Wireless Access

I have a lab set up:

virtual MM and VMC running 8.2.2.2,

iAP205 running 6.4.2.8

I want to convert the iAP to CAP and connect it to the VMC - which seems to be supported.

The iAP convert-to-CAP steps appeared to go well, the iAP checks in to the VMC and I see it in the MM GUI, but it comes up in the default AP-Group rather than the "lab" group I have provisioned it to use. Then after 3 minutes it reboots.

On the console for the iAP I see the iAP boot to 6.4.2.8, remember it is supposed to look to the VMC as master and go there to download 8.2.2.2, then come up apparently fine and reboot a few minutes later - repeat.

I'm sure it's a simple thing for folks already versed in 8.x but this is my first jaunt.

--Matthew

Here's the console output for one complete cycle if anyone is curious:

APBoot 1.5.3.14 (build 45815)
Built: 2014-09-05 at 11:23:04

Model: AP-20x
CPU:   BCM53011/15, revision A0
I2C:   ready
SKU:   2
OTP:   0xeca01028
Clock:
       CPU:  800 MHz
       DDR:  533 MHz
       AXI:  400 MHz
       APB:  200 MHz
       PER:  400 MHz
DRAM:  128 MB
POST1: memory passed
SF:    Detected MX25L25635E with page size  4 kB, total 32 MB
Flash: 32 MB
PCIe0: RC, link up
       dev fn venID devID class  rev    MBAR0    MBAR1    MBAR2    MBAR3
       00  00  14e4  4360 00002   03 08000004 00000000 00000000 00000000
PCIe1: RC, link up
       dev fn venID devID class  rev    MBAR0    MBAR1    MBAR2    MBAR3
       00  00  14e4  4360 00002   03 40000004 00000000 00000000 00000000
Power: POE
Net:   eth0
Radio: bcm43460#0, bcm43460#1

Hit <Enter> to stop autoboot:  0
Booting OS partition 0
Checking image @ 0x1e100000
Copying image from 0x1e100000

Image is signed; verifying checksum... passed
Signer Cert OK
Policy Cert OK
RSA signature verified.
Uncompressing... done
[    0.000000]
[    0.000000] Aruba Networks
[    0.000000] ArubaOS Version 6.4.2.8 (build 50314 / label #50314)
[    0.000000] Built by p4build@formentera.arubanetworks.com on 2015-06-03 at 11:15:26 PDT (gcc version 4.7.2)
[    0.000000]
[    0.000000] Flash variant: variant0
[    0.000000] MPCORE found at 19020000, SCTLR 0x10c53c7f ACTLR 0x00000040 CPSR 0x600001d3 SPSR 0x60000013 PRRR 0x000a81a8 NMRR 0x40e040e0
[    0.000000] Memory: 128MB = 128MB total
[    0.000000] Memory: 120976k/120976k available, 10096k reserved, 0K highmem
[    0.052000] hw perfevents: enabled with ARMv7 Cortex-A9 PMU driver, 7 counters available
[    3.388000] PMU: registered new PMU device of type 0
[    3.894000] pci 0001:00:00.0: BAR 8: assigned [mem 0x08000000-0x080fffff]
[    3.896000] pci 0001:01:00.0: BAR 0: assigned [mem 0x08000000-0x08007fff 64bit]
[    3.898000] pci 0001:01:00.0: BAR 0: set to [mem 0x08000000-0x08007fff 64bit] (PCI address [0x8000000-0x8007fff]
[    4.402000] pci 0002:00:00.0: BAR 8: assigned [mem 0x40000000-0x400fffff]
[    4.404000] pci 0002:02:00.0: BAR 0: assigned [mem 0x40000000-0x40007fff 64bit]
[    4.406000] pci 0002:02:00.0: BAR 0: set to [mem 0x40000000-0x40007fff 64bit] (PCI address [0x40000000-0x40007fff]
[    4.750000] i2c-springbank: using remapped base c9d86060
[    4.754000] mpcore_wdt mpcore_wdt: enabling watchdog.
[    4.758000] qspi_iproc qspi_iproc.1: 1-lane output, 3-byte address
[    4.760000] m25p80 spi1.0: mx25l25635e (32768 Kbytes)
[    4.762000] Creating 1 MTD partitions on "spi1.0":
[    4.764000] 0x000000000000-0x000002000000 : "qspi"
[    4.768000]
[    4.768000] Starting Kernel SHA1 KAT ...Completed Kernel SHA1 KAT
[    4.772000] Starting Kernel HMAC-SHA1 KAT ...Completed Kernel HMAC-SHA1 KAT
[    4.784000] Starting Kernel DES KAT ...Completed Kernel DES KAT
[    4.788000] Starting Kernel AES KAT ...Completed Kernel AES KAT
[    4.790000]
Domain Name: arubanetworks.com
No panic info available
[    6.268000] AP xml model 81, num_radios 2 (jiffies 3134)
[    6.270000] init_asap_mod: installation:0
[    6.272000] radio 0: band 1 ant 0 max_ssid 16
[    6.274000] radio 1: band 0 ant 0 max_ssid 16
Starting watchdog process...
Getting an IP address...
[    8.668000] ADDRCONF(NETDEV_UP): bond0: link is not ready
[   10.672000] bond0: link up (100FD)
[   10.674000] ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
10.20.191.41 255.255.255.192 10.20.191.1
Running ADP...Done. Master is 10.0.40.44
[   64.712000] wifi0: AP type AP-205, radio 0, max_bssids 16
[   64.756000] wifi1: AP type AP-205, radio 1, max_bssids 16
AP rebooted Wed Dec 31 16:03:11 PST 1969; SAPD: Reboot after successful image upgrade
shutting down watchdog process (nanny will restart it)...

        <<<<<       Welcome to the Access Point     >>>>>

The system is going down NOW !!
Sending SIGTERM to all processes.
Please stand by while rebooting the system.
[  252.120000] Restarting system.


APBoot 1.5.3.14 (build 45815)
Built: 2014-09-05 at 11:23:04

Model: AP-20x
CPU:   BCM53011/15, revision A0
I2C:   ready
SKU:   2
OTP:   0xeca01028
Clock:
       CPU:  800 MHz
       DDR:  533 MHz
       AXI:  400 MHz
       APB:  200 MHz
       PER:  400 MHz
DRAM:  128 MB
POST1: memory passed
SF:    Detected MX25L25635E with page size  4 kB, total 32 MB
Flash: 32 MB
PCIe0: RC, link up
       dev fn venID devID class  rev    MBAR0    MBAR1    MBAR2    MBAR3
       00  00  14e4  4360 00002   03 08000004 00000000 00000000 00000000
PCIe1: RC, link up
       dev fn venID devID class  rev    MBAR0    MBAR1    MBAR2    MBAR3
       00  00  14e4  4360 00002   03 40000004 00000000 00000000 00000000
Power: POE
Net:   eth0
Radio: bcm43460#0, bcm43460#1

Hit <Enter> to stop autoboot:  0
Booting OS partition 0
Checking image @ 0x1e100000
Copying image from 0x1e100000

Image is signed; verifying checksum... passed
Signer Cert OK
Policy Cert OK
RSA signature verified.
Uncompressing... done
[    0.000000]
[    0.000000] Aruba Networks
[    0.000000] ArubaOS Version 8.2.2.2 (build 67597 / label #67597)
[    0.000000] Built by p4build@pr-hpn-build05 on 2018-11-02 at 10:02:28 UTC (gcc version 4.7.2)
[    0.000000]
[    0.000000] Flash variant: variant0
[    0.000000] MPCORE found at 19020000, SCTLR 0x10c53c7f ACTLR 0x00000040 CPSR 0x600001d3 SPSR 0x60000013 PRRR 0x000a81a8 NMRR 0x40e040e0
[    0.000000] Memory: 128MB = 128MB total
[    0.000000] Memory: 116348k/116348k available, 14724k reserved, 0K highmem
[    0.000000] External imprecise Data abort at addr=0x0, fsr=0x406 ignored.
[    0.000000] MPCORE Global Timer Clock 400000000Hz
[    0.046000] L310: cache controller enabled 16 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x7a130800
[    0.052000] CCA UART Clock Config: Sel=1 Ovr=0 Div=2
[    0.054000] CCA UART Clock rate 50000000Hz CCB UART Clock rate 100000000Hz
[    0.056000] ACP (Accelerator Coherence Port) enabled
[    5.922000] PCI: no core
[    5.924000] PCI: no core
[    5.926000] PCI: scanning bus 0
[    5.928000] PCI: Fixing up bus 0
[    6.184000] PCIE1 link=1
[    6.186000] PCIE1 switching to GEN2
[    6.438000] PCIE1 link=1
[    6.440000] PCI: Fixing up bus 0
[    6.442000] PCI: Fixing up bus 1
[    6.444000] pci 0001:00:00.0: BAR 8: assigned [mem 0x08000000-0x080fffff]
[    6.446000] pci 0001:01:00.0: BAR 0: assigned [mem 0x08000000-0x08007fff 64bit]
[    6.448000] pci 0001:01:00.0: BAR 0: set to [mem 0x08000000-0x08007fff 64bit] (PCI address [0x8000000-0x8007fff]
[    6.700000] PCIE2 link=1
[    6.702000] PCIE2 switching to GEN2
[    6.954000] PCIE2 link=1
[    6.956000] PCI: Fixing up bus 0
[    6.958000] PCI: Fixing up bus 2
[    6.960000] pci 0002:00:00.0: BAR 8: assigned [mem 0x40000000-0x400fffff]
[    6.962000] pci 0002:02:00.0: BAR 0: assigned [mem 0x40000000-0x40007fff 64bit]
[    6.964000] pci 0002:02:00.0: BAR 0: set to [mem 0x40000000-0x40007fff 64bit] (PCI address [0x40000000-0x40007fff]
[    7.216000] PCIE3 link=0
[    7.272000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    7.316000] i2c-springbank: using remapped base c892e060
[    7.320000] mpcore_wdt mpcore_wdt: enabling watchdog.
[    7.322000] ramzswap: num_devices not specified. Using default: 1
[    7.324000] ramzswap: Creating 1 devices ...
[    7.330000] qspi_iproc qspi_iproc.1: 1-lane output, 3-byte address
[    7.332000] m25p80 spi1.0: mx25l25635e (32768 Kbytes)
[    7.336000] Creating 1 MTD partitions on "spi1.0":
[    7.338000] 0x000000000000-0x000002000000 : "qspi"
[    7.354000]
[    7.354000] Starting Kernel SHA1 KAT ...Completed Kernel SHA1 KAT
[    7.358000] Starting Kernel HMAC-SHA1 KAT ...Completed Kernel HMAC-SHA1 KAT
[    7.428000] Starting Kernel DES KAT ...Completed Kernel DES KAT
[    7.432000] Starting Kernel AES KAT ...Completed Kernel AES KAT
[    7.434000]
[    7.436000] Starting Kernel AESGCM KAT ...Completed Kernel AESGCM KAT
Domain Name: arubanetworks.com
No panic info available
[   19.432000] ADDRCONF(NETDEV_UP): bond0: link is not ready
[   19.636000] AP xml model 81, num_radios 2 (jiffies 9818)
[   19.638000] apType 81 hw_opmode 0
[   19.640000] radio 0: band 1 ant 0 max_ssid 16
[   19.642000] radio 1: band 0 ant 0 max_ssid 16
[   19.644000] init_asap_mod: installation:0
[   19.660000] firewall cpu: core-0
[   21.436000] bond0: link up (100FD)
[   21.438000] ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
Starting watchdog process...[   23.718000] mpcore_wdt mpcore_wdt: enabling watchdog.

Getting an IP address...
10.20.191.41 255.255.255.192 10.20.191.1
Running ADP...Done. Master is 10.0.40.44
[   57.502000] wifi0: AP type AP-205, radio 0, max_bssids 16
[   57.546000] wifi1: AP type AP-205, radio 1, max_bssids 16
AP rebooted Wed Dec 31 16:04:05 PST 1969; SAPD: Reboot after successful image upgrade
shutting down watchdog process (nanny will restart it)...

