Wired Intelligent Edge

Hello,

I am a new Network Admin and I have come into a fully Aruba enviorment. Controller, Switches, APs, ClearPass, and Airwave are all installed here. However, there is no network diagram to speak of, so short of tracing out each cable, I'm not sure where everything is going. 

I know in my training with Cisco I was able to use a Show CDP neighbor command to build a network diagram, is there something similar on the Aruba Switches?

Show neighbor-devices seems to show all the APs connected, but not the stacked switches or the link between the two stacks we have. I don't believe show cdp neighbors worked for stacked switches either, because it is seen as one large switch.  Is there a way to determine which stack ports are are used between each switch and where other switches are connected between eachother?

Also, the stacked switches are all on seperate floors which is why tracing out the cable would be a challenge. 

I believe so. If I do a show lldp neighbor it shows the APs that are connected as well, but not the links between switches.  I just assumed it was on by default. 

ereader22,

To see the stack topology you can use the following commands:

(S3500) #show stacking members

Stack status: Active, Stack Id: 001a1e17b98050f9e894
Stack uptime: 61 days 6 hours 17 minutes 1 seconds
Id    Role       MAC Address        Priority  State     Model            Serial
--    ----       -----------        --------  -----     -----            ------
0  *  Primary    00:1a:1e:17:b9:80  Preset    Active    ArubaS3500-24F   BW0000044
1     Secondary  00:0b:86:6c:25:00  Preset    Active    ArubaS3500-48P   AW0000549
2     Linecard   00:0b:86:6b:7b:c0  Preset    Active    ArubaS3500-48P   AW0000446

(S3500) #show stacking topology

Member-id  Role       Mac Address          Interface  Neighbor Member-id
---------  ----       -----------          ---------  ------------------
0  *       Primary    00:1a:1e:17:b9:80    stack1/2   1
                                           stack1/3   2
1          Secondary  00:0b:86:6c:25:00    stack1/3   0
                                           stack1/2   2
2          Linecard   00:0b:86:6b:7b:c0    stack1/2   0
                                           stack1/3   1

So what this shows is that the primary switch has a stack link going from its 1/2 (3rd port on the uplink) to member 1 and a stack link going from its 1/3 (4th port on the uplink) to member 2.

Now in terms on non-stack switch to switch links, those you would see via LLDP if the profile was attached to those links. Please send over the output of "show interface-config gigabitethernet <x/y/z>" for your switch to switch links and we'll see what's going on with LLDP.

Best regards,

Madani

Show stacking members is exactly what I needed for that portion. Thank you!  Below is the output for one of the ports I know for sure is an uplink. 

#show interface-config gigabitethernet 0/1/1

gigabitethernet "0/1/1"
-----------------------
Parameter Value Config Derivation
--------- ----- -----------------
Interface MSTP Profile default default
Interface Rapid PVST Profile default default
Interface GVRP Profile N/A gigabitethernet0/1/1
Interface Tunneled Node Profile N/A gigabitethernet0/1/1
Interface VOIP Profile N/A gigabitethernet0/1/1
Interface LLDP Profile lldp-factory-initial default
Interface PoE Profile poe-factory-initial default
Interface Ethernet Link Profile default default
Interface OAM Profile N/A gigabitethernet0/1/1
Interface LACP Profile N/A gigabitethernet0/1/1
Interface QoS Profile default gigabitethernet0/1/1
Interface Policer Profile N/A gigabitethernet0/1/1
Interface AAA Profile N/A gigabitethernet0/1/1
Interface Shutdown Disabled default
Interface MTU 1514 default
Interface Ingress ACL N/A gigabitethernet0/1/1
Interface Egress ACL N/A gigabitethernet0/1/1
Interface QoS Trust Mode Disabled default
Interface Description N/A default
Interface Switching Profile Upstream-profile gigabitethernet0/1/1
Interface Security Profile uplink-port gigabitethernet0/1/1
Ingress Port Mirroring Profile N/A gigabitethernet0/1/1
Egress Port Mirroring Profile N/A gigabitethernet0/1/1
Static IGMP Multicast Router port for the VLANs 0 default
Static MLD Multicast Router port for the VLANs 0 default
Interface Trusted Mode Enabled default
HSL backup interface N/A gigabitethernet0/1/1
HSL preemption mode Off default
HSL preemption delay 100 default

EDIT:

