest" ! wlan virtual-ap "default" ! wlan virtual-ap "PCST_Employee" aaa-profile "employee-aaa" ssid-profile "ssid-employee" vlan 1 ! wlan virtual-ap "PCST_Guest" aaa-profile "guest-aaa" ssid-profile "ssid-guest" vlan 1 ! ap provisioning-profile "default" ! ap spectrum local-override ! ap-group "default" virtual-ap "default" ! ap-group "PCST" virtual-ap "PCST_Employee" virtual-ap "PCST_Guest" ! logging level warnings security subcat ids logging level warnings security subcat ids-ap snmp-server enable trap process monitor log network-printer max-jobs 500 network-printer max-clients-per-host 10 network-printer max-clients 10 end