Hi sadams,
Thanks for the detailed reply. Here are the outputs:
- AP doesnt have direct connection to the MD, because I am using VM for both MM/MC-MD
- MD cannot detect the AP at all, so there is no sign about any AP trying to connect.
- I already set static for the "master" and "serverip". Note that I also cannot use "dhcp" coz my small lab doesnt have DHCP server.
====AP Boot===still showing similar
Writing 4
192.168.68.105 255.255.255.0 192.168.68.1
Running ADP...Done. Master is 192.168.68.52
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_rate_atheros: Aruba Networks Rate Control Algorithm
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_spectrum: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_pci: 0.9.4.5 (Atheros/multi-bss)
ath_attach: scn 80530280 sc 80560000 ah 80580000
wifi0: Base BSSID 6c:f3:7f:40:f9:38, 8 available BSSID(s)
bond0 address=6c:f3:7f:cc:0f:93
br0 address=6c:f3:7f:cc:0f:93
wifi0: AP type AP-105, radio 0, max_bssids 8
--------output truncated-------
AP rebooted Fri Dec 31 16:44:32 PST 1999; SAPD: Unable to contact switch: HELLO-TIMEOUT. Last rebootstrap reason: HELLO-TIMEOUT, 229 sec before: Last Ctrl msg: HELLO len=1091 dest=192.168.68.52 tries=10 seq=0
keep watchdog process alive for talisker (nanny will restart it)...
====show allowlist cpsec==old OS still using old term, from MM/MC and from the MD same output
MM/MC:
(mm8201) [mynode] #show whitelist-db cpsec
Control-Plane Security Whitelist-entry Details
----------------------------------------------
MAC-Address AP-Group AP-Name Enable State Cert-Type Description Revoke Text Last Updated
----------- -------- ------- ------ ----- --------- ----------- ----------- ------------
Total Entries: 0
(mm8201) [mynode] #
MD:
(md8201-1) #show whitelist-db cpsec
Control-Plane Security Whitelist-entry Details
----------------------------------------------
MAC-Address AP-Group AP-Name Enable State Cert-Type Description Revoke Text Last Updated
----------- -------- ------- ------ ----- --------- ----------- ----------- ------------
Total Entries: 0
(md8201-1) #
====show ap database long====from MM/MC and from the MD same output
MM/MC:
(mm8201) [mynode] #show ap database long
AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP Wired MAC Address Serial # Port FQLN Outer IP User
---- ----- ------- ---------- ------ ----- --------- ---------- ----------------- -------- ---- ---- -------- ----
Flags: U = Unprovisioned; N = Duplicate name; G = No such group; L = Unlicensed
I = Inactive; D = Dirty or no config; E = Regulatory Domain Mismatch
X = Maintenance Mode; P = PPPoE AP; B = Built-in AP; s = LACP striping
R = Remote AP; R- = Remote AP requires Auth; C = Cellular RAP;
c = CERT-based RAP; 1 = 802.1x authenticated AP; 2 = Using IKE version 2
u = Custom-Cert RAP; S = Standby-mode AP; J = USB cert at AP
f = No Spectrum FFT support
i = Indoor; o = Outdoor
M = Mesh node; Y = Mesh Recovery
z = Datazone AP; e = Custom EST cert
Total APs:0
(mm8201) [mynode] #
MD:
(md8201-1) #show whitelist-db cpsec
Control-Plane Security Whitelist-entry Details
----------------------------------------------
MAC-Address AP-Group AP-Name Enable State Cert-Type Description Revoke Text Last Updated
----------- -------- ------- ------ ----- --------- ----------- ----------- ------------
Total Entries: 0
(md8201-1) #
======show control-plane-security===== shows different output:
MM/MC:
(mm8201) [mynode] #show control-plane-security
Control Plane Security Profile
------------------------------
Parameter Value
--------- -----
Control Plane Security Disabled