Below are all the other uplinks we have, it looks like 1 is not "factory default", but is set to default.

gigabitethernet "2/1/0"
-----------------------
Parameter Value Config Derivation
--------- ----- -----------------
Interface MSTP Profile default N/A
Interface Rapid PVST Profile default N/A
Interface GVRP Profile N/A gigabitethernet2/1/0
Interface Tunneled Node Profile N/A gigabitethernet2/1/0
Interface VOIP Profile N/A gigabitethernet2/1/0
Interface LLDP Profile default gigabitethernet2/1/0
Interface PoE Profile default gigabitethernet2/1/0
Interface Ethernet Link Profile default N/A
Interface OAM Profile N/A gigabitethernet2/1/0
Interface LACP Profile LACP_ToController gigabitethernet2/1/0
Interface QoS Profile N/A gigabitethernet2/1/0
Interface Policer Profile N/A gigabitethernet2/1/0
Interface AAA Profile N/A gigabitethernet2/1/0
Interface Shutdown Disabled N/A
Interface MTU 1514 N/A
Interface Ingress ACL N/A gigabitethernet2/1/0
Interface Egress ACL N/A gigabitethernet2/1/0
Interface QoS Trust Mode Disabled N/A
Interface Description N/A N/A
Interface Switching Profile default N/A
Interface Security Profile N/A gigabitethernet2/1/0
Ingress Port Mirroring Profile N/A gigabitethernet2/1/0
Egress Port Mirroring Profile N/A gigabitethernet2/1/0
Static IGMP Multicast Router port for the VLANs 0 N/A
Static MLD Multicast Router port for the VLANs 0 N/A
Interface Trusted Mode Enabled N/A
HSL backup interface N/A gigabitethernet2/1/0
HSL preemption mode Off N/A
HSL preemption delay 100 N/A

gigabitethernet "2/1/1"
-----------------------
Parameter Value Config Derivation
--------- ----- -----------------
Interface MSTP Profile default default
Interface Rapid PVST Profile default default
Interface GVRP Profile N/A gigabitethernet2/1/1
Interface Tunneled Node Profile N/A gigabitethernet2/1/1
Interface VOIP Profile N/A gigabitethernet2/1/1
Interface LLDP Profile lldp-factory-initial default
Interface PoE Profile poe-factory-initial default
Interface Ethernet Link Profile default default
Interface OAM Profile N/A gigabitethernet2/1/1
Interface LACP Profile N/A gigabitethernet2/1/1
Interface QoS Profile N/A gigabitethernet2/1/1
Interface Policer Profile N/A gigabitethernet2/1/1
Interface AAA Profile N/A gigabitethernet2/1/1
Interface Shutdown Disabled default
Interface MTU 1514 default
Interface Ingress ACL N/A gigabitethernet2/1/1
Interface Egress ACL N/A gigabitethernet2/1/1
Interface QoS Trust Mode Disabled default
Interface Description N/A default
Interface Switching Profile Tower Access gigabitethernet2/1/1
Interface Security Profile dhcp-prevent gigabitethernet2/1/1
Ingress Port Mirroring Profile N/A gigabitethernet2/1/1
Egress Port Mirroring Profile N/A gigabitethernet2/1/1
Static IGMP Multicast Router port for the VLANs 0 default
Static MLD Multicast Router port for the VLANs 0 default
Interface Trusted Mode Enabled default
HSL backup interface N/A gigabitethernet2/1/1
HSL preemption mode Off default
HSL preemption delay 100 default

gigabitethernet "3/1/1"
-----------------------
Parameter Value Config Derivation
--------- ----- -----------------
Interface MSTP Profile default N/A
Interface Rapid PVST Profile default N/A
Interface GVRP Profile N/A gigabitethernet3/1/1
Interface Tunneled Node Profile N/A gigabitethernet3/1/1
Interface VOIP Profile N/A gigabitethernet3/1/1
Interface LLDP Profile default gigabitethernet3/1/1
Interface PoE Profile default gigabitethernet3/1/1
Interface Ethernet Link Profile default N/A
Interface OAM Profile N/A gigabitethernet3/1/1
Interface LACP Profile LACP_ToController gigabitethernet3/1/1
Interface QoS Profile N/A gigabitethernet3/1/1
Interface Policer Profile N/A gigabitethernet3/1/1
Interface AAA Profile N/A gigabitethernet3/1/1
Interface Shutdown Disabled N/A
Interface MTU 1514 N/A
Interface Ingress ACL N/A gigabitethernet3/1/1
Interface Egress ACL N/A gigabitethernet3/1/1
Interface QoS Trust Mode Disabled N/A
Interface Description N/A N/A
Interface Switching Profile default N/A
Interface Security Profile N/A gigabitethernet3/1/1
Ingress Port Mirroring Profile N/A gigabitethernet3/1/1
Egress Port Mirroring Profile N/A gigabitethernet3/1/1
Static IGMP Multicast Router port for the VLANs 0 N/A
Static MLD Multicast Router port for the VLANs 0 N/A
Interface Trusted Mode Enabled N/A
HSL backup interface N/A gigabitethernet3/1/1
HSL preemption mode Off N/A
HSL preemption delay 100 N/A

Alright, so this side of the switch has an LLDP profle:

Interface LLDP Profile lldp-factory-initial default

And its the factory default so unless someone changed the settings, it whould be sending and receiving LLDP. You can check this by using 'show interface-profile lldp-profile lldp-factory-initial'.

Now the question is how is the upstream switch configured. If it doesn't have LLDP enabled on its end, you obviously won't see it. Since you're buidling the network diagram, can you at least log into all your switches and verify that the above is configured?

Best regards,

Madani

***** Edited the show command I mentioned.

I edited my above reply to add in the output from our other switch stack. It's possible that the interface 2/1/0 is causing the issue because it doesn't claim to be factory default. 

Is there any issues I should be aware of by running factory default lldp? I'm not sure why it would be changed on just the 1 single port. 

Yes, there is quite a difference between the two, the default has LLDP disabled.

(S1500-1) #show interface-profile lldp-profile lldp-factory-initial

LLDP Profile "lldp-factory-initial"
-----------------------------------
Parameter                               Value
---------                               -----
LLDP pdu transmit                       Enabled
LLDP protocol receive processing        Enabled
LLDP transmit interval (Secs)           30
LLDP transmit hold multiplier           4
LLDP fast transmit interval (Secs)      1
LLDP fast transmit counter              4
LLDP-MED protocol                       Enabled
Control proprietary neighbor discovery  Disabled

(S1500-1) #show interface-profile lldp-profile default

LLDP Profile "default"
----------------------
Parameter                               Value
---------                               -----
LLDP pdu transmit                       Disabled
LLDP protocol receive processing        Disabled
LLDP transmit interval (Secs)           30
LLDP transmit hold multiplier           4
LLDP fast transmit interval (Secs)      1
LLDP fast transmit counter              4
LLDP-MED protocol                       Disabled
Control proprietary neighbor discovery  Disabled

So on the uplinks that have the default lldp-profile, apply the lldp-factory-initial.

So I configured the port with the lldp factory default profile, it still doesn't appear to show the connected switch stack, though I can be almost certain that it's connected to that port. The issue I think now has to do with the Config Derivation, it's set to N/A. I'm not familiar with how to set that. I used this command to set the profile. 

(config)# interface gigabitethernet  2/1/0

lldp-profile lldp-factory-initial

This is what the interface config currently displays. 

gigabitethernet "2/1/0"
-----------------------
Parameter Value Config Derivation
--------- ----- -----------------
Interface MSTP Profile default N/A
Interface Rapid PVST Profile default N/A
Interface GVRP Profile N/A gigabitethernet2/1/0
Interface Tunneled Node Profile N/A gigabitethernet2/1/0
Interface VOIP Profile N/A gigabitethernet2/1/0
Interface LLDP Profile lldp-factory-initial N/A
Interface PoE Profile default gigabitethernet2/1/0
Interface Ethernet Link Profile default N/A
Interface OAM Profile N/A gigabitethernet2/1/0
Interface LACP Profile LACP_ToController gigabitethernet2/1/0
Interface QoS Profile N/A gigabitethernet2/1/0
Interface Policer Profile N/A gigabitethernet2/1/0
Interface AAA Profile N/A gigabitethernet2/1/0
Interface Shutdown Disabled N/A
Interface MTU 1514 N/A
Interface Ingress ACL N/A gigabitethernet2/1/0
Interface Egress ACL N/A gigabitethernet2/1/0
Interface QoS Trust Mode Disabled N/A
Interface Description N/A N/A
Interface Switching Profile default N/A
Interface Security Profile N/A gigabitethernet2/1/0
Ingress Port Mirroring Profile N/A gigabitethernet2/1/0
Egress Port Mirroring Profile N/A gigabitethernet2/1/0
Static IGMP Multicast Router port for the VLANs 0 N/A
Static MLD Multicast Router port for the VLANs 0 N/A
Interface Trusted Mode Enabled N/A
HSL backup interface N/A gigabitethernet2/1/0
HSL preemption mode Off N/A
HSL preemption delay 100 N/A

You don't need to worry about the config derivation as it applies to which interface-group the config was derived from, since you've applied the command specifically on to the interface that takes precedence. However there are other things that are now standing out such as the fact that the switched profile is set to default. Is it possible to attach the 'show tech-support' for this switch? It will give a much better picture of the configuration.

Attached you will find a show tech-support.

This is the main switch stack in our building. We have 2 switch stacks. 

Attachment(s)

showtechsupport.txt   1.43 MB 1 version

So at least based on the profile names, I don't think 2/1/0 and 3/1/1 are connected to other switches. I think they are connected to a Mobility Controller.

!
interface gigabitethernet "2/1/0"
   lldp-profile "lldp-factory-initial"
   lacp-profile "LACP_ToController"

!
interface gigabitethernet "3/1/1"
   lacp-profile "LACP_ToController"
!

The Mobility Controllers do not currently transmit/receive LLDP so you won't see them. How many switches are supposed to be attached to this one? We might have to look at the MAC address table to find ports with large numbers of MACs to track them down.

There is really one 1 switch stack that I'm not sure where it connects in. If those two ports are controllers, then that must leave the third uplink port for the other switch stack. Does that sound reasonable to assume? 

Based on this is sounds like 2/1/1 may be the missing link? This raises the question of why didn't it show up as an lldp neighbor though. 

Based on the profile name "Tower Access" that definitely leads me to belive that this is the port for access to our other stack, our other stack is called the Tower Stack.

So I guess we have found what I needed, but still brought the question to light of why did this link not show in a show lldp neighbor? 

Can you attach the techsupport file for that other switch. Let's see how it is configured.

M.

Attached is the show tech support from the other stack. 

Thanks for taking the time to look it over.

Attachment(s)

showtechsupport2.txt   478 KB 1 version

Puzzling, the config is enabled for lldp (notice the lldp-factory-initial) on the default group. Let's check this, run this command on both stacks:

show lldp statistics

That way we can see who is and isn't sending LLDP.

M.

Here is the requested info. Sorry for the delay in my response.

This is our main stack (seems to be the issue?)

LLDP Statistics
---------------
Interface Received Unknown TLVs Malformed Transmitted
--------- -------- ------------ --------- -----------

This is the second stack 

#show lldp statistics

LLDP Statistics
---------------
Interface Received Unknown TLVs Malformed Transmitted
--------- -------- ------------ --------- -----------
GE0/0/0 283006 0 0 283043
GE0/0/1 283004 0 0 283047
GE0/0/2 283010 0 0 283043
GE0/0/3 283006 0 0 283042
GE0/0/4 282996 0 0 283049
GE0/0/5 283007 0 0 283043
GE0/0/6 283004 0 0 283048
GE0/0/7 283003 0 0 283048
GE0/0/8 283012 0 1 283044
GE0/0/9 283010 0 0 283045
GE0/0/10 0 0 0 0
GE0/0/11 283011 0 0 283043
GE0/0/12 0 0 0 0
GE0/0/13 0 0 0 0
GE0/0/14 283010 0 0 283045
GE0/0/15 0 0 0 0
GE0/0/16 0 0 0 0
GE0/0/17 0 0 0 0
GE0/0/18 0 0 0 0

LLDP Statistics
---------------
Interface Received Unknown TLVs Malformed Transmitted
--------- -------- ------------ --------- -----------
GE0/0/19 0 0 0 0
GE0/0/20 0 0 0 0
GE0/0/21 0 0 0 0
GE0/0/22 0 0 0 0
GE0/0/23 0 0 0 0
GE0/1/0 0 0 0 0
GE0/1/1 0 0 0 283065
GE1/0/0 0 0 0 283061
GE1/0/1 0 0 0 0
GE1/0/2 0 0 0 0
GE1/0/3 0 0 0 0
GE1/0/4 0 0 0 0
GE1/0/5 0 0 0 0
GE1/0/6 283003 0 0 283048
GE1/0/7 283012 0 0 283045
GE1/0/8 283010 0 0 283040
GE1/0/9 283011 0 0 283047
GE1/0/10 283007 0 0 283044
GE1/0/11 283010 0 0 283046

