Controllerless Networks

Good afternoon all,

When I run Aruba firmware update check from within Instant OS, it shows nothing to update but when I bypass our filter it shows there is an update available. I have enabled aruba.brightcloud.com on our web filter but wondering what else do I have to whitelist to gain firmware updates without bypassing our filter please? Each time I click update I don't see any activity on the web filter to pinpoint where it's trying to go in order to whitelist it.

any direction links etc would be highly appreciated.

kindest regards

Jehanzeb

Try here:  http://support.arubanetworks.com/LifetimeWarrantySoftware/tabid/121/DMXModule/661/Default.aspx?EntryId=20375

Thanks Colin, the link shows how to manually download the firmware which is good however my query is related to opening ports/whitelisting Aruba firmware direct update server URLs so that it automatically downloads the version when I click check for updates.

kindest regards

jehanzeb

device.arubanetworks.com is what you should be whitelisting.  The brightcloud URL is for the web filtering and classification function.

Thanks Colin, I have made the entry and will test it tomorrow, will update this tomorrow 

kindest regards

jehanzeb

Good morning Colin,

It still doesn't work. It says "Receveid No Response from the server" when I click on Check for New Version. However bypassing the filter it works fine.

There must be either IP range or URL that is blocking it I think.

Kindest regards

Jehanzeb

Try allowing traffic to images.arubanetworks.com

Also,

Make sure that your IAP has access to an NTP server (port 123), because if the clock is set to 1970 in the logs on the instant cluster, the cloud will assume that the certificate on the system is not valid yet.

I have a bigger problem now. I ran the update by bypassing the proxy and now although it updated some of the APs others it says it AP register failed due to image miss match.aaghhh

P.S. Image.arbua.... is already whitelisted. I found that it was trying to get to this IP address: 104.36.249.201. I have put that into exception list.

Kindest regards

Jehanzeb

Are all of your IAPs the same model?

Quite frankly, most people update the software manually so that they know exactly what version to expect, so that they can fix bugs or gain features specifically for the version they want..

Thanks for the continous responses and support Colin. No the IAP is a mix cluster. We have IAP325, all up and running and then we have IAP 205 (some came on some didn't) and only two 115, both 115 came on. So out of 21 only six came back on and 15 are showing miss match. I rebooted one of the failed ones by taking the cable out and see if it would pick the right image but it didn't.

I am guessing my option is to take them off plug into the mac and push the image manually however I would need a reminder on how to push them and also need to look at the 12v adapter that would run the AP.

P.S. I thought if we push updates from the stable Check New version - it would be fine but no! aaargghh.

Kindest regards

Jehanzeb

unless I can push manual image update again to the failed ones from Controller?

Kindest regards

Jehanzeb

On the VC, type "show upgrade info" to see where things are failing.

If you have a mixed cluster,  to upgrade manually you will need a tftp server to host the images for all the classes of APs you need.  First go here:  http://support.arubanetworks.com/LifetimeWarrantySoftware/tabid/121/DMXModule/661/EntryId/20374/Default.aspx and choose either the latest standard or conservative build and make sure that there is an image for all of the APs in your cluster.  

Download the images for each type of AP and put it into a TFTP server.

Lastly, start the multi-cluster upgrade:  http://www.arubanetworks.com/techdocs/Instant_423_WebHelp/InstantWebHelp.htm#UG_files/IAP_maintenance/Firmware_Image_Server_in.htm?Highlight=upgrade tftp

Run "show upgrade info" on the Virtual Controller repeatedly to keep track of how things are going.

Thanks Colin. The website link you gave me has images version 6.5.2.0.59123 but my 325 IAPs have been upgraded to 6.5.3.2-6.5.3.2_60886. 

Where can I find the above firmware please or should I just image all with 6.5.2.0? 

I have downloaded all the images and put the into /private/tftpboot/ folder and I have a TFTP server running so I can upload all images from there to all APs. The only thing is, all IAPs are wireless i.e. TFTP server is my mac machine wirelessly connected. Would that make any difference? or does it actually download the full image and then install it on the AP i.e. I wouldn't have to worry about the Mac (TFTP Server) being wireless?

