Wireless Access

Trying to get a 3600 controller going with a handful of AP-135 for a conference (I'd normally just use Instant but didn't have IAPs available to me for this gig). Internet access and DHCP are being provided by an external pfSense router due to DHCP limitations imposed by the controller. 

 

VLAN 1: Management network, 172.16.0.0/24

VLAN 99: Guest network, 10.99.0.0/22

 

Currently have the 3 APs up, but I can't seem to get the SSIDs to show up. I'm sure I'm missing something trivial here, but I'm about to go bald from tearing my hair out trying to get this to work. 

 

In the web UI monitoring tab, under "WLAN" it shows "No SSIDs found". 

Under the configuration tab, under AP configuration, I'm showing the SSIDs under the Virtual AP.

 

 

#3600

Type "show profile-errors" on the commandline

(Aruba3600) #show profile-errors

 

Invalid Profiles

----------------

Profile  Error

-------  -----

 

(Aruba3600) #

Try "show ap bss-table" to see if any access points are broadcasting. Then type "show ap database"

(Aruba3600) #show ap bss-table


fm (forward mode): T-Tunnel, S-Split, D-Decrypt Tunnel, B-Bridge (s-standard, p-persistent, b-backup, a-always), n-anyspot


Aruba AP BSS Table

------------------

bss ess port ip phy type ch/EIRP/max-EIRP cur-cl ap name in-t(s) tot-t mtu acl-state acl fm

--- --- ---- -- --- ---- ---------------- ------ ------- ------- ----- --- --------- --- --


Channel followed by "*" indicates channel selected due to unsupported configured channel.

"Spectrum" followed by "^" indicates Local Spectrum Override in effect.


Num APs:0

Num Associations:0


(Aruba3600) #show ap database


AP Database

-----------

Name Group AP Type IP Address Status Flags Switch IP Standby IP

---- ----- ------- ---------- ------ ----- --------- ----------

24:de:c6:c7:e1:58 default 135 172.16.0.12 Up 34m:23s I 172.16.0.2 0.0.0.0

24:de:c6:c7:e1:8a default 135 172.16.0.11 Up 34m:24s I 172.16.0.2 0.0.0.0

24:de:c6:c7:e2:8c default 135 172.16.0.13 Up 33m:58s I 172.16.0.2 0.0.0.0


Flags: U = Unprovisioned; N = Duplicate name; G = No such group; L = Unlicensed

I = Inactive; D = Dirty or no config; E = Regulatory Domain Mismatch

X = Maintenance Mode; P = PPPoE AP; B = Built-in AP; s = LACP striping

R = Remote AP; R- = Remote AP requires Auth; C = Cellular RAP;

c = CERT-based RAP; 1 = 802.1x authenticated AP; 2 = Using IKE version 2

u = Custom-Cert RAP; S = Standby-mode AP; J = USB cert at AP

i = Indoor; o = Outdoor

M = Mesh node; Y = Mesh Recovery


Total APs:3

Do you have a virtual ap configured in the default ap group?

As near as I can tell, yes.

AP group "default"

------------------

Parameter                                Value

---------                                -----

Virtual AP                               CMForum-vap_prof

Virtual AP                               DTL_Admin-vap_prof

802.11a radio profile                    default

802.11g radio profile                    default

Ethernet interface 0 port configuration  default

Ethernet interface 1 port configuration  default

Ethernet interface 2 port configuration  shutdown

Ethernet interface 3 port configuration  shutdown

Ethernet interface 4 port configuration  shutdown

AP system profile                        default

VoIP Call Admission Control profile      default

802.11a Traffic Management profile       N/A

802.11g Traffic Management profile       N/A

Regulatory Domain profile                default

RF Optimization profile                  default

RF Event Thresholds profile              default

IDS profile                              default

Mesh Radio profile                       default

Mesh Cluster profile                     N/A

Provisioning profile                     N/A

AP authorization profile                 N/A

Can you do:

 

#show ap-group "default"

 

Then  find the SSID profile name the do:

 

#show wlan ssid-profile "your SSID profile"

 

Then post back the results please.