LLDP Statistics
---------------
Interface Received Unknown TLVs Malformed Transmitted
--------- -------- ------------ --------- -----------
GE1/0/12 283012 0 0 283045
GE1/0/13 283004 0 0 283045
GE1/0/14 283004 0 1 283046
GE1/0/15 283011 0 0 283047
GE1/0/16 283010 0 0 283043
GE1/0/17 283011 0 0 283046
GE1/0/18 281150 0 0 281183
GE1/0/19 283010 0 0 283046
GE1/0/20 283010 0 0 283043
GE1/0/21 283011 0 0 283045
GE1/0/22 283008 0 0 283045
GE1/0/23 283008 0 0 283033
GE1/1/0 0 0 0 0
GE1/1/1 0 0 0 0
GE2/0/0 0 0 0 0
GE2/0/1 0 0 0 0
GE2/0/2 0 0 0 0
GE2/0/3 0 0 0 0
GE2/0/4 0 0 0 0

LLDP Statistics
---------------
Interface Received Unknown TLVs Malformed Transmitted
--------- -------- ------------ --------- -----------
GE2/0/5 0 0 0 0
GE2/0/6 0 0 0 0
GE2/0/7 0 0 0 0
GE2/0/8 0 0 0 0
GE2/0/9 0 0 0 0
GE2/0/10 0 0 0 0
GE2/0/11 0 0 0 0
GE2/0/12 283005 0 0 283046
GE2/0/13 283005 0 0 283028
GE2/0/14 283011 0 0 283046
GE2/0/15 283010 0 0 283046
GE2/0/16 282999 0 0 283045
GE2/0/17 283012 0 0 283046
GE2/0/18 283007 0 0 283034
GE2/0/19 282996 0 0 283050
GE2/0/20 283011 0 0 283045
GE2/0/21 283012 0 0 283047
GE2/0/22 283013 0 0 283046
GE2/0/23 283012 0 1 283043

LLDP Statistics
---------------
Interface Received Unknown TLVs Malformed Transmitted
--------- -------- ------------ --------- -----------
GE2/1/0 0 0 0 0
GE2/1/1 0 0 0 0

Yeah if the main stack is not giving you any output for "show lldp statistics", something is wrong. On that chassis did you previously say that you could see at least APs in the show neighbor-devices output?

I only tried from the tower stack, which is the one that is showing output. So I'm not sure if it was working. Do you happen to have any idea what might by the cause of not having lldp data? 

Looking at the "NU-SLC-Campus" configuration again, I realized I missed something...

This is what you have in the configuration.

!

interface-profile lldp-profile "lldp-factory-initial"
!

This effectively disabled lldp. It should look like this:

!

interface-profile lldp-profile "lldp-factory-initial"
   lldp transmit
   lldp receive
   med enable

!

I should have caught that earlier, sorry about that. Add those and let me know what you see.

Yes! That made it work. Now I am seeing the results that I would expect, including the connection between the two switch stacks!

Thanks so much for your help on that. 

Hi ,

i want to configure IAP with mutiple ssid with multiple vlan.

Vlan 1 -management VLAN   192.168.1.0/24

Vlan 2 - Employee ssid    192.168.2.0/24

VLAN 3 -Employee-Mobile SSID  192.168.3.0/24

what settup i need to do in switch and  which port i can connect IAP should be in trunport or access port.

please wright the command in for aruba switch .

Regards

N.Muthu

The instant AP needs to be on a trunk port on your switch.  The "untagged" or native VLAN should be 1 and VLANs 2 and 3 should be "tagged" or trunked on your switch.  On an Aruba switch, to create a trunk, you need to create a switching profile and assign it to the interface that your access point will be on:  http://www.arubanetworks.com/techdocs/ArubaOS_73_Web_Help/Default.htm#mas_guides/vlans/Creating_and_Applying_a_3.htm

When you configure your SSID for each WLAN on the Instant AP you need to set the VLAN for Static and the Vlan number that you want your users to be on.  For example, your Employee WLAN needs to have "Client IP assignement" set to "Network Assigned",  client vlan assignment of "Static" and a VLAN Number of 2.

On an