Training, Certification & Career

Campus are part of the LAN. Remote APs are like the name says. The are on a different network and the communicate via IP Sec. Campus are on site remote are not.

• "When the network between the AP and controller is an un-trusted/non-routable network, such as the Internet, a RAP is recommended; in cases where the AP needs to connect over private links (LAN, WAN, MPLS), a CAP is recommended. The reason that CAP is not recommended over a non-routable network is because the IPSec within control plane security is in tunnel mode."

   

  As much i understand from the above paraghraph. If we have a network suppose a university WLAN and our AP's directly terminate to the controller in the same university then we will use CAP. But if AP's is installed in some university and the AP reached to the controller through some untrusted network then we use RAP. And for that we will use some tunneling method. Is i understand correct or you think i need some correction.  

RAP's look here 

CAPs look here

 

That was just a quick summary of the difference.

 

Campus APs terminate via GRE to the controller. Remote terminate via IP Sec router through an untrusted network

if the APs are being plugged into an un routable network frkm the conteoller (ie: NATTed behind a public ip at your house or at a separate location that is not on the same nerwork) use a RAP. if on the same network you can use CAP with GRE tunnle to the controller.

Raps can also be used in campus environments if your needs dictate.

 

Raps can give extra functionality such as split-tunnel mode ssids or backup or persistent ssids.

Can you explain how to make Raps used in campus environments ?

Closing this thread, because it is 4 years old.  Please open a new post.

Kudos! Just out of curiousity, what if the remote site is connected to LAN via VPN tunnel already? What would be best practice then?

The AP can work as a campus AP in that setup, but the MTU might have to be adjusted.  Unfortunately, the AP would first be able to connect to the controller to get the updated MTU, which means they would need to be at the main site, first...

What would you recommend as a proper mtu for this scenario? Would adjusting the mtu effect other sites as well?

The MTU is adjusted in the AP system profile, so you can create a new AP-Group that only has the devices at the test remote site and add a new AP system prfile that has a 1400 MTU

Thanks to All.

 

I understand too much from your posts but still i have some confusion. I am working on Aruba devices for 3G project and configure many Outdoor and Indoor AP's. What i was do, i just configure IP Address, Subnet Mask, Master Controller IP and Server IP directly on the AP. And then do little configuration from controller once my AP reached to Controller.

 

Now the confusion is what type of this configuration i do because i didn't configure any GRE or IPSec tunnel. 

 

I Attached the scenrio of our network for your information.

 

 

 

The remote AP started off as a way to get an access point across the internet to connect to a controller, and the only way to do that is with IPSEC, because it can cross a NAT boundary.  GRE cannot.  If you have your own private internal network, you will only need Campus APs, period.  An MPLS cloud is still considered a private network.  For Campus APS you do not have to configure GRE or IPSEC:  That is done automatically behind the scenes.