Wireless Access

 View Only
last person joined: 18 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

WebGUI/SSH issue with Mobility Conductors

This thread has been viewed 66 times

  • 1.  WebGUI/SSH issue with Mobility Conductors

    Posted Jan 06, 2022 04:23 AM

    Hello ! 

    I have configured a cluster with two HW-MM-5K and four controllers (7220 and 7240).
    Yesterday, I decided to switch VRRP master on Mobility Conductors and since then I can't join them with SSH/HTTPS from remote network.
    Second member was reachable but I rebooted it thinking it could be a VRRP issue. Now, it is unreachable too.

    ICMP is still OK and SSHd service is still up because I can reach them from other controllers on the same network.

    Do you have ever seen same issue with remote access ?

    We have verified the whole architecture, routing protocols are OK and there are not any firewall equipements between PC with SSH client and Mobility-conductor : SSH access is possible only on the same network.

    Can be that there is a problem with a change done before the reboot but I don't remember of anything new big.
    I read issues with "trusted" state on interfaces so I verified it. I verified firewall-cp state too. Nothing to report !

    Do you know some verifications to do ?

    Thanks for your help.



    ------------------------------
    Jules Bvt
    ------------------------------


  • 2.  RE: WebGUI/SSH issue with Mobility Conductors
    Best Answer

    EMPLOYEE
    Posted Jan 06, 2022 10:06 AM
    Can you check with the 'show users' command on the controller if you see your client there, possibly in a logon role?

    That may happen if the interface is trusted, but the VLAN is not. Then still the client IP may end up in untrusted role, where logon is the default and does not allow access to the controller, but does allow icmp.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 3.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 07, 2022 08:32 AM
    Thanks you Herman,

    I will verify this possibility but in my memories, I verified uplinks interfaces and are "trusted" like the "VLANs".
    I will look at "show users" in few days.

    As husnu said, I can connect to these HW-MM-5K from other controllers on the same subnet. This situation is very strange...

    ------------------------------
    Jules Bvt
    ------------------------------

    Original Message


  • 4.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 10, 2022 04:54 AM

    Dear Herman, 

    I tried your workaround, added « trusted vlan » on port-channel 0 interface and now I can reach the two Mobility Conductors.
    Even I don't understand why this issue appeared suddenly, I thanks you for this idea !



    ------------------------------
    Jules Bvt
    ------------------------------

    Original Message


  • 5.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 07, 2022 04:06 AM
    Hi,

    If you can connect from local network with MDs, it could be network problem. Be sure about topology. Did you enter the correct default route?

    check with;

    show ip route and show ip interface brief

    check with client ip reachibility with traceroute;

    By the way aruba did not recommend L3 config. If possibel use L2 cluster connectivity between switches (I mean aruba MDs). 

    You may want to check your topology, design with a aruba eng.

    ------------------------------
    husnu demir
    ------------------------------

    Original Message


  • 6.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 07, 2022 08:43 AM
    Thanks you too Husnu,

    I'm agree with you but there was not any changes on network and we verified it two times with my network team.
    The default route is the only L3 route on the Mobility-Controller.

    interface vlan 500
    ip address 172.31.0.5 255.255.255.128
    ip default-gateway 172.31.0.1

    Each 7220/7240 controller has an IP on the same subnet : This is a L2-Connectivity, not ?

    ------------------------------
    Jules Bvt
    ------------------------------

    Original Message


  • 7.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 10, 2022 12:29 AM
    Hi,

    If there is a reachability problem,

    1. Check firewalls and ACLs.
    There can be an ACL in the configs. Especially, on the uplink. If there is no ACL, write one to log the packets and see if your packets coming to your controller.

    2. Check routing problem.

    If ping packets are coming and going to the interface, then most probably no routing problem. Also you may check with "telnet <IP ADDRE> 4343" command and see the result.





    ------------------------------
    husnu demir
    ------------------------------

    Original Message


  • 8.  RE: WebGUI/SSH issue with Mobility Conductors

    EMPLOYEE
    Posted Jan 07, 2022 11:33 AM
    Is the problem associated with just ssh/webui access to the MCR's VRRP VIP, or does it also prevent access to the MCR's unique management IP?

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------

    Original Message


  • 9.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 07, 2022 11:41 AM
    Unfortunately, the issue is the same with VIP and equipment unique IP. Even the MGMT interface IP is affected !

    ------------------------------
    Jules Bvt
    ------------------------------

    Original Message


  • 10.  RE: WebGUI/SSH issue with Mobility Conductors

    EMPLOYEE
    Posted Jan 07, 2022 11:52 AM
    At least the behavior is consistent. 

    Is there any error message presented when trying to ssh into the MCR, or does it simply timeout?

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------

    Original Message


  • 11.  RE: WebGUI/SSH issue with Mobility Conductors

    Posted Jan 07, 2022 11:57 AM
    Yes, there is only a timeout with HTTPS or SSH.

    ------------------------------
    Jules Bvt
    ------------------------------

    Original Message


  • 12.  RE: WebGUI/SSH issue with Mobility Conductors

    EMPLOYEE
    Posted Jan 07, 2022 12:07 PM
    I would start from both the remote client as well as the MCR directly to start isolating where the issue occurs.

    Do a traceroute/tracert from the remote client to the MCR. Where does it stop?
    From the MCR, traceroute back to the remote client. Is it reachable or does it stop?

    Remember, communications between controllers and the conductor is carried inside IPSec, so that would potentially present itself differently if there's been a firewall rule added/changed somewhere. If ping works between the MCR and remote device, then routing should be correct.

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------

    Original Message