Controllerless Networks

I have an Aruba RAP-3 that needs to communicate to the main site where the controller is at.  The traffic of the RAP-3 need to first go out through a Cisco firewall where the RAP-3 is at.  There is an access list on the INSIDE interface of the firewall that allows all TCP and UDP ports, and IPSec ports to be open for the RAP-3 so it can go out the fire wall and talk to the controller.  The RAP-3 is also NATTED with an external IP.   However, the RAP-3 cannot communicate to the controller.  From the controller I can ping and traceroute to the RAP-3, but I don't understand why the RAP-3 and the controller cannot communicate with each other via IPSec.

Diagram, please.

jdeleon71,

Does the Aruba controller have a natted public ip address on your firewall?  Are you allowing UDP 4500 traffic inbounds from any ip address to that natted public ip address on your firewall?  If your answer to both questions are yes, it should work fine.  

Have you seen the Remote AP (RAP) VRD here:  http://www.arubanetworks.com/wp-content/uploads/RAPVRD_version_8.pdf  ?

The Aruba controller's public IP would be the 10.1.1.71 as indicated on the diagram, and yes, I am allowing UDP 4500 traffic inbounds from any ip address to the natted ip address.

Do you see "hits" on the firewall from the RAPs ip address?

Did you provision the access point as a remote AP pointing to the address?

I did provision the access point.  I do not see any hits on the firewall.  I did a packet capture and I see the packet going out the firewall, but I do not see anything coming back from the controller on the outside.  Do I need to do anything on the controllers' firewall?

Do the following :

- Make sure you have AOS 6.2 and up

- From the Remote Location can you ping the Public IP address

- Make sure you add VPN Pool to provide an Internal IP address 

- Add the MAC address of the RAP to the RAP Whitelist

- In the AP-Group add the PUBLIC IP Address to the provision > Master IP

- Factory Reset the RAP

- Connect the Instant SSID and open a browser to reach instant.arubanetworks.com , login using admin/admin

- From the Maintenance Tab 

- Finally Click on Convert NOW

-

Yes.

Thanks.  I would have skipped the provisioning profile step.  I have never used that before.  The rest had been done already.  The AP is up and operational, just want to make sure it comes up remotely.