Auto Cert Provisioning Disabled
Auto Cert Allow All Enabled
Auto Cert Allowed Addresses N/A
Auto Cert Allowed IPv6 Addresses N/A
(mm8201) [mynode] #
MD:
(md8201-1) #show control-plane-security
Control Plane Security Profile
------------------------------
Parameter Value
--------- -----
Control Plane Security Enabled
Auto Cert Provisioning Disabled
Auto Cert Allow All Enabled
Auto Cert Allowed Addresses N/A
Auto Cert Allowed IPv6 Addresses N/A
(md8201-1) #
(md8201-1) #
====show log all | inc 6c:f3:7f:cc:0f:93======= shows something at the MD
MM/MC:
(mm8201) [mynode] #show log all | include 6c:f3:7f:cc:0f:93
(mm8201) [mynode] #show log all | include 6c:f3:7f:cc:0f:93
(mm8201) [mynode] #
MD:
(md8201-1) #show log all | include 6c:f3:7f:cc:0f:93
Dec 30 13:44:13 nanny[945]: <303022> <WARN> |AP 6c:f3:7f:cc:0f:93@192.168.68.105 nanny| Reboot Reason: AP rebooted Fri Dec 31 16:44:32 PST 1999; SAPD: Unable to contact switch: HELLO-TIMEOUT. Last rebootstrap reason: HELLO-TIMEOUT, 229 sec before: Last Ctrl msg: HELLO len=1091 dest=192.168.68.52 tries=10 seq=0
(md8201-1) #
====show datapath session table==== same output for both
MM/MC:
(mm8201) [mynode] #show datapath session table 192.168.68.105
Datapath Session Table Entries
------------------------------
Flags: F - fast age, S - src NAT, N - dest NAT
D - deny, R - redirect, Y - no syn
H - high prio, P - set prio, T - set ToS
C - client, M - mirror, V - VOIP
Q - Real-Time Quality analysis
u - Upstream Real-Time Quality analysis
I - Deep inspect, U - Locally destined
E - Media Deep Inspect, G - media signal
r - Route Nexthop, h - High Value
B - Permanent, O - Openflow
L - Log
Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
--------------- --------------- ---- ----- ----- -------- ---- --- --- ----------- ---- --------- --------- ---------------
(mm8201) [mynode] #
MD:
(md8201-1) #show datapath session table 192.168.68.105
Datapath Session Table Entries
------------------------------
Flags: F - fast age, S - src NAT, N - dest NAT
D - deny, R - redirect, Y - no syn
H - high prio, P - set prio, T - set ToS
C - client, M - mirror, V - VOIP
Q - Real-Time Quality analysis
u - Upstream Real-Time Quality analysis
I - Deep inspect, U - Locally destined
E - Media Deep Inspect, G - media signal
r - Route Nexthop, h - High Value
A - Application Firewall Inspect
B - Permanent, O - Openflow
L - Log
Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge Packets Bytes Flags
--------------- --------------- ---- ----- ----- -------- ---- --- --- ----------- ---- --------- --------- ---------------
(md8201-1) #
Original Message:
Sent: Dec 30, 2024 03:38 AM
From: sadams
Subject: RADIUS IP is the MM, Replicating Customer setup but I am NEW to 8.6.0.23 with AP-105 Deployment, Cannot Auto-Discover AP, I just want to provision my AP
Is the AP-105 still showing the same sequence on the console ? This indicates the AP cannot reach the MD:
192.168.68.105 255.255.255.0 192.168.68.1
Running ADP...Done. Master is 192.168.68.52
AP rebooted Fri Dec 31 16:44:32 PST 1999; SAPD: Unable to contact swLO-TIMEOUT, 228 sec before: Last Ctrl msg: HELLO len=426 dest=192.16
This looks like the AP is receiving the ADP packet from the MD and trying to connect.
The best information is going to be from the AP console as Herman wrote, but there should be evidence in the MD/MC if the AP can reach.
If CPSEC is enabled, check the allowlists: (allowlists are always established at the MC, and copied down to the MD)
Note:
Hereafter , MC refers to the Mobility Conductor, MD to the Managed Device.
