Controllerless Networks

Recent IAP Firmware Releases

This post outlines high level information about recent IAP firmware releases.  Hopefully it will aid you in determining what version you should be running and help delineate the differences between versions. 

Info about new versions of IAP SW will be added to this post as they are released.  Subscribe to this post to be alerted when new versions of code are released. 

Please contact Aruba Support before upgrading if you have any questions.  A valid support account is needed to access the firmware files and release notes.  The release notes are the definitive source of information about a release and should always be read before upgrading.

Currently, IAP images are posted to the TAC site, under SW Downloads first followed by posting to the Cloud based upgrade server 4 - 6 weeks later.  Dell branded IAPs typically see the SW upgrade 4 - 6 weeks after the Aruba image is released.

Instant 3.1 (6.1.3.4-3.1.0.0) Released Sept. 17, 2012

Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

• Spectrum Analysis.
• Layer-3 Roaming
• USB and PPPoE uplink 
• Uplink failover 
• Dynamic Multicast Optimization
• Media Classification for Lync and FaceTime
• 4G Support for RAP-3WN in Instant mode
• Release Notes and SW can be downloaded here:
• Instant 3.1 Release Notes and SW
• Users Guide can be downloaded here:
• 3.1 Users Guide

Instant v. 3.2 (6.2.0.0-3.2.0.0) Released March 8, 2013

Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

• Authentication Survivability (With ClearPass 6.0.2+)
• Distributed Airgroup (With ClearPass 6.0+ as integrated release)
• Wifi Uplink
• 802.1X authentication for wired users
• WISPr Authentication
• GVRP based vlan propagation (With MAS 7.2)
• IPSec fast failover
• Mixed authentication modes per SSID
• VLAN Pooling
• Daylight Savings Time

• Release Notes and SW can be downloaded here:
• Instant 3.2 Release Notes and SW
• Users Guide can be downloaded here:
• 3.2 Users Guide

Instant v. 3.3 (6.2.1.0-3.3.0.0) Released March 8, 2013

Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

• RAP-155 support
• New USB modems
• Spectrum Load Balancing
• WMM
• Staggered SW upgrades (update now and reboot later)
• Dual uplinks
• CLI officially supported with CLI reference guide
• Minor UI reorganization
• Ability to disable an SSID rather than deleting it
• Redirect to external captive portal via HTTPS
• Release Notes and SW can be downloaded here:
• Instant 3.3 Release Notes and SW
• Users Guide and CLI Reference Guide can be downloaded here:
• 3.3 Users Guide and CLI Guide

Instant v. 3.3.0.2 (6.2.1.0-3.3.0.2) Released June 24, 2013

This is a patch release.  No new features are included.  Fix highlights are listed below.  Check the Release Notes for  complete desctiptions of the fixes.

Fix Summary:

• Regulatory Domain support for RAP-155 in EU.
• Three Mesh related issues
• Incorrect status shown for unathenticated clients.
• Client connectivity issue when client is on a Slave IAP and Dynamic Radius Proxy is enabled.  Problem caused by Radius packets tagged with incorrect VLAN ID.

Instant 3.4 (6.2.1.0-3.4.0.0) Released July 22, 2013

Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

• L2TPv3 tunnelling support
• Lawful intercept capability (CALEA)
• Dynamic CPU management
• Regular expression based DHCP option role and VLAN derivation 
• Unnumbered PPPoE interface support
• Reconnect user on VPN failover to force client DHCP refresh.
• Connectivity summary on Instant UI
• Release Notes and SW can be downloaded here:
• Instant 3.4 Release Notes and SW
• Users Guide can be downloaded here:
• 3.4 Users Guide

Instant v. 3.4.0.3 (6.2.1.0-3.4.0.3) Released October 14, 2013

This is a patch release with no new features.  Fix highlights are listed below.  Check the Release Notes for complete descriptions.

