[Tutorial] Building a VPN from a IAP Cluster to a Wireless Contoller

[cdelarosa]

Hello! in this guide ill teach you how to build a VPN tunnel from your IAP Cluster to the wireless controller

Prerequisites: you need a controller on 6.2 .x version!

There are many modes in which you can build this tunnel but expecifically ill teach you how to build a vpn tunnel to the controller on local network Nated by VC

First let see the config on the IAP

Lets go to VPN option on the IAP

You select IPSEC and on the primary host you put the ip address of the controller which should have a port mapping to your controller with a public ip address with the ipsec ports

then click next

Here you add the networks that you want to reach on your  central site, the default gateway would be the public ip address of the controller.

Click finish

Now go to more again and go to DHCP Server

add a new scope with a ramdom vlan, with a network of your preference.  When you fniish click ok

Now lets go to the SSID creation

Create a new network

There you put network assigned, and you put static and put the random vlan you created before, then you can set whatever you need on the other paramehters and click finish.

We are done on the Instant APs

Now on the controller side

You need to add the mac address of the IAP on your controller like this

(Aruba3400) #local-userdb-ap add mac-address 00:11:22:33:44:55 ap-group test

Or you can add it on the gui on the remote APS whitelist

After that you need to create a vpn pool like this

(Aruba3400) # ip local pool "rapngpool" <startip> <endip>

You can do it also by gui on vpn services.

Take in mind that the range you put in there should be a routable range that exist on the controller. for example  in my case for this demostration i used this vpn range

Becauase i got a interface vlan like this

Which as you see that range is routable in my controller(not sure if you guys get my point?)

Then you need to create a IAP role like this

(Aruba3400) (config) #ip access-list session iaprole

(Aruba3400) (config-sess-iaprole)#any host <radius-server-ip> any src-nat (Aruba3400) (config-sess-iaprole)#any any any permit

(Aruba3400) (config-sess-iaprole)#!

(Aruba3400) (config) #user-role iaprole

(Aruba3400) (config-role) #session-acl iaprole

(Aruba3400) (config-role) #

(Aruba3400) (config) #aaa authentication vpn default-iap

(Aruba3400) (VPN Authentication Profile "default-iap") #server-group default

(Aruba3400) (VPN Authentication Profile "default-iap") #default-role iaprole

(Aruba3400) (VPN Authentication Profile "default-iap") #!

(Aruba3400) (config) #

Now if you got many address pools like me for many different things like this

then you will need to select the correct one on the iap role like this

You go to the iaprole on access control and look for the l2tp pool and select the correct one, in my case is vpn liek this

After this you are done!

you can check if the vpn is up by doing show iap table

And you should see your vpn up in there...

Anyways i hope this help you guys

Cheers

Carlos

[Mod note: edited title for readability]

[SethFiermonti]

This is a great overview.  I would also add that folks understand all the DHCP (L2,L3,Local) depending on your scenario.  The one in the post above is basically a local DHCP server and ALL client traffic is NAT'ed out of the virtual controller.  It really depends on the scenario.  

For L2 extension like our traditional RAPs, it would be L2,Centralized

For a L3 extension which should be used for remote teleworkers or branch offices, please review and consider L3,Distributed.  It is what I recommend almost 100% of the time.  

[cdelarosa]

thanks Seth

Ill try making a tutorial forhte L3 deployment another day

Cheers

Carlos

[pmonardo]

Can I make a suggestion that you post this to the Aruba Solution Exchange??

[rmehra]

Great guide NightShade1.  

Take a look at the solution, https://ase.arubanetworks.com/solution/name/iap_vpn/, on Solution Exchange.  This solution helps configure IAP VPN to Mobility Controller either over distributed L2 or distributed L3.  I just added a link on the solution to this thread as an additional reference point for other users.

[cdelarosa]

Excellent link thank you very much!

Cheers

Carlos

[cdelarosa]

Did you just made that tutorial? hahaha it just got like 10 mins there :)

[rmehra]

It's actually been around since August but it shows when the solution was last modified, which was just recently to add a link to this thread.  

[Colin_King]

Carlos,

I followed your turtorial, and I'm still having some issues.

I do have a unique setup that may differ from normal production environments.

Using ArubaOS 6.3.1.2

Instant 6.3.1.2-4.0.0.3

I'm trying to make this function in a test environment without the availability of public IP facing the internet.  So all IP interfaces are private.  This could add some issue itself.

I do have a router/firewall in between the IAP and the controller, on the recommendation that I could have a route to the controller in addition to the VPN tunnel.  This could cause two paths which could interfere my testing.

First issue is getting the VPN connected.  I do not see the the vpn in the "show iap table"

However, the VPN shows "up" in the Instant UI.  

I also see the IAP in the AOS Monitor tab > Clients > (two entries, one for the inner and one for the outer IP)  

Behavior seen is the VPN status on the IAP goes up and down.  The inner IP address changes each time it does this.

I can't access any of my controller VLANs that I have set up in the route section for the VPN on the IAP.

Any suggestions?

Regards,

Colin

[cdelarosa]

Hello Collin King

If you cannnot see the tunnel up on show iap table then the tunnel is not up...

Can you show me some kind of network diagram? to see what you are doing in your lab?

Cheers

Carlos