# Here, we should see an entry for the AP-105 on both MC and MD going from approved to certified indicating the CPSEC certificate exchange is complete.
show allowlist cpsec
does the MD have a correct connection to the MC ?
Does the MD show any signs of the AP trying to connect ?
MC and MD:
show ap database long
show control-plane-security
MC and MD:
show log all | inc <AP MAC>
# check the actual traffic from AP to MD:
show datapath session table 192.168.68.105
You might use the apboot prompt on the AP to statically configure the MD ip address as a test, but it seems the problem is further long in the process.
setenv master 192.168.68.52
setenv serverip 192.168.68.52
setenv
dhcp
boot
------------------------------
Shawn Adams
Original Message:
Sent: Dec 30, 2024 02:02 AM
From: breenubee
Subject: RADIUS IP is the MM, Replicating Customer setup but I am NEW to 8.6.0.23 with AP-105 Deployment, Cannot Auto-Discover AP, I just want to provision my AP
Hi shpat,
I am matchabear but with different account, coz that account somehow "needs to be investigated", not sure why. Maybe because using a personal email to register. But anyway, here below is my licensing screenshot from MM. Is it proper and expected to see "0/1" from AP and PEF ? Coz, I still cannot detect the AP-105. I put all into one segment.
Original Message:
Sent: Dec 30, 2024 01:35 AM
From: shpat
Subject: RADIUS IP is the MM, Replicating Customer setup but I am NEW to 8.6.0.23 with AP-105 Deployment, Cannot Auto-Discover AP, I just want to provision my AP
Hi matchabear
Yes you need AP License. PEF License is needed if you have configurations using Role Based Access, apart from the standard ones used in AOS.
------------------------------
Shpat | ACEP | ACMP | ACCP | ACDP |
-Just an Aruba enthusiast and contributor by cases
Original Message:
Sent: Dec 25, 2024 11:52 AM
From: matchabear
Subject: RADIUS IP is the MM, Replicating Customer setup but I am NEW to 8.6.0.23 with AP-105 Deployment, Cannot Auto-Discover AP, I just want to provision my AP
Hi Herman,
Thanks much for your response.
I tried with 8.2.0.1 as below logs showing, but still from MM/MD I couldn't see the AP. For clarification, I navigated to the Configuration > Access Points at the MD. Note that I already disable the CPSec and also whitelisted the AP, still unable to see it.
Do I need AP and PEFNG licenses beforehand so that I am able to see the AP there?
Bootup logs from the AP:
APBoot 1.4.0.3 (build 37726)
Built: 2013-03-21 at 20:13:41
Model: AP-10x
CPU: AR7161 revision: A2
Clock: 680 MHz, DDR clock: 340 MHz, Bus clock: 170 MHz
DRAM: 128 MB
POST1: passed
Copy: done
Flash: 16 MB
PCI: scanning bus 0 ...
dev fn venID devID class rev MBAR0 MBAR1 MBAR2 MBAR3
00 00 168c 0029 00002 01 10000000 00000000 00000000 00000000
01 00 168c 0029 00002 01 10010000 00000000 00000000 00000000
Net: eth0
Radio: ar922x#0, ar922x#1
Hit <Enter> to stop autoboot: 0
Checking image @ 0xbf100000
Invalid image format version: 0xffffffff
Checking image @ 0xbf800000
Invalid image format version: 0xffffffff
eth0 up: 1 Gb/s full duplex
ADP multicast 1
ADP broadcast 1
Controller address: 192.168.68.52
Using eth0 device
TFTP from server 192.168.68.52; our IP address is 192.168.68.105
Filename 'mips32.ari'.
Load address: 0x2000000
Loading: #################################################################
########################
done
Bytes transferred = 5812856 (58b278 hex)
Image is signed; verifying checksum... passed
Signer Cert OK
Policy Cert OK
RSA signature verified.
Automatic boot of image at addr 0x02000000 ...
ELF file is 32 bit
Loading .text @ 0x80e00000 (5743096 bytes)
Loading .data @ 0x8137a200 (32 bytes)
Clearing .bss @ 0x8137a220 (16 bytes)
## Starting application at 0x80e00000 ...
Uncompressing......................................................