Fix Summary:

• Authentication: Radius authentication failed for clients connecting to a Member IAP.
• IAP-VPN: Two issues with VPN failover with IAPs running v.3.4.x.x.
• Mesh: Process crash on the Mesh Portal. Found in v.3.3.0.0 and later.
• L3 Roaming: Two issues.
• SNMP: VC does not respond to queries coming in from the Ethernet port.
• DHCP issue with Windows 2012 DHCP Server when DHCP Failover feature is enabled.

• Release Notes and SW can be downloaded here:
• Instant 3.4.0.3 Release Notes and SW

Instant 4.0(6.3.1.1-4.0.0.0) Released November 18, 2013

Instant v.4.0 is a major release with many new features. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Platform:

• IAP-224/225 
• IAP-114/115 
• LACP 
• STP for multi-port APs
• Telnet - re-enabled

Wireless:

• 802.11ac
• Distributed Client-Match
• OKC
• 802.11r

Security:

• Bandwidth contracts - Asymmetric bandwidth contracts per-role

Guest Captive Portal:

• Multiple external CP profiles - per-role
• Custom certificates for captive portal
• Internal splash page customization - logo
• Guest-manager UI
• Domain-based ACLs

Services:

• Analytics & Location Engine Integration
• Palo Alto Network Firewall integration
• AirGroup enhancements 

Zero-touch provisioning:

• HTTP proxy for cloud-upgrade
• DNS-based AirWave discovery

Management:

• Aruba Central sign-up
• View-only login
• Certificate-based auth between IAP and AMP

IAP-VPN:

• Centralized-L3 mode, with DHCP relay
• GRE outside IPSec for guest DMZ

• Release Notes and SW can be downloaded here:
• Instant 4.0 Release Notes and SW
• Users Guide can be downloaded here:
• 4.0 Users Guide

Instant 4.0.0.1 (6.3.1.1-4.0.0.1) Released Dec. 2, 2013

This is a minor release with a bug fix. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

• Regulatory Domain changes. Previously domains were: -IL, -JP, -US, and –RW.  New domains are: -US and –RW.
• Wired port profile: Unable to create a wired port profile via the WebUI. Fixed in 4.0.0.1.
• Release Notes and SW can be downloaded here:
• Instant 4.0.0.1 Release Notes and SW

Instant 4.0.0.2 (6.3.1.1-4.0.0.2) Released Jan. 2, 2014

This is a minor release with three enhancements and several bug fixes. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Enhancements:

• Support for automatic negotiation support for authentication between IAP and AirWave.
• PPoE Configuration – can configure up to 80 characters for username, service name, password, and the secret key for CHAP auth.
• Support for VPN tunnel states and statistics reporting from IAP

Bug Fixes:

• ARM – radios were continuously resetting in the presence of certain interfering devices.
• Firewall – When Drop Bad Arp was enabled clients could not connect to the network.
• IDS – A syslog message was not getting generated when a Rogue AP was detected.
• SNMP- ColdStart and WarmStart traps were not being generated.
• Uplink Mgmt – Unable to configure the uplink Vlan through the CLI
• VPN cfg – DHCP packets were dropped resulting in the VPN tunnel dropping.
• WLAN cfg – IAP-93 broadcasting SSID in the wrong band.

• Release Notes and SW can be downloaded here:
• Instant 4.0.0.2 Release Notes and SW

Instant 4.0.0.3 (6.3.1.1-4.0.0.3) Released Jan. 20, 2014

This is a minor release with two enhancements and several bug fixes. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Enhancements:

• Change in the Timeout Duration for an Inactive User
• IAP-VPN Scalability Enhancements

Bug Fixes:

• Authentication –  Allowed invalid certificates to be uploaded without error.

                                 -- The .pem cert was not displayed in the output of "show cert all"

• Firewall – DSCP mapping value of the client was not copied to the outer header.

                      -- When the 0.0.0.0 routhing profile was defined the SA was translated incorrectly.