 

 

---------                                -----

Virtual AP                               CMForum-vap_prof

Virtual AP                               DTL_Admin-vap_prof

802.11a radio profile                    default

802.11g radio profile                    default

Ethernet interface 0 port configuration  default

Ethernet interface 1 port configuration  default

Ethernet interface 2 port configuration  shutdown

Ethernet interface 3 port configuration  shutdown

Ethernet interface 4 port configuration  shutdown

AP system profile                        default

VoIP Call Admission Control profile      default

802.11a Traffic Management profile       N/A

802.11g Traffic Management profile       N/A

Regulatory Domain profile                default

RF Optimization profile                  default

RF Event Thresholds profile              default

IDS profile                              default

Mesh Radio profile                       default

Mesh Cluster profile                     N/A

Provisioning profile                     N/A

AP authorization profile                 N/A

 

(Aruba3600) #show wlan ssid-profile "CMForum-vap_prof"

SSID Profile "CMForum-vap_prof" undefined.

(Aruba3600) #show wlan ssid-profile "CMForum-ssid_prof"

 

SSID Profile "CMForum-ssid_prof"

--------------------------------

Parameter                                         Value

---------                                         -----

SSID enable                                       Enabled

ESSID                                             CMForum

Encryption                                        opensystem

Enable Management Frame Protection                Disabled

Require Management Frame Protection               Disabled

DTIM Interval                                     1 beacon periods

802.11a Basic Rates                               6 12 24

802.11a Transmit Rates                            6 9 12 18 24 36 48 54

802.11g Basic Rates                               1 2

802.11g Transmit Rates                            1 2 5 6 9 11 12 18 24 36 48 54

Station Ageout Time                               1000 sec

Max Transmit Attempts                             8

RTS Threshold                                     2333 bytes

Short Preamble                                    Enabled

Max Associations                                  64

Wireless Multimedia (WMM)                         Disabled

Wireless Multimedia U-APSD (WMM-UAPSD) Powersave  Enabled

WMM TSPEC Min Inactivity Interval                 0 msec

Override DSCP mappings for WMM clients            Disabled

DSCP mapping for WMM voice AC (0-63)              N/A

DSCP mapping for WMM video AC (0-63)              N/A

DSCP mapping for WMM best-effort AC (0-63)        N/A

DSCP mapping for WMM background AC (0-63)         N/A

Multiple Tx Replay Counters                       Disabled

Hide SSID                                         Disabled

Deny_Broadcast Probes                             Disabled

Local Probe Request Threshold (dB)                0

Auth Request Threshold (dB)                       0

Disable Probe Retry                               Enabled

Battery Boost                                     Disabled

WEP Key 1                                         N/A

WEP Key 2                                         N/A

WEP Key 3                                         N/A

WEP Key 4                                         N/A

WEP Transmit Key Index                            1

WPA Hexkey                                        N/A

WPA Passphrase                                    N/A

Maximum Transmit Failures                         0

EDCA Parameters Station profile                   N/A

EDCA Parameters AP profile                        N/A

BC/MC Rate Optimization                           Disabled

Rate Optimization for delivering EAPOL frames     Enabled

Strict Spectralink Voice Protocol (SVP)           Disabled

High-throughput SSID Profile                      CMForum-htssid_prof

802.11g Beacon Rate                               default

802.11a Beacon Rate                               default

Video Multicast Rate Optimization                 default

Advertise QBSS Load IE                            Disabled

Advertise Location Info                           Disabled

Advertise AP Name                                 Disabled

802.11r Profile                                   N/A

Enforce user vlan for open stations               Disabled

Enable OKC                                        Enabled

Were you able to locate an SSID profile for the default group?

I was able to locate the profile, but I'm not sure how to tell if it's associated with the default group or not. in the Web UI, it seems to be. 

Apparently e-mail replies aren't posting here... 

(Aruba3600) #show ap-group default

AP group "default"
------------------
Parameter                                Value
---------                                -----
Virtual AP                               CMForum-vap_prof
Virtual AP                               DTL_Admin-vap_prof
802.11a radio profile                    default
802.11g radio profile                    default
Ethernet interface 0 port configuration  default
Ethernet interface 1 port configuration  default
Ethernet interface 2 port configuration  shutdown
Ethernet interface 3 port configuration  shutdown
Ethernet interface 4 port configuration  shutdown
AP system profile                        default
VoIP Call Admission Control profile      default
802.11a Traffic Management profile       N/A
802.11g Traffic Management profile       N/A
Regulatory Domain profile                default
RF Optimization profile                  default
RF Event Thresholds profile              default
IDS profile                              default
Mesh Radio profile                       default
Mesh Cluster profile                     N/A
Provisioning profile                     N/A
AP authorization profile                 N/A

(Aruba3600) #show wlan ssid-profile "CMForum-vap_prof"
SSID Profile "CMForum-vap_prof" undefined.