Aruba Networks
ArubaOS Version 8.2.0.1 (build 62115 / label #62115)
Built by p4build@corfu on 2017-10-31 at 21:58:22 PDT (gcc version 4.
CPU Rev: aa
71x CPU
Flash variant: default
Cache parity protection disabled
Using 340.000 MHz high precision timer. cycles_per_jiffy=680000
Memory: 120576k/131072k available (1741k kernel code, 10372k reserve
available.
detected lzma initramfs
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=8388608,origSize=24606208
LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com> ...........................................................................................................................................................................................................................
AR7100 GPIOC major 0
wdt: registered with refresh
Enabling Watchdog
Talisker RSSI LED initialization
Creating 1 MTD partitions on "ar7100-nor0":
0x00000000-0x01000000 : "flash"
i2c /dev entries driver
i2c-talisker: using default base 0x18040000
AD7416 driver probing for devices on AR7100 I2C
.<6>lo: Disabled Privacy Extensions
IPv6 over IPv4 tunneling driver
Starting Kernel SHA1 KAT ...Completed Kernel SHA1 KAT
Starting Kernel HMAC-SHA1 KAT ...Completed Kernel HMAC-SHA1 KAT
Starting Kernel DES KAT ...Completed Kernel DES KAT
Starting Kernel AES KAT ...Completed Kernel AES KAT
Starting Kernel AESGCM KAT ...Completed Kernel AESGCM KAT
Domain Name: arubanetworks.com
No panic info available
Testing TPM... Passed
ag7100_mod: module license 'unspecified' taints kernel.
AG7100: Length per segment 512
AG7100: Max segments per packet 4
AG7100: Max tx descriptor count 400
AG7100: Max rx descriptor count 252
AG7100: fifo cfg 3 018001ff
AG7100CHH: Mac address for unit 0
AG7100CHH: 6c:f3:7f:cc:0f:93
AG7100: cfg1 0xf cfg2 0x7014
ATHRF1: Port 0, Neg Success
ATHRF1: unit 0 phy addr 0 ATHRF1: reg0 3100
AP xml model 39, num_radios 2 (jiffies 13447)
apType 39 hw_opmode 0
radio 0: band 1 ant 0 max_ssid 8
radio 1: band 0 ant 0 max_ssid 8
init_asap_mod: installation:0
firewall cpu: core-0
Starting watchdog process...
Got all network params from APboot env. Skippingag7100_ring_alloc Al
DHCP
ag7100_ring_alloc Allocated 3024 at 0x86aa7000
AG7100: cfg1 0xf cfg2 0x7014
ATHRF1: Port 0, Neg Success
ATHRF1: unit 0 phy addr 0 ATHRF1: reg0 3100
AG7100: unit 0 phy is up...RGMii 1000Mbps full duplex
AG7100: pll reg 0x18050010: 0x110000 AG7100: cfg_1: 0x1ff0000
AG7100: cfg_2: 0x3ff
AG7100: cfg_3: 0x18001ff
AG7100: cfg_4: 0xffff
AG7100: cfg_5: 0xfffef
AG7100: done cfg2 0x7215 ifctl 0x0 miictrl 0x22
Writing 4
192.168.68.105 255.255.255.0 192.168.68.1
Running ADP...Done. Master is 192.168.68.52
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, PRIVATE_DIAG, WRITE_
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, In
ath_rate_atheros: Aruba Networks Rate Control Algorithm
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Rese
ath_spectrum: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Rese
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Ri
ath_pci: 0.9.4.5 (Atheros/multi-bss)
ath_attach: scn 80530280 sc 86340000 ah 80580000
wifi0: Base BSSID 6c:f3:7f:40:f9:38, 8 available BSSID(s)
bond0 address=6c:f3:7f:cc:0f:93
br0 address=6c:f3:7f:cc:0f:93
wifi0: AP type AP-105, radio 0, max_bssids 8
wifi0: Atheros 9280: mem=0x10010000, irq=49 hw_base=0xb0010000
ath_attach: scn 85e20280 sc 85e40000 ah 85e80000
wifi1: Base BSSID 6c:f3:7f:40:f9:30, 8 available BSSID(s)
bond0 address=6c:f3:7f:cc:0f:93
br0 address=6c:f3:7f:cc:0f:93
wifi1: AP type AP-105, radio 1, max_bssids 8
wifi1: Atheros 9280: mem=0x10000000, irq=48 hw_base=0xb0000000
ath_ahb: 0.9.4.5 (Atheros/multi-bss)
Starting FIPS KAT ... Completed FIPS KAT
AP rebooted Fri Dec 31 16:44:32 PST 1999; SAPD: Unable to contact swLO-TIMEOUT, 228 sec before: Last Ctrl msg: HELLO len=426 dest=192.16
keep watchdog process alive for talisker (nanny will restart it)...