• AP Config – Master IAP did not apply sys location config to slave IAPs joining the cluster.
• WiFi Driver- Latency

• Release Notes and SW can be downloaded here:

• Instant 4.0.0.3 Release Notes and SW

Instant 4.0.0.4 (6.3.1.2-4.0.0.4) Released Feb. 24, 2014

This is a minor release with one enhancement and several bug fixes. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Enhancements:

• IAP-225 now supports up to 128 ACLs for an SSID or wired profile through the CLI.
•  

Bug Fixes:

• Access Points – two AP crash related issues.
• Aruba Central – Fixed issue where an IAP-175 could not connect to Central.
• Auth – erroneous error msg displayed “Authentication Server is Down”.
• Firewall- “show datapath user” displayed incorrect user details.
• L2TPv3 – multiple connectivity related issues
• RTLS – Communication issue to RTLS server.
• Security –medium level vulnerabilities found in cipher suite.
• STM – Some clients not able to associate to IAP-225 with Client-Match and background Spectrum monitoring enabled.
• Virtual Controller – IAP-225 rebooted due to VC transition from one IAP to another.

• Release Notes and SW can be downloaded here:
• Instant 4.0.0.4 Release Notes and SW

 Enhancements:

• Configurable Port for Communication between IAP and AirWave Management Platform.
• Command Outputs generated from the Support Window in a Single Page
• GUI Enhancements for Air Monitor Configuration 

Bug Fixes:

• AirGroup – random connectivity issues to connected AppleTV’s
• AirWave – (1) An IAP stopped communicating with AirWave and was marked as Down in the AirWaveUI, although the IAP functioned locally. (2) When the Airwave IP address, shared key, and organization configuration details were applied to an IAP from the AirWave management system, the AirWave IP details were not displayed in the CLI.
• AP Platform – (1) The Bandwidth graphs did not display any data due to the AP clock corruption. (2) The IAP-22x devices kept sending multicast traffic even though no wireless client was connected to the IAP.
• Authentication - Some Apple devices could not authenticate
• Captive Portal - The HTTP 408 error was displayed when the users tried to connect to the external captive portal through Port 80.
• Datapath - An IAP rebooted randomly when the CLI process opened too many files.
• IAP Provisioning - The system log of an IAP displayed the error message, APAS provision failed, code: failprov-no-rule….
• Instant UI - The Continue login link in the Login page was not correctly displayed when the Instant UI was launched from an unsupported browser
• SNMP- When an SNMP GET operation was performed for the aiClientUptime object (OID-1.3.6.1.4.1.14823.2.3.3.1.2.4.1.16), no output was received.
• Vlan Configuration - The allowed VLAN configuration settings on Virtual Controller were not replicated on slave IAPs in a cluster.
• WiFi Driver - GE Dash devices were not able to access devices on the network when connected an IAP on a WPA-PSK-TKIP SSID

• Release Notes and SW can be downloaded here:
• Instant 4.0.0.5 Release Notes and SW

Instant 4.0.0.6 (6.3.1.4-4.0.0.6) Released June 9, 2014

This is a minor release with one enhancement and several bug fixes. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Enhancements:

• Support for Fully Qualified Domain Name (FQDN) Lookup.

Bug Fixes:

• Management  – IAP-105 was unable to come up on Aruba Central without a valid NTP configuration
• Authentication – When the RADIUS server was down clients were prompted multiple times.
• General – Executing clear-cert server command did not delete the uploaded server cert.
• Palo Alto Server – When connecting via 802.1x the MAC address of the client was displayed rather than the username.
• STM – DHCP timeout alerts were generated even after an IP address was delivered to the client.
• User Interface – Users were unable to rename an IAP from the GUI.
• WiFi Driver –Clients were unable to receive ARP broadcast from the IAP.

