Wireless Access

Seeking knowledge and advice on this subject.

Scenario

RAPs (Converted IAP-105's) deployed at a remote site using Split-Tunneling, registered through Aruba's VPN to a 7005 Controller. There is a need to deploy Airgroups at the remote site so that Apple devices may Airplay to Zoom meetings (mere Airplay). It doesn't seem to work natively, even though the controllers are not blockig AirPlay and mDNS between VLANs.

Challenges and Considerations
1) Airplay mDNS is not supported at the RAP site, since when using Split-Tunneling, the WiFi network can only be assigned one VLAN (VLAN 17). That VLAN uses NAT to access the VLAN where the Airplay hosts are deployed (VLAN 5). VLAN 5 is 'known' to the controller, but not routed because that subnet only exists at the remote site.

2) We can't deviate from the Split-Tunneled deployement.

3) I'm max'd out on the number of APs (16) I can use with the 7005.

4) Setting up a standalone IAP-105 to allow mDNS access from the wired network on VLAN 5. Leave Virtual AP disabled.

5) Apple advertises no need to connect to WiFi any longer (iOS 8 or later).

6) We don't want to purchase CPPM for this single function to work, or to upgrade or add to the controller.

My Question
Is there an easier way to accomplish this, and by my suggested solution in setting up a standalone IAP105 for mDNS, but no WiFi enabled, can this work? Documentation does really address AirGroups in RAP deployments well enough to plan a deployment that will work.

Thanks!

Right, but can the end-users see Airplay advertisements through the IAP-105, but connect to airplay devices through the RAP? Or does the end-user need to connect to a Virtual AP SSID on the IAP105 to ccomplish this?

If the user can see the advertisement, they need to make sure that the actual traffic is not blocked between endpoints.

It appears the IAP-105 just needs to be on the network. The solution is working, but I'm not onsite to validate it's working as advertised or by some othe rmeans. The Virtual AP on the IAP-105 is disabled.

It appears Airplay is not working onsite with this workaround. It works if the user is on the same VLAN (wired) as the Airplay device, even though the user can see advertisements through the IAP.

So, what I have not gotten a full understanding about is, do the users need to only connect to the Airplay device through the IAP-105 that provides the mDNS adervtisements? In other words, can Airplay play at all with the RAPs onsite? Or should this just be a totally separate solution?

My next thought is to simply deploy controllers at the remote site and just eliminate the use of RAPs.

Is the VLAN with the Airplay device trunked to the IAP?

Does the Airplay device show up in the Airgroup Servers?

You need to type "show airgroup servers" on the IAP to see if the IAP even sees the Airgroup Advertisements of those devices:  http://www.arubanetworks.com/techdocs/Instant_423_WebHelp/InstantWebHelp.htm#CLI_commands/show_airgroup_cppm_entries.htm%3FTocPath%3DCLI%2520Commands%7CList%2520of%2520Commands%7C_____142

The IAP-105 can see the local Airplay devices in Airgroup, yes. The local LAN is one flat VLAN (5), but the users are assigned a different VLAN (17) by the 802.1x SSID, and routed using Split-Tunnel NAT to the local VLAN. On the 802.1x SSID, they see every Airplay in the HQ office. When wired locally, they see only the local Airplay devices. VLAN 17 is provided by the HQ Controllers, and the local Split-Tunnel RAP NATs them to the local VLAN (5), where the local Airplay devices are. There is no concept of VLAN 17 on the RAP network, since routing would prove complicated or overlapping with VLAN 17's subnet in the HQ office.

What I'm finding is, and this may need to be a note in the Aruba OS manual, Airplay is not supported with RAP used in Split-Tunnel mode with NAT. I just have not seen any documentation that supports that claim or shows how it should be configured.