(Aruba3600) #show wlan ssid-profile "CMForum-ssid_prof"

SSID Profile "CMForum-ssid_prof"
--------------------------------
Parameter                                         Value
---------                                         -----
SSID enable                                       Enabled
ESSID                                             CMForum
Encryption                                        opensystem
Enable Management Frame Protection                Disabled
Require Management Frame Protection               Disabled
DTIM Interval                                     1 beacon periods
802.11a Basic Rates                               6 12 24
802.11a Transmit Rates                            6 9 12 18 24 36 48 54
802.11g Basic Rates                               1 2
802.11g Transmit Rates                            1 2 5 6 9 11 12 18 24 36 48 54
Station Ageout Time                               1000 sec
Max Transmit Attempts                             8
RTS Threshold                                     2333 bytes
Short Preamble                                    Enabled
Max Associations                                  64
Wireless Multimedia (WMM)                         Disabled
Wireless Multimedia U-APSD (WMM-UAPSD) Powersave  Enabled
WMM TSPEC Min Inactivity Interval                 0 msec
Override DSCP mappings for WMM clients            Disabled
DSCP mapping for WMM voice AC (0-63)              N/A
DSCP mapping for WMM video AC (0-63)              N/A
DSCP mapping for WMM best-effort AC (0-63)        N/A
DSCP mapping for WMM background AC (0-63)         N/A
Multiple Tx Replay Counters                       Disabled
Hide SSID                                         Disabled
Deny_Broadcast Probes                             Disabled
Local Probe Request Threshold (dB)                0
Auth Request Threshold (dB)                       0
Disable Probe Retry                               Enabled
Battery Boost                                     Disabled
WEP Key 1                                         N/A
WEP Key 2                                         N/A
WEP Key 3                                         N/A
WEP Key 4                                         N/A
WEP Transmit Key Index                            1
WPA Hexkey                                        N/A
WPA Passphrase                                    N/A
Maximum Transmit Failures                         0
EDCA Parameters Station profile                   N/A
EDCA Parameters AP profile                        N/A
BC/MC Rate Optimization                           Disabled
Rate Optimization for delivering EAPOL frames     Enabled
Strict Spectralink Voice Protocol (SVP)           Disabled
High-throughput SSID Profile                      CMForum-htssid_prof
802.11g Beacon Rate                               default
802.11a Beacon Rate                               default
Video Multicast Rate Optimization                 default
Advertise QBSS Load IE                            Disabled
Advertise Location Info                           Disabled
Advertise AP Name                                 Disabled
802.11r Profile                                   N/A
Enforce user vlan for open stations               Disabled
Enable OKC                                        Enabled

 

Run a: 

 

#show wlan virtual-ap CMForum-vap_prof

 

This will list the profiles you have for this this AP group.

Try "show wlan virtual-ap CMForum-vap_prof

1. (Aruba3600) #show wlan virtual-ap CMForum-vap_prof
   
   Virtual AP profile "CMForum-vap_prof"
   -------------------------------------
   Parameter                                       Value
   ---------                                       -----
   AAA Profile                                     CMForum-aaa_prof
   802.11K Profile                                 default
   Hotspot 2.0 Profile                             N/A
   SSID Profile                                    CMForum-ssid_prof
   Virtual AP enable                               Enabled
   VLAN                                            99
   Forward mode                                    bridge
   Allowed band                                    all
   Band Steering                                   Disabled
   Steering Mode                                   prefer-5ghz
   Dynamic Multicast Optimization (DMO)            Disabled
   Dynamic Multicast Optimization (DMO) Threshold  6
   Drop Broadcast and Unknown Multicast            Disabled
   Convert Broadcast ARP requests to unicast       Enabled
   Authentication Failure Blacklist Time           3600 sec
   Blacklist Time                                  3600 sec
   Deny inter user traffic                         Disabled
   Deny time range                                 N/A
   DoS Prevention                                  Disabled
   HA Discovery on-association                     Enabled
   Mobile IP                                       Enabled
   Preserve Client VLAN                            Disabled
   Remote-AP Operation                             standard
   Station Blacklisting                            Enabled
   Strict Compliance                               Disabled
   VLAN Mobility                                   Disabled
   WAN Operation mode                              always
   FDB Update on Assoc                             Disabled
   WMM Traffic Management Profile                  N/A
   Anyspot profile                                 N/A