• Release Notes and SW can be downloaded here

Instant 4.1.0.0 (6.4.0.2-4.1.0.0) Released June 10, 2014

This is a Major release with many new and exciting features!  The release highlights are below.  Be sure to download a copy of the Release Notes for complete details and the 4.1 Users Guide for a complete description of each feature.

• AppRF:

AppRF on Instant comprises two components - On-board DPI (on newer AP platforms) and cloud-based web policy enforcement (on all AP platforms except the IAP-9x).DPI identifies individual, well-known applications (list of ~1500, same as AOS) and allows network administrators to enforce a variety of policy actions on a per-user, per-application basis. DPI is supported on IAPs 103, 114/115, 224/225, 274/275. On supported platforms, DPI is part of InstantOS and requires no add-ons. 

For Web-enforcement, InstantOS leverages Webroot’s Brightcloud database - a cloud-hosted database which inspects millions of websites in real-time and classifies them by functional category and reputation. 

Using this information InstantOS can again enforce a variety of policy actions.

Unlike other vendors who offer one or the other, combining both engines into a single enforcement engines allows networks to have a simple, flexible framework that combine applications, functional categories and security. 

And AppRF on Instant continues to have the advantages of the distributed-forwarding, virtual-controller architecture in terms of survivability and scaling.

NOTE: The Web Enforcement component requires a per-AP, annual subscription to the cloud service. The Web-Enforcement subscription can obviate the need for a dedicated Web / URL filtering engine for the deployment. Details of the SKUs (Aruba product & updated June price-list), purchasing and enforcement will be provided soon. 

• Platforms:

Instant 4.1 will support new AP models - the IAP-103, IAP-274 and IAP-275.

IAP-92/93 is NOT SUPPORTED in Instant 4.1.0.0. IAP-92/93 will be supported in Instant 4.1.0.1 for the rest of the 4.1 release cycle, but with some features disabled - likely including AirGroup, SNMP, internal 802.1x, EAP Termination, WiFi uplink etc. A complete list will be included in the release documentation. IAP-92/93 customers requiring these features should stay on. Instant 4.1 is the LAST SUPPORTED RELEASE for the IAP-92/93. 

• AirGroup Enhancements:

Instant 4.1 extends the AirGroup umbrella to include DLNA and support Android / ChromeOS environments as well.

• Zones:

Instant 4.1 includes a long awaited feature of advertising specific SSIDs (say, guest SSID) only on a subset of APs in the cluster (say the lobby APs). 

• Authentication Survivability:

Instant 4.1 extends the existing authentication survivability capability for EAP-PEAP to include EAP-TLS as well. This feature will be supported with non-Aruba AAA servers also, and will be key to BYOD deployments.

…and many more features - details of which can be found in release documentation.

As always, the 4.1 release will be available on the Aruba support site for now, and will be uploaded to the cloud firmware server soon.

• Release Notes and SW can be downloaded here:
• Instant 4.1.0.0 Release Notes and SW
• Users Guide can be downloaded here:
• Instant 4.1 Users Guide

Instant 4.1.0.1 (6.4.0.3-4.1.0.1) Released July 30, 2014

This is a minor release with two enhancements and several bug fixes. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Enhancements:

• Regulatory Domain updates
•  Reintroduced IAP-9x into the 4.1.x.x code base.       Limitations do apply – check the Release Notes for details.

Bug Fixes:

• AirWave – IAP still broadcasting “Instant” SSID after receiving config from AirWave.
• Authentication – 4 Radius issues
• Captive Portal – Cluster instability after loading a custom Captive Portal logo.
• Datapath – (1) Lync voice and video not properly prioritized when using the “Classify Media” firewall option. (2) IAP-135 crash under load.
• RAPNG – IAP unable to send Syslog messages when VPN connectivity enabled.
• STM – IAP reported incorrect OS type for Blackberry Z10.
• VPN – IAP register message did not reach controller.
• Wireless – (1) Broadcast packets dropped causing loss of connectivity on IAP-225 under heavy load.    (2) IAP crash due to Watchdog timeout

• Release Notes and SW can be downloaded here:
• Instant 4.1.0.1 Release Notes and SW

Instant 4.1.0.2 (6.4.0.3-4.1.0.2) Released Sept. 4, 2014

This is a minor release with only bug fixes. Release highlights are listed below.  Check the Release Notes for a complete list of new features. 