P.S. how do you run Show upgrade info on AP? you meant the command line?

Many thanks

Kindest regards

Jehanzeb

Which Instant AP models do you need images for?  PM me your email address and I will send them to you.

Having an image server on the wireless is tricky especially if you are connected to an AP that can be disconnected at any time.  It can be done if you need to do it, but try to find a wired tftp server if you can..

I have PMed Colin. Many thanks

I will connect the iMAC with wired Connection straight into the wall. and will run it from there. Cannot take more chances. 

I will wait for your kind reply/

Kindest regards

Jehanzeb

Okay.

When upgrading, please pay attention to the URL format for tftp here:  http://www.arubanetworks.com/techdocs/Instant_423_WebHelp/InstantWebHelp.htm#UG_files/IAP_maintenance/Firmware_Image_Server_in.htm?Highlight=upgrade

Ok tftp all set, when I click on it it says cannot upgrade as upgrade is in progress but there is nothing running. "Upgrade cannot proceed because of another upgrade in progress." I even try to reboot but it doesn't send any command for reboot either

SSH into the Virtual Controller and type "show upgrade info" to see what it thinks is happening.

That's what I am getting on ssh.

It doesn't show rest of the IAPs. Should I unplug all of them and reinsert?

AP 15 IT Room# show upgrade info

swarm upgrade status
--------------------
Mac IP Address Seed AP AP Class Status Image Info
--- ---------- ------- -------- ------ ----------
f0:5c:19:c 10.149.xxx.xx No Hercules image-ok From Seed
f0:5c:110.149.xxx.xx No Hercules image-ok From Seed
ac:a3:110.149.xxx.xx No Taurus image-ok From Seed
9c:1c:10.149.xxx.xx No Pegasus image-ok From Seed
18:64 10.149.xx.xx No Pegasus image-ok From Seed
f0:5c:10.149.xxx.xx No Hercules image-ok From Seed
Auto reboot :enable
Use external URL :disable
Master wait Time :0 secs 0 count
Switch Partition :enable
Upgrade in process :No
AP 15 IT Room#

Kindest regards

Jehanzeb

On the failed IAP, when I do ssh, it asks for a admin password and when I put the admin password, it says incorrect password. Access denied.

I got the access all of a sudden and it is showing this

AP 19 Class 11# show upgrade info

Image Upgrade Progress
----------------------
Mac IP Address AP Class Status Image Info Error Detail
--- ---------- -------- ------ ---------- ------------
ac:a3:1e: 10.149.xxx.xxx Taurus image-ok -- none
Auto reboot :enable
Use external URL :disable
Master wait Time :0 secs 0 count
Switch Partition :enable
AP 19 Class 11#

but on my VC Instant GUI it shows Error

AP Register fail because of image missmatch

Kindest regards

Jehanzeb

If you only have a single failed IAP, you should possibly put it on a dhcp network by itself and upgrade it manually.  I am assuming rebooting does not work?

Nope rebooting isn't working with the VC. It also showing only 6 IAPs out of 21. All others are showing in Alert message but nothing else.

When I ssh into failed IAP, it shows all is ok.

AP 11 Class 1# show upgrade info

Image Upgrade Progress
----------------------
Mac IP Address AP Class Status Image Info Error Detail
--- ---------- -------- ------ ---------- ------------
ac:a3:1e: 10.149.xxx.xxx Taurus image-ok -- none
Auto reboot :enable
Use external URL :disable
Master wait Time :0 secs 0 count
Switch Partition :enable
AP 11 Class 1#

I am thinking, can we revert the images back to the old one? but then again the error is saying the upgrade is in progress when I try to upgrade manually.

I wish I hadn't press that button.

Kindest regards

Jehanzeb

On the failed IAP I logged into it through ssh and sent a upgrade command

AP 20 Staff Room# upgrade-image tftp://10.149.187.130/ArubaInstant_Taurus_6.5.3.2_60886

It came up with the following message but how will I know it's done?

