ArubaOS and Controllers

Occasional Contributor I

Management IP on seperate network/Disallow clients controller access

Two quick questions. If I have a controller serving clients on a 10.10.4.x address, but want it to be able to be managed from a 192.168.3.x address, should I have to do anything more than add the 192.168.3.x address to the 1/1 port?

Also, is there an easy way to disallow wireless clients from reaching the controller WebUI?
Guru Elite

Re: Management IP on seperate network/Disallow clients controller access

You can manage, AKA login to the controller on any IP address that is reachable by your web or SSH client. What is MORE important, however is the switchip, or controller IP address. That is the IP address that access points MUST terminate on. For example, if a controller has 3 interfaces with 3 different IP addresses, and its switch or controller IP is on VLAN1, access points that locate the controller on the other interfaces will be immediately forwarded to VLAN1. Very important if you are planning routing. As of ArubaOS 3.4.1.x and above you can manually change this controller ip to be any VLAN that you want.

The best way to disallow clients from reaching the controller GUI is to create an alias that has ip hosts for all of the controller interface ip addresses. Create a firewall policy that says user alias controller service svc-ssh deny, and user alias controller TCP 4343 deny. Apply that policy to the user role you want blocked.

*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Super Contributor I


That's all well and good, but once they bring up another IP address on the controller, they'll also have to update that alias so it includes (i.e., protects) the new address.

Wouldn't it be nice if the controller just *knew* what addresses were configured on it and one could use an alias that dynamically maps to all the controller's local addresses? "mswitch" gets close by dynamically matching the controller-ip.

I've asked for this for 3 years. :(
Ryan Holland, ACDX #1 ACMX #1
The Ohio State University
Search Airheads
Showing results for 
Search instead for 
Did you mean: