Wireless Access

Seasonal Greetings!

I am fairly new to Aruba and have been stumbling around with a few issues lately.

Half of our RAPs are stuck on "upgrading" for days following a code upgrade on the 3600 controllers from ArubaOS 6.1.3.1 to 6.1.4.1

From what I understand after reading the posts here that RAPs with image version 3.x in their "provisioning/backup partition" will not connect to controllers running 6.1 code. (but I got a few  3.x RAPs connecting successfully to our controller!)

I would like to know if the following is possible:

Re-provision  the 3.x imaged RAPs (mainly RAP2s and some RAP5s) from the 6.1 controller they are currently provisioned on to another 3600 controller  with 5.x code.  Then I can update their backup partition to the 5.x code.  Then re-provision them back to the production controller running the 6.1.4 code?

I would like to do this without end user intervension (over 80 in this case) and silently (most users are on holiday), so as to minimise the disruption.  Any kind of special RAP commands that I could send from the 6.1 controller to tell these RAPs to provision to another IP address and vice versa?

Since I wasn't involved in the previous controller upgrades, I missed the bit about the RAPs "backup partition issue" in the release notes for code 6.1.4

Any suggestions on how best  to get this sorted, without much end user intrevention, would be most appreciated.

Thanks in advance

RK

If your APs worked on 6.1.3.1, they should work on 6.1.4.1.

If they had the "backup partition" issue, they would not have worked to even connect to 6.1.3.1 successfully.  That would not necessarily come into play in this upgrade.

Question:  Is there a specific reason that you are upgrading to 6.1.4.1.  It is a technology release specifically for RAP3 support.  I would backrev to 6.1.3.1 and make sure everything is working properly.  I would then try to Upgrade to 6.2.0.1 instead, which also has RAP3 support.

If your RAPs are still having an issue, please open a support case.

Thank you for the quick response

.

Yes they did work on 6.1.3.1, but are stuck at "Upgrading" after the updated to 6.1.4.1 

The affected RAPs stil have 6.1.3.1 as "running" and "production" images but their "(Provisioning/Backup)" Image Version is not just  3.3.2.11-rn-3.0.1 but also  5.0.4.4 and some even show their "Production Image" as empty!! (so my initial analysis might be wrong after all!). I saw port 21 was open to master and jumped to conclusion.

Yes it was for RAP3 support.  I needed to test the RAP3s on a pre-production controller (3200) first,  it didn't have enough memory to take 6.2 as it hung that controller. So I got 6.1.4.1 released and did all the pre-production tests which was successful so I upgraded our production units to  6.1.4  . Since 6.1.4 seemed okay I thought I will wait for the 6.2.01 to bed in a bit longer before taking the leap mid year.

I am reluctant to down graded as a few RAPs have presisted and upgraded after many may hours, one has just come up an hour ago! Would it involve these RAPs reflashing, trigging reboots en masse?

Should I just attempt to go 6.2.0.1 anyway, which I prefer?

I will log a support call also.

One question I like answer to is what command will let me know the current usage of the RAP IP address pool? I am sure this is not the case, but didn't know how to check for sure.  Also I am wondering if our firewall is restricting the upgrade process somehow, unlikely as I had successly reflashed already upgraded unit without any big delay.  Any idea how to check this on the controller end?

Kind Regards,

RK

The APs whose production image is empty might not have contacted the controller correctly or it is a cosmetic error, so do not rely on that, just yet.

3200 Controllers have an upgrade kit - 3200-MEM-UG which will allow it to run 6.2, if that is the route you want to go.

To see how many ip addresses have been consumed in your pool, type "show vpdn l2tp local pool"

I would let all of the access points upgrade and take time to reassess after all of them are up.

I would open a support case to determine what is going on, whether your firewall or the controller only allows a certain number of APs to upgrade....

Thanks again,

The RAPs IP pool looks fine and licenses also look fine.

One of the users tired resetting with a paper clip and putting the controller's external IP, but still not progressing further than "Upgrading" :-(  

I've logged it with Support, but we have to go through our partner care, who were notified earlier, the progress will be slow through them.

I shall procure the upgrade kit you mentioned as I'd like to get the pre-production unit on 6.2 as well.

Thank you for your help so far and will keep you posted on the resolution.

Many Thanks,

RK

Ravislk,

If the user reset with the paperclip, and the "backup or provisioning partition is 3.2-rn.xxxxx", it will not work with 6.x when it is reset.  They have to point it to a 5.x controller first, unfortunately :(  Support might be able to get you a 5.x controller to point them to..

SOLVED SOLVED

Hi cjoseph,

This is now solved, and funnily enough it's to do with the FTP port not being open on the profile in use for the RAP's sessions!!
I did see port 21 open from the RAP to the controller but I didn't realise that is was getting blocked at the controller.
Anyhow the Aruba Support was able to nail down the issue (with a support file) and swiftly followed with a Gotomeeting and everything was sorted in just a few minutes!

For anyone else in the same boat; here is the summary of the change made:
!
ip access-list session control
user any udp 68 deny
any any svc-ftp permit
any any svc-icmp permit
any any svc-dns permit
any any svc-papi permit
any any svc-cfgm-tcp permit
any any svc-adp permit
any any svc-tftp permit
any any svc-dhcp permit
any any svc-natt permit
any any svc-sec-papi permit
!
The support engineer used the webui to add :

any any svc-ftp permit

then used the UP arrow button to place it as the second entry from the top.

All the RAPs stuck on "Upgrading" quickly changed to "Up"

Finally; after all the whole weekend trying to fix this, I am so relieved, a bit tired, but very happy with the outcome.

Thanks for your help suggesting I contact support, also good to know there could be a way to upgrade older RAPs which we seem to have quite a few in the wild!

Happy New Year!

RK

Awesome!  that is how it is supposed to work.

Happy New Year to you as well!

I had a similar issue upgrading to 6.1.3.6 controller image on a 3400.

The line "any any svc-ftp permit" was not in my session control access list either. I added it and the RAPs came up in a matter of moments.

Thank you for posting this answer.