Wireless Access

RAP will not connect to controller via VPN. In "Process Logs":

Apr 3 13:04:15

isakmpd[2262]: <103061> <ERRS> |ike| 192.168.111.31:4500-> find_listening_transport: virtual transport for address X.X.X.X not found in virtual_listen_list

What could be a reason?

Did you just started experiencing this issue ? The rap was up and running already?

Make sure you have a rap pool created to allow the rap to get an IP
also make the rap has been added to the rap whitelist
And if you have a firewall in between make it's allowing Udp /4500

What type of rap are you using and AOS code ?

Early RAP was work. After i change many things in roles, policies.

Firewall is aruba 620 v 6.3.1.3. "ACL White List" include 4500 port.

#show datapath session table | include 4500

X.X.X.X 192.168.111.31 17 4500 4500 0/0 0 0 2 1/8 27 0 0 FY
192.168.111.31 X.X.X.X 17 4500 4500 0/0 0 0 0 1/8 27 0 0 FC

 

RAP-3WN

Run show crypto ipsec sa and show crypto isamkp sa

#show crypto ipsec sa

% No active IPSEC SA

 

#show crypto isakmp sa

% No active ISAKMP SA

d.makarov,

 

I would type "show audit-trail" to see what you changed.  You might be able to figure out what you changed to make it not work.

 

I am not sure that we can guess what you did to make it break.

maybe together we can verify some of important settings on my controller

We could try, but there are a number of changes that you could have made that broke it, that are independent of typical settings.  The answer is in what changes you made, since at one time it was working.

how i can test from outside that all ports on firewall (not aruba controller) for tunnel is open?

ON the commandline of the controller, type "show datapath session table | inclue 4500" while the remote AP is trying to come up.  That will tell you if traffic is trying to come in from the outside.

 

#show datapath session table | include 4500
IP1 IP2 17 49176 4500 0/0 0 0 0 1/8 1f 0 0 FC
IP2 IP1 17 4500 49176 0/0 0 0 2 1/8 1f 0 0 FY

 

It's enough to make sure that all ports are open?

 

and who know what is mean

"isakmpd[2285]: <103061> <ERRS> |ike| IP1:49176-> find_listening_transport: virtual transport for address IP2 not found in virtual_listen_list"

?

 

*IP1 - real RAP address, IP2 - controller address.