Wireless Access

Hello!

I have two different AP-groups. One for the local segment, and one for a branch office. I use the same AAA-profiles and SSID profiles and everything works fine. But as soon as i try to change in the virtual AP profile for the branchoffice from forward mode tunnel to bridge it stops announcing the SSID. The radios are still up according to the AP. I must have missed something but I can't find what I have missed.

Are you using multiple VLANs in your configuration?  Is the AP connected to a switch port that would drop tagged traffic? In the new AP group you are using did you create a new virtual AP profile?

---

@discharged wrote:

Hello!

 

I have two different AP-groups. One for the local segment, and one for a branch office. I use the same AAA-profiles and SSID profiles and everything works fine. But as soon as i try to change in the virtual AP profile for the branchoffice from forward mode tunnel to bridge it stops announcing the SSID. The radios are still up according to the AP. I must have missed something but I can't find what I have missed.

---

Please make sure that you have "Control Plane Security" Enabled, with Auto Cert provisioning on your controller and it is auto-provisioning certificates for your APs.  Local Bridging requires Control Plane Security be on, unless you are provisioning those APs as RAPS.

(3600.arubanetworks.com) #show control-plane-security 

Control Plane Security Profile
------------------------------
Parameter                    Value
---------                    -----
Control Plane Security       Enabled
Auto Cert Provisioning       Enabled
Auto Cert Allow All          Enabled
Auto Cert Allowed Addresses  N/A

WARNING: You can turn on Control plane Security ON if it is off, but it will cause all of your APs to REBOOT and get a certificate (8 minutes outage for LAN-Connected APS).

(3600.arubanetworks.com) (config) #control-plane-security 
(3600.arubanetworks.com) (Control Plane Security Profile) #?
auto-cert-allow-all     When enabled, automatic certificate provisioning is 
                        allowed on all APs. When disabled, only APs whose IP 
                        addresses are in the ranges specified by 
                        auto-cert-allowed-addrs are allowed.
auto-cert-allowed-add.. Range of AP IP addresses allowed for automatic 
                        certificate provisioning. Multiple ranges may be 
                        specified.
auto-cert-prov          Enable or disable automatic provisioning of 
                        certificates on legacy APs
cpsec-enable            Enable or disable Control Plane Security
no                      Delete Command

I read your response and I just enabled it now. (it is midnight where I am). I do not have any AP at my current location but I will test it tomorrow and see if it corrected my problem.

I've had time to test it now and it works! Thanks for the help.

I'm using a Aruba 620 running on 6.1.30. I am able to connect the AP 105 in tunnel mode but as soon as I put it in bridge mode, the radio's will not come up.  The AP does get the DHCP IP address and the the DNS domain name. In the Campus WhiteList tab, I put it to use the factory certificate, but still no success.  Any other ideas?  I do have a separate AP GROUP define as bridge mode.

Type "show ap database" and see if the access point has any flags next to it, indicating why it is not up.

Also type "show log system 50" to see if it records any errors.

I finally got my AP 105 in bridge mode. It was weird.

AP GROUP (For bridge mode APs on the VAP settings)

Controller Plane Security enabled

Campus Whitelist - mac address is using factory-cert

AP Provision:

     1. Selected AP GROUP created for bridges APs

     2. Selected No for Remote AP

     3. Host Controller IP Address

     4. Insert AP NAME of access point

     5. Apply

Thanks Collin for the update.

Question:  Reading the User Guide for 6.1.x,  When configuring the VAP, Forward mode is set to bridge and the Remote-AP Operation by default is standard.  Should I set Remote-AP operation to always or persistent?  Scenerio, location of remote office coming back to the main site via a T1 which would be considered CAP in bridge mode.

---

@jescobedo wrote:

Question:  Reading the User Guide for 6.1.x,  When configuring the VAP, Forward mode is set to bridge and the Remote-AP Operation by default is standard.  Should I set Remote-AP operation to always or persistent?  Scenerio, location of remote office coming back to the main site via a T1 which would be considered CAP in bridge mode.

---

You are not configuring that AP as a RAP, so the "remote ap operation" will not come into play.

Sorry I know Im off topic. But I need to post a question about a Aruba Aruba6000-US controller. I cant seem to find anywhere in the community how to do that. Can someone point me in the right direction

Go here:  https://community.arubanetworks.com/t5/Wireless-Access/bd-p/unified-wired-wireless-access

Click on "Start a topic"