Wireless Access

last person joined: 13 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

Branch setup

This thread has been viewed 5 times

  • 1.  Branch setup

    Posted Apr 01, 2020 07:17 PM

    I'm manually setting up a 7005 branch controller in 8.5 to a 7010 VPNC. I have a tunnel between the MM and the VPNC, and tunnel between the VPNC and the branch controller. But the MM show the branch as down.  I added the branch to the Controllers list and the branch has the MM IP. Any clues as to where I should look next? Thanks for any help.



  • 2.  RE: Branch setup

    Posted Apr 01, 2020 08:14 PM
    Try the following :

    Under the MM add the Branch Controller :

    local-peer-mac "branch device mac" ipsec


    Under the /md/VPNC add the Branch Controller :

    vpn-peer peer-mac "branch device mac" cert-auth factory-cert


  • 3.  RE: Branch setup

    Posted Apr 02, 2020 12:01 PM

    Thanks for the suggestion but there is no change. The branch gets an IP from the VPNC.  I see ipsec tunnels to /mm and branch from the VPNC. The branch logs show

    Apr 2 09:02:01 :103103:  <3316> <WARN> |ike|   IKE SA Deletion: IKE2_delSa peer:<IP>:4500 id:2592555168 errcode:ERR_IKESA_EXPIRED saflags:0x41000005 arflags:0x20

    Thanks!



  • 4.  RE: Branch setup

    Posted Apr 02, 2020 12:23 PM
    How are you pointing the Branch controller to the VPNC?

    Do you have a firewall between the VPNC and Branch controller ? if so are you allowing UDP/4500 ?




    Sent from Mail for Windows 10


  • 5.  RE: Branch setup

    Posted Apr 02, 2020 01:23 PM

    There is no firewall. In the initial setup I listed the VPNC IP. The output of 'show conf effective' show the vpn-ip as the VPNC IP.  Show ip route list the VPNC IP as an ipsec map management-vpnc. Show datapath session shows limited traffic between the branch and VPNC but keeps resetting. Thanks!



  • 6.  RE: Branch setup

    Posted Apr 02, 2020 02:53 PM
    Do you have something similar to this on the Branch MC :

    masterip “MM IP” vpn-ip "VPNC Public IP/VRRP IP NAT if using two VPNCs” ipsec-factory-cert vpn-mac-1 "VPNC1 mac address” vpn-mac-2 "VPNC2 mac address” interface vlan “mgmt VLAN”



    Sent from Mail for Windows 10


  • 7.  RE: Branch setup

    Posted Apr 02, 2020 04:01 PM

    Yes, very similar. I'm using public IP addresses to try to keep it simple. I only have a single VPNC. Default gw is on the same subnet. The vpn-mac-1 that I have doesn't match the VPNC mac. I'm not sure where it came from -- possibly another branch controller I had been working with. Not sure how to change that line. Thanks.



  • 8.  RE: Branch setup

    Posted Apr 02, 2020 06:34 PM

    Sorry, I misread the mac address above. It is the correct mac address of the VPNC controller.



  • 9.  RE: Branch setup
    Best Answer

    Posted Apr 16, 2020 03:26 PM

    I got this working with Aruba TAC's help. Needed to use Mgmt mac address for MM and backup MM when running VPNC setup script. -- Jim