Bug Fixes:

• AirGroup – AirGroup was unable to maintain a record of cache servers.
• Authentication – Clients were unable to connect to slave IAPs when the WPA-passphrase contained a “space”.
• ARM – (1) Voice issues when a SIP phone was connected to IAP-22x. (2) Poor 2.4Ghz performance for legacy traffic.
• DHCP – Exclude IP address range was not taking effect.
• UI – IAP user session remained connected after password was changed.
• VC Management – (1) Warning message “CLI module is running in a degraded state. Some commands will not function” when trying to connect to the CLI when the external RADIUS server was unavailable. (2) IAP-105 unable to re-join a cluster after a SW upgrade due to a specific MAC address range not being recognized.
• VPN – Motorola scanners were taking too long to join the network.

 Release Notes and SW can be downloaded here:

         Instant 4.1.0.3 Release Notes and SW

Instant 4.1.1(6.4.2.0-4.1.1.0) Released September 22, 2014

Instant v.4.1.1.0 is a major release with many new features. Release highlights are listed below.  Check the Release Notes for a complete list of new features and fixes.

Platform:

• IAP-205 / 205 (2x2:2 .11ac)
• IAP-214 / 215 (3X3:3 .11AC)

AppRF enhancements:

• Support for IAP to send AppRF data to AirWave 8.0.4.
• AppRF data aggregation in VC from individual SSIDs across all IAPs.   Previously, AppRF data was only viewed on a per-IAP basis.

ClientMatch enhancements:

• Previously, ClientMatch looked at received RSSI from client probe requests.   ClientMatch now examines received RSSI of all frames from the client providing more accurate and real-time measurement and improved steering.

Security:

• Support for separate RADIUS Authentication and Accounting servers.
• Support for MAC address delimeter and uppercase characters for all authentication types.

Management:

• Improved troubleshooting capabilities

• Release Notes and SW can be downloaded here:
• Instant 4.1.1 Release Notes and SW
• Users Guide can be downloaded here:
• 4.1.1 Users Guide

Instant 4.1.1.1 (6.4.2.0-4.1.1.1) Released November 10, 2014

Instant v.4.1.1.1 is a patch release with two minor enhancements. Release highlights are listed below.  Check the Release Notes for a complete list of new features and fixes.

 Enhancements:

• New Syslog message. When a new user is added or deleted a NOTICE message with the IP and MAC is sent.
• Age field in RSSI sent to ALE server.

Fixes:

• Authentication: (1) When using separate Authentication and Accounting servers the Accounting packets were not being sent.(2) A legacy 802.11b handheld failed to authenticate using dynamic WEP/EAP-TLS.

• Captive Portal: Did not work with custom certificates.
• Datapath / Firewall: DHCP forwarding delayed when Captive Portal and MAC Auth were enabled.
• General: (1) IAPs were rebooting stating that the System Clock was far ahead of the NTP sync result. (2) IAP-22x was unable to perform an LACP failover when Eth0 was down.
• IDS: False alerts on Rogue APs causing some clients to be flagged as a Rogue.
• SNMP: (1) SNMPv3 traps with inform enabled were not getting processed on the IAP-204/205. (2) Incorrect output was generated for ESSID with SNMP walk, get, or get-next finctions.
• STM: Clients using MAC auth and 802.1x auth went into a deny-all role when roaming with PMK cache in the cluster.
• VPN: A factory reset IAP was unable to bring up an IPSec tunnel when managed by AirWave.

• Release Notes and SW can be downloaded here:
• Instant 4.1.1.1 Release Notes and SW