Network Management

Hi.

I installed an AMP server to manage two IAP cluster. I configured the first VC with SNMP community and Airwave options. It appeared at airwave and then I moved to the correct folder and group.

The APs are showing 'Good', but the VC is showing 'Mismatched'.

I tried:

- Remove and insert again

- Fetch the VC template from the VC 

- Delete the VC template

- Move the VC to a different group of the IAPs.

None had worked.

Someone knows how to fix this?

AMP Version: 8.2.8.1

Could we click on the mismatch and check what exactly is the mismatched config?

Hi, see below the output:

allow-new-aps
ams-ip xxx.xx.10.24
ams-key XXXXXXXXXX
auth-failure-blacklist-time 3600
auth-survivability cache-time-out 24
blacklist-time 3600
clock summer-time BRAD recurring first sunday november 00:00 last sunday february 00:00
clock timezone Brasilia -03 00
Actual cp-cert-checksum 5c1ac28bde8ff4e904c39dabae240044
dpi
dynamic-radius-proxy
dynamic-tacacs-proxy
enet-vlan 80
enet0-port-profile default_wired_port_profile
extended-ssid
hash-mgmt-password
hash-mgmt-user admin password XXXXXXXXXX 350a450c0298281a590809ebe8037f3d04fe15389183505930ae8c1b7b06b0c499a79b3fce
ip-mode v4-prefer
name "Aruba01"
ntp-server 200.160.7.186
organization "mycompany:IAPs"
report-rssi-to-central unassociated-and-associated-clients
rf-band all
snmp-server community XXXXXXXXXX
snmp-server community XXXXXXXXXX
syslog-level warn ap-debug
syslog-level warn network
syslog-level warn security
syslog-level warn system
syslog-level warn user
syslog-level warn user-debug
syslog-level warn wireless
terminal-access
time-range Expediente periodic monday 08:00 to friday 19:00
virtual-controller-country BR
virtual-controller-ip xxx.xx.80.99
virtual-controller-key XXXXXXXXXX

wlan access-rule Guest"
rule any any match any any any permit

wlan access-rule "default_wired_port_profile"
rule any any match any any any permit

wlan access-rule "guest"
rule any any match any any any permit

wlan access-rule "guest-login"
captive-portal external profile Clearpass
rule any any match udp 53 53 permit
rule any any match udp 67 68 permit
rule any any match udp 67 69 permit
rule xxx.xx.80.63 255.255.255.255 match tcp 80 80 permit
rule xxx.xx.80.63 255.255.255.255 match tcp 443 443 permit
rule any any match any any any deny

airgroup
disable

airgroupservice "DLNA Media"
disable

airgroupservice "DLNA Print"
disable

airgroupservice AmazonTV
disable

airgroupservice DIAL
disable

airgroupservice airplay
description AirPlay
disable

airgroupservice airprint
description AirPrint
disable

airgroupservice allowall
disable

airgroupservice chat
disable

airgroupservice googlecast
disable

airgroupservice itunes
disable

airgroupservice remotemgmt
disable

airgroupservice sharing
disable

arm
80mhz-support
air-time-fairness-mode default-access
band-steering-mode prefer-5ghz
client-aware
max-tx-power 127
min-tx-power 18
scanning
wide-bands 5ghz

wlan auth-server AS1_#guest#_
acctport 1813
ip nae1.cloudguest.central.arubanetworks.com
nas-id c244a1ab-48e1-4970-a8fe-a87e4e3d9943
port 1812
radsec
rfc3576
timeout 20

wlan auth-server AS2_#guest#_
acctport 1813
ip nae1-elb.cloudguest.central.arubanetworks.com
nas-id c244a1ab-48e1-4970-a8fe-a87e4e3d9943
port 1812
radsec port 443
rfc3576
timeout 20

wlan auth-server ClearPass
acctport 1813
cppm-rfc3576-port 5999
ip xxx.xx.80.63
key XXXXXXXXXX
nas-id xxx.xx.80.99
nas-ip xx.xx.80.99
port 1812
rfc3576
rfc5997
service-type-framed-user 1x
service-type-framed-user cp
service-type-framed-user mac

wlan captive-portal
background-color 16777215
banner-color 15329769
banner-text "57;65;6c;63;6f;6d;65;20;74;6f;20;47;75;65;73;74;20;4e;65;74;77;6f;72;6b;"
decoded-texts "banner/terms/policy"
terms-of-use "54;68;69;73;20;6e;65;74;77;6f;72;6b;20;69;73;20;6e;6f;74;20;73;65;63;75;72;65;20;61;6e;64;20;75;73;65;20;69;74;20;61;74;20;79;6f;75;72;20;6f;77;6e;20;72;69;73;6b;2e;"
use-policy "50;6c;65;61;73;65;20;72;65;61;64;20;61;6e;64;20;61;63;63;65;70;74;20;74;65;72;6d;73;20;61;6e;64;20;63;6f;6e;64;69;74;69;6f;6e;73;20;61;6e;64;20;74;68;65;6e;20;6c;6f;67;69;6e;2e;"

clarity
inline-auth-stats
inline-dhcp-stats
inline-dns-stats
inline-sta-stats

wlan external-captive-portal
auth-text "Authenticated"
auto-whitelist-disable
https
port 80
server "localhost"
url "/"

wlan external-captive-portal Clearpass
auth-text ""
auto-whitelist-disable
https
port 443
server "XXX.XX.80.63"
url "/guest/guest.php"

ids
wireless-containment none

uplink
enforce none
failover-internet-pkt-lost-cnt 10
failover-internet-pkt-send-freq 30
failover-vpn-timeout 180
preemption

wired-port-profile default_wired_port_profile
access-rule-name default_wired_port_profile
allowed-vlan all
captive-portal disable
no dot1x
duplex full
native-vlan 1
no poe
shutdown
speed auto
switchport-mode trunk
type employee

wlan ssid-profile Guest"
auth-server InternalServer
broadcast-filter arp
captive-portal disable
dmo-channel-utilization-threshold 90
dtim-period 1
enable
essid Guest"
local-probe-req-thresh 0
max-authentication-failures 0
max-clients-threshold 64
opmode wpa2-psk-aes
rf-band all
time-range Expediente enable
type employee
vlan 900
wpa-passphrase XXXXXXXXXX

I dont see any actual or desired showing up in the output. What is the version of the device?
Also, could you try an import setting from device manage page on Airwave?

The IAP cluster is with the version 6.5.4.8

AMP is 8.2.8.1

I tried to import in Groups -> List -> My_IAP_Group -> Templates -> Aruba Instant Virtual Controler -> pencil(edit) -> Template Select -> Fetch Template from device -> Fetch -> save -> Save and Apply -> Apply Changes Now

Its changes the status to 'Verifying' and after some minutes shows again 'Mismatched'

Not the template fetch. Go to VC manage page on Airwave and you will see import setting towards the end of the page. You can hit on that. If it is still showing mismatch it would be good to open a TAC case as you might have to put it in manage mode once to sync and back to monitor(i will suggest doing it along with TAC after verifying config).

Not worked... but thank you. I will open a TAC case. Ty.