Wireless Access

Reply
Highlighted
New Contributor

RAP Zero Touch Provisioning

I am trying to set up zero touch provisioning for RAPs using FreeRADIUS.  I know it is possible using CPPM, but am trying to understand the bits required to get it working with a generic RADIUS product instead. I found this link, but it only discusses CPPM.

 

We plan on updating Activate by assigning the RAP a folder with a provisioning rule setting the controller's IP address.  Additionally, we will need to add an entry to our RADIUS server's database giving the RAP's MAC address, a hostname and AP group.  (This would normally be done by setting up the context server config on CPPM to update its endpoint db via activate).

 

We have a basic RADIUS authentication working with FreeRADIUS, but it does not send back the AP's name or group, only an ACCEPT allowing the RAP to authenticate to the controller.  Our staff must manually provision those details on the controller during initial deployment.

 

The part I need confirmation on is what the RADIUS server needs for the device and what/how to send it back to the controller.  I believe that the RADIUS server will just need the VSAs "Aruba-Location-Id" (AP Name) and "Aruba-AP-Group" (AP Group), and it would include those in the ACCEPT response back to the controller.

 

Has anyone had experience with this, or has any knowledge on what CPPM sends back to the controller to successfully authenticate the RAP?

 

 

MVP Guru

Re: RAP Zero Touch Provisioning

I just checked on a ClearPass, and these are the attributes returned on a RAP whitelist RADIUS request:

Radius:Aruba:Aruba-AP-Group default
Radius:Aruba:Aruba-Location-Id enter-AP-name-here

Do you have an Aruba VSA dictionary? If not, these are the two used VSAs:

Aruba VSA vendor: 14823

Attribute Aruba-AP-Group Attribute-id: 10 Type: String

Attribute Aruba-Location-Id Attribute-id: 6 Type: String

 

Does this help you to get started?

--
If you have urgent issues, please contact your Aruba partner or Aruba TAC (click for contact details).
New Contributor

Re: RAP Zero Touch Provisioning

Great, that's what I was hoping for, Thanks.  I will give it a go.

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: