Wireless Access

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

Thanks Herman! I was hoping it was something simple.  I had followed that guide, but somehow missed the remote AP tab.  I'll try that and see if it comes online.  

I did have the AP in the wrong list (Campus)

I do have the LMS ip set for both controllers in the cluster here in the IP address and Backup IP address field. This is the public NAT address (which is surely working since I can see the RAP trying to connect.

I'm not in the same area as the AP right now but I'll give it another reset this eve and see if it will come online if it doesn't before that.  

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

Did you set the RAP Public IP in your cluster?

With controller clusters, most of LMS configuration is ignored and an AP will connect directly to the controller IP as configured in the cluster, or when in RAP mode to the RAP Public IP.

The Auth Request message suggests an authentication problem, but it may be that the RAP just cannot reach its anchor or user controllers.

If this is not your issue, it may be more effective to work with your partner or Aruba Support as there are many things to look at and verify.

Thanks Herman! I was hoping it was something simple.  I had followed that guide, but somehow missed the remote AP tab.  I'll try that and see if it comes online.  

I did have the AP in the wrong list (Campus)

I do have the LMS ip set for both controllers in the cluster here in the IP address and Backup IP address field. This is the public NAT address (which is surely working since I can see the RAP trying to connect.

I'm not in the same area as the AP right now but I'll give it another reset this eve and see if it will come online if it doesn't before that.  

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

Did you set the RAP Public IP in your cluster?

With controller clusters, most of LMS configuration is ignored and an AP will connect directly to the controller IP as configured in the cluster, or when in RAP mode to the RAP Public IP.

The Auth Request message suggests an authentication problem, but it may be that the RAP just cannot reach its anchor or user controllers.

If this is not your issue, it may be more effective to work with your partner or Aruba Support as there are many things to look at and verify.

Thanks Herman! I was hoping it was something simple.  I had followed that guide, but somehow missed the remote AP tab.  I'll try that and see if it comes online.  

I did have the AP in the wrong list (Campus)

I do have the LMS ip set for both controllers in the cluster here in the IP address and Backup IP address field. This is the public NAT address (which is surely working since I can see the RAP trying to connect.

I'm not in the same area as the AP right now but I'll give it another reset this eve and see if it will come online if it doesn't before that.  

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

Hello everyone,

I'm back with another question that should have a simple answer, but I've been having a hard time finding it.

We're all set up with the above - I have a RAP that works fine connecting to the controller from a remote location. The working AP is an AP303H that originally shipped with IAP mode, and I was able to go in and provision it to the controller and convert it to RAP.

What I can't figure out is how to configure existing campus APs to work remotely. I have tried with a 505H, and a 315 and a 325 (though I'll admit that I can't remember if these are the universal AP or if they are only campus APs - JW797A and JW327A (both have the model and then -61001 on the sticker if I am reading  that right).
Anyway - what would be the process to get these converted to RAP? We had them online, and then set them up on the controller as RAP, and they showed up like they were going to work, but they never come online. I don't have handy the serial adapter for the 315, but I could console in to the 325 if I knew what I needed to do. 

Any help or nudge in the correct direction would be appreciated!

Did you set the RAP Public IP in your cluster?

With controller clusters, most of LMS configuration is ignored and an AP will connect directly to the controller IP as configured in the cluster, or when in RAP mode to the RAP Public IP.

The Auth Request message suggests an authentication problem, but it may be that the RAP just cannot reach its anchor or user controllers.

If this is not your issue, it may be more effective to work with your partner or Aruba Support as there are many things to look at and verify.

Thanks Herman! I was hoping it was something simple.  I had followed that guide, but somehow missed the remote AP tab.  I'll try that and see if it comes online.  

I did have the AP in the wrong list (Campus)

I do have the LMS ip set for both controllers in the cluster here in the IP address and Backup IP address field. This is the public NAT address (which is surely working since I can see the RAP trying to connect.

I'm not in the same area as the AP right now but I'll give it another reset this eve and see if it will come online if it doesn't before that.  

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

The 505H can be easy, just factory default the AP and convert from IAP.

For Campus APs, should just need to re-provision the AP to remote mode.  As long as the AP can get an IP address and reach one of the cluster nodes as seen in the node-list environment variable, that should work.

Hello everyone,

I'm back with another question that should have a simple answer, but I've been having a hard time finding it.

We're all set up with the above - I have a RAP that works fine connecting to the controller from a remote location. The working AP is an AP303H that originally shipped with IAP mode, and I was able to go in and provision it to the controller and convert it to RAP.

What I can't figure out is how to configure existing campus APs to work remotely. I have tried with a 505H, and a 315 and a 325 (though I'll admit that I can't remember if these are the universal AP or if they are only campus APs - JW797A and JW327A (both have the model and then -61001 on the sticker if I am reading  that right).
Anyway - what would be the process to get these converted to RAP? We had them online, and then set them up on the controller as RAP, and they showed up like they were going to work, but they never come online. I don't have handy the serial adapter for the 315, but I could console in to the 325 if I knew what I needed to do. 

Any help or nudge in the correct direction would be appreciated!

Did you set the RAP Public IP in your cluster?

With controller clusters, most of LMS configuration is ignored and an AP will connect directly to the controller IP as configured in the cluster, or when in RAP mode to the RAP Public IP.

The Auth Request message suggests an authentication problem, but it may be that the RAP just cannot reach its anchor or user controllers.

If this is not your issue, it may be more effective to work with your partner or Aruba Support as there are many things to look at and verify.

Thanks Herman! I was hoping it was something simple.  I had followed that guide, but somehow missed the remote AP tab.  I'll try that and see if it comes online.  

I did have the AP in the wrong list (Campus)

I do have the LMS ip set for both controllers in the cluster here in the IP address and Backup IP address field. This is the public NAT address (which is surely working since I can see the RAP trying to connect.

I'm not in the same area as the AP right now but I'll give it another reset this eve and see if it will come online if it doesn't before that.  

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH

The 505H can be easy, just factory default the AP and convert from IAP.

For Campus APs, should just need to re-provision the AP to remote mode.  As long as the AP can get an IP address and reach one of the cluster nodes as seen in the node-list environment variable, that should work.

Hello everyone,

I'm back with another question that should have a simple answer, but I've been having a hard time finding it.

We're all set up with the above - I have a RAP that works fine connecting to the controller from a remote location. The working AP is an AP303H that originally shipped with IAP mode, and I was able to go in and provision it to the controller and convert it to RAP.

What I can't figure out is how to configure existing campus APs to work remotely. I have tried with a 505H, and a 315 and a 325 (though I'll admit that I can't remember if these are the universal AP or if they are only campus APs - JW797A and JW327A (both have the model and then -61001 on the sticker if I am reading  that right).
Anyway - what would be the process to get these converted to RAP? We had them online, and then set them up on the controller as RAP, and they showed up like they were going to work, but they never come online. I don't have handy the serial adapter for the 315, but I could console in to the 325 if I knew what I needed to do. 

Any help or nudge in the correct direction would be appreciated!

Did you set the RAP Public IP in your cluster?

With controller clusters, most of LMS configuration is ignored and an AP will connect directly to the controller IP as configured in the cluster, or when in RAP mode to the RAP Public IP.

The Auth Request message suggests an authentication problem, but it may be that the RAP just cannot reach its anchor or user controllers.

If this is not your issue, it may be more effective to work with your partner or Aruba Support as there are many things to look at and verify.

Thanks Herman! I was hoping it was something simple.  I had followed that guide, but somehow missed the remote AP tab.  I'll try that and see if it comes online.  

I did have the AP in the wrong list (Campus)

I do have the LMS ip set for both controllers in the cluster here in the IP address and Backup IP address field. This is the public NAT address (which is surely working since I can see the RAP trying to connect.

I'm not in the same area as the AP right now but I'll give it another reset this eve and see if it will come online if it doesn't before that.  

Are your controllers in a cluster? In that case you would need to configure the public IPs in your configuration as well... and there is a separate allow list for remote APs (from normal / Campus APs).

If the controllers are not in a cluster, the NAT should be enough.

This page seems to have a good summary... a bit down from the top there is the cluster configuration.

Hey everyone,

I have an ArubaMM-VA (pri/backup) on version 8.10.0.7 LSR orchestrating two Physical 7210 controllers. I am trying to get some remote APs going, but am hitting a snag and I haven't been able to find the cause. The traffic is coming from a typical home user network with a NAT to the public Internet over to the corporate Palo firewall. There are two NAT addresses configured both in the firewall and the profile for the RAP in the controller, and a corresponding policy to allow "any" traffic from the home location ip address to the two NAT addresses on the controller. The controllers have private IP addresses, but the NAT rule points to those IPs. I don't think I should have to include specific ports, but I can do that (I'm testing now with wide open settings to get it working).

The AP is an AP-303, it's in the allow list, and I can see it connect to the controller, but it will never come all the way online.  I'm unsure what I have missed, but I did see the AP go Up, then Down a few times

The message is:
AP is down since 2023-12-07 02:01:02 because of the following reason: Auth Request.

On the controller:

show datapath session table 10.200.200.51

I'm not sure what else to check. I'm sure I missed a step, as the RAP configuring isn't as well documented as I hoped. Where do I go next?

Thanks!

PH