In the virtual ap, you need to change the forwarding mode to tunnel.

Won't that require me to set up the VLAN on the controller? When I've tried doing those on the controller, it's broken the whole thing and have had to nuke config and start over. If I set up tunnel without VLAN config it doesn't have any effect on this particular problem. 

 

Why is bridge even an option if it won't work? Seems that would also cause the controller to be a bottleneck in a larger installation. 

 

 

There is no bottleneck. Very few deployments are bridge, but they are out there and they work. If you are using bridge, make the virtual ap vlan 1.

WLAN 1(Modified)

1. WLAN
APGroup: default
SSID: CMForum
2. Forwarding Mode
Tunnel
3. Radio & VLAN
Radio Type: all
VLAN: 99
4. Internal/Guest
Internal
5. Authentication and Encryption
WPA-2 Personal
6. Captive Portal
Disabled
7. Authentication Server
N/A
8. Role Assignment
Pre-authentication role: authenticated
Post-authentication role: authenticated

 

 

Virtual AP profile "CMForum-vap_prof" (Invalid: VLAN 99 does not exist)
-----------------------------------------------------------------------
Parameter                                       Value
---------                                       -----
AAA Profile                                     CMForum-aaa_prof
802.11K Profile                                 default
Hotspot 2.0 Profile                             N/A
SSID Profile                                    CMForum-ssid_prof
Virtual AP enable                               Enabled
VLAN                                            99
Forward mode                                    tunnel
Allowed band                                    all
Band Steering                                   Disabled
Steering Mode                                   prefer-5ghz
Dynamic Multicast Optimization (DMO)            Disabled
Dynamic Multicast Optimization (DMO) Threshold  6
Drop Broadcast and Unknown Multicast            Disabled
Convert Broadcast ARP requests to unicast       Enabled
Authentication Failure Blacklist Time           3600 sec
Blacklist Time                                  3600 sec
Deny inter user traffic                         Disabled
Deny time range                                 N/A
DoS Prevention                                  Disabled
HA Discovery on-association                     Enabled
Mobile IP                                       Enabled
Preserve Client VLAN                            Disabled
Remote-AP Operation                             standard
Station Blacklisting                            Enabled
Strict Compliance                               Disabled
VLAN Mobility                                   Disabled
WAN Operation mode                              always
FDB Update on Assoc                             Disabled
WMM Traffic Management Profile                  N/A
Anyspot profile                                 N/A

The PoE switch it's attached to has VLAN 1 as native and VLAN 99 tagged on all ports.

 

If you change it to tunnel, you will need a vlan 99 on your controller.

How do I go about that without completely breaking access to the unit without a serial cable? 

So, if you are trying to put user traffic on a trunk, making it bridged and putting the vlan in the virtual ap will work, because the default vlan is 1 and user traffic will be tagged. Do you have control plane security on?

I'm going to guess that control plane security is whatever the default is. Because I have no idea. 

 I seem to have gotten ports 1 and 2 set up as VLAN trunks with VLAN 1 native and VLAN 99 trunked - and the controller is responding to pings on both VLANs. This is progress, I think. 

 

But my APs still refuse to send out any SSIDs. 

I am not sure how far you got, but the reason why tunneling is easier, is you would only have to have a single trunk to the controller and the APs would tunnel all the traffic back to it, so you would not have to manage a trunk every time you connect an access point...  The access point can have any ip address and only need to have connectivity to the controller to work....

 

Bump. Any further ideas on getting the SSID assigned to the APs?

If you are still having problems, you should open a support case, because there is probably something that we cannot see that is happening.  Support would more easily get to the bottom of your problems using your logs.