There may be options with template groups, or additional commands via API if the required configuration is unavailable in the Web based configuration groups. But as I don't know what part of the configuration cannot be done, I would not really know. You should be in good hands with TAC.
Note that especially when you have many APs managed from Central, it may be even easier to work with local roles and push those from Central, and just return that role name that is in the configuration instead of using downloadable roles from ClearPass.
On AOS10, I have not tried as I just push my roles from central instead of using local roles, but if
@chulcher mentions that downloadable roles are currently not yet supported in AOS10 at the moment, I don't have a reason to doubt that.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check
https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------
Original Message:
Sent: Feb 08, 2023 12:23 AM
From: Kavi_WiFI
Subject: Downloadable User Role - Wireless DUR setup
Hi Herman,
Thanks for the update!!!
I am trying the same via Aruba central cloud to all IAP's but it seems some config options are not available to perform the same (DUR via wireless).
As per TAC/ERT members everything is working locally (via IAP config), this is fine for single AP, what about 100+ AP's managed from Aruba central cloud. This is where I got stuck on it.
Also one more discussion is on going in the above conversations that Wi-Fi DUR won't be available in AOS10. Is it? can you also confirm?
Original Message:
Sent: Feb 07, 2023 09:25 AM
From: Herman Robers
Subject: Downloadable User Role - Wireless DUR setup
Check here for setup on CX and here an old one for Instant AP.
What is important for downloadable user roles:
- ClearPass server is referred to by FQDN (not by IP) in your switch/AP
- FQDN needs to be resolvable by the switch/AP (DNS must work)
- Root CA that issued the ClearPass HTTPS server certificate has to be added as 'trust-anchor' or 'trustedCA'
The above should take care that the switch/AP can setup a HTTPS connection to ClearPass to download the roles.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Feb 07, 2023 12:32 AM
From: Kavi_WiFI
Subject: Downloadable User Role - Wireless DUR setup
I have tested the Wireless LUR which is working fine in AOS8 & 10 but DUR is not working in both versions.
AOS8 components:- Aruba Central, CPPM, CX-Switches & AP's - LUR is working, DUR is not working, Working with TAC for DUR part.
AOS10 components:- Aruba Central, CPPM, CX-Switches & AP's LUR is working, DUR is not working, I will cross check whether we can find any docs for DUR won't be available now. I will check with TAC too.
Thanks for your support!!!
If you have more information then share here.
Original Message:
Sent: Feb 03, 2023 09:53 AM
From: chulcher
Subject: Downloadable User Role - Wireless DUR setup
Usage of DUR in AOS 8 is supported and up to you if you want to use the feature. My personal recommendation would be not to spend the effort to resolve whatever issue you are running into because at this point the feature is dead in AOS 10 so at some near future point you would be re-configuring with local roles.
Wired DUR is fully supported in AOS-Switch and in AOS-CX on the switches that support DUR, I don't know of any changes happening there.
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Feb 03, 2023 12:04 AM
From: Kavi_WiFI
Subject: Downloadable User Role - Wireless DUR setup
One more points is, I am still using AOS 8 architecture now.
If it is not recommended to use DUR functionality for wireless then I am not sure why this feature is available.
what about wired DUR functionality?
Original Message:
Sent: Feb 01, 2023 09:37 AM
From: chulcher
Subject: Downloadable User Role - Wireless DUR setup
Recommendation would be to not use the DUR functionality for wireless if you don't already have it working. DUR isn't available once you move to AOS 10.
------------------------------
Carson Hulcher, ACEX#110
Original Message:
Sent: Feb 01, 2023 06:18 AM
From: Kavi_WiFI
Subject: Downloadable User Role - Wireless DUR setup
Hi All,
I have referred a Aruba documentations , Airhead broadcasting youtube channels to setup a DUR in wireless by using Aruba central & CPPM components.
For Wired - It is working fine, but still there is a limitation by setting up DUR via Aruba central like uploading certificates is difficult one and not able to upload it via central, still required CLI access. Even Multi Edit tool is not supporting this feature.
For Wireless - Certificate is the main issue, By default it is downloading HTTPS(ECC) CA certificate instead of RSA CA certificate, ECC is disabled in CPPM.
second point, If it is uploaded manually via central then there is no option to assign the certificate to application, its need to be done via AP CLI - this is drawback in Central config.
third point, even assigning the certificate manually via AP CLI, still DUR is not working.
anyone know did DUR via wireless by using CPPM? Need your assist to setup the same.