Upgrading swarm image. Will automatically reboot when done.

Kindest regards

Jehanzeb

Is there an AP class that is not upgraded?  Take one AP of a single class that is not upgraded, manually upgrade it to the correct firmware on another network and re-introduce it to the cluster.  If you reboot the other APs in that class that have failed, they should get the firmware from that AP you reintroduced to the cluster...  Did your tftp server say that any APs got the firmware?

15 IAPs are not upgraded as they are not showing up in the cluster, under Instant VC GUI. They are coming up as missmatch. If I have to take the APs down I will have to uplug all of them from all classes.

To be able to manually upgrade I would need a power supply with 12v 2-3Amp with the right pin to go into the IAP as it wouldn't switch on without the PSU. I can run an upgrade via my iMAC by plugging into it but not having a PSU is a major setback.

I can access the affected iAP via SSH and it seems it sends the commands but it doesn't show any progress of it nor it's appearing into the VC Cluster.

Kindest regards

Jehanzeb

Can I revert back i.e. can I upload an older image onto my current upgraded VC so instead of 6.5.3 I can go back to 6.4.xx? It might actually pick all of them up then? 

Kindest regards

Jehanzeb

You can downgrade, but without having proper access to the internet, you would have to do it manually via TFTP in a multi environment.

You should try to open a TAC case so that they can guide you through this over the phone.

Alternatively, can you reach the GUI of any access point that is not up?

I can access the GUI of IAPs that are not up but they all come up with the same 6 x IAP showing and others aren't.

Kindest regards

Jehanzeb

It is possible that those APS have formed their own cluster.  You can manually update those APs, by going to the maintenance window and seeing if it will allow you to update to the new code.  When they reboot, if they have the same version of code, they should join the existing upgraded cluster.

I think they might be but when I am using our usual password it doesn't let me in. The Affected IAPs are all accessible from the GUI but just not letting me in. I am using admin as a username and password is what we usually use. I also tried admin admin but that doesn't work either. I can SSH into it but it refuses connection due to wrong password.

What is the default password to get into the Access Point when they are shipped i.e. factory default admin password please?

Kindest regards

Jehanzeb

That would be admin, admin as well.

I tried that you see and it didn't work.

As we stand, 103, 115, 325 and only one out of 16x225 is working. I

wonder if I disconnect all working ones and leave the only working 225 and see if it picks it up from there.

Also each time I try to login onto one of the affected APs it reverts me back to the VC IP.

Will take one of the IAP with me and will try to isolate it from the network. I will also try and find a PSU so that I can connect it manually to a machine.

Colin you've been a great help. Thank you so much for everything.

Kindest regards

Jehanzeb

See if you can SSH into one of the affected APS and then reboot it using the "reload" command:  http://www.arubanetworks.com/techdocs/Instant_423_WebHelp/InstantWebHelp.htm#CLI_commands/reload.htm?Highlight=reboot.  

Only the GUI redirects to the VC, the SSH prompt does not.

Thanks Colin, Although I was able to login into any APs however none of the command line commands were affecting any of the APs using SSH. It showed that it has sent the command but nothing happened.

All the digitally signed images/firmwares either 6.5.2 or 6.5.3, none of them works with some of the IAP-205s (Taurus). Strangely enough out of 16 205s only one accepted the 6.5.3.

So today I unplugged all of them, reverted to 6.5.2 by only plug-in two APs (both 205s) and it didn't work. So I reverted another step back, this time to 6.4.4.xx. This however worked straight away. So it seems like there is some issue with 6.5.xx version firmware.

Now I have 18 APs out of 21, Taurus (205s) and Hercules(325s) APs working but not Pegasus. So I have brought the Pegasus into another network. Will try and push the 6.4.4.xx image and will take that back into work on Tuesday.

I'd like to thank you for all your support and efforts. You're truly a Gem!

Many thanks

Kindest regards

Jehanzeb