        <<<<<       Welcome to the Access Point     >>>>>

[   61.594000] mpcore_wdt mpcore_wdt: enabling watchdog.
The system is going down NOW !!
Sending SIGTERM to all processes.
Please stand by while rebooting the system.
[  195.548000] Restarting system.

Hi Matthew,

Could you share the output of "show ap database", run from the VMC, while the AP is sitting at "Welcome to Access Point"?

Thanks,

--jeff

Could it be that you have a controller with the 6.5 firmware on it still in your network? If this loop continues, it looks like the AP is jumping between an 8.3 and 6.5 controller and as soon as it connects to a controller with different firmware than the one on the AP it will auto-up(or down)grade. Resulting in this type of loop.

This is supported by the line in the log: 

SAPD: Reboot after successful image upgrade

Looks like you have two versions of controllers in your network. You might need to set the master ip fixed in the AP to get around that.

Herman Robers:

The CAP conversion does set the master to a hard IP, but the default group on the VMC was set for aruba-master - which does indeed point to a 6.4 controller.

I have set the AP-Group in VMC to hard IP, and confirmed the iAP  shows the IP address in the environment variables at boot.

jeffcullen:

My serial cable was disconnected over night, so I'm awaiting the next reboot cycle to get back to "Welcome" to check the ap database.

More data, shortly...

jeffcullen:

show ap database output:

(Aruba_VMC_Phoenix) #show ap database

AP Database
-----------
Name               Group    AP Type  IP Address    Status     Flags  Switch IP   Standby IP
----               -----    -------  ----------    ------     -----  ---------   ----------
40:e3:d6:cf:29:d0  default  205      10.20.191.41  Upgrading  IL     10.0.40.44  0.0.0.0

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
       B = Built-in AP; C = Cellular RAP; D = Dirty or no config
       E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
       G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
       M = Mesh node
       N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
       S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
       Y = Mesh Recovery
       c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
       i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP

Total APs:1

The AP seems to think it has upgraded already, yet the VMC doesn't.

I have 8 AP licenses in the MM license table - showing none in use:

On the other hand, this morning I'm getting reboots about every hour rather than 3 minutes - better-ish but still not quite what I'm expecting.

Correction - the iAP boots up in the 6.4.2.8 - so it was downgraded by the aruba-master identified controller. It no longer warm boots into 8.2.2.2 - I suspect it's unhappy with the 8.2.2.2 upgrade file for some reason.

Maybe I'll try factory-defaulting it at boot...

Wish me luck!

Turns out that even though the environment variable "master" is set to the IP of the VMC, the AP still tries to build a tunnel to "aruba-master" - when I let it, we get the case I've been describing so far.

A quick firewall rule in the lab router to drop connections to the address of aruba-master and the software update appears to succeed. but the environment variable "servername" has been set and set to aruba-master so it appears that the AP is ignoring the master variable in favor of the servername variable.

My packet captures show attempts to tunnel to aruba-master and little else.

Now I've removed the servername variable and am rebooting.

I begin to see some of my problem.

It looks like the AP users aruba-master whether I tell it to or not.

I had aruba-master re-aimed at the VMC.and the AP comes up as licensed on the MM and not licensed on the VMC.

leading to two questions:

1. Since I apparently need aruba-master should it point to the MM?

2. What's up with the license? (or is that to do with where I look to "master" controller for the AP as well?

1.  When you convert access points, the ip address of the target controller is written to the flash of the APs and that is the only controller they will look for after the conversion.  APs should never point to the MM, because the MM cannot service them in any scenario.

2.  I don't know.

Did you enable the license (pool) for your VMC?

This video series may help to get you started with ArubaOS 8, MM and VMCs.

Turns out it may boil down to licensing issues - my sales team hadn't had the experience of "cutting a VMC license" before,and so we think I've got the right license with the wrong encryption key.

I'll report back after I get a new license.

Getting the coorect license from my SE fixed the fianl issue.

Thanks for everyone's support on the way.

Contrary to the documentation, the iAP converted to CAP kept trying to use aruba-master to find code and configuration even when given a specific IP address at conversion time, and assigned a specific local-master-controller. To make it work we had to redirect aruba-master from our legacy (6.4.x) to the new (8.2.x) controllers.