<<<<< Welcome to the Access Point >>>>>
~ #
~ #
~ #
Original Message:
Sent: Dec 23, 2024 04:53 AM
From: Herman Robers
Subject: RADIUS IP is the MM, Replicating Customer setup but I am NEW to 8.6.0.23 with AP-105 Deployment, Cannot Auto-Discover AP, I just want to provision my AP
1) Note that AP and firmware version are both unsupported, but I think there is a known intermediate step required for some 6.x APs to go to 8.x, and if I'm correct that's 8.2. It may help to upgrade first to the latest 6.x, then to 8.6; or see if you can downgrade your controller to 8.2 and see if the upgrade to 8.2 works, then to 8.6. Connecting to the console of the AP, or check controller logs may provide additional information.
2) You would need to set/override the NAS-IP per group or even controller. The VRRPs are needed for CoA to work in an AOS8 cluster. Check this article/post for more information.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Dec 21, 2024 04:47 PM
From: matchabear
Subject: RADIUS IP is the MM, Replicating Customer setup but I am NEW to 8.6.0.23 with AP-105 Deployment, Cannot Auto-Discover AP, I just want to provision my AP
Hi All,
I am currently replicating my customer's environment as we have Posturing project with ClearPass, but when I start to lab with MM-MD setup with 8.6.0.23 (since AP-105 only supported until that version), I could not get the AP discovered from the MD. I use all virtual: MM and VMC. I consoled the AP and can discover the VMC with ADP already (since I put all MM, MD, and the AP under same subnet). It is just now I couldn't see the AP under the Configuration > Access Point section from the Managed Network section. I disabled the CPSec from the MM to make it simple. Strangely, if I login individually to the MD, the CPSec is still Enabled, but I don't think this makes the AP cannot be seen from the MM/MD. If this makes a difference, kindly let me know.
I can tell you that my experience is only around AOS 6.x since I did quite a number of Wifi projects like 10 years back. But, now since I have a full Aruba wireless customer environment, I need to lab it but got stuck in this simple step. AOS 6.x was so simple I remember it strongly, just do like mentioned above, and the AP can be seen from the physical MC easily and I can provision it after that. I don't know what I am missing here with the MM-MD setup, kindly please guide me to the right direction. If there is a "pinned" thread, like all-in-one MM-MD setup, I would like to scour through it and refresh my knowledge on this MM-MD thing.
So, I have two issue now:
1) How do I get to see the AP-105 from the 8.6.0.23 MM-MD
2) and the root of all this is because we found that the RADIUS NAD-IP-Address at customer site is the MM, with the Src-IP-Address is the MD. Customer's have multiple MD Groups, for example in total 4 groups, in 3 groups we found that the Src-IP is the MD's individual IP, and the NAD-IP is the MD's VRRP, but then in one group we see that the NAD-IP is the MM with the Src-IP is the MD's individual IP. The 3 groups has 3 VRRP IP (not sure why since we are not the one configuring it at the first place), and the one group has only 1 VRRP IP; but I do not think this will make a difference in terms of the RADIUS attributes detail. Please advise if other otherwise.
Thank you..!