Wireless Access

 View Only
last person joined: 4 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Expand all | Collapse all

VLAN for APs and Controllers in AOS10

This thread has been viewed 24 times
  • 1.  VLAN for APs and Controllers in AOS10

    Posted Mar 16, 2023 06:12 AM


    I did my first AOS10 installation with a customer which had a lot of issues in the first stages of the installation; 

    Now a HPE employee went on site and told the end-customer that it is best practice and following the VRDs that APs and controllers must be in seperate vlans. I have them installed in a dedicated WLAN-mgmt vlan, which means: only APs and gateways are in the same VLAN (and the  coreswitch has an IP for routing purpose off course) .  Now I am working for almost 11 years with Aruba products and I have never heard of this statement; more even searching on this community gives me posts where cjoseph is saying, APs and controllers just need to be able to reach each other no matter the vlan; - I mostly try to configure a dedicated AP/controller vlan, so no user traffic is disturbing in this vlan. 

    Does this change in AOS10 ? Is there somewhere a VRD for AOS10 available ? 



  • 2.  RE: VLAN for APs and Controllers in AOS10

    Posted Mar 16, 2023 07:18 AM

    Thomas, AOS10 is indeed different from AOS 6/8 as the datapath is in the AP and in the controller, rather than just in the controller. If you have the same VLAN in the AP and in the controller and a tunnel between them, you may imagine that there can be L2 loops. That is one of the reasons that gateway and AP need to be in different VLANs. For AOS 8 you can still put your APs adjacent to your controller (but don't need to).

    Check the ESP Campus Design documents as well (formerly VRD). And some additional resources:

    Check here for a nice video series on deploying AOS 10.

    More official training in the AOS 10 Essentials Webinar.

    For partners with access to Arubapedia for Partners, you can search 'AOS 10' in the Search Bar to get to a rich set of additional documentation.

    Herman Robers
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

  • 3.  RE: VLAN for APs and Controllers in AOS10

    Posted Mar 16, 2023 08:01 AM


    I can follow you with your statements about loops somehow, but this contradicts what is said about the branches in that documentationwhere is stated:

    Network Overview | Validated Solution Guide (arubanetworks.com) =>

    "Branch switches at each site have nine VLANs. Their default gateway is a virtual IP shared among the branch gateways at each site."

    this means the vlans are know on the wireless as well as on the controller. since on each branch your AP termination is the branch controller as well. 

    Even in the part about the campuses, where is stated that 1 of the access vlans is 15 which is also the mgmt vlan of the controllers. 

    To complete my design info, I had a vlan  which was on my controller, on the AP side is was vlan 1 since only in vlan 1 he is doing DHCP, but access vlan x on the switch side. the VLAN x or vlan 1 is impossible to receive on the wireless side, and all SSIDs are tunneled to the gateway. There is as well an option "tunnel loop prevention" which I enabled, and there is an option to allow only the specified vlans on the uplink of the AP which is the native vlan, So loops could not be created (theoretically) 

    My colleague who is experimenting with AOS 10 and branch setups even just told me that Aruba TAC themselves told him that it is better to have the gateways as default gateway for each vlan. 

    Do I understand correctly that the vlans might exist on both and even an IP may exist for the AP-vlan, but the "controller-ip" itself should defined in another vlan?