Wireless Access

 View Only
  • 1.  Aruba 9240 Management Interface

    Posted 30 days ago

    Hello air heads

    I'm evaluating the 9240 model controller for future use in our environment.  Unboxed a brand new one today and I am having a hard time getting the management interface to obtain a DHCP address.  Is there some trick to get it to work?  Currently we're using firmware version 8.10.0.15_91324.  In this version I believe the command to allow DHCP on the interface is simply "dhcp".  But it doesn't appear to be effective on this controller.  I tried in both mynode mode and in mm mode.  It never gets a DHCP address there are plenty of available IP's and other DHCP clients are working just fine.  Screen shot attached.

    tia



  • 2.  RE: Aruba 9240 Management Interface
    Best Answer

    Posted 23 days ago

    Should work if you are on 8.9 or up, which you are. Management port is sometimes a bit hard to troubleshoot as it's a special interface; and personally I try to avoid using it, but that's me. As there are no other responses, I would recommend to open a TAC case...



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 3.  RE: Aruba 9240 Management Interface

    Posted 23 days ago

    Herman,

    Thank you for your reply.  My colleague suggested that only a static IP assignment is allowed on the mgmt interface.  But I don't see any documentation that says DHCP is not allowed.  So I figured I could try to make it work.

    Can you say more about why you prefer to avoid using mgmt interface?




  • 4.  RE: Aruba 9240 Management Interface

    Posted 23 days ago

    I am pretty sure that DHCP is supported on the mgmt port of 9240. 

    Are you using the mgmt port for ZTP?



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 5.  RE: Aruba 9240 Management Interface

    Posted 23 days ago

    I try to avoid out-of-band management as in general it tends to create a backdoor into your network. If someone gains access to one device that's connected to the out-of-band management network, they can potentially use that to jump to other devices on that management network. So the management network would need to be segmented in the same way your production network is, and you need to secure access to and from that network. By using in-band management, you avoid that whole problem. And it's clear what you get and that you need to protect the management access. Not saying it can't be done, or there is no use-case for it, but you double your security hardening efforts (and need additional cabling, switches, etc).

    To repeat, personal opinion.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 6.  RE: Aruba 9240 Management Interface

    Posted 22 days ago

    I'm aligned with you on this.  It makes sense to minimize your attack surface.

    For me the primary benefit of the management port is for initial setup.  Especially for firmware uploads.  When I'm preparing switches I like the ability to unbox the device, plug in the mgmt port, check for a DHCP address and go straight to the web interface.  Never touch the console port.  It's particularly useful when doing this in volume, preparing lots and lots of switches.  And then when they are deployed then we often disable the mgmt interface, except certain situations like emergencies.

    I want to be able to do the same with the controller.  I may still need to console in for the initial setup wizard.  But after that I would like to use the mgmt port for the remaining preparations.  Just need to figure out how to make it work without having to manually assign an IP, to streamline the preparation process.

    I'll take your advice and see about opening a TAC case